@compass-ai/nova 1.0.74 → 1.0.76

package/dist/services/credential-store.js

@@ -1,877 +0,0 @@
-/**
- * Credential storage service using keytar for system keychain integration
- * with AES-256 encrypted file fallback for API keys.
- *
- * This module provides secure storage for sensitive credentials like API keys,
- * using the system keychain when available (via keytar) and falling back to
- * AES-256 encrypted file storage when the keychain is unavailable.
- *
- * Security features:
- * - System keychain integration via keytar (macOS Keychain, Windows Credential Vault, Linux Secret Service)
- * - AES-256-GCM encryption for file-based fallback
- * - Machine-specific encryption key derivation
- * - Environment variable support for CI/CD environments
- */
-import path from 'path';
-import os from 'os';
-import crypto from 'crypto';
-import { encrypt, decrypt } from '../utils/crypto.js';
-import { safeReadFile, safeWriteFile, pathExists, remove, ensureDir, } from '../utils/file-system.js';
-import { getGlobalCompassDir } from '../utils/path.js';
-import { logger } from '../utils/logger.js';
-import { CREDENTIALS_FILE_NAME, ENV_VARS, PROVIDER_ENV_VARS, PROVIDERS } from '../constants/defaults.js';
-/**
- * Cached keytar module instance (loaded dynamically to handle missing native deps)
- */
-let keytarModule = null;
-let keytarLoadAttempted = false;
-/**
- * File name for caching keytar availability probe result.
- * Avoids a write+delete to the system keychain on every startup.
- */
-const KEYTAR_CACHE_FILE = 'keytar-available.json';
-/**
- * Attempts to load keytar dynamically.
- * Returns null if keytar cannot be loaded (missing native dependencies).
- */
-async function loadKeytar() {
-    if (keytarLoadAttempted) {
-        return keytarModule;
-    }
-    keytarLoadAttempted = true;
-    try {
-        const keytar = await import('keytar');
-        keytarModule = keytar.default || keytar;
-        return keytarModule;
-    }
-    catch (error) {
-        logger.debug('Failed to load keytar native module:', error);
-        return null;
-    }
-}
-/**
- * Service name used for keytar keychain storage
- */
-const SERVICE_NAME = 'compass-cli';
-/**
- * Account name for the Anthropic API key in keychain
- */
-const ANTHROPIC_API_KEY_ACCOUNT = 'anthropic-api-key';
-/**
- * Account name for the Compass API key in keychain
- */
-const COMPASS_API_KEY_ACCOUNT = 'compass-api-key';
-/**
- * Mapping of provider names to keychain account names
- */
-const PROVIDER_KEYCHAIN_ACCOUNTS = {
-    anthropic: 'anthropic-api-key',
-    ollama: 'ollama-api-key',
-    zai: 'zai-api-key',
-    minimax: 'minimax-api-key',
-};
-/**
- * Version identifier for encrypted credentials file format
- */
-const CREDENTIALS_VERSION = '1.0';
-/**
- * Mapping of provider names to credentials data keys
- */
-const PROVIDER_CREDENTIALS_KEYS = {
-    anthropic: 'anthropicApiKey',
-    ollama: 'ollamaApiKey',
-    zai: 'zaiApiKey',
-    minimax: 'minimaxApiKey',
-};
-/**
- * CredentialStore class provides secure storage for sensitive credentials.
- *
- * It attempts to use the system keychain via keytar for maximum security,
- * and falls back to AES-256 encrypted file storage when the keychain is
- * unavailable (e.g., in headless environments or when keytar fails).
- *
- * Features:
- * - Automatic detection of keychain availability
- * - Transparent fallback to encrypted file storage
- * - Machine-specific encryption key derivation
- * - Environment variable support for CI/CD
- * - API key format validation
- */
-class CredentialStore {
-    useKeytar = true;
-    machineKey = null;
-    initialized = false;
-    /**
-     * Initializes the credential store by testing keytar availability.
-     * Uses a cached probe result to avoid keychain write+delete on every startup.
-     * This should be called before any other operations.
-     */
-    async initialize() {
-        if (this.initialized) {
-            return;
-        }
-        const platformStamp = `${os.platform()}-${os.arch()}`;
-        // Try to read cached probe result first
-        try {
-            const cachePath = path.join(getGlobalCompassDir(), KEYTAR_CACHE_FILE);
-            if (await pathExists(cachePath)) {
-                const content = await safeReadFile(cachePath);
-                if (content) {
-                    const cache = JSON.parse(content);
-                    if (cache.platform === platformStamp) {
-                        if (cache.available) {
-                            // Verify keytar module can still be loaded (binary might have been removed)
-                            const keytar = await loadKeytar();
-                            if (keytar) {
-                                this.useKeytar = true;
-                                this.initialized = true;
-                                logger.debug('Using system keychain (cached probe)');
-                                return;
-                            }
-                            // Module gone — fall through to full probe
-                        }
-                        else {
-                            // Previously determined unavailable on this platform
-                            this.useKeytar = false;
-                            this.machineKey = await this.getMachineKey();
-                            this.initialized = true;
-                            logger.debug('Using encrypted file storage (cached probe)');
-                            return;
-                        }
-                    }
-                    // Platform changed — re-probe
-                }
-            }
-        }
-        catch {
-            // Cache unreadable — fall through to full probe
-        }
-        // Full probe: test keytar with a write+delete
-        try {
-            const keytar = await loadKeytar();
-            if (!keytar) {
-                throw new Error('Keytar module not available');
-            }
-            const testService = `${SERVICE_NAME}-test`;
-            const testAccount = 'availability-test';
-            await keytar.setPassword(testService, testAccount, 'test');
-            await keytar.deletePassword(testService, testAccount);
-            this.useKeytar = true;
-            logger.debug('Using system keychain for credential storage');
-        }
-        catch (error) {
-            this.useKeytar = false;
-            logger.debug('System keychain unavailable, using encrypted file storage', error);
-            // Pre-compute machine key for file-based storage
-            this.machineKey = await this.getMachineKey();
-        }
-        this.initialized = true;
-        // Persist probe result for next startup (fire-and-forget)
-        this.saveKeytarCache(platformStamp).catch(err => {
-            logger.debug('Failed to cache keytar probe result', err);
-        });
-    }
-    /**
-     * Persists the keytar availability probe result to disk.
-     */
-    async saveKeytarCache(platformStamp) {
-        const globalDir = getGlobalCompassDir();
-        await ensureDir(globalDir);
-        const cachePath = path.join(globalDir, KEYTAR_CACHE_FILE);
-        const data = {
-            available: this.useKeytar,
-            platform: platformStamp,
-            checkedAt: new Date().toISOString(),
-        };
-        await safeWriteFile(cachePath, JSON.stringify(data));
-    }
-    /**
-     * Stores the Anthropic API key securely.
-     *
-     * @param apiKey - The API key to store
-     * @throws Error if storage fails
-     *
-     * @example
-     * ```typescript
-     * const store = await getCredentialStore();
-     * await store.setApiKey('sk-ant-api03-...');
-     * ```
-     */
-    async setApiKey(apiKey) {
-        await this.ensureInitialized();
-        if (!apiKey || typeof apiKey !== 'string') {
-            throw new Error('API key must be a non-empty string');
-        }
-        const trimmedKey = apiKey.trim();
-        if (this.useKeytar) {
-            try {
-                const keytar = await loadKeytar();
-                if (keytar) {
-                    await keytar.setPassword(SERVICE_NAME, ANTHROPIC_API_KEY_ACCOUNT, trimmedKey);
-                    logger.debug('API key stored in system keychain');
-                    return;
-                }
-            }
-            catch (error) {
-                logger.warn('Failed to store in keychain, falling back to file storage', error);
-                // Fall through to file-based storage
-            }
-        }
-        await this.saveToFile({ anthropicApiKey: trimmedKey });
-        logger.debug('API key stored in encrypted file');
-    }
-    /**
-     * Retrieves the stored Anthropic API key.
-     *
-     * Checks sources in order of precedence:
-     * 1. Environment variable (ANTHROPIC_API_KEY)
-     * 2. System keychain (if available)
-     * 3. Encrypted file storage
-     *
-     * @returns The API key if found, null otherwise
-     *
-     * @example
-     * ```typescript
-     * const store = await getCredentialStore();
-     * const apiKey = await store.getApiKey();
-     * if (apiKey) {
-     *   // Use the API key
-     * }
-     * ```
-     */
-    async getApiKey() {
-        await this.ensureInitialized();
-        // First, check environment variable (highest precedence)
-        const envKey = process.env[ENV_VARS.API_KEY];
-        if (envKey && envKey.trim()) {
-            logger.debug('API key loaded from environment variable');
-            return envKey.trim();
-        }
-        // Try keychain if available
-        if (this.useKeytar) {
-            try {
-                const keytar = await loadKeytar();
-                if (keytar) {
-                    const keychainKey = await keytar.getPassword(SERVICE_NAME, ANTHROPIC_API_KEY_ACCOUNT);
-                    if (keychainKey) {
-                        logger.debug('API key loaded from system keychain');
-                        return keychainKey;
-                    }
-                }
-            }
-            catch (error) {
-                logger.debug('Failed to read from keychain', error);
-                // Fall through to file-based storage
-            }
-        }
-        // Try file-based storage
-        const credentials = await this.loadFromFile();
-        if (credentials?.anthropicApiKey) {
-            logger.debug('API key loaded from encrypted file');
-            return credentials.anthropicApiKey;
-        }
-        return null;
-    }
-    /**
-     * Deletes the stored API key from all storage locations.
-     *
-     * @returns True if deletion was successful, false otherwise
-     *
-     * @example
-     * ```typescript
-     * const store = await getCredentialStore();
-     * const deleted = await store.deleteApiKey();
-     * ```
-     */
-    async deleteApiKey() {
-        await this.ensureInitialized();
-        let success = true;
-        // Delete from keychain if available
-        if (this.useKeytar) {
-            try {
-                const keytar = await loadKeytar();
-                if (keytar) {
-                    const deleted = await keytar.deletePassword(SERVICE_NAME, ANTHROPIC_API_KEY_ACCOUNT);
-                    if (deleted) {
-                        logger.debug('API key deleted from system keychain');
-                    }
-                }
-            }
-            catch (error) {
-                logger.debug('Failed to delete from keychain', error);
-                success = false;
-            }
-        }
-        // Delete from file storage
-        const fileDeleted = await this.deleteFile();
-        if (!fileDeleted) {
-            success = false;
-        }
-        if (success) {
-            logger.debug('API key deleted successfully');
-        }
-        return success;
-    }
-    /**
-     * Checks if an API key is currently stored.
-     *
-     * @returns True if an API key is available (from any source)
-     *
-     * @example
-     * ```typescript
-     * const store = await getCredentialStore();
-     * if (await store.hasApiKey()) {
-     *   console.log('API key is configured');
-     * }
-     * ```
-     */
-    async hasApiKey() {
-        const key = await this.getApiKey();
-        return key !== null && key.length > 0;
-    }
-    /**
-     * Stores the Compass API key securely.
-     *
-     * @param apiKey - The API key to store
-     * @throws Error if storage fails
-     */
-    async setCompassApiKey(apiKey) {
-        await this.ensureInitialized();
-        if (!apiKey || typeof apiKey !== 'string') {
-            throw new Error('API key must be a non-empty string');
-        }
-        const trimmedKey = apiKey.trim();
-        if (this.useKeytar) {
-            try {
-                const keytar = await loadKeytar();
-                if (keytar) {
-                    await keytar.setPassword(SERVICE_NAME, COMPASS_API_KEY_ACCOUNT, trimmedKey);
-                    logger.debug('Compass API key stored in system keychain');
-                    return;
-                }
-            }
-            catch (error) {
-                logger.warn('Failed to store in keychain, falling back to file storage', error);
-                // Fall through to file-based storage
-            }
-        }
-        // Get existing credentials and update compassApiKey
-        const existingCredentials = await this.loadFromFile() || {};
-        await this.saveToFile({ ...existingCredentials, compassApiKey: trimmedKey });
-        logger.debug('Compass API key stored in encrypted file');
-    }
-    /**
-     * Retrieves the stored Compass API key.
-     *
-     * Checks sources in order of precedence:
-     * 1. Environment variable (COMPASS_API_KEY)
-     * 2. System keychain (if available)
-     * 3. Encrypted file storage
-     *
-     * @returns The API key if found, null otherwise
-     */
-    async getCompassApiKey() {
-        await this.ensureInitialized();
-        // First, check environment variable (highest precedence)
-        const envKey = process.env[ENV_VARS.COMPASS_API_KEY];
-        if (envKey && envKey.trim()) {
-            logger.debug('Compass API key loaded from environment variable');
-            return envKey.trim();
-        }
-        // Try keychain if available
-        if (this.useKeytar) {
-            try {
-                const keytar = await loadKeytar();
-                if (keytar) {
-                    const keychainKey = await keytar.getPassword(SERVICE_NAME, COMPASS_API_KEY_ACCOUNT);
-                    if (keychainKey) {
-                        logger.debug('Compass API key loaded from system keychain');
-                        return keychainKey;
-                    }
-                }
-            }
-            catch (error) {
-                logger.debug('Failed to read from keychain', error);
-                // Fall through to file-based storage
-            }
-        }
-        // Try file-based storage
-        const credentials = await this.loadFromFile();
-        if (credentials?.compassApiKey) {
-            logger.debug('Compass API key loaded from encrypted file');
-            return credentials.compassApiKey;
-        }
-        return null;
-    }
-    /**
-     * Deletes the stored Compass API key from all storage locations.
-     *
-     * @returns True if deletion was successful, false otherwise
-     */
-    async deleteCompassApiKey() {
-        await this.ensureInitialized();
-        let success = true;
-        // Delete from keychain if available
-        if (this.useKeytar) {
-            try {
-                const keytar = await loadKeytar();
-                if (keytar) {
-                    const deleted = await keytar.deletePassword(SERVICE_NAME, COMPASS_API_KEY_ACCOUNT);
-                    if (deleted) {
-                        logger.debug('Compass API key deleted from system keychain');
-                    }
-                }
-            }
-            catch (error) {
-                logger.debug('Failed to delete from keychain', error);
-                success = false;
-            }
-        }
-        // Delete from file storage by updating credentials without compassApiKey
-        try {
-            const existingCredentials = await this.loadFromFile();
-            if (existingCredentials?.compassApiKey) {
-                delete existingCredentials.compassApiKey;
-                await this.saveToFile(existingCredentials);
-                logger.debug('Compass API key deleted from encrypted file');
-            }
-        }
-        catch (error) {
-            logger.error('Failed to delete Compass API key from file', error);
-            success = false;
-        }
-        if (success) {
-            logger.debug('Compass API key deleted successfully');
-        }
-        return success;
-    }
-    /**
-     * Checks if a Compass API key is currently stored.
-     *
-     * @returns True if an API key is available (from any source)
-     */
-    async hasCompassApiKey() {
-        const key = await this.getCompassApiKey();
-        return key !== null && key.length > 0;
-    }
-    // =========================================================================
-    // Provider-Specific API Key Methods
-    // =========================================================================
-    /**
-     * Stores an API key for a specific provider.
-     *
-     * @param provider - The provider name (anthropic, ollama, zai, minimax)
-     * @param apiKey - The API key to store
-     * @throws Error if storage fails
-     *
-     * @example
-     * ```typescript
-     * const store = await getCredentialStore();
-     * await store.setProviderApiKey('ollama', 'my-ollama-key');
-     * ```
-     */
-    async setProviderApiKey(provider, apiKey) {
-        await this.ensureInitialized();
-        if (!apiKey || typeof apiKey !== 'string') {
-            throw new Error('API key must be a non-empty string');
-        }
-        if (!PROVIDERS.includes(provider)) {
-            throw new Error(`Invalid provider: ${provider}. Must be one of: ${PROVIDERS.join(', ')}`);
-        }
-        const trimmedKey = apiKey.trim();
-        const accountName = PROVIDER_KEYCHAIN_ACCOUNTS[provider];
-        if (this.useKeytar) {
-            try {
-                const keytar = await loadKeytar();
-                if (keytar) {
-                    await keytar.setPassword(SERVICE_NAME, accountName, trimmedKey);
-                    logger.debug(`${provider} API key stored in system keychain`);
-                    return;
-                }
-            }
-            catch (error) {
-                logger.warn('Failed to store in keychain, falling back to file storage', error);
-            }
-        }
-        // Fall back to file storage
-        const existingCredentials = await this.loadFromFile() || {};
-        const credentialsKey = PROVIDER_CREDENTIALS_KEYS[provider];
-        await this.saveToFile({ ...existingCredentials, [credentialsKey]: trimmedKey });
-        logger.debug(`${provider} API key stored in encrypted file`);
-    }
-    /**
-     * Retrieves the stored API key for a specific provider.
-     *
-     * Checks sources in order of precedence:
-     * 1. Environment variable (provider-specific)
-     * 2. System keychain (if available)
-     * 3. Encrypted file storage
-     *
-     * @param provider - The provider name (anthropic, ollama, zai, minimax)
-     * @returns The API key if found, null otherwise
-     *
-     * @example
-     * ```typescript
-     * const store = await getCredentialStore();
-     * const apiKey = await store.getProviderApiKey('ollama');
-     * ```
-     */
-    async getProviderApiKey(provider) {
-        await this.ensureInitialized();
-        if (!PROVIDERS.includes(provider)) {
-            logger.warn(`Invalid provider: ${provider}`);
-            return null;
-        }
-        // First, check environment variable (highest precedence)
-        const envVarName = PROVIDER_ENV_VARS[provider];
-        const envKey = process.env[envVarName];
-        if (envKey && envKey.trim()) {
-            logger.debug(`${provider} API key loaded from environment variable ${envVarName}`);
-            return envKey.trim();
-        }
-        // Try keychain if available
-        const accountName = PROVIDER_KEYCHAIN_ACCOUNTS[provider];
-        if (this.useKeytar) {
-            try {
-                const keytar = await loadKeytar();
-                if (keytar) {
-                    const keychainKey = await keytar.getPassword(SERVICE_NAME, accountName);
-                    if (keychainKey) {
-                        logger.debug(`${provider} API key loaded from system keychain`);
-                        return keychainKey;
-                    }
-                }
-            }
-            catch (error) {
-                logger.debug(`Failed to read ${provider} key from keychain`, error);
-            }
-        }
-        // Try file-based storage
-        const credentials = await this.loadFromFile();
-        const credentialsKey = PROVIDER_CREDENTIALS_KEYS[provider];
-        if (credentials?.[credentialsKey]) {
-            logger.debug(`${provider} API key loaded from encrypted file`);
-            return credentials[credentialsKey];
-        }
-        return null;
-    }
-    /**
-     * Checks if an API key is stored for a specific provider.
-     *
-     * @param provider - The provider name (anthropic, ollama, zai, minimax)
-     * @returns True if an API key is available (from any source)
-     */
-    async hasProviderApiKey(provider) {
-        const key = await this.getProviderApiKey(provider);
-        return key !== null && key.length > 0;
-    }
-    /**
-     * Deletes the stored API key for a specific provider.
-     *
-     * @param provider - The provider name (anthropic, ollama, zai, minimax)
-     * @returns True if deletion was successful, false otherwise
-     */
-    async deleteProviderApiKey(provider) {
-        await this.ensureInitialized();
-        if (!PROVIDERS.includes(provider)) {
-            logger.warn(`Invalid provider: ${provider}`);
-            return false;
-        }
-        let success = true;
-        const accountName = PROVIDER_KEYCHAIN_ACCOUNTS[provider];
-        // Delete from keychain if available
-        if (this.useKeytar) {
-            try {
-                const keytar = await loadKeytar();
-                if (keytar) {
-                    const deleted = await keytar.deletePassword(SERVICE_NAME, accountName);
-                    if (deleted) {
-                        logger.debug(`${provider} API key deleted from system keychain`);
-                    }
-                }
-            }
-            catch (error) {
-                logger.debug(`Failed to delete ${provider} key from keychain`, error);
-                success = false;
-            }
-        }
-        // Delete from file storage
-        try {
-            const existingCredentials = await this.loadFromFile();
-            const credentialsKey = PROVIDER_CREDENTIALS_KEYS[provider];
-            if (existingCredentials?.[credentialsKey]) {
-                delete existingCredentials[credentialsKey];
-                await this.saveToFile(existingCredentials);
-                logger.debug(`${provider} API key deleted from encrypted file`);
-            }
-        }
-        catch (error) {
-            logger.error(`Failed to delete ${provider} API key from file`, error);
-            success = false;
-        }
-        return success;
-    }
-    /**
-     * Gets all configured providers that have API keys.
-     *
-     * @returns Array of provider names that have API keys configured
-     */
-    async getConfiguredProviders() {
-        const configured = [];
-        for (const provider of PROVIDERS) {
-            if (await this.hasProviderApiKey(provider)) {
-                configured.push(provider);
-            }
-        }
-        return configured;
-    }
-    /**
-     * Validates the format of an Anthropic API key.
-     *
-     * Anthropic API keys follow the format: sk-ant-api03-...
-     * This method performs basic format validation without making API calls.
-     *
-     * @param apiKey - The API key to validate
-     * @returns True if the format is valid
-     *
-     * @example
-     * ```typescript
-     * const store = await getCredentialStore();
-     * if (store.validateApiKeyFormat('sk-ant-api03-...')) {
-     *   // Key format is valid
-     * }
-     * ```
-     */
-    validateApiKeyFormat(apiKey) {
-        if (!apiKey || typeof apiKey !== 'string') {
-            return false;
-        }
-        const trimmed = apiKey.trim();
-        // Minimum reasonable length for an API key
-        if (trimmed.length < 20) {
-            return false;
-        }
-        return true;
-        // Anthropic API keys start with 'sk-ant-' and have a minimum length
-        // Format: sk-ant-api03-<base64-encoded-data>
-        if (!trimmed.startsWith('sk-ant-')) {
-            return false;
-        }
-        // Check for valid characters (alphanumeric, hyphens, underscores)
-        const validPattern = /^sk-ant-[a-zA-Z0-9_-]+$/;
-        return validPattern.test(trimmed);
-    }
-    /**
-     * Gets the storage method currently in use.
-     *
-     * @returns 'keychain' if using system keychain, 'file' if using encrypted file
-     */
-    getStorageMethod() {
-        return this.useKeytar ? 'keychain' : 'file';
-    }
-    /**
-     * Checks if the credential store has been initialized.
-     *
-     * @returns True if initialize() has been called
-     */
-    isInitialized() {
-        return this.initialized;
-    }
-    /**
-     * Ensures the store is initialized before operations.
-     */
-    async ensureInitialized() {
-        if (!this.initialized) {
-            await this.initialize();
-        }
-    }
-    /**
-     * Generates a machine-specific key for encryption.
-     * Uses a combination of machine identifiers to create a unique key.
-     */
-    async getMachineKey() {
-        if (this.machineKey) {
-            return this.machineKey;
-        }
-        // Combine multiple machine-specific values for key derivation
-        const components = [
-            os.hostname(),
-            os.platform(),
-            os.arch(),
-            os.userInfo().username,
-            // Add home directory for additional uniqueness
-            os.homedir(),
-        ];
-        // Create a hash of the combined components
-        const combined = components.join(':');
-        const hash = crypto.createHash('sha256').update(combined).digest('hex');
-        this.machineKey = hash;
-        return hash;
-    }
-    /**
-     * Saves credentials to an encrypted file.
-     */
-    async saveToFile(credentials) {
-        const key = await this.getMachineKey();
-        const dataString = JSON.stringify(credentials);
-        const encrypted = encrypt(dataString, key);
-        const encryptedCredentials = {
-            version: CREDENTIALS_VERSION,
-            data: encrypted,
-            updatedAt: new Date().toISOString(),
-        };
-        const globalDir = getGlobalCompassDir();
-        await ensureDir(globalDir);
-        const filePath = path.join(globalDir, CREDENTIALS_FILE_NAME);
-        await safeWriteFile(filePath, JSON.stringify(encryptedCredentials, null, 2));
-        logger.debug('Credentials saved to encrypted file');
-    }
-    /**
-     * Loads credentials from the encrypted file.
-     */
-    async loadFromFile() {
-        const filePath = path.join(getGlobalCompassDir(), CREDENTIALS_FILE_NAME);
-        if (!(await pathExists(filePath))) {
-            return null;
-        }
-        try {
-            const content = await safeReadFile(filePath);
-            if (!content) {
-                return null;
-            }
-            const encryptedCredentials = JSON.parse(content);
-            // Validate version
-            if (encryptedCredentials.version !== CREDENTIALS_VERSION) {
-                logger.warn(`Credentials file version mismatch: ${encryptedCredentials.version}`);
-                // For now, attempt to decrypt anyway; future versions may need migration
-            }
-            const key = await this.getMachineKey();
-            const decrypted = decrypt(encryptedCredentials.data, key);
-            const credentials = JSON.parse(decrypted);
-            return credentials;
-        }
-        catch (error) {
-            logger.error('Failed to load credentials from file', error);
-            return null;
-        }
-    }
-    /**
-     * Deletes the encrypted credentials file.
-     */
-    async deleteFile() {
-        const filePath = path.join(getGlobalCompassDir(), CREDENTIALS_FILE_NAME);
-        try {
-            if (await pathExists(filePath)) {
-                await remove(filePath);
-                logger.debug('Credentials file deleted');
-            }
-            return true;
-        }
-        catch (error) {
-            logger.error('Failed to delete credentials file', error);
-            return false;
-        }
-    }
-    /**
-     * Migrates credentials from file storage to keychain.
-     * Useful when keychain becomes available after initial setup.
-     *
-     * @returns True if migration was successful or not needed
-     */
-    async migrateToKeychain() {
-        if (!this.useKeytar) {
-            logger.debug('Keychain not available, migration skipped');
-            return false;
-        }
-        try {
-            const keytar = await loadKeytar();
-            if (!keytar) {
-                logger.debug('Keytar not available, migration skipped');
-                return false;
-            }
-            // Check if there are file-based credentials to migrate
-            const fileCredentials = await this.loadFromFile();
-            if (!fileCredentials?.anthropicApiKey) {
-                logger.debug('No file-based credentials to migrate');
-                return true;
-            }
-            // Check if keychain already has the key
-            const keychainKey = await keytar.getPassword(SERVICE_NAME, ANTHROPIC_API_KEY_ACCOUNT);
-            if (keychainKey) {
-                logger.debug('Keychain already has credentials, skipping migration');
-                return true;
-            }
-            // Migrate to keychain
-            await keytar.setPassword(SERVICE_NAME, ANTHROPIC_API_KEY_ACCOUNT, fileCredentials.anthropicApiKey);
-            // Delete file-based storage after successful migration
-            await this.deleteFile();
-            logger.debug('Credentials migrated from file to system keychain');
-            return true;
-        }
-        catch (error) {
-            logger.error('Failed to migrate credentials to keychain', error);
-            return false;
-        }
-    }
-    /**
-     * Clears all stored credentials from all storage locations.
-     * Use with caution - this is irreversible.
-     */
-    async clearAll() {
-        await this.ensureInitialized();
-        // Clear keychain
-        if (this.useKeytar) {
-            try {
-                const keytar = await loadKeytar();
-                if (keytar) {
-                    await keytar.deletePassword(SERVICE_NAME, ANTHROPIC_API_KEY_ACCOUNT);
-                    await keytar.deletePassword(SERVICE_NAME, COMPASS_API_KEY_ACCOUNT);
-                    // Clear all provider-specific keys
-                    for (const provider of PROVIDERS) {
-                        await keytar.deletePassword(SERVICE_NAME, PROVIDER_KEYCHAIN_ACCOUNTS[provider]);
-                    }
-                }
-            }
-            catch (error) {
-                logger.debug('Failed to clear keychain', error);
-            }
-        }
-        // Clear file storage
-        await this.deleteFile();
-        logger.debug('All credentials cleared');
-    }
-}
-// Singleton instance
-let credentialStoreInstance = null;
-/**
- * Gets the singleton CredentialStore instance.
- * Initializes the instance on first call.
- *
- * @returns Promise resolving to the initialized CredentialStore instance
- *
- * @example
- * ```typescript
- * const store = await getCredentialStore();
- * const apiKey = await store.getApiKey();
- * ```
- */
-export async function getCredentialStore() {
-    if (!credentialStoreInstance) {
-        credentialStoreInstance = new CredentialStore();
-        await credentialStoreInstance.initialize();
-    }
-    return credentialStoreInstance;
-}
-/**
- * Creates a new CredentialStore instance.
- * Use this when you need a separate instance from the singleton.
- *
- * Note: You must call initialize() on the returned instance before use.
- *
- * @returns A new CredentialStore instance (not initialized)
- */
-export function createCredentialStore() {
-    return new CredentialStore();
-}
-export { CredentialStore };
-//# sourceMappingURL=credential-store.js.map