@compass-ai/nova 1.0.72 → 1.0.74

package/dist/services/credential-store.js

@@ -0,0 +1,877 @@
+/**
+ * Credential storage service using keytar for system keychain integration
+ * with AES-256 encrypted file fallback for API keys.
+ *
+ * This module provides secure storage for sensitive credentials like API keys,
+ * using the system keychain when available (via keytar) and falling back to
+ * AES-256 encrypted file storage when the keychain is unavailable.
+ *
+ * Security features:
+ * - System keychain integration via keytar (macOS Keychain, Windows Credential Vault, Linux Secret Service)
+ * - AES-256-GCM encryption for file-based fallback
+ * - Machine-specific encryption key derivation
+ * - Environment variable support for CI/CD environments
+ */
+import path from 'path';
+import os from 'os';
+import crypto from 'crypto';
+import { encrypt, decrypt } from '../utils/crypto.js';
+import { safeReadFile, safeWriteFile, pathExists, remove, ensureDir, } from '../utils/file-system.js';
+import { getGlobalCompassDir } from '../utils/path.js';
+import { logger } from '../utils/logger.js';
+import { CREDENTIALS_FILE_NAME, ENV_VARS, PROVIDER_ENV_VARS, PROVIDERS } from '../constants/defaults.js';
+/**
+ * Cached keytar module instance (loaded dynamically to handle missing native deps)
+ */
+let keytarModule = null;
+let keytarLoadAttempted = false;
+/**
+ * File name for caching keytar availability probe result.
+ * Avoids a write+delete to the system keychain on every startup.
+ */
+const KEYTAR_CACHE_FILE = 'keytar-available.json';
+/**
+ * Attempts to load keytar dynamically.
+ * Returns null if keytar cannot be loaded (missing native dependencies).
+ */
+async function loadKeytar() {
+    if (keytarLoadAttempted) {
+        return keytarModule;
+    }
+    keytarLoadAttempted = true;
+    try {
+        const keytar = await import('keytar');
+        keytarModule = keytar.default || keytar;
+        return keytarModule;
+    }
+    catch (error) {
+        logger.debug('Failed to load keytar native module:', error);
+        return null;
+    }
+}
+/**
+ * Service name used for keytar keychain storage
+ */
+const SERVICE_NAME = 'compass-cli';
+/**
+ * Account name for the Anthropic API key in keychain
+ */
+const ANTHROPIC_API_KEY_ACCOUNT = 'anthropic-api-key';
+/**
+ * Account name for the Compass API key in keychain
+ */
+const COMPASS_API_KEY_ACCOUNT = 'compass-api-key';
+/**
+ * Mapping of provider names to keychain account names
+ */
+const PROVIDER_KEYCHAIN_ACCOUNTS = {
+    anthropic: 'anthropic-api-key',
+    ollama: 'ollama-api-key',
+    zai: 'zai-api-key',
+    minimax: 'minimax-api-key',
+};
+/**
+ * Version identifier for encrypted credentials file format
+ */
+const CREDENTIALS_VERSION = '1.0';
+/**
+ * Mapping of provider names to credentials data keys
+ */
+const PROVIDER_CREDENTIALS_KEYS = {
+    anthropic: 'anthropicApiKey',
+    ollama: 'ollamaApiKey',
+    zai: 'zaiApiKey',
+    minimax: 'minimaxApiKey',
+};
+/**
+ * CredentialStore class provides secure storage for sensitive credentials.
+ *
+ * It attempts to use the system keychain via keytar for maximum security,
+ * and falls back to AES-256 encrypted file storage when the keychain is
+ * unavailable (e.g., in headless environments or when keytar fails).
+ *
+ * Features:
+ * - Automatic detection of keychain availability
+ * - Transparent fallback to encrypted file storage
+ * - Machine-specific encryption key derivation
+ * - Environment variable support for CI/CD
+ * - API key format validation
+ */
+class CredentialStore {
+    useKeytar = true;
+    machineKey = null;
+    initialized = false;
+    /**
+     * Initializes the credential store by testing keytar availability.
+     * Uses a cached probe result to avoid keychain write+delete on every startup.
+     * This should be called before any other operations.
+     */
+    async initialize() {
+        if (this.initialized) {
+            return;
+        }
+        const platformStamp = `${os.platform()}-${os.arch()}`;
+        // Try to read cached probe result first
+        try {
+            const cachePath = path.join(getGlobalCompassDir(), KEYTAR_CACHE_FILE);
+            if (await pathExists(cachePath)) {
+                const content = await safeReadFile(cachePath);
+                if (content) {
+                    const cache = JSON.parse(content);
+                    if (cache.platform === platformStamp) {
+                        if (cache.available) {
+                            // Verify keytar module can still be loaded (binary might have been removed)
+                            const keytar = await loadKeytar();
+                            if (keytar) {
+                                this.useKeytar = true;
+                                this.initialized = true;
+                                logger.debug('Using system keychain (cached probe)');
+                                return;
+                            }
+                            // Module gone — fall through to full probe
+                        }
+                        else {
+                            // Previously determined unavailable on this platform
+                            this.useKeytar = false;
+                            this.machineKey = await this.getMachineKey();
+                            this.initialized = true;
+                            logger.debug('Using encrypted file storage (cached probe)');
+                            return;
+                        }
+                    }
+                    // Platform changed — re-probe
+                }
+            }
+        }
+        catch {
+            // Cache unreadable — fall through to full probe
+        }
+        // Full probe: test keytar with a write+delete
+        try {
+            const keytar = await loadKeytar();
+            if (!keytar) {
+                throw new Error('Keytar module not available');
+            }
+            const testService = `${SERVICE_NAME}-test`;
+            const testAccount = 'availability-test';
+            await keytar.setPassword(testService, testAccount, 'test');
+            await keytar.deletePassword(testService, testAccount);
+            this.useKeytar = true;
+            logger.debug('Using system keychain for credential storage');
+        }
+        catch (error) {
+            this.useKeytar = false;
+            logger.debug('System keychain unavailable, using encrypted file storage', error);
+            // Pre-compute machine key for file-based storage
+            this.machineKey = await this.getMachineKey();
+        }
+        this.initialized = true;
+        // Persist probe result for next startup (fire-and-forget)
+        this.saveKeytarCache(platformStamp).catch(err => {
+            logger.debug('Failed to cache keytar probe result', err);
+        });
+    }
+    /**
+     * Persists the keytar availability probe result to disk.
+     */
+    async saveKeytarCache(platformStamp) {
+        const globalDir = getGlobalCompassDir();
+        await ensureDir(globalDir);
+        const cachePath = path.join(globalDir, KEYTAR_CACHE_FILE);
+        const data = {
+            available: this.useKeytar,
+            platform: platformStamp,
+            checkedAt: new Date().toISOString(),
+        };
+        await safeWriteFile(cachePath, JSON.stringify(data));
+    }
+    /**
+     * Stores the Anthropic API key securely.
+     *
+     * @param apiKey - The API key to store
+     * @throws Error if storage fails
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * await store.setApiKey('sk-ant-api03-...');
+     * ```
+     */
+    async setApiKey(apiKey) {
+        await this.ensureInitialized();
+        if (!apiKey || typeof apiKey !== 'string') {
+            throw new Error('API key must be a non-empty string');
+        }
+        const trimmedKey = apiKey.trim();
+        if (this.useKeytar) {
+            try {
+                const keytar = await loadKeytar();
+                if (keytar) {
+                    await keytar.setPassword(SERVICE_NAME, ANTHROPIC_API_KEY_ACCOUNT, trimmedKey);
+                    logger.debug('API key stored in system keychain');
+                    return;
+                }
+            }
+            catch (error) {
+                logger.warn('Failed to store in keychain, falling back to file storage', error);
+                // Fall through to file-based storage
+            }
+        }
+        await this.saveToFile({ anthropicApiKey: trimmedKey });
+        logger.debug('API key stored in encrypted file');
+    }
+    /**
+     * Retrieves the stored Anthropic API key.
+     *
+     * Checks sources in order of precedence:
+     * 1. Environment variable (ANTHROPIC_API_KEY)
+     * 2. System keychain (if available)
+     * 3. Encrypted file storage
+     *
+     * @returns The API key if found, null otherwise
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * const apiKey = await store.getApiKey();
+     * if (apiKey) {
+     *   // Use the API key
+     * }
+     * ```
+     */
+    async getApiKey() {
+        await this.ensureInitialized();
+        // First, check environment variable (highest precedence)
+        const envKey = process.env[ENV_VARS.API_KEY];
+        if (envKey && envKey.trim()) {
+            logger.debug('API key loaded from environment variable');
+            return envKey.trim();
+        }
+        // Try keychain if available
+        if (this.useKeytar) {
+            try {
+                const keytar = await loadKeytar();
+                if (keytar) {
+                    const keychainKey = await keytar.getPassword(SERVICE_NAME, ANTHROPIC_API_KEY_ACCOUNT);
+                    if (keychainKey) {
+                        logger.debug('API key loaded from system keychain');
+                        return keychainKey;
+                    }
+                }
+            }
+            catch (error) {
+                logger.debug('Failed to read from keychain', error);
+                // Fall through to file-based storage
+            }
+        }
+        // Try file-based storage
+        const credentials = await this.loadFromFile();
+        if (credentials?.anthropicApiKey) {
+            logger.debug('API key loaded from encrypted file');
+            return credentials.anthropicApiKey;
+        }
+        return null;
+    }
+    /**
+     * Deletes the stored API key from all storage locations.
+     *
+     * @returns True if deletion was successful, false otherwise
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * const deleted = await store.deleteApiKey();
+     * ```
+     */
+    async deleteApiKey() {
+        await this.ensureInitialized();
+        let success = true;
+        // Delete from keychain if available
+        if (this.useKeytar) {
+            try {
+                const keytar = await loadKeytar();
+                if (keytar) {
+                    const deleted = await keytar.deletePassword(SERVICE_NAME, ANTHROPIC_API_KEY_ACCOUNT);
+                    if (deleted) {
+                        logger.debug('API key deleted from system keychain');
+                    }
+                }
+            }
+            catch (error) {
+                logger.debug('Failed to delete from keychain', error);
+                success = false;
+            }
+        }
+        // Delete from file storage
+        const fileDeleted = await this.deleteFile();
+        if (!fileDeleted) {
+            success = false;
+        }
+        if (success) {
+            logger.debug('API key deleted successfully');
+        }
+        return success;
+    }
+    /**
+     * Checks if an API key is currently stored.
+     *
+     * @returns True if an API key is available (from any source)
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * if (await store.hasApiKey()) {
+     *   console.log('API key is configured');
+     * }
+     * ```
+     */
+    async hasApiKey() {
+        const key = await this.getApiKey();
+        return key !== null && key.length > 0;
+    }
+    /**
+     * Stores the Compass API key securely.
+     *
+     * @param apiKey - The API key to store
+     * @throws Error if storage fails
+     */
+    async setCompassApiKey(apiKey) {
+        await this.ensureInitialized();
+        if (!apiKey || typeof apiKey !== 'string') {
+            throw new Error('API key must be a non-empty string');
+        }
+        const trimmedKey = apiKey.trim();
+        if (this.useKeytar) {
+            try {
+                const keytar = await loadKeytar();
+                if (keytar) {
+                    await keytar.setPassword(SERVICE_NAME, COMPASS_API_KEY_ACCOUNT, trimmedKey);
+                    logger.debug('Compass API key stored in system keychain');
+                    return;
+                }
+            }
+            catch (error) {
+                logger.warn('Failed to store in keychain, falling back to file storage', error);
+                // Fall through to file-based storage
+            }
+        }
+        // Get existing credentials and update compassApiKey
+        const existingCredentials = await this.loadFromFile() || {};
+        await this.saveToFile({ ...existingCredentials, compassApiKey: trimmedKey });
+        logger.debug('Compass API key stored in encrypted file');
+    }
+    /**
+     * Retrieves the stored Compass API key.
+     *
+     * Checks sources in order of precedence:
+     * 1. Environment variable (COMPASS_API_KEY)
+     * 2. System keychain (if available)
+     * 3. Encrypted file storage
+     *
+     * @returns The API key if found, null otherwise
+     */
+    async getCompassApiKey() {
+        await this.ensureInitialized();
+        // First, check environment variable (highest precedence)
+        const envKey = process.env[ENV_VARS.COMPASS_API_KEY];
+        if (envKey && envKey.trim()) {
+            logger.debug('Compass API key loaded from environment variable');
+            return envKey.trim();
+        }
+        // Try keychain if available
+        if (this.useKeytar) {
+            try {
+                const keytar = await loadKeytar();
+                if (keytar) {
+                    const keychainKey = await keytar.getPassword(SERVICE_NAME, COMPASS_API_KEY_ACCOUNT);
+                    if (keychainKey) {
+                        logger.debug('Compass API key loaded from system keychain');
+                        return keychainKey;
+                    }
+                }
+            }
+            catch (error) {
+                logger.debug('Failed to read from keychain', error);
+                // Fall through to file-based storage
+            }
+        }
+        // Try file-based storage
+        const credentials = await this.loadFromFile();
+        if (credentials?.compassApiKey) {
+            logger.debug('Compass API key loaded from encrypted file');
+            return credentials.compassApiKey;
+        }
+        return null;
+    }
+    /**
+     * Deletes the stored Compass API key from all storage locations.
+     *
+     * @returns True if deletion was successful, false otherwise
+     */
+    async deleteCompassApiKey() {
+        await this.ensureInitialized();
+        let success = true;
+        // Delete from keychain if available
+        if (this.useKeytar) {
+            try {
+                const keytar = await loadKeytar();
+                if (keytar) {
+                    const deleted = await keytar.deletePassword(SERVICE_NAME, COMPASS_API_KEY_ACCOUNT);
+                    if (deleted) {
+                        logger.debug('Compass API key deleted from system keychain');
+                    }
+                }
+            }
+            catch (error) {
+                logger.debug('Failed to delete from keychain', error);
+                success = false;
+            }
+        }
+        // Delete from file storage by updating credentials without compassApiKey
+        try {
+            const existingCredentials = await this.loadFromFile();
+            if (existingCredentials?.compassApiKey) {
+                delete existingCredentials.compassApiKey;
+                await this.saveToFile(existingCredentials);
+                logger.debug('Compass API key deleted from encrypted file');
+            }
+        }
+        catch (error) {
+            logger.error('Failed to delete Compass API key from file', error);
+            success = false;
+        }
+        if (success) {
+            logger.debug('Compass API key deleted successfully');
+        }
+        return success;
+    }
+    /**
+     * Checks if a Compass API key is currently stored.
+     *
+     * @returns True if an API key is available (from any source)
+     */
+    async hasCompassApiKey() {
+        const key = await this.getCompassApiKey();
+        return key !== null && key.length > 0;
+    }
+    // =========================================================================
+    // Provider-Specific API Key Methods
+    // =========================================================================
+    /**
+     * Stores an API key for a specific provider.
+     *
+     * @param provider - The provider name (anthropic, ollama, zai, minimax)
+     * @param apiKey - The API key to store
+     * @throws Error if storage fails
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * await store.setProviderApiKey('ollama', 'my-ollama-key');
+     * ```
+     */
+    async setProviderApiKey(provider, apiKey) {
+        await this.ensureInitialized();
+        if (!apiKey || typeof apiKey !== 'string') {
+            throw new Error('API key must be a non-empty string');
+        }
+        if (!PROVIDERS.includes(provider)) {
+            throw new Error(`Invalid provider: ${provider}. Must be one of: ${PROVIDERS.join(', ')}`);
+        }
+        const trimmedKey = apiKey.trim();
+        const accountName = PROVIDER_KEYCHAIN_ACCOUNTS[provider];
+        if (this.useKeytar) {
+            try {
+                const keytar = await loadKeytar();
+                if (keytar) {
+                    await keytar.setPassword(SERVICE_NAME, accountName, trimmedKey);
+                    logger.debug(`${provider} API key stored in system keychain`);
+                    return;
+                }
+            }
+            catch (error) {
+                logger.warn('Failed to store in keychain, falling back to file storage', error);
+            }
+        }
+        // Fall back to file storage
+        const existingCredentials = await this.loadFromFile() || {};
+        const credentialsKey = PROVIDER_CREDENTIALS_KEYS[provider];
+        await this.saveToFile({ ...existingCredentials, [credentialsKey]: trimmedKey });
+        logger.debug(`${provider} API key stored in encrypted file`);
+    }
+    /**
+     * Retrieves the stored API key for a specific provider.
+     *
+     * Checks sources in order of precedence:
+     * 1. Environment variable (provider-specific)
+     * 2. System keychain (if available)
+     * 3. Encrypted file storage
+     *
+     * @param provider - The provider name (anthropic, ollama, zai, minimax)
+     * @returns The API key if found, null otherwise
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * const apiKey = await store.getProviderApiKey('ollama');
+     * ```
+     */
+    async getProviderApiKey(provider) {
+        await this.ensureInitialized();
+        if (!PROVIDERS.includes(provider)) {
+            logger.warn(`Invalid provider: ${provider}`);
+            return null;
+        }
+        // First, check environment variable (highest precedence)
+        const envVarName = PROVIDER_ENV_VARS[provider];
+        const envKey = process.env[envVarName];
+        if (envKey && envKey.trim()) {
+            logger.debug(`${provider} API key loaded from environment variable ${envVarName}`);
+            return envKey.trim();
+        }
+        // Try keychain if available
+        const accountName = PROVIDER_KEYCHAIN_ACCOUNTS[provider];
+        if (this.useKeytar) {
+            try {
+                const keytar = await loadKeytar();
+                if (keytar) {
+                    const keychainKey = await keytar.getPassword(SERVICE_NAME, accountName);
+                    if (keychainKey) {
+                        logger.debug(`${provider} API key loaded from system keychain`);
+                        return keychainKey;
+                    }
+                }
+            }
+            catch (error) {
+                logger.debug(`Failed to read ${provider} key from keychain`, error);
+            }
+        }
+        // Try file-based storage
+        const credentials = await this.loadFromFile();
+        const credentialsKey = PROVIDER_CREDENTIALS_KEYS[provider];
+        if (credentials?.[credentialsKey]) {
+            logger.debug(`${provider} API key loaded from encrypted file`);
+            return credentials[credentialsKey];
+        }
+        return null;
+    }
+    /**
+     * Checks if an API key is stored for a specific provider.
+     *
+     * @param provider - The provider name (anthropic, ollama, zai, minimax)
+     * @returns True if an API key is available (from any source)
+     */
+    async hasProviderApiKey(provider) {
+        const key = await this.getProviderApiKey(provider);
+        return key !== null && key.length > 0;
+    }
+    /**
+     * Deletes the stored API key for a specific provider.
+     *
+     * @param provider - The provider name (anthropic, ollama, zai, minimax)
+     * @returns True if deletion was successful, false otherwise
+     */
+    async deleteProviderApiKey(provider) {
+        await this.ensureInitialized();
+        if (!PROVIDERS.includes(provider)) {
+            logger.warn(`Invalid provider: ${provider}`);
+            return false;
+        }
+        let success = true;
+        const accountName = PROVIDER_KEYCHAIN_ACCOUNTS[provider];
+        // Delete from keychain if available
+        if (this.useKeytar) {
+            try {
+                const keytar = await loadKeytar();
+                if (keytar) {
+                    const deleted = await keytar.deletePassword(SERVICE_NAME, accountName);
+                    if (deleted) {
+                        logger.debug(`${provider} API key deleted from system keychain`);
+                    }
+                }
+            }
+            catch (error) {
+                logger.debug(`Failed to delete ${provider} key from keychain`, error);
+                success = false;
+            }
+        }
+        // Delete from file storage
+        try {
+            const existingCredentials = await this.loadFromFile();
+            const credentialsKey = PROVIDER_CREDENTIALS_KEYS[provider];
+            if (existingCredentials?.[credentialsKey]) {
+                delete existingCredentials[credentialsKey];
+                await this.saveToFile(existingCredentials);
+                logger.debug(`${provider} API key deleted from encrypted file`);
+            }
+        }
+        catch (error) {
+            logger.error(`Failed to delete ${provider} API key from file`, error);
+            success = false;
+        }
+        return success;
+    }
+    /**
+     * Gets all configured providers that have API keys.
+     *
+     * @returns Array of provider names that have API keys configured
+     */
+    async getConfiguredProviders() {
+        const configured = [];
+        for (const provider of PROVIDERS) {
+            if (await this.hasProviderApiKey(provider)) {
+                configured.push(provider);
+            }
+        }
+        return configured;
+    }
+    /**
+     * Validates the format of an Anthropic API key.
+     *
+     * Anthropic API keys follow the format: sk-ant-api03-...
+     * This method performs basic format validation without making API calls.
+     *
+     * @param apiKey - The API key to validate
+     * @returns True if the format is valid
+     *
+     * @example
+     * ```typescript
+     * const store = await getCredentialStore();
+     * if (store.validateApiKeyFormat('sk-ant-api03-...')) {
+     *   // Key format is valid
+     * }
+     * ```
+     */
+    validateApiKeyFormat(apiKey) {
+        if (!apiKey || typeof apiKey !== 'string') {
+            return false;
+        }
+        const trimmed = apiKey.trim();
+        // Minimum reasonable length for an API key
+        if (trimmed.length < 20) {
+            return false;
+        }
+        return true;
+        // Anthropic API keys start with 'sk-ant-' and have a minimum length
+        // Format: sk-ant-api03-<base64-encoded-data>
+        if (!trimmed.startsWith('sk-ant-')) {
+            return false;
+        }
+        // Check for valid characters (alphanumeric, hyphens, underscores)
+        const validPattern = /^sk-ant-[a-zA-Z0-9_-]+$/;
+        return validPattern.test(trimmed);
+    }
+    /**
+     * Gets the storage method currently in use.
+     *
+     * @returns 'keychain' if using system keychain, 'file' if using encrypted file
+     */
+    getStorageMethod() {
+        return this.useKeytar ? 'keychain' : 'file';
+    }
+    /**
+     * Checks if the credential store has been initialized.
+     *
+     * @returns True if initialize() has been called
+     */
+    isInitialized() {
+        return this.initialized;
+    }
+    /**
+     * Ensures the store is initialized before operations.
+     */
+    async ensureInitialized() {
+        if (!this.initialized) {
+            await this.initialize();
+        }
+    }
+    /**
+     * Generates a machine-specific key for encryption.
+     * Uses a combination of machine identifiers to create a unique key.
+     */
+    async getMachineKey() {
+        if (this.machineKey) {
+            return this.machineKey;
+        }
+        // Combine multiple machine-specific values for key derivation
+        const components = [
+            os.hostname(),
+            os.platform(),
+            os.arch(),
+            os.userInfo().username,
+            // Add home directory for additional uniqueness
+            os.homedir(),
+        ];
+        // Create a hash of the combined components
+        const combined = components.join(':');
+        const hash = crypto.createHash('sha256').update(combined).digest('hex');
+        this.machineKey = hash;
+        return hash;
+    }
+    /**
+     * Saves credentials to an encrypted file.
+     */
+    async saveToFile(credentials) {
+        const key = await this.getMachineKey();
+        const dataString = JSON.stringify(credentials);
+        const encrypted = encrypt(dataString, key);
+        const encryptedCredentials = {
+            version: CREDENTIALS_VERSION,
+            data: encrypted,
+            updatedAt: new Date().toISOString(),
+        };
+        const globalDir = getGlobalCompassDir();
+        await ensureDir(globalDir);
+        const filePath = path.join(globalDir, CREDENTIALS_FILE_NAME);
+        await safeWriteFile(filePath, JSON.stringify(encryptedCredentials, null, 2));
+        logger.debug('Credentials saved to encrypted file');
+    }
+    /**
+     * Loads credentials from the encrypted file.
+     */
+    async loadFromFile() {
+        const filePath = path.join(getGlobalCompassDir(), CREDENTIALS_FILE_NAME);
+        if (!(await pathExists(filePath))) {
+            return null;
+        }
+        try {
+            const content = await safeReadFile(filePath);
+            if (!content) {
+                return null;
+            }
+            const encryptedCredentials = JSON.parse(content);
+            // Validate version
+            if (encryptedCredentials.version !== CREDENTIALS_VERSION) {
+                logger.warn(`Credentials file version mismatch: ${encryptedCredentials.version}`);
+                // For now, attempt to decrypt anyway; future versions may need migration
+            }
+            const key = await this.getMachineKey();
+            const decrypted = decrypt(encryptedCredentials.data, key);
+            const credentials = JSON.parse(decrypted);
+            return credentials;
+        }
+        catch (error) {
+            logger.error('Failed to load credentials from file', error);
+            return null;
+        }
+    }
+    /**
+     * Deletes the encrypted credentials file.
+     */
+    async deleteFile() {
+        const filePath = path.join(getGlobalCompassDir(), CREDENTIALS_FILE_NAME);
+        try {
+            if (await pathExists(filePath)) {
+                await remove(filePath);
+                logger.debug('Credentials file deleted');
+            }
+            return true;
+        }
+        catch (error) {
+            logger.error('Failed to delete credentials file', error);
+            return false;
+        }
+    }
+    /**
+     * Migrates credentials from file storage to keychain.
+     * Useful when keychain becomes available after initial setup.
+     *
+     * @returns True if migration was successful or not needed
+     */
+    async migrateToKeychain() {
+        if (!this.useKeytar) {
+            logger.debug('Keychain not available, migration skipped');
+            return false;
+        }
+        try {
+            const keytar = await loadKeytar();
+            if (!keytar) {
+                logger.debug('Keytar not available, migration skipped');
+                return false;
+            }
+            // Check if there are file-based credentials to migrate
+            const fileCredentials = await this.loadFromFile();
+            if (!fileCredentials?.anthropicApiKey) {
+                logger.debug('No file-based credentials to migrate');
+                return true;
+            }
+            // Check if keychain already has the key
+            const keychainKey = await keytar.getPassword(SERVICE_NAME, ANTHROPIC_API_KEY_ACCOUNT);
+            if (keychainKey) {
+                logger.debug('Keychain already has credentials, skipping migration');
+                return true;
+            }
+            // Migrate to keychain
+            await keytar.setPassword(SERVICE_NAME, ANTHROPIC_API_KEY_ACCOUNT, fileCredentials.anthropicApiKey);
+            // Delete file-based storage after successful migration
+            await this.deleteFile();
+            logger.debug('Credentials migrated from file to system keychain');
+            return true;
+        }
+        catch (error) {
+            logger.error('Failed to migrate credentials to keychain', error);
+            return false;
+        }
+    }
+    /**
+     * Clears all stored credentials from all storage locations.
+     * Use with caution - this is irreversible.
+     */
+    async clearAll() {
+        await this.ensureInitialized();
+        // Clear keychain
+        if (this.useKeytar) {
+            try {
+                const keytar = await loadKeytar();
+                if (keytar) {
+                    await keytar.deletePassword(SERVICE_NAME, ANTHROPIC_API_KEY_ACCOUNT);
+                    await keytar.deletePassword(SERVICE_NAME, COMPASS_API_KEY_ACCOUNT);
+                    // Clear all provider-specific keys
+                    for (const provider of PROVIDERS) {
+                        await keytar.deletePassword(SERVICE_NAME, PROVIDER_KEYCHAIN_ACCOUNTS[provider]);
+                    }
+                }
+            }
+            catch (error) {
+                logger.debug('Failed to clear keychain', error);
+            }
+        }
+        // Clear file storage
+        await this.deleteFile();
+        logger.debug('All credentials cleared');
+    }
+}
+// Singleton instance
+let credentialStoreInstance = null;
+/**
+ * Gets the singleton CredentialStore instance.
+ * Initializes the instance on first call.
+ *
+ * @returns Promise resolving to the initialized CredentialStore instance
+ *
+ * @example
+ * ```typescript
+ * const store = await getCredentialStore();
+ * const apiKey = await store.getApiKey();
+ * ```
+ */
+export async function getCredentialStore() {
+    if (!credentialStoreInstance) {
+        credentialStoreInstance = new CredentialStore();
+        await credentialStoreInstance.initialize();
+    }
+    return credentialStoreInstance;
+}
+/**
+ * Creates a new CredentialStore instance.
+ * Use this when you need a separate instance from the singleton.
+ *
+ * Note: You must call initialize() on the returned instance before use.
+ *
+ * @returns A new CredentialStore instance (not initialized)
+ */
+export function createCredentialStore() {
+    return new CredentialStore();
+}
+export { CredentialStore };
+//# sourceMappingURL=credential-store.js.map