@dsh-enhanced/credentials-keychain 0.1.3

package/lib/providers.js

@@ -0,0 +1,126 @@
+import { spawn } from 'node:child_process';
+export class CredentialProviderError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'CredentialProviderError';
+    }
+}
+function minimalLinuxEnv(env) {
+    return {
+        PATH: '/usr/bin:/bin',
+        ...(env.DBUS_SESSION_BUS_ADDRESS === undefined ? {} : { DBUS_SESSION_BUS_ADDRESS: env.DBUS_SESSION_BUS_ADDRESS }),
+        ...(env.XDG_RUNTIME_DIR === undefined ? {} : { XDG_RUNTIME_DIR: env.XDG_RUNTIME_DIR }),
+    };
+}
+function normalizeSecret(value, maxSecretBytes) {
+    const bytes = Buffer.isBuffer(value) ? value : Buffer.from(value);
+    if (bytes.byteLength > maxSecretBytes)
+        throw new CredentialProviderError('oversize', 'credential provider output is too large');
+    const text = bytes.toString('utf8').replace(/[\r\n]+$/u, '');
+    if (text.length === 0)
+        throw new CredentialProviderError('not-found', 'credential value is missing');
+    if (text.includes('\0'))
+        throw new CredentialProviderError('invalid-value', 'credential value contains an invalid byte');
+    return text;
+}
+const windowsPowerShell = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+const windowsReadCommand = '$credential = Import-Clixml -LiteralPath $args[0]; [Console]::Out.Write($credential.GetNetworkCredential().Password)';
+export async function readCredential(handle, options) {
+    if (handle.provider === 'environment') {
+        const value = options.env[handle.environmentName];
+        if (value === undefined)
+            throw new CredentialProviderError('not-found', 'credential value is missing');
+        return normalizeSecret(value, options.maxSecretBytes);
+    }
+    let command;
+    if (handle.provider === 'macos-keychain') {
+        command = {
+            executable: '/usr/bin/security',
+            args: ['find-generic-password', '-w', '-s', handle.service, '-a', handle.account],
+            env: { PATH: '/usr/bin:/bin' },
+            timeoutMs: options.timeoutMs,
+            maxOutputBytes: options.maxSecretBytes + 1,
+        };
+    }
+    else if (handle.provider === 'linux-secret-service') {
+        command = {
+            executable: '/usr/bin/secret-tool',
+            args: ['lookup', 'service', handle.service, 'account', handle.account],
+            env: minimalLinuxEnv(options.env),
+            timeoutMs: options.timeoutMs,
+            maxOutputBytes: options.maxSecretBytes + 1,
+        };
+    }
+    else if (handle.provider === 'windows-dpapi') {
+        command = {
+            executable: windowsPowerShell,
+            args: ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', windowsReadCommand, handle.path],
+            env: { PATH: 'C:\\Windows\\System32;C:\\Windows', SystemRoot: 'C:\\Windows' },
+            timeoutMs: options.timeoutMs,
+            maxOutputBytes: options.maxSecretBytes + 1,
+        };
+    }
+    else {
+        throw new CredentialProviderError('provider-failed', 'credential provider is unsupported');
+    }
+    let result;
+    try {
+        result = await options.run(command);
+    }
+    catch (error) {
+        if (error instanceof CredentialProviderError)
+            throw error;
+        throw new CredentialProviderError('provider-failed', 'credential provider execution failed');
+    }
+    if (result.stdout.byteLength > options.maxSecretBytes) {
+        throw new CredentialProviderError('oversize', 'credential provider output is too large');
+    }
+    if (result.code !== 0)
+        throw new CredentialProviderError('provider-failed', 'credential provider returned an error');
+    return normalizeSecret(result.stdout, options.maxSecretBytes);
+}
+export const runCredentialCommand = input => new Promise((resolve, reject) => {
+    const child = spawn(input.executable, [...input.args], {
+        env: { ...input.env },
+        shell: false,
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const stdout = [];
+    const stderr = [];
+    let total = 0;
+    let settled = false;
+    let timer;
+    const finish = (callback) => {
+        if (settled)
+            return;
+        settled = true;
+        if (timer !== undefined)
+            clearTimeout(timer);
+        callback();
+    };
+    const append = (target, chunk) => {
+        total += chunk.byteLength;
+        if (total > input.maxOutputBytes) {
+            child.kill('SIGKILL');
+            finish(() => reject(new CredentialProviderError('oversize', 'credential provider output is too large')));
+            return;
+        }
+        target.push(Buffer.from(chunk));
+    };
+    child.stdout.on('data', (chunk) => append(stdout, chunk));
+    child.stderr.on('data', (chunk) => append(stderr, chunk));
+    child.once('error', () => finish(() => reject(new CredentialProviderError('provider-failed', 'credential provider execution failed'))));
+    child.once('close', code => finish(() => resolve({
+        code: code ?? -1,
+        stdout: Buffer.concat(stdout),
+        stderr: Buffer.concat(stderr),
+    })));
+    timer = setTimeout(() => {
+        child.kill('SIGKILL');
+        finish(() => reject(new CredentialProviderError('timeout', 'credential provider timed out')));
+    }, input.timeoutMs);
+    timer.unref?.();
+});
+//# sourceMappingURL=providers.js.map

package/lib/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../src/providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAS1C,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC3B;IAArB,YAAqB,IAAiC,EAAE,OAAe;QACrE,KAAK,CAAC,OAAO,CAAC,CAAA;QADK,SAAI,GAAJ,IAAI,CAA6B;QAEpD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AASD,SAAS,eAAe,CAAC,GAAiD;IACxE,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,GAAG,CAAC,GAAG,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,GAAG,CAAC,wBAAwB,EAAE,CAAC;QACjH,GAAG,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC;KACvF,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB,EAAE,cAAsB;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjE,IAAI,KAAK,CAAC,UAAU,GAAG,cAAc;QAAE,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,yCAAyC,CAAC,CAAA;IAC/H,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAA;IACpG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAA;IACxH,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,iBAAiB,GAAG,gEAAgE,CAAA;AAC1F,MAAM,kBAAkB,GAAG,sHAAsH,CAAA;AAEjJ,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAwB,EAAE,OAA8B;IAC3F,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAA;QACtG,OAAO,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,OAA+B,CAAA;IACnC,IAAI,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACzC,OAAO,GAAG;YACN,UAAU,EAAE,mBAAmB;YAC/B,IAAI,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC;YACjF,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc,GAAG,CAAC;SAC3C,CAAA;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACtD,OAAO,GAAG;YACN,UAAU,EAAE,sBAAsB;YAClC,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;YACtE,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC;YACjC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc,GAAG,CAAC;SAC3C,CAAA;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QAC/C,OAAO,GAAG;YACR,UAAU,EAAE,iBAAiB;YAC7B,IAAI,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC;YAC/F,GAAG,EAAE,EAAE,IAAI,EAAE,mCAAmC,EAAE,UAAU,EAAE,aAAa,EAAE;YAC7E,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc,GAAG,CAAC;SAC3C,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,MAA+B,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAA;QACzD,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,yCAAyC,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,uCAAuC,CAAC,CAAA;IACpH,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAA4B,KAAK,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IACpG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE;QACrD,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE;QACrB,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAA;IACF,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,KAAgD,CAAA;IACpD,MAAM,MAAM,GAAG,CAAC,QAAoB,EAAE,EAAE;QACtC,IAAI,OAAO;YAAE,OAAM;QACnB,OAAO,GAAG,IAAI,CAAA;QACd,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAC5C,QAAQ,EAAE,CAAA;IACZ,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,CAAC,MAAgB,EAAE,KAAa,EAAE,EAAE;QACjD,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;QACzB,IAAI,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACrB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,UAAU,EAAE,yCAAyC,CAAC,CAAC,CAAC,CAAA;YACxG,OAAM;QACR,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACjC,CAAC,CAAA;IACD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IACjE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAC3C,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CACvF,CAAC,CAAC,CAAA;IACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;QAC/C,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KAC9B,CAAC,CAAC,CAAC,CAAA;IACJ,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QACtB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC,CAAC,CAAA;IAC/F,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;IACnB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/lib/service.d.ts

@@ -0,0 +1,65 @@
+import { Context, Service } from '@deepseek-ai/cordis';
+import { Config } from './config.js';
+import type { CredentialCommandRunner, CredentialHandle, CredentialLeaseMetadata, CredentialLeaseRequest, CredentialLeaseStatus } from './types.js';
+export type CredentialsKeychainErrorCode = 'consumer-denied' | 'disposed' | 'handle-not-found' | 'invalid-ttl' | 'lease-replayed' | 'policy-denied' | 'purpose-denied';
+export declare class CredentialsKeychainError extends Error {
+    readonly code: CredentialsKeychainErrorCode;
+    constructor(code: CredentialsKeychainErrorCode, message: string);
+}
+export type CredentialLeaseAbortCode = 'disposed' | 'expired' | 'revoked';
+export declare class CredentialLeaseAbortError extends Error {
+    readonly code: CredentialLeaseAbortCode;
+    constructor(code: CredentialLeaseAbortCode, message: string);
+}
+export interface CredentialsKeychainServiceOptions {
+    env?: Readonly<Record<string, string | undefined>>;
+    run?: CredentialCommandRunner;
+    now?: () => number;
+}
+export interface CredentialCallbackLease {
+    readonly id: string;
+    readonly handleId: string;
+    readonly consumer: string;
+    readonly purpose: string;
+    readonly expiresAt: number;
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        credentialsKeychain: CredentialsKeychainService;
+    }
+}
+export declare class CredentialsKeychainService extends Service {
+    static Config: import("@deepseek-ai/schemastery").default<Config>;
+    private readonly ledger;
+    private readonly policy;
+    private readonly handles;
+    private readonly env;
+    private readonly run;
+    private readonly defaultLeaseMs;
+    private readonly maxSecretBytes;
+    private readonly providerTimeoutMs;
+    private readonly controllers;
+    private readonly operations;
+    private active;
+    constructor(ctx: Context, input: import('./config.js').Config, options?: CredentialsKeychainServiceOptions);
+    withSecret<T>(caller: Context, request: CredentialLeaseRequest, callback: (value: string, signal: AbortSignal, lease: CredentialCallbackLease) => Promise<T>): Promise<T>;
+    revoke(input: {
+        operatorId: string;
+        leaseId: string;
+        expectedVersion: number;
+        reason: string;
+    }): CredentialLeaseMetadata;
+    listLeases(input?: {
+        status?: CredentialLeaseStatus;
+        limit?: number;
+    }): CredentialLeaseMetadata[];
+    listHandles(): Array<Pick<CredentialHandle, 'consumers' | 'id' | 'maxLeaseMs' | 'provider' | 'purposes'>>;
+    health(): {
+        handles: number;
+        activeLeases: number;
+        failedLeases: number;
+    };
+    private execute;
+    private assertActive;
+}
+//# sourceMappingURL=service.d.ts.map

package/lib/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGpC,OAAO,KAAK,EACV,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,EAEvB,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,YAAY,CAAA;AAEnB,MAAM,MAAM,4BAA4B,GACpC,iBAAiB,GACjB,UAAU,GACV,kBAAkB,GAClB,aAAa,GACb,gBAAgB,GAChB,eAAe,GACf,gBAAgB,CAAA;AAEpB,qBAAa,wBAAyB,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,4BAA4B;gBAAlC,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,MAAM;CAIzE;AAED,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAA;AAEzE,qBAAa,yBAA0B,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,wBAAwB;gBAA9B,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,MAAM;CAIrE;AAED,MAAM,WAAW,iCAAiC;IAChD,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAClD,GAAG,CAAC,EAAE,uBAAuB,CAAA;IAC7B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAiBD,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,mBAAmB,EAAE,0BAA0B,CAAA;KAChD;CACF;AAED,qBAAa,0BAA2B,SAAQ,OAAO;IACrD,MAAM,CAAC,MAAM,qDAAS;IAEtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA8C;IAClE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAyB;IAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqC;IACjE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,MAAM,CAAO;gBAET,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,MAAM,EAAE,OAAO,GAAE,iCAAsC;IA4B9G,UAAU,CAAC,CAAC,EACV,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3F,OAAO,CAAC,CAAC,CAAC;IAQb,MAAM,CAAC,KAAK,EAAE;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,CAAA;QACf,eAAe,EAAE,MAAM,CAAA;QACvB,MAAM,EAAE,MAAM,CAAA;KACf,GAAG,uBAAuB;IAkB3B,UAAU,CAAC,KAAK,GAAE;QAAE,MAAM,CAAC,EAAE,qBAAqB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,uBAAuB,EAAE;IAKrG,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,IAAI,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,CAAC,CAAC;IAWzG,MAAM,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE;YAS3D,OAAO;IAuErB,OAAO,CAAC,YAAY;CAGrB"}

package/lib/service.js

@@ -0,0 +1,199 @@
+import { isAbsolute } from 'node:path';
+import { Context, Service } from '@deepseek-ai/cordis';
+import { Config } from './config.js';
+import { CredentialLedger } from './ledger.js';
+import { CredentialProviderError, readCredential, runCredentialCommand } from './providers.js';
+export class CredentialsKeychainError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'CredentialsKeychainError';
+    }
+}
+export class CredentialLeaseAbortError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'CredentialLeaseAbortError';
+    }
+}
+function leaseMetadata(record) {
+    return {
+        id: record.id,
+        handleId: record.handleId,
+        consumer: record.consumer,
+        purpose: record.purpose,
+        status: record.status,
+        issuedAt: record.issuedAt,
+        expiresAt: record.expiresAt,
+        ...(record.settledAt === undefined ? {} : { settledAt: record.settledAt }),
+        ...(record.failureCode === undefined ? {} : { failureCode: record.failureCode }),
+        version: record.version,
+    };
+}
+export class CredentialsKeychainService extends Service {
+    static Config = Config;
+    ledger;
+    policy;
+    handles;
+    env;
+    run;
+    defaultLeaseMs;
+    maxSecretBytes;
+    providerTimeoutMs;
+    controllers = new Map();
+    operations = new Set();
+    active = true;
+    constructor(ctx, input, options = {}) {
+        super(ctx, 'credentialsKeychain');
+        const policy = ctx.get('assistantPolicy');
+        if (policy === undefined)
+            throw new Error('credentials-keychain: assistantPolicy service is required');
+        const config = Config(input);
+        if (!isAbsolute(config.databasePath))
+            throw new Error('credentials-keychain: databasePath must be absolute');
+        this.policy = policy;
+        this.handles = new Map(config.handles.map(handle => [handle.id, Object.freeze(handle)]));
+        this.env = options.env ?? process.env;
+        this.run = options.run ?? runCredentialCommand;
+        this.defaultLeaseMs = config.defaultLeaseMs;
+        this.maxSecretBytes = config.maxSecretBytes;
+        this.providerTimeoutMs = config.providerTimeoutMs;
+        this.ledger = new CredentialLedger({ path: config.databasePath, ...(options.now === undefined ? {} : { now: options.now }) });
+        ctx.effect(() => async () => {
+            this.active = false;
+            for (const [leaseId, controller] of this.controllers) {
+                const current = this.ledger.get(leaseId);
+                if (current?.status === 'active') {
+                    this.ledger.settle({ leaseId, expectedVersion: current.version, status: 'failed', failureCode: 'service-disposed' });
+                }
+                controller.abort(new CredentialLeaseAbortError('disposed', 'credentials-keychain disposed'));
+            }
+            await Promise.allSettled(this.operations);
+            this.ledger.close();
+        }, 'credentials-keychain.ledger');
+    }
+    withSecret(caller, request, callback) {
+        this.assertActive();
+        const operation = this.execute(caller, request, callback);
+        this.operations.add(operation);
+        void operation.finally(() => this.operations.delete(operation)).catch(() => { });
+        return operation;
+    }
+    revoke(input) {
+        this.assertActive();
+        const current = this.ledger.get(input.leaseId);
+        if (current === undefined)
+            throw new Error('credentials-keychain: lease does not exist');
+        const decision = this.policy.authorize({
+            subject: { kind: 'external', id: `local:${input.operatorId}` },
+            action: 'credential.revoke',
+            resource: { kind: 'credential', id: current.handleId },
+            context: { initiator: 'foreground' },
+        }, { idempotencyKey: `credential-revoke:${input.leaseId}:${input.expectedVersion}` });
+        if (decision.effect !== 'allow')
+            throw new CredentialsKeychainError('policy-denied', `credentials-keychain: policy denied revocation: ${decision.reasonCode}`);
+        const revoked = this.ledger.revoke({ leaseId: input.leaseId, expectedVersion: input.expectedVersion,
+            actor: `local:${input.operatorId}`, reason: input.reason });
+        this.controllers.get(input.leaseId)?.abort(new CredentialLeaseAbortError('revoked', 'credential lease revoked'));
+        return leaseMetadata(revoked);
+    }
+    listLeases(input = {}) {
+        this.assertActive();
+        return this.ledger.list(input).map(leaseMetadata);
+    }
+    listHandles() {
+        this.assertActive();
+        return [...this.handles.values()].map(handle => ({
+            id: handle.id,
+            provider: handle.provider,
+            consumers: [...handle.consumers],
+            purposes: [...handle.purposes],
+            maxLeaseMs: handle.maxLeaseMs,
+        }));
+    }
+    health() {
+        this.assertActive();
+        return {
+            handles: this.handles.size,
+            activeLeases: this.ledger.list({ status: 'active', limit: 1_000 }).length,
+            failedLeases: this.ledger.list({ status: 'failed', limit: 1_000 }).length,
+        };
+    }
+    async execute(caller, request, callback) {
+        const consumer = caller.fiber.name;
+        const handle = this.handles.get(request.handleId);
+        if (handle === undefined)
+            throw new CredentialsKeychainError('handle-not-found', 'credential handle does not exist');
+        if (!handle.consumers.includes(consumer)) {
+            throw new CredentialsKeychainError('consumer-denied', 'caller is not allowlisted for this credential handle');
+        }
+        if (!handle.purposes.includes(request.purpose)) {
+            throw new CredentialsKeychainError('purpose-denied', 'purpose is not allowlisted for this credential handle');
+        }
+        const ttlMs = request.ttlMs ?? Math.min(this.defaultLeaseMs, handle.maxLeaseMs);
+        if (!Number.isSafeInteger(ttlMs) || ttlMs < 1_000 || ttlMs > handle.maxLeaseMs) {
+            throw new CredentialsKeychainError('invalid-ttl', 'credential lease TTL exceeds the handle limit');
+        }
+        const decision = this.policy.authorize({
+            subject: { kind: 'background', id: consumer },
+            action: 'credential.use',
+            resource: { kind: 'credential', id: handle.id },
+            context: { initiator: 'background' },
+        }, { idempotencyKey: `credential-use:${request.idempotencyKey}` });
+        if (decision.effect !== 'allow')
+            throw new CredentialsKeychainError('policy-denied', `credentials-keychain: policy denied use: ${decision.reasonCode}`);
+        const begun = this.ledger.begin({ handleId: handle.id, consumer, purpose: request.purpose,
+            idempotencyKey: request.idempotencyKey, ttlMs });
+        if (begun.replayed)
+            throw new CredentialsKeychainError('lease-replayed', `credential lease request was already ${begun.record.status}`);
+        const controller = new AbortController();
+        this.controllers.set(begun.record.id, controller);
+        const timer = setTimeout(() => {
+            const current = this.ledger.get(begun.record.id);
+            if (current?.status === 'active') {
+                this.ledger.settle({ leaseId: current.id, expectedVersion: current.version,
+                    status: 'expired', failureCode: 'lease-expired' });
+            }
+            controller.abort(new CredentialLeaseAbortError('expired', 'credential lease expired'));
+        }, ttlMs);
+        timer.unref?.();
+        try {
+            const value = await readCredential(handle, { env: this.env, run: this.run,
+                timeoutMs: this.providerTimeoutMs, maxSecretBytes: this.maxSecretBytes });
+            const result = await callback(value, controller.signal, {
+                id: begun.record.id, handleId: handle.id, consumer, purpose: request.purpose,
+                expiresAt: begun.record.expiresAt,
+            });
+            const current = this.ledger.get(begun.record.id);
+            if (current?.status === 'active') {
+                this.ledger.settle({ leaseId: current.id, expectedVersion: current.version,
+                    status: controller.signal.aborted ? 'expired' : 'completed',
+                    ...(controller.signal.aborted ? { failureCode: 'lease-expired' } : {}) });
+            }
+            return result;
+        }
+        catch (error) {
+            const current = this.ledger.get(begun.record.id);
+            if (current?.status === 'active') {
+                this.ledger.settle({ leaseId: current.id, expectedVersion: current.version,
+                    status: controller.signal.aborted ? 'expired' : 'failed',
+                    failureCode: controller.signal.aborted
+                        ? 'lease-expired'
+                        : error instanceof CredentialProviderError ? error.code : 'callback-failed' });
+            }
+            throw error;
+        }
+        finally {
+            clearTimeout(timer);
+            this.controllers.delete(begun.record.id);
+        }
+    }
+    assertActive() {
+        if (!this.active)
+            throw new CredentialsKeychainError('disposed', 'credentials-keychain service is disposed');
+    }
+}
+//# sourceMappingURL=service.js.map

package/lib/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAmB9F,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC5B;IAArB,YAAqB,IAAkC,EAAE,OAAe;QACtE,KAAK,CAAC,OAAO,CAAC,CAAA;QADK,SAAI,GAAJ,IAAI,CAA8B;QAErD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAID,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAC7B;IAArB,YAAqB,IAA8B,EAAE,OAAe;QAClE,KAAK,CAAC,OAAO,CAAC,CAAA;QADK,SAAI,GAAJ,IAAI,CAA0B;QAEjD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAgBD,SAAS,aAAa,CAAC,MAA6B;IAClD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAChF,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAA;AACH,CAAC;AAQD,MAAM,OAAO,0BAA2B,SAAQ,OAAO;IACrD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;IAEL,MAAM,CAAkB;IACxB,MAAM,CAAwB;IAC9B,OAAO,CAAuC;IAC9C,GAAG,CAA8C;IACjD,GAAG,CAAyB;IAC5B,cAAc,CAAQ;IACtB,cAAc,CAAQ;IACtB,iBAAiB,CAAQ;IACzB,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAA;IAChD,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAA;IACjD,MAAM,GAAG,IAAI,CAAA;IAErB,YAAY,GAAY,EAAE,KAAmC,EAAE,UAA6C,EAAE;QAC5G,KAAK,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAA;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAuC,CAAA;QAC/E,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QACtG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAA2C,CAAA;QACtE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QAC5G,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QACxF,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,oBAAoB,CAAA;QAC9C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAA;QAC3C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAA;QAC3C,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAA;QACjD,IAAI,CAAC,MAAM,GAAG,IAAI,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7H,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;YACnB,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBACxC,IAAI,OAAO,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACjC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBACtH,CAAC;gBACD,UAAU,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAC,CAAA;YAC9F,CAAC;YACD,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACzC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACrB,CAAC,EAAE,6BAA6B,CAAC,CAAA;IACnC,CAAC;IAED,UAAU,CACR,MAAe,EACf,OAA+B,EAC/B,QAA4F;QAE5F,IAAI,CAAC,YAAY,EAAE,CAAA;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;QACzD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9B,KAAK,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC/E,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,CAAC,KAKN;QACC,IAAI,CAAC,YAAY,EAAE,CAAA;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9C,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,KAAK,CAAC,UAAU,EAAE,EAAE;YAC9D,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE;YACtD,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE;SACrC,EAAE,EAAE,cAAc,EAAE,qBAAqB,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;QACrF,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO;YAAE,MAAM,IAAI,wBAAwB,CAAC,eAAe,EACjF,mDAAmD,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe;YACjG,KAAK,EAAE,SAAS,KAAK,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;QAC7D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,yBAAyB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC,CAAA;QAChH,OAAO,aAAa,CAAC,OAAO,CAAC,CAAA;IAC/B,CAAC;IAED,UAAU,CAAC,QAA4D,EAAE;QACvE,IAAI,CAAC,YAAY,EAAE,CAAA;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACnD,CAAC;IAED,WAAW;QACT,IAAI,CAAC,YAAY,EAAE,CAAA;QACnB,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/C,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;YAChC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC,CAAA;IACL,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,YAAY,EAAE,CAAA;QACnB,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC1B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM;YACzE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM;SAC1E,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAe,EACf,OAA+B,EAC/B,QAA4F;QAE5F,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAA;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QACjD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,wBAAwB,CAAC,kBAAkB,EAAE,kCAAkC,CAAC,CAAA;QACpH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,wBAAwB,CAAC,iBAAiB,EAAE,sDAAsD,CAAC,CAAA;QAC/G,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,wBAAwB,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAA;QAC/G,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;QAC/E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,IAAI,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAC/E,MAAM,IAAI,wBAAwB,CAAC,aAAa,EAAE,+CAA+C,CAAC,CAAA;QACpG,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE;YAC7C,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;YAC/C,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE;SACrC,EAAE,EAAE,cAAc,EAAE,kBAAkB,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;QAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO;YAAE,MAAM,IAAI,wBAAwB,CAAC,eAAe,EACjF,4CAA4C,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;YACvF,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;QAClD,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,wBAAwB,CAAC,gBAAgB,EACrE,wCAAwC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QAChE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChD,IAAI,OAAO,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO;oBACxE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAA;YACtD,CAAC;YACD,UAAU,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC,CAAA;QACxF,CAAC,EAAE,KAAK,CAAC,CAAA;QACT,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;QACf,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG;gBACvE,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAA;YAC3E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE;gBACtD,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;gBAC5E,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;aAClC,CAAC,CAAA;YACF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChD,IAAI,OAAO,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO;oBACxE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;oBAC3D,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YAC7E,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChD,IAAI,OAAO,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO;oBACxE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;oBACxD,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO;wBACpC,CAAC,CAAC,eAAe;wBACjB,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAA;YACpF,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC1C,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,wBAAwB,CAAC,UAAU,EAAE,0CAA0C,CAAC,CAAA;IAC9G,CAAC"}

package/lib/sqlite.d.ts

@@ -0,0 +1,8 @@
+import { DatabaseSync } from 'node:sqlite';
+export declare const credentialSchemaVersion = 1;
+export declare class CredentialDatabaseError extends Error {
+    readonly code: 'invalid-path' | 'schema-too-new';
+    constructor(code: 'invalid-path' | 'schema-too-new', message: string);
+}
+export declare function openCredentialDatabase(path: string): DatabaseSync;
+//# sourceMappingURL=sqlite.d.ts.map

package/lib/sqlite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../src/sqlite.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,eAAO,MAAM,uBAAuB,IAAI,CAAA;AAExC,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,gBAAgB;gBAAvC,IAAI,EAAE,cAAc,GAAG,gBAAgB,EAAE,OAAO,EAAE,MAAM;CAI9E;AA2CD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAkBjE"}

package/lib/sqlite.js

@@ -0,0 +1,76 @@
+import { chmodSync, mkdirSync } from 'node:fs';
+import { dirname, isAbsolute } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+export const credentialSchemaVersion = 1;
+export class CredentialDatabaseError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'CredentialDatabaseError';
+    }
+}
+function migrate(database) {
+    const current = database.prepare('PRAGMA user_version').get();
+    if (current.user_version > credentialSchemaVersion) {
+        throw new CredentialDatabaseError('schema-too-new', `credential schema ${current.user_version} is newer than supported schema ${credentialSchemaVersion}`);
+    }
+    if (current.user_version === credentialSchemaVersion)
+        return;
+    database.exec(`
+    BEGIN IMMEDIATE;
+    CREATE TABLE credential_leases (
+      id TEXT PRIMARY KEY,
+      idempotency_key TEXT NOT NULL UNIQUE,
+      handle_id TEXT NOT NULL,
+      consumer TEXT NOT NULL,
+      purpose TEXT NOT NULL,
+      status TEXT NOT NULL CHECK (status IN ('active', 'completed', 'expired', 'failed', 'revoked')),
+      issued_at INTEGER NOT NULL,
+      expires_at INTEGER NOT NULL,
+      settled_at INTEGER,
+      failure_code TEXT,
+      version INTEGER NOT NULL DEFAULT 1
+    ) STRICT;
+    CREATE INDEX credential_leases_status_expiry ON credential_leases(status, expires_at);
+    CREATE TABLE credential_audit (
+      sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+      occurred_at INTEGER NOT NULL,
+      action TEXT NOT NULL,
+      lease_id TEXT NOT NULL,
+      handle_id TEXT NOT NULL,
+      consumer TEXT NOT NULL,
+      purpose TEXT NOT NULL,
+      outcome TEXT NOT NULL,
+      failure_code TEXT,
+      actor TEXT,
+      reason TEXT
+    ) STRICT;
+    PRAGMA user_version = 1;
+    COMMIT;
+  `);
+}
+export function openCredentialDatabase(path) {
+    if (path !== ':memory:' && !isAbsolute(path)) {
+        throw new CredentialDatabaseError('invalid-path', 'credential database path must be absolute');
+    }
+    if (path !== ':memory:')
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const database = new DatabaseSync(path);
+    try {
+        database.exec('PRAGMA foreign_keys = ON');
+        database.exec('PRAGMA busy_timeout = 5000');
+        database.exec('PRAGMA synchronous = FULL');
+        if (path !== ':memory:')
+            database.exec('PRAGMA journal_mode = WAL');
+        migrate(database);
+        if (path !== ':memory:')
+            chmodSync(path, 0o600);
+        return database;
+    }
+    catch (error) {
+        database.close();
+        throw error;
+    }
+}
+//# sourceMappingURL=sqlite.js.map

package/lib/sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../src/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAExC,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC3B;IAArB,YAAqB,IAAuC,EAAE,OAAe;QAC3E,KAAK,CAAC,OAAO,CAAC,CAAA;QADK,SAAI,GAAJ,IAAI,CAAmC;QAE1D,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAED,SAAS,OAAO,CAAC,QAAsB;IACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA8B,CAAA;IACzF,IAAI,OAAO,CAAC,YAAY,GAAG,uBAAuB,EAAE,CAAC;QACnD,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,EAChD,qBAAqB,OAAO,CAAC,YAAY,mCAAmC,uBAAuB,EAAE,CAAC,CAAA;IAC1G,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,uBAAuB;QAAE,OAAM;IAC5D,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+Bb,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,uBAAuB,CAAC,cAAc,EAAE,2CAA2C,CAAC,CAAA;IAChG,CAAC;IACD,IAAI,IAAI,KAAK,UAAU;QAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACnF,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QACzC,QAAQ,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;QAC3C,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QAC1C,IAAI,IAAI,KAAK,UAAU;YAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QACnE,OAAO,CAAC,QAAQ,CAAC,CAAA;QACjB,IAAI,IAAI,KAAK,UAAU;YAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC/C,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,KAAK,EAAE,CAAA;QAChB,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}

package/lib/types.d.ts

@@ -0,0 +1,57 @@
+export interface CredentialHandleBase {
+    id: string;
+    consumers: readonly string[];
+    purposes: readonly string[];
+    maxLeaseMs: number;
+}
+export interface EnvironmentCredentialHandle extends CredentialHandleBase {
+    provider: 'environment';
+    environmentName: string;
+}
+export interface KeychainCredentialHandle extends CredentialHandleBase {
+    provider: 'linux-secret-service' | 'macos-keychain';
+    service: string;
+    account: string;
+}
+export interface WindowsDpapiCredentialHandle extends CredentialHandleBase {
+    provider: 'windows-dpapi';
+    /** Absolute path to a per-user DPAPI-encrypted PSCredential export. */
+    path: string;
+}
+export type CredentialHandle = EnvironmentCredentialHandle | KeychainCredentialHandle | WindowsDpapiCredentialHandle;
+export interface CredentialCommandInput {
+    executable: string;
+    args: readonly string[];
+    env: Readonly<Record<string, string>>;
+    timeoutMs: number;
+    maxOutputBytes: number;
+}
+export interface CredentialCommandResult {
+    code: number;
+    stdout: Buffer;
+    stderr: Buffer;
+}
+export type CredentialCommandRunner = (input: CredentialCommandInput) => Promise<CredentialCommandResult>;
+export type CredentialProviderErrorCode = 'invalid-value' | 'not-found' | 'oversize' | 'provider-failed' | 'timeout';
+export interface CredentialLeaseRequest {
+    handleId: string;
+    purpose: string;
+    ttlMs?: number;
+    idempotencyKey: string;
+}
+export type CredentialLeaseStatus = 'active' | 'completed' | 'expired' | 'failed' | 'revoked';
+export interface CredentialLeaseRecord {
+    id: string;
+    handleId: string;
+    consumer: string;
+    purpose: string;
+    idempotencyKey: string;
+    status: CredentialLeaseStatus;
+    issuedAt: number;
+    expiresAt: number;
+    settledAt?: number;
+    failureCode?: string;
+    version: number;
+}
+export type CredentialLeaseMetadata = Omit<CredentialLeaseRecord, 'idempotencyKey'>;
+//# sourceMappingURL=types.d.ts.map

package/lib/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,QAAQ,EAAE,aAAa,CAAA;IACvB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,QAAQ,EAAE,sBAAsB,GAAG,gBAAgB,CAAA;IACnD,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,4BAA6B,SAAQ,oBAAoB;IACxE,QAAQ,EAAE,eAAe,CAAA;IACzB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,MAAM,gBAAgB,GAAG,2BAA2B,GAAG,wBAAwB,GAAG,4BAA4B,CAAA;AAEpH,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAA;AAEzG,MAAM,MAAM,2BAA2B,GAAG,eAAe,GAAG,WAAW,GAAG,UAAU,GAAG,iBAAiB,GAAG,SAAS,CAAA;AAEpH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAA;AAE7F,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,qBAAqB,CAAA;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAA"}

package/lib/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/lib/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/lib/version.d.ts

@@ -0,0 +1,2 @@
+export declare const version = "0.1.3";
+//# sourceMappingURL=version.d.ts.map

package/lib/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,UAAU,CAAA"}

package/lib/version.js

@@ -0,0 +1,2 @@
+export const version = '0.1.3';
+//# sourceMappingURL=version.js.map

package/lib/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAA"}