@claudexor/secrets 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 joi-lab
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,7 @@
+# @claudexor/secrets
+
+Internal package of [Claudexor](https://github.com/razzant/claudexor) — Cross-platform secret store: OS keychain where available, else a 0600 file; named secret refs resolved by adapters.
+
+Published as part of the Claudexor toolchain; it follows the monorepo's
+lockstep version and has no separate semver contract. Use the `claudexor`
+CLI (or `@claudexor/cli`) as the supported entry point.

package/dist/index.d.ts

@@ -0,0 +1,57 @@
+export { redactSecrets } from "@claudexor/util";
+export type SecretBackend = "auto" | "keychain" | "file";
+/**
+ * Secret store mirroring how Codex/Claude store credentials: OS keychain where
+ * available (macOS), otherwise a 0600 file under the config dir. (Adapters read
+ * their own provider env vars directly; the env-var/helper-command indirection
+ * was retired.) Subscriptions are NOT stored here — Claudexor reuses each
+ * harness's own native login.
+ */
+export declare class SecretStore {
+    private readonly backend;
+    constructor(backend?: SecretBackend);
+    resolvedBackend(): "keychain" | "file";
+    /** Why the last `set` landed in the file store despite a keychain backend. */
+    lastFallbackReason: string | null;
+    set(name: string, value: string): "keychain" | "file";
+    get(name: string): string | null;
+    delete(name: string): void;
+    list(): {
+        name: string;
+        backend: "keychain" | "file";
+        present: true;
+    }[];
+    private fileStore;
+    private writeFileStore;
+    private fileSet;
+    private fileGet;
+    private fileDelete;
+    private getKeychain;
+    private keychainNames;
+}
+/**
+ * The single allowlist of managed secret names (previously duplicated in
+ * the CLI and the control API, and BOTH were missing `claude_oauth` — the
+ * claude adapter reads it, so it must be settable). Names are secret REFS,
+ * never values; adding a name here makes it settable via CLI and HTTP alike.
+ */
+export declare const MANAGED_SECRET_NAMES: readonly ["openai", "anthropic", "claude_oauth", "openrouter", "cursor", "opencode", "raw"];
+export declare function isManagedSecretName(name: string): boolean;
+export interface ResolveOptions {
+    /** Test seam: inject a scoped store. Production callers use the default. */
+    store?: SecretStore;
+}
+/**
+ * Resolve a stored secret by name. (The env-var and helper-command indirection
+ * options were retired: no production caller ever passed them — adapters read
+ * their own provider env vars directly, and a vault helper belongs to a
+ * future typed config surface, not a dead parameter.)
+ *
+ * CLAUDEXOR_DISABLE_STORED_SECRETS=1 is the hermetic kill switch, honored HERE
+ * (the single owner) so every adapter's key resolution obeys it uniformly —
+ * tests and isolation envelopes must never read the operator's real store.
+ * Explicit `opts.store` (the test seam) bypasses the switch: an injected
+ * scoped store IS the hermetic fixture.
+ */
+export declare function resolveSecret(name: string, opts?: ResolveOptions): string | null;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAsBzD;;;;;;GAMG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,aAAsB;IAE5D,eAAe,IAAI,UAAU,GAAG,MAAM;IAmBtC,8EAA8E;IAC9E,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAQ;IAEzC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM;IAmBrD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiBhC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAa1B,IAAI,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,EAAE;IAiBvE,OAAO,CAAC,SAAS;IAmBjB,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,aAAa;CActB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,6FAQvB,CAAC;AAEX,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,MAAM,GAAG,IAAI,CAGpF"}

package/dist/index.js

@@ -0,0 +1,229 @@
+import { execFileSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { platform } from "node:os";
+import { join } from "node:path";
+import { userConfigDir } from "@claudexor/util";
+export { redactSecrets } from "@claudexor/util";
+const SERVICE = "claudexor";
+function configDir() {
+    return userConfigDir();
+}
+function fileStorePath() {
+    return join(configDir(), "secrets.json");
+}
+function keychainAvailable() {
+    if (platform() !== "darwin")
+        return false;
+    try {
+        execFileSync("security", ["help"], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Secret store mirroring how Codex/Claude store credentials: OS keychain where
+ * available (macOS), otherwise a 0600 file under the config dir. (Adapters read
+ * their own provider env vars directly; the env-var/helper-command indirection
+ * was retired.) Subscriptions are NOT stored here — Claudexor reuses each
+ * harness's own native login.
+ */
+export class SecretStore {
+    backend;
+    constructor(backend = "auto") {
+        this.backend = backend;
+    }
+    resolvedBackend() {
+        if (this.backend === "keychain")
+            return "keychain";
+        if (this.backend === "file")
+            return "file";
+        // backend === "auto": an explicit env override lets a sandboxed run/test
+        // (CLAUDEXOR_CONFIG_DIR + CLAUDEXOR_SECRETS_BACKEND=file) keep ALL secret I/O
+        // in the 0600 file store and never read/mutate the real OS login Keychain
+        // (which is not path-scoped, so CLAUDEXOR_CONFIG_DIR alone can't redirect it).
+        // Precedence: explicit constructor arg > env > platform default. A non-empty
+        // env typo FAILS LOUDLY rather than silently falling back to the Keychain
+        // (e.g. CLAUDEXOR_SECRETS_BACKEND=fil must not quietly hit the real Keychain).
+        const envBackend = process.env.CLAUDEXOR_SECRETS_BACKEND;
+        if (envBackend !== undefined && envBackend !== "" && envBackend !== "file" && envBackend !== "keychain" && envBackend !== "auto") {
+            throw new Error(`CLAUDEXOR_SECRETS_BACKEND must be file|keychain|auto (got '${envBackend}')`);
+        }
+        if (envBackend === "file")
+            return "file";
+        if (envBackend === "keychain")
+            return "keychain";
+        return keychainAvailable() ? "keychain" : "file";
+    }
+    /** Why the last `set` landed in the file store despite a keychain backend. */
+    lastFallbackReason = null;
+    set(name, value) {
+        this.lastFallbackReason = null;
+        if (this.resolvedBackend() === "keychain") {
+            try {
+                execFileSync("security", ["add-generic-password", "-U", "-a", SERVICE, "-s", `${SERVICE}:${name}`, "-w"], { input: `${value}\n${value}\n`, stdio: ["pipe", "ignore", "ignore"] });
+                return "keychain";
+            }
+            catch (err) {
+                // SURFACED degradation (not silent): callers report this to the UI/CLI.
+                this.lastFallbackReason = `keychain write failed (${err instanceof Error ? err.message.split("\n")[0] : "error"}); stored in 0600 file instead`;
+            }
+        }
+        this.fileSet(name, value);
+        return "file";
+    }
+    get(name) {
+        if (this.resolvedBackend() === "keychain") {
+            try {
+                const out = execFileSync("security", ["find-generic-password", "-a", SERVICE, "-s", `${SERVICE}:${name}`, "-w"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+                const v = out.trim();
+                if (v)
+                    return v;
+            }
+            catch {
+                /* not in keychain; try file */
+            }
+        }
+        return this.fileGet(name);
+    }
+    delete(name) {
+        if (this.resolvedBackend() === "keychain") {
+            try {
+                execFileSync("security", ["delete-generic-password", "-a", SERVICE, "-s", `${SERVICE}:${name}`], {
+                    stdio: "ignore",
+                });
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        this.fileDelete(name);
+    }
+    list() {
+        const backend = this.resolvedBackend();
+        if (backend === "file") {
+            return Object.keys(this.fileStore())
+                .sort()
+                .map((name) => ({ name, backend: "file", present: true }));
+        }
+        const names = new Set();
+        for (const name of this.keychainNames())
+            names.add(name);
+        for (const name of Object.keys(this.fileStore()))
+            names.add(name);
+        return [...names].sort().map((name) => ({
+            name,
+            backend: this.getKeychain(name) !== null ? "keychain" : "file",
+            present: true,
+        }));
+    }
+    fileStore() {
+        const path = fileStorePath();
+        if (!existsSync(path))
+            return {};
+        try {
+            const parsed = JSON.parse(readFileSync(path, "utf8"));
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                throw new Error("expected an object");
+            }
+            const out = {};
+            for (const [key, value] of Object.entries(parsed)) {
+                if (typeof value !== "string")
+                    throw new Error(`secret '${key}' is not a string`);
+                out[key] = value;
+            }
+            return out;
+        }
+        catch (err) {
+            throw new Error(`invalid Claudexor secret store at ${path}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    writeFileStore(store) {
+        mkdirSync(configDir(), { recursive: true });
+        const path = fileStorePath();
+        writeFileSync(path, JSON.stringify(store, null, 2) + "\n", { mode: 0o600 });
+        try {
+            chmodSync(path, 0o600);
+        }
+        catch {
+            /* best-effort on platforms without POSIX modes */
+        }
+    }
+    fileSet(name, value) {
+        const store = this.fileStore();
+        store[name] = value;
+        this.writeFileStore(store);
+    }
+    fileGet(name) {
+        return this.fileStore()[name] ?? null;
+    }
+    fileDelete(name) {
+        const store = this.fileStore();
+        delete store[name];
+        this.writeFileStore(store);
+    }
+    getKeychain(name) {
+        try {
+            const out = execFileSync("security", ["find-generic-password", "-a", SERVICE, "-s", `${SERVICE}:${name}`, "-w"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+            const v = out.trim();
+            return v || null;
+        }
+        catch {
+            return null;
+        }
+    }
+    keychainNames() {
+        if (platform() !== "darwin")
+            return [];
+        try {
+            const out = execFileSync("security", ["dump-keychain"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+            const re = new RegExp(`"svce"<blob>="${SERVICE}:([^"]+)"`, "g");
+            const names = [];
+            for (let m = re.exec(out); m !== null; m = re.exec(out)) {
+                if (m[1])
+                    names.push(m[1]);
+            }
+            return names;
+        }
+        catch {
+            return [];
+        }
+    }
+}
+/**
+ * The single allowlist of managed secret names (previously duplicated in
+ * the CLI and the control API, and BOTH were missing `claude_oauth` — the
+ * claude adapter reads it, so it must be settable). Names are secret REFS,
+ * never values; adding a name here makes it settable via CLI and HTTP alike.
+ */
+export const MANAGED_SECRET_NAMES = [
+    "openai",
+    "anthropic",
+    "claude_oauth",
+    "openrouter",
+    "cursor",
+    "opencode",
+    "raw",
+];
+export function isManagedSecretName(name) {
+    return MANAGED_SECRET_NAMES.includes(name);
+}
+/**
+ * Resolve a stored secret by name. (The env-var and helper-command indirection
+ * options were retired: no production caller ever passed them — adapters read
+ * their own provider env vars directly, and a vault helper belongs to a
+ * future typed config surface, not a dead parameter.)
+ *
+ * CLAUDEXOR_DISABLE_STORED_SECRETS=1 is the hermetic kill switch, honored HERE
+ * (the single owner) so every adapter's key resolution obeys it uniformly —
+ * tests and isolation envelopes must never read the operator's real store.
+ * Explicit `opts.store` (the test seam) bypasses the switch: an injected
+ * scoped store IS the hermetic fixture.
+ */
+export function resolveSecret(name, opts = {}) {
+    if (!opts.store && process.env.CLAUDEXOR_DISABLE_STORED_SECRETS === "1")
+        return null;
+    return (opts.store ?? new SecretStore()).get(name);
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAIhD,MAAM,OAAO,GAAG,WAAW,CAAC;AAE5B,SAAS,SAAS;IAChB,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,cAAc,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,YAAY,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,UAAyB,MAAM;QAA/B,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IAEhE,eAAe;QACb,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC;QACnD,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QAC3C,yEAAyE;QACzE,8EAA8E;QAC9E,0EAA0E;QAC1E,+EAA+E;QAC/E,6EAA6E;QAC7E,0EAA0E;QAC1E,+EAA+E;QAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACzD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,UAAU,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YACjI,MAAM,IAAI,KAAK,CAAC,8DAA8D,UAAU,IAAI,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,UAAU,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QACzC,IAAI,UAAU,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC;QACjD,OAAO,iBAAiB,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IACnD,CAAC;IAED,8EAA8E;IAC9E,kBAAkB,GAAkB,IAAI,CAAC;IAEzC,GAAG,CAAC,IAAY,EAAE,KAAa;QAC7B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,IAAI,IAAI,CAAC,eAAe,EAAE,KAAK,UAAU,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,YAAY,CACV,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,EAC/E,EAAE,KAAK,EAAE,GAAG,KAAK,KAAK,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CACvE,CAAC;gBACF,OAAO,UAAU,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wEAAwE;gBACxE,IAAI,CAAC,kBAAkB,GAAG,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,gCAAgC,CAAC;YAClJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,GAAG,CAAC,IAAY;QACd,IAAI,IAAI,CAAC,eAAe,EAAE,KAAK,UAAU,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CACtB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,EAC1E,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAC1D,CAAC;gBACF,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC;oBAAE,OAAO,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,CAAC,IAAY;QACjB,IAAI,IAAI,CAAC,eAAe,EAAE,KAAK,UAAU,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,YAAY,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,EAAE;oBAC/F,KAAK,EAAE,QAAQ;iBAChB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,IAAI;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;iBACjC,IAAI,EAAE;iBACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAe,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI;YACJ,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAE,UAAoB,CAAC,CAAC,CAAE,MAAgB;YACpF,OAAO,EAAE,IAAa;SACvB,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,SAAS;QACf,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;YACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;gBAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,mBAAmB,CAAC,CAAC;gBAClF,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACnB,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,KAA6B;QAClD,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;QAC7B,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,IAAY,EAAE,KAAa;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACxC,CAAC;IAEO,UAAU,CAAC,IAAY;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAEO,WAAW,CAAC,IAAY;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CACtB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,EAC1E,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAC1D,CAAC;YACF,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,QAAQ,EAAE,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACnH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,iBAAiB,OAAO,WAAW,EAAE,GAAG,CAAC,CAAC;YAChE,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,IAAI,CAAC,CAAC,CAAC,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ;IACR,WAAW;IACX,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,UAAU;IACV,KAAK;CACG,CAAC;AAEX,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAQ,oBAA0C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAuB,EAAE;IACnE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,gCAAgC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC"}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@claudexor/secrets",
+  "version": "1.0.0",
+  "license": "MIT",
+  "description": "Cross-platform secret store: OS keychain where available, else a 0600 file; named secret refs resolved by adapters.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@claudexor/util": "1.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/razzant/claudexor.git",
+    "directory": "packages/secrets"
+  },
+  "homepage": "https://github.com/razzant/claudexor#readme",
+  "bugs": {
+    "url": "https://github.com/razzant/claudexor/issues"
+  },
+  "engines": {
+    "node": ">=20.19"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit"
+  }
+}