@ayushporwal/coja 0.0.1

package/dist/routes/pulls.js

@@ -0,0 +1,64 @@
+import { getProject } from '../projects/store.js';
+import { isEmptyFilter, parsePrQuery, } from '../shared/api.js';
+import { badRequest, notFound } from './http.js';
+/**
+ * Hono path patterns behind API_ROUTES.prs / API_ROUTES.pr (shared/api.ts
+ * builds concrete URLs; these are the parameterised forms the router needs).
+ */
+export const PRS_ROUTE = '/api/projects/:projectId/prs';
+export const PR_ROUTE = `${PRS_ROUTE}/:number`;
+/** The project named by `:projectId`, or a 404. */
+export /** Trimmed param or undefined when empty. */ function clean(value) {
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+}
+function resolveProject(ctx, c) {
+    const id = c.req.param('projectId');
+    const project = id ? getProject(ctx.db, id) : undefined;
+    if (!project)
+        throw notFound('project');
+    return { project, repo: { owner: project.owner, repo: project.repo } };
+}
+/** The project plus a validated `:number` (positive integer), or a 404 / 400. */
+export function resolvePr(ctx, c) {
+    const scope = resolveProject(ctx, c);
+    const raw = c.req.param('number') ?? '';
+    const number = Number(raw);
+    if (!/^\d+$/.test(raw) || !Number.isSafeInteger(number) || number < 1) {
+        throw badRequest(`invalid pull request number "${raw}"`);
+    }
+    return { ...scope, number };
+}
+export function registerPullRoutes(app, ctx, deps) {
+    const { forge } = deps;
+    app.get(PRS_ROUTE, async (c) => {
+        const { repo } = resolveProject(ctx, c);
+        const parsed = Number.parseInt(c.req.query('page') ?? '1', 10);
+        const page = Number.isFinite(parsed) && parsed >= 1 ? parsed : 1;
+        // `q` is the GitHub-style query string (primary); the discrete params keep
+        // working for API callers that prefer structured input.
+        const q = clean(c.req.query('q'));
+        const draftParam = c.req.query('draft');
+        const filter = q
+            ? parsePrQuery(q)
+            : {
+                text: clean(c.req.query('text')),
+                author: clean(c.req.query('author')),
+                head: clean(c.req.query('head')),
+                base: clean(c.req.query('base')),
+                ...(draftParam === 'true'
+                    ? { draft: true }
+                    : draftParam === 'false'
+                        ? { draft: false }
+                        : {}),
+            };
+        // An empty filter means 'everything': pass undefined so the forge uses the plain list query.
+        const body = await forge.listPullRequestPage(repo, page, isEmptyFilter(filter) ? undefined : filter);
+        return c.json(body);
+    });
+    app.get(PR_ROUTE, async (c) => {
+        const { repo, number } = resolvePr(ctx, c);
+        const pr = await forge.getPullRequest(repo, number);
+        return c.json(pr);
+    });
+}

package/dist/routes/review.js

@@ -0,0 +1,113 @@
+import { z } from 'zod';
+import { badRequest } from './http.js';
+import { PR_ROUTE, resolvePr } from './pulls.js';
+/**
+ * Review sync routes. Each handler is one explicit human action in the UI and
+ * goes straight to GitHub through the Forge — GitHub is the source of truth,
+ * nothing is stored locally. These are the only callers of the mutating Forge
+ * methods; the AI layer never gets a Forge ("the AI drafts, the human sends").
+ */
+const side = z.enum(['LEFT', 'RIGHT']);
+const nonBlank = (what) => z.string().refine((s) => s.trim().length > 0, { error: `${what} must not be blank` });
+const addCommentSchema = z
+    .object({
+    path: z.string().min(1, { error: 'path is required' }),
+    body: nonBlank('body'),
+    line: z.number().int().min(1),
+    side,
+    startLine: z.number().int().min(1).optional(),
+    startSide: side.optional(),
+})
+    .refine(
+// Line numbers are only comparable within one side of the diff.
+(v) => v.startLine === undefined || (v.startSide ?? v.side) !== v.side || v.startLine <= v.line, { error: 'startLine must not be greater than line', path: ['startLine'] });
+const bodySchema = z.object({ body: nonBlank('body') });
+const setViewedSchema = z.object({
+    path: z.string().min(1, { error: 'path is required' }),
+    viewed: z.boolean(),
+});
+const submitReviewSchema = z.object({
+    event: z.enum(['APPROVE', 'REQUEST_CHANGES', 'COMMENT']),
+    body: z.string().default(''),
+});
+async function parseBody(c, schema) {
+    let raw;
+    try {
+        raw = await c.req.json();
+    }
+    catch {
+        throw badRequest('request body must be JSON');
+    }
+    const result = schema.safeParse(raw);
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((i) => (i.path.length ? `${i.path.map(String).join('.')}: ${i.message}` : i.message))
+            .join('; ');
+        throw badRequest(`invalid request: ${issues}`);
+    }
+    return result.data;
+}
+function requireParam(c, name) {
+    const value = c.req.param(name);
+    if (!value)
+        throw badRequest(`missing ${name}`);
+    return value;
+}
+export function registerReviewRoutes(app, ctx, deps) {
+    const { forge } = deps;
+    // Line/range comment → the viewer's pending review (created when missing).
+    app.post(`${PR_ROUTE}/comments`, async (c) => {
+        const { repo, number } = resolvePr(ctx, c);
+        const input = await parseBody(c, addCommentSchema);
+        const refs = await forge.getPullRequestRefs(repo, number);
+        const res = await forge.addPendingComment(repo, refs, input);
+        return c.json(res, 201);
+    });
+    // Comment and thread ids come from the client; each is tied to the route's PR before any
+    // mutation, so a request under one PR can never edit, delete or reply on another PR's thread.
+    app.patch(`${PR_ROUTE}/comments/:commentId`, async (c) => {
+        const { repo, number } = resolvePr(ctx, c);
+        const commentId = requireParam(c, 'commentId');
+        const { body } = await parseBody(c, bodySchema);
+        await forge.assertCommentInPullRequest(commentId, repo, number);
+        const comment = await forge.updateComment(commentId, body);
+        return c.json(comment);
+    });
+    app.delete(`${PR_ROUTE}/comments/:commentId`, async (c) => {
+        const { repo, number } = resolvePr(ctx, c);
+        const commentId = requireParam(c, 'commentId');
+        await forge.assertCommentInPullRequest(commentId, repo, number);
+        await forge.deleteComment(commentId);
+        return c.json({ ok: true });
+    });
+    // Replies publish immediately (decisions.md) unless the viewer has a pending review open, in
+    // which case GitHub attaches the reply to it; the response's comment.isPending tells the UI.
+    app.post(`${PR_ROUTE}/threads/:threadId/replies`, async (c) => {
+        const { repo, number } = resolvePr(ctx, c);
+        const threadId = requireParam(c, 'threadId');
+        const { body } = await parseBody(c, bodySchema);
+        await forge.assertThreadInPullRequest(threadId, repo, number);
+        const res = await forge.replyToThread(threadId, body);
+        return c.json(res, 201);
+    });
+    app.post(`${PR_ROUTE}/viewed`, async (c) => {
+        const { repo, number } = resolvePr(ctx, c);
+        const { path, viewed } = await parseBody(c, setViewedSchema);
+        const refs = await forge.getPullRequestRefs(repo, number);
+        const viewedState = await forge.setFileViewed(refs.id, path, viewed);
+        const res = { path, viewedState };
+        return c.json(res);
+    });
+    app.post(`${PR_ROUTE}/review`, async (c) => {
+        const { repo, number } = resolvePr(ctx, c);
+        const input = await parseBody(c, submitReviewSchema);
+        const refs = await forge.getPullRequestRefs(repo, number);
+        const res = await forge.submitReview(repo, refs, input);
+        return c.json(res);
+    });
+    app.delete(`${PR_ROUTE}/review`, async (c) => {
+        const { repo, number } = resolvePr(ctx, c);
+        await forge.discardPendingReview(repo, number);
+        return c.json({ ok: true });
+    });
+}

package/dist/routes/setup.js

@@ -0,0 +1,285 @@
+import { z } from 'zod';
+import { addCustomProviderSchema, deleteCustomProvider, getCustomProvider, listCustomProviders, saveCustomProvider, } from '../custom-providers.js';
+import { settings } from '../db.js';
+import { curatedModels } from '../secrets/providers.js';
+import { providerKeyName } from '../secrets/store.js';
+import { API_ROUTES, parseChatGptMarker, } from '../shared/api.js';
+import { badRequest, HttpError } from './http.js';
+/**
+ * Setup screen and AI-model routes (design.md, "Setup"). The GitHub step is
+ * read-only (`gh auth status`); the AI step stores provider keys in the
+ * SecretStore after validating them with the provider. Keys never leave the
+ * server: every response carries `configured: boolean` at most. The
+ * ChatGPT route is the one non-key path: the server runs the
+ * browser OAuth flow, tokens land in the SecretStore, and the browser sees
+ * connection facts only.
+ */
+/** Settings key: '1' once the user saved a key or explicitly skipped the AI step. */
+export const SETUP_COMPLETE_KEY = 'setup_complete';
+export const MODEL_CACHE_TTL_MS = 10 * 60 * 1000;
+export function registerSetupRoutes(app, ctx, deps) {
+    const { secrets } = deps;
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const ghStatus = async () => {
+        try {
+            return await deps.ghAuthStatus();
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return { ok: false, error: `Could not check the GitHub CLI: ${message}` };
+        }
+    };
+    const chatgptStatus = async () => {
+        if (!deps.chatgpt)
+            return { connected: false };
+        const { signingIn: _signingIn, ...rest } = await deps.chatgpt.status();
+        return rest;
+    };
+    const status = async () => {
+        const [gh, chatgpt] = await Promise.all([ghStatus(), chatgptStatus()]);
+        return {
+            gh,
+            customProviders: await Promise.all(listCustomProviders(ctx.db).map(decorate)),
+            secrets: { backend: secrets.backend },
+            setupComplete: settings.get(ctx.db, SETUP_COMPLETE_KEY) === '1',
+            chatgpt,
+        };
+    };
+    /** Config + whether a key is stored — the API never returns key material. */
+    const decorate = async (p) => ({
+        ...p,
+        hasKey: Boolean(await secrets.get(providerKeyName(p.id))),
+    });
+    /**
+     * The subscription picker comes from the backend's model catalog (per-plan
+     * ground truth, incl. per-model reasoning efforts), gated on the connection.
+     * A catalog failure falls back to the short curated bootstrap list so the
+     * picker never empties.
+     */
+    const subscriptionModels = async () => {
+        if (!deps.chatgpt)
+            return [];
+        const state = await deps.chatgpt.status();
+        if (!state.connected)
+            return [];
+        try {
+            const models = await deps.chatgpt.listModels();
+            return models.map((m) => ({
+                id: `chatgpt:${m.slug}`,
+                provider: 'chatgpt',
+                modelId: m.slug,
+                label: m.displayName,
+                reasoningEfforts: m.reasoningEfforts.map((level) => ({
+                    effort: level.effort,
+                    ...(level.description ? { description: level.description } : {}),
+                })),
+                ...(m.defaultReasoningEffort ? { defaultReasoningEffort: m.defaultReasoningEffort } : {}),
+            }));
+        }
+        catch {
+            return curatedModels('chatgpt');
+        }
+    };
+    app.get(API_ROUTES.setupStatus, async (c) => c.json(await status()));
+    app.post(API_ROUTES.setupComplete, async (c) => {
+        settings.set(ctx.db, SETUP_COMPLETE_KEY, '1');
+        return c.json(await status());
+    });
+    // --- ChatGPT subscription ------------------------------------------------
+    /** Errors meant for the chat stream self-mark; Setup shows the bare text. */
+    const unmarked = (err) => {
+        const message = err instanceof Error ? err.message : String(err);
+        return parseChatGptMarker(message)?.text ?? message;
+    };
+    app.post(API_ROUTES.setupChatgptConnect, async (c) => {
+        if (!deps.chatgpt)
+            throw new HttpError(400, 'ChatGPT sign-in is not available', 'provider');
+        try {
+            const { authUrl } = await deps.chatgpt.connect();
+            return c.json({ ok: true, authUrl });
+        }
+        catch (err) {
+            if (err instanceof HttpError)
+                throw err;
+            throw new HttpError(400, unmarked(err), 'provider');
+        }
+    });
+    app.get(API_ROUTES.setupChatgptStatus, async (c) => {
+        if (!deps.chatgpt)
+            throw new HttpError(400, 'ChatGPT sign-in is not available', 'provider');
+        const { connected, signingIn, email, plan, authExpired, connectError } = await deps.chatgpt.status();
+        const body = {
+            status: connected ? 'connected' : signingIn ? 'connecting' : 'idle',
+            connected,
+            ...(email ? { email } : {}),
+            ...(plan ? { plan } : {}),
+            ...(authExpired ? { authExpired: true } : {}),
+            ...(connectError ? { connectError } : {}),
+        };
+        return c.json(body);
+    });
+    app.delete(API_ROUTES.setupChatgptDisconnect, async (c) => {
+        if (!deps.chatgpt)
+            throw new HttpError(400, 'ChatGPT sign-in is not available', 'provider');
+        await deps.chatgpt.disconnect();
+        return c.json({ ok: true });
+    });
+    app.get(API_ROUTES.aiModels, async (c) => {
+        const [subscription, custom] = await Promise.all([
+            subscriptionModels(),
+            Promise.resolve(listCustomProviders(ctx.db).flatMap((provider) => provider.models.map((model) => ({
+                id: `${provider.id}:${model.id}`,
+                provider: provider.id,
+                modelId: model.id,
+                // A display name from the endpoint's model list wins; otherwise
+                // the provider name plus the raw id.
+                label: model.label ?? `${provider.name} ${model.id}`,
+                providerLabel: provider.name,
+            })))),
+        ]);
+        return c.json([...subscription, ...custom]);
+    });
+    app.post(API_ROUTES.setupCustomProviders, async (c) => {
+        const request = parseOr400(addCustomProviderSchema, await readJson(c));
+        const { saved } = saveCustomProvider(ctx.db, request);
+        // Same id = intentional edit. A typed key stores/replaces; a blank one
+        // keeps whatever is stored (an edit that only renames must not drop the
+        // key — it is never shown again, so it could not be re-entered).
+        if (request.apiKey)
+            await secrets.set(providerKeyName(saved.id), request.apiKey);
+        const customProviders = await Promise.all(listCustomProviders(ctx.db).map(decorate));
+        return c.json({ customProviders });
+    });
+    // Raw segment (not the API_ROUTES helper): encodeURIComponent would escape the ':id' marker.
+    app.delete(`${API_ROUTES.setupCustomProviders}/:id`, async (c) => {
+        const id = c.req.param('id') ?? '';
+        if (!deleteCustomProvider(ctx.db, id))
+            throw new HttpError(404, `No custom provider "${id}"`);
+        await secrets.delete(providerKeyName(id));
+        return c.json({ ok: true });
+    });
+    const fetchModelsSchema = z
+        .object({
+        id: z
+            .string()
+            .regex(/^custom-[a-z0-9][a-z0-9-]*$/)
+            .optional(),
+        baseUrl: z.string().trim().url().optional(),
+        apiFormat: z.enum(['openai', 'anthropic']).optional(),
+        apiKey: z.string().max(4096).optional(),
+    })
+        .refine((v) => Boolean(v.id || (v.baseUrl && v.apiFormat)), {
+        message: 'need a provider id, or a base URL with an API format',
+    });
+    app.post(API_ROUTES.setupCustomModels, async (c) => {
+        const body = parseOr400(fetchModelsSchema, await readJson(c));
+        let baseUrl;
+        let apiFormat;
+        let apiKey = '';
+        if (body.id) {
+            const config = getCustomProvider(ctx.db, body.id);
+            if (!config)
+                throw new HttpError(404, `No custom provider "${body.id}"`);
+            baseUrl = config.baseUrl;
+            apiFormat = config.apiFormat;
+            // A typed key wins; otherwise the stored one — never shown, but usable.
+            apiKey = body.apiKey ?? (await secrets.get(providerKeyName(config.id))) ?? '';
+        }
+        else if (body.baseUrl && body.apiFormat) {
+            baseUrl = body.baseUrl;
+            apiFormat = body.apiFormat;
+            apiKey = body.apiKey ?? '';
+        }
+        else {
+            throw badRequest('need a provider id, or a base URL with an API format');
+        }
+        const url = `${baseUrl.replace(/\/+$/, '')}/models`;
+        const headers = apiFormat === 'openai'
+            ? apiKey
+                ? { authorization: `Bearer ${apiKey}` }
+                : {}
+            : { 'x-api-key': apiKey, 'anthropic-version': '2023-06-01' };
+        let res;
+        try {
+            res = await fetchImpl(url, {
+                headers,
+                signal: AbortSignal.timeout(10_000),
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new HttpError(502, `Could not reach the model list at ${url} (${message}). Add models by hand.`, 'provider');
+        }
+        if (!res.ok) {
+            res.body?.cancel();
+            throw new HttpError(502, `The model list answered HTTP ${res.status}. The endpoint may not implement it — add models by hand.`, 'provider');
+        }
+        let parsed;
+        try {
+            parsed = await res.json();
+        }
+        catch {
+            throw new HttpError(502, 'The model list response was not JSON. Add models by hand.', 'provider');
+        }
+        // OpenAI shape: { data: [{ id }] }. Anthropic: { data: [{ id, display_name }] }.
+        // Some proxies use a bare array or { models: [...] } — accept all three.
+        const list = Array.isArray(parsed)
+            ? parsed
+            : typeof parsed === 'object' &&
+                parsed !== null &&
+                Array.isArray(parsed.data)
+                ? parsed.data
+                : typeof parsed === 'object' &&
+                    parsed !== null &&
+                    Array.isArray(parsed.models)
+                    ? parsed.models
+                    : null;
+        if (!list) {
+            throw new HttpError(502, 'The model list response was not recognised. Add models by hand.', 'provider');
+        }
+        const seen = new Set();
+        const models = [];
+        for (const entry of list) {
+            const id = typeof entry === 'string'
+                ? entry
+                : typeof entry === 'object' &&
+                    entry !== null &&
+                    typeof entry.id === 'string'
+                    ? entry.id
+                    : '';
+            const label = typeof entry === 'object' &&
+                entry !== null &&
+                typeof entry.display_name === 'string'
+                ? entry.display_name
+                : undefined;
+            if (!id || seen.has(id))
+                continue;
+            seen.add(id);
+            models.push(label ? { id, label } : { id });
+            if (models.length >= 64)
+                break;
+        }
+        if (models.length === 0) {
+            throw new HttpError(502, 'The model list was empty. Add models by hand.', 'provider');
+        }
+        return c.json({ models });
+    });
+}
+async function readJson(c) {
+    try {
+        return await c.req.json();
+    }
+    catch {
+        throw badRequest('expected a JSON body');
+    }
+}
+/** Validate with zod; a failure becomes a 400 whose message names the offending fields. */
+function parseOr400(schema, input) {
+    const result = schema.safeParse(input);
+    if (result.success)
+        return result.data;
+    const details = result.error.issues
+        .map((issue) => `${issue.path.map(String).join('.') || 'body'}: ${issue.message}`)
+        .join('; ');
+    throw badRequest(`invalid request: ${details}`);
+}

package/dist/secrets/providers.js

@@ -0,0 +1,27 @@
+/**
+ * The ChatGPT subscription is the one non-key provider: users reach OpenAI
+ * and Anthropic (and anything else) through custom endpoints (Setup →
+ * "Add model provider"). This module keeps its display label and the short
+ * bootstrap model list used when the backend's catalog cannot be reached.
+ */
+export const PROVIDER_LABELS = {
+    chatgpt: 'ChatGPT (subscription)',
+};
+/**
+ * Bootstrap-only fallback: the picker is normally driven by the backend's
+ * model catalog (`ChatGptConnection.listModels`), which is per-plan ground
+ * truth. This list — slugs verified live on a Plus account, 2026-09-05 —
+ * only covers a catalog outage before any mirror exists.
+ */
+const CURATED_CHATGPT = [
+    { modelId: 'gpt-5.5', label: 'GPT-5.5' },
+    { modelId: 'gpt-5.4-mini', label: 'GPT-5.4 mini' },
+];
+export function curatedModels(provider) {
+    return CURATED_CHATGPT.map(({ modelId, label }) => ({
+        id: `${provider}:${modelId}`,
+        provider,
+        modelId,
+        label,
+    }));
+}

package/dist/secrets/store.js

@@ -0,0 +1,190 @@
+import { randomBytes } from 'node:crypto';
+import { chmod, mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { z } from 'zod';
+const PREFERENCES = ['auto', 'keychain', 'file'];
+/** Service of every keychain item coja writes (`security find-generic-password -s coja -a <key>`). */
+export const KEYCHAIN_SERVICE = 'coja';
+/** Account read once on open to check the store works. Never written, so it never appears in the keychain. */
+export const PROBE_ACCOUNT = '__coja_probe__';
+/** File name of the fallback store inside the data dir. */
+export const CREDENTIALS_FILE = 'credentials.json';
+/** Keychain account / file key under which a provider's API key is stored. */
+export const providerKeyName = (provider) => `${provider}-api-key`;
+const loadNativeKeyring = () => import('@napi-rs/keyring');
+export async function openSecretStore(opts) {
+    const env = opts.env ?? process.env;
+    const prefer = parsePreference(opts.prefer ?? env.COJA_CREDENTIAL_STORE ?? 'auto');
+    const platform = opts.platform ?? process.platform;
+    const warn = opts.warn ?? ((message) => console.warn(message));
+    const file = new FileSecretStore(opts.dataDir);
+    if (prefer === 'file')
+        return file;
+    if (prefer === 'auto' && platform === 'linux' && !env.DBUS_SESSION_BUS_ADDRESS) {
+        // No session bus means no Secret Service. keyring-rs would silently fall
+        // back to the kernel keyring, which is in-memory only, so a saved key would
+        // vanish on reboot. The file is the honest choice on a headless box.
+        return file;
+    }
+    try {
+        return await openKeychain(opts.loadKeyring ?? loadNativeKeyring);
+    }
+    catch (err) {
+        if (prefer === 'keychain')
+            throw err;
+        warn(`coja: OS keychain unavailable (${firstLine(err)}); storing API keys in ${file.path} (mode 0600)`);
+        return file;
+    }
+}
+function parsePreference(value) {
+    if (PREFERENCES.includes(value))
+        return value;
+    throw new Error(`COJA_CREDENTIAL_STORE must be one of ${PREFERENCES.join(', ')} (got ${JSON.stringify(value)})`);
+}
+// ---------------------------------------------------------------------------
+// Keychain backend
+// ---------------------------------------------------------------------------
+async function openKeychain(load) {
+    // Throws "Cannot find native binding" when there is no prebuilt binary for this platform.
+    const { Entry } = await load();
+    const entry = (key) => new Entry(KEYCHAIN_SERVICE, key);
+    // A working store answers null for an account nobody wrote. A locked, denied
+    // or absent store throws — from the constructor on Linux, from the read on
+    // macOS — and that is exactly the signal to fall back on.
+    entry(PROBE_ACCOUNT).getPassword();
+    return {
+        backend: 'keychain',
+        async get(key) {
+            return entry(requireKey(key)).getPassword() ?? null;
+        },
+        async set(key, value) {
+            entry(requireKey(key)).setPassword(value);
+        },
+        async delete(key) {
+            return entry(requireKey(key)).deletePassword();
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// File backend
+// ---------------------------------------------------------------------------
+const FileContents = z.object({
+    version: z.literal(1),
+    secrets: z.record(z.string(), z.string()),
+});
+/**
+ * `<dataDir>/credentials.json`, `{ version: 1, secrets: { <key>: <value> } }`.
+ * Every write goes to a temp file (mode 0600) that is renamed over the real
+ * one, so a crash never leaves a half-written or world-readable file. Calls
+ * are serialized within the process so concurrent sets cannot lose each other.
+ */
+export class FileSecretStore {
+    dir;
+    backend = 'file';
+    path;
+    queue = Promise.resolve();
+    constructor(dir) {
+        this.dir = dir;
+        this.path = path.join(dir, CREDENTIALS_FILE);
+    }
+    async get(key) {
+        requireKey(key);
+        return this.serialized(async () => (await this.load()).get(key) ?? null);
+    }
+    async set(key, value) {
+        requireKey(key);
+        return this.serialized(async () => {
+            const secrets = await this.load();
+            secrets.set(key, value);
+            await this.save(secrets);
+        });
+    }
+    async delete(key) {
+        requireKey(key);
+        return this.serialized(async () => {
+            const secrets = await this.load();
+            const had = secrets.delete(key);
+            if (had)
+                await this.save(secrets);
+            return had;
+        });
+    }
+    serialized(fn) {
+        const run = this.queue.then(fn, fn);
+        this.queue = run.then(noop, noop);
+        return run;
+    }
+    async load() {
+        let raw;
+        try {
+            raw = await readFile(this.path, 'utf8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return new Map();
+            throw err;
+        }
+        let json;
+        try {
+            json = JSON.parse(raw);
+        }
+        catch {
+            throw this.corrupt();
+        }
+        const parsed = FileContents.safeParse(json);
+        if (!parsed.success)
+            throw this.corrupt();
+        return new Map(Object.entries(parsed.data.secrets));
+    }
+    corrupt() {
+        return new Error(`${this.path} is not a valid coja credentials file. Fix it, or delete it and re-enter your API keys.`);
+    }
+    async save(secrets) {
+        await mkdir(this.dir, { recursive: true, mode: 0o700 });
+        // `mkdir`'s mode only applies when it creates the directory; tighten an existing one too.
+        await chmod(this.dir, 0o700).catch(noop);
+        const body = `${JSON.stringify({ version: 1, secrets: Object.fromEntries(secrets) }, null, 2)}\n`;
+        const tmp = `${this.path}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+        try {
+            await writeFile(tmp, body, { mode: 0o600, flag: 'wx' });
+            // writeFile's mode is subject to the umask; enforce 0600 before the file becomes visible.
+            await chmod(tmp, 0o600);
+            await rename(tmp, this.path);
+        }
+        catch (err) {
+            await unlink(tmp).catch(noop);
+            throw err;
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// In-memory backend (tests)
+// ---------------------------------------------------------------------------
+export class MemorySecretStore {
+    backend;
+    values = new Map();
+    constructor(backend = 'keychain') {
+        this.backend = backend;
+    }
+    async get(key) {
+        return this.values.get(requireKey(key)) ?? null;
+    }
+    async set(key, value) {
+        this.values.set(requireKey(key), value);
+    }
+    async delete(key) {
+        return this.values.delete(requireKey(key));
+    }
+}
+// ---------------------------------------------------------------------------
+function requireKey(key) {
+    if (typeof key !== 'string' || key.length === 0) {
+        throw new Error('secret key must be a non-empty string');
+    }
+    return key;
+}
+function firstLine(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return message.split('\n')[0] ?? message;
+}
+function noop() { }