@bookedsolid/reagent 0.14.2 → 0.15.0

package/dist/platform/keychain.js

@@ -0,0 +1,92 @@
+import { execFileSync } from 'node:child_process';
+const KEYCHAIN_ACCOUNT = 'reagent';
+/**
+ * Store a credential blob in macOS Keychain under a reagent-namespaced service.
+ */
+export function keychainSet(service, credential) {
+    const data = JSON.stringify(credential);
+    // Delete existing entry first (ignore errors if it doesn't exist)
+    try {
+        execFileSync('security', ['delete-generic-password', '-s', service, '-a', KEYCHAIN_ACCOUNT], {
+            stdio: 'pipe',
+        });
+    }
+    catch {
+        // Entry doesn't exist yet — that's fine
+    }
+    execFileSync('security', ['add-generic-password', '-s', service, '-a', KEYCHAIN_ACCOUNT, '-w', data, '-U'], { stdio: 'pipe' });
+}
+/**
+ * Retrieve a credential blob from macOS Keychain.
+ */
+export function keychainGet(service) {
+    try {
+        const raw = execFileSync('security', ['find-generic-password', '-s', service, '-a', KEYCHAIN_ACCOUNT, '-w'], { stdio: ['pipe', 'pipe', 'pipe'], encoding: 'utf8' });
+        return JSON.parse(raw.trim());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Delete a credential from macOS Keychain.
+ */
+export function keychainDelete(service) {
+    try {
+        execFileSync('security', ['delete-generic-password', '-s', service, '-a', KEYCHAIN_ACCOUNT], {
+            stdio: 'pipe',
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Check if a credential exists in macOS Keychain.
+ */
+export function keychainExists(service) {
+    try {
+        execFileSync('security', ['find-generic-password', '-s', service, '-a', KEYCHAIN_ACCOUNT], {
+            stdio: 'pipe',
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Read Claude Code's own keychain credential.
+ */
+export function readClaudeCodeCredential() {
+    try {
+        const raw = execFileSync('security', ['find-generic-password', '-s', 'Claude Code-credentials', '-w'], { stdio: ['pipe', 'pipe', 'pipe'], encoding: 'utf8' });
+        const parsed = JSON.parse(raw.trim());
+        // Claude Code stores {oauth_token, refresh_token, expiry, ...} — normalize to our shape
+        return {
+            accessToken: parsed.oauth_token || parsed.accessToken,
+            refreshToken: parsed.refresh_token || parsed.refreshToken,
+            expiresAt: parsed.expiry || parsed.expiresAt,
+            scopes: parsed.scopes,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write back a credential to Claude Code's own keychain entry.
+ */
+export function writeClaudeCodeCredential(data) {
+    try {
+        execFileSync('security', ['delete-generic-password', '-s', 'Claude Code-credentials'], {
+            stdio: 'pipe',
+        });
+    }
+    catch {
+        // Doesn't exist yet
+    }
+    execFileSync('security', ['add-generic-password', '-s', 'Claude Code-credentials', '-w', data, '-U'], { stdio: 'pipe' });
+}
+//# sourceMappingURL=keychain.js.map

package/dist/platform/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/platform/keychain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAEnC;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,UAA6B;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAExC,kEAAkE;IAClE,IAAI,CAAC;QACH,YAAY,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAAE;YAC3F,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IAED,YAAY,CACV,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EACjF,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,EACtE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CACtD,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,CAAC;QACH,YAAY,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAAE;YAC3F,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,CAAC;QACH,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAAE;YACzF,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,CAAC,EAChE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CACtD,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,wFAAwF;QACxF,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW;YACrD,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY;YACzD,SAAS,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,IAAI,CAAC;QACH,YAAY,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,yBAAyB,CAAC,EAAE;YACrF,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;IACD,YAAY,CACV,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAC3E,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;AACJ,CAAC"}

package/dist/types/accounts.d.ts

@@ -0,0 +1,22 @@
+export interface AccountBudget {
+    warn_usd?: number;
+    halt_usd?: number;
+    period?: 'monthly' | 'weekly' | 'daily';
+}
+export interface Account {
+    description?: string;
+    credential_store: 'keychain';
+    keychain_service: string;
+    budget?: AccountBudget;
+}
+export interface AccountsConfig {
+    version: string;
+    accounts: Record<string, Account>;
+}
+export interface AccountCredential {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: string;
+    scopes?: string[];
+}
+//# sourceMappingURL=accounts.d.ts.map

package/dist/types/accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../src/types/accounts.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,OAAO;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,UAAU,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB"}

package/dist/types/accounts.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=accounts.js.map

package/dist/types/accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../src/types/accounts.ts"],"names":[],"mappings":""}

package/dist/types/audit.d.ts

@@ -8,6 +8,7 @@ export interface AuditRecord {
     status: InvocationStatus;
     autonomy_level: string;
     duration_ms: number;
+    account_name?: string;
     error?: string;
     redacted_fields?: string[];
     hash: string;

package/dist/types/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/types/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,gBAAgB,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/types/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,gBAAgB,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/types/index.d.ts

@@ -2,4 +2,5 @@ export { Tier, AutonomyLevel, InvocationStatus } from './enums.js';
 export type { Policy } from './policy.js';
 export type { GatewayConfig, DownstreamServer, ToolOverride } from './gateway.js';
 export type { AuditRecord } from './audit.js';
+export type { Account, AccountsConfig, AccountCredential, AccountBudget } from './accounts.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnE,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAClF,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnE,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAClF,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bookedsolid/reagent",
-  "version": "0.14.2",
+  "version": "0.15.0",
   "description": "Governance layer for Claude Code — policy enforcement, hook-based safety gates, and audit logging for AI-assisted projects",
   "license": "MIT",
   "author": "Booked Solid Technology <oss@bookedsolid.tech> (https://bookedsolid.tech)",
@@ -76,6 +76,7 @@
     "zod": "^3.23.0"
   },
   "devDependencies": {
+    "@bookedsolid/reagent": "latest",
     "@changesets/cli": "^2.30.0",
     "@types/node": "^25.5.2",
     "@typescript-eslint/eslint-plugin": "^8.0.0",