@executioncontrolprotocol/secrets 0.10.0

package/README.md

@@ -0,0 +1,25 @@
+# @executioncontrolprotocol/secrets
+
+OS secrets extension for ECP. Resolves `secrets("key")` / `{ "$secret": "key" }` environment bindings via the OS keychain (Windows Credential Manager, macOS Keychain, Linux where supported).
+
+## Usage
+
+```ts
+import "@executioncontrolprotocol/secrets"
+import { environment, extension, secrets } from "@executioncontrolprotocol/node"
+
+const env = (await environment("demo")).withExtensions([
+  extension("@executioncontrolprotocol/secrets").with({}),
+  extension("@executioncontrolprotocol/openai").with({
+    apiKey: secrets("openai/api-key"),
+  }),
+])
+```
+
+## CLI
+
+Use `ecp config secrets add KEY` (interactive paste) or `ecp config secrets add KEY --value …` for non-interactive input. `get KEY`, `list`, and `remove KEY` manage stored keys.
+
+## Tests
+
+Unit tests use `setSecretsStore(memorySecretsStore)` to avoid touching the real keychain.

package/dist/constants.d.ts

@@ -0,0 +1,21 @@
+/**
+ * URI scheme prefix for OS keyring targets and default ref ids.
+ * @category Secrets
+ */
+export declare const ECP_SECRET_REF_PROTOCOL_PREFIX = "ecp://";
+/**
+ * Windows `CredEnumerateW` filter for `ecp://` targets.
+ * @category Secrets
+ */
+export declare const ECP_SECRET_REF_WIN32_ENUM_FILTER = "ecp://*";
+/**
+ * Service name for OS credential stores.
+ * @category Secrets
+ */
+export declare const ECP_KEYRING_SERVICE = "ecp";
+/**
+ * Legacy dotted prefix for display helpers only.
+ * @category Secrets
+ */
+export declare const ECP_KEYRING_ACCOUNT_PREFIX = "ecp.";
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,8BAA8B,WAAW,CAAA;AAEtD;;;GAGG;AACH,eAAO,MAAM,gCAAgC,YAAuC,CAAA;AAEpF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAAQ,CAAA;AAExC;;;GAGG;AACH,eAAO,MAAM,0BAA0B,SAAS,CAAA"}

package/dist/constants.js

@@ -0,0 +1,21 @@
+/**
+ * URI scheme prefix for OS keyring targets and default ref ids.
+ * @category Secrets
+ */
+export const ECP_SECRET_REF_PROTOCOL_PREFIX = "ecp://";
+/**
+ * Windows `CredEnumerateW` filter for `ecp://` targets.
+ * @category Secrets
+ */
+export const ECP_SECRET_REF_WIN32_ENUM_FILTER = `${ECP_SECRET_REF_PROTOCOL_PREFIX}*`;
+/**
+ * Service name for OS credential stores.
+ * @category Secrets
+ */
+export const ECP_KEYRING_SERVICE = "ecp";
+/**
+ * Legacy dotted prefix for display helpers only.
+ * @category Secrets
+ */
+export const ECP_KEYRING_ACCOUNT_PREFIX = "ecp.";
+//# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,QAAQ,CAAA;AAEtD;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,8BAA8B,GAAG,CAAA;AAEpF;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAA;AAExC;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+import { memorySecretsStore, setMemorySecret, clearMemorySecrets } from "./memory-store.js";
+import type { SecretsStore } from "./store.js";
+/** Replace the active secrets store (e.g. in-memory for tests). @category Secrets */
+export declare function setSecretsStore(store: SecretsStore): void;
+/** Alias for {@link setSecretsStore}. @category Secrets */
+export declare function setSecretsProvider(store: SecretsStore): void;
+/** Restore the default OS keychain store. @category Secrets */
+export declare function resetSecretsStore(): void;
+/** OS secrets extension. @category Secrets */
+export declare const secretsExtension: import("@executioncontrolprotocol/core").ExtensionDefinition;
+/** Register `@executioncontrolprotocol/secrets`. @category Secrets */
+export declare function registerSecretsExtension(registry?: import("@executioncontrolprotocol/core").Registry): Promise<void>;
+export { memorySecretsStore, setMemorySecret, clearMemorySecrets };
+export { createOsSecretsStore, secretRefId, OsKeychainSecretsStore } from "./os-keychain-store.js";
+export { redactSecret } from "./redaction.js";
+export { canonicalSecretKey, secretRefIdFromLogicalKey } from "./ref.js";
+export { normalizeOsKeychainAccountKey, osKeychainCredentialTarget, canonicalSecretKeyForOsStorage, } from "./os-keychain-account-key.js";
+export { ECP_SECRET_REF_PROTOCOL_PREFIX, ECP_KEYRING_SERVICE } from "./constants.js";
+export type { SecretsStore } from "./store.js";
+/** @category Secrets */
+export declare const memorySecretsProvider: SecretsStore;
+export default secretsExtension;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAM9C,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAEzD;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAE5D;AAED,+DAA+D;AAC/D,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAeD,8CAA8C;AAC9C,eAAO,MAAM,gBAAgB,8DAOnB,CAAA;AAIV,sEAAsE;AACtE,wBAAsB,wBAAwB,CAAC,QAAQ,oDAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIvF;AAED,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAA;AAClE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAClG,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AACxE,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpF,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,wBAAwB;AACxB,eAAO,MAAM,qBAAqB,cAAqB,CAAA;AAEvD,eAAe,gBAAgB,CAAA"}

package/dist/index.js

@@ -0,0 +1,56 @@
+import { defineExtension, hook, globalRegistry, catalogExtension, SECRETS_RESOLVER_ID, } from "@executioncontrolprotocol/core";
+import { z } from "zod";
+import { createOsSecretsStore } from "./os-keychain-store.js";
+import { memorySecretsStore, setMemorySecret, clearMemorySecrets } from "./memory-store.js";
+const EXT_ID = "@executioncontrolprotocol/secrets";
+let activeStore = createOsSecretsStore();
+/** Replace the active secrets store (e.g. in-memory for tests). @category Secrets */
+export function setSecretsStore(store) {
+    activeStore = store;
+}
+/** Alias for {@link setSecretsStore}. @category Secrets */
+export function setSecretsProvider(store) {
+    setSecretsStore(store);
+}
+/** Restore the default OS keychain store. @category Secrets */
+export function resetSecretsStore() {
+    activeStore = createOsSecretsStore();
+}
+function attachSecretsResolver(ctx) {
+    const host = ctx.environment;
+    if (!host)
+        return;
+    const resolver = {
+        id: SECRETS_RESOLVER_ID,
+        async resolve(name) {
+            return activeStore.get(name);
+        },
+    };
+    host.registerConfigResolver(resolver);
+}
+/** OS secrets extension. @category Secrets */
+export const secretsExtension = defineExtension("@executioncontrolprotocol", "secrets")
+    .withSupportedRuntimes(["@executioncontrolprotocol/node"])
+    .withConfig(z.object({}))
+    .withHooks([
+    hook("environment:configuring", attachSecretsResolver),
+    hook("environment:terminate", () => undefined),
+])
+    .build();
+catalogExtension(secretsExtension);
+/** Register `@executioncontrolprotocol/secrets`. @category Secrets */
+export async function registerSecretsExtension(registry = globalRegistry) {
+    if (!registry.getExtension(EXT_ID)) {
+        await registry.registerExtension(secretsExtension);
+    }
+}
+export { memorySecretsStore, setMemorySecret, clearMemorySecrets };
+export { createOsSecretsStore, secretRefId, OsKeychainSecretsStore } from "./os-keychain-store.js";
+export { redactSecret } from "./redaction.js";
+export { canonicalSecretKey, secretRefIdFromLogicalKey } from "./ref.js";
+export { normalizeOsKeychainAccountKey, osKeychainCredentialTarget, canonicalSecretKeyForOsStorage, } from "./os-keychain-account-key.js";
+export { ECP_SECRET_REF_PROTOCOL_PREFIX, ECP_KEYRING_SERVICE } from "./constants.js";
+/** @category Secrets */
+export const memorySecretsProvider = memorySecretsStore;
+export default secretsExtension;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,IAAI,EACJ,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAG3F,MAAM,MAAM,GAAG,mCAAmC,CAAA;AAElD,IAAI,WAAW,GAAiB,oBAAoB,EAAE,CAAA;AAEtD,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,KAAmB;IACjD,WAAW,GAAG,KAAK,CAAA;AACrB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB,CAAC,KAAmB;IACpD,eAAe,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB;IAC/B,WAAW,GAAG,oBAAoB,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAqB;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAA;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,QAAQ,GAA8B;QAC1C,EAAE,EAAE,mBAAmB;QACvB,KAAK,CAAC,OAAO,CAAC,IAAY;YACxB,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;KACF,CAAA;IACD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAA;AACvC,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC,2BAA2B,EAAE,SAAS,CAAC;KACpF,qBAAqB,CAAC,CAAC,gCAAgC,CAAC,CAAC;KACzD,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;KACxB,SAAS,CAAC;IACT,IAAI,CAAC,yBAAyB,EAAE,qBAAqB,CAAC;IACtD,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC;CAC/C,CAAC;KACD,KAAK,EAAE,CAAA;AAEV,gBAAgB,CAAC,gBAAgB,CAAC,CAAA;AAElC,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,QAAQ,GAAG,cAAc;IACtE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAA;AAClE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAClG,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AACxE,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAGpF,wBAAwB;AACxB,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAA;AAEvD,eAAe,gBAAgB,CAAA"}

package/dist/memory-store.d.ts

@@ -0,0 +1,8 @@
+import type { SecretsStore } from "./store.js";
+/** In-memory secrets store for tests. @category Secrets */
+export declare const memorySecretsStore: SecretsStore;
+/** Set a value in the in-memory store (tests). @category Secrets */
+export declare function setMemorySecret(key: string, value: string): void;
+/** Clear the in-memory store (tests). @category Secrets */
+export declare function clearMemorySecrets(): void;
+//# sourceMappingURL=memory-store.d.ts.map

package/dist/memory-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-store.d.ts","sourceRoot":"","sources":["../src/memory-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAI9C,2DAA2D;AAC3D,eAAO,MAAM,kBAAkB,EAAE,YAgBhC,CAAA;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAEhE;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/memory-store.js

@@ -0,0 +1,28 @@
+const memoryStore = new Map();
+/** In-memory secrets store for tests. @category Secrets */
+export const memorySecretsStore = {
+    async get(key) {
+        return memoryStore.get(key);
+    },
+    async set(key, value) {
+        memoryStore.set(key, value);
+    },
+    async delete(key) {
+        memoryStore.delete(key);
+    },
+    async list() {
+        return [...memoryStore.keys()];
+    },
+    async isAvailable() {
+        return true;
+    },
+};
+/** Set a value in the in-memory store (tests). @category Secrets */
+export function setMemorySecret(key, value) {
+    memoryStore.set(key, value);
+}
+/** Clear the in-memory store (tests). @category Secrets */
+export function clearMemorySecrets() {
+    memoryStore.clear();
+}
+//# sourceMappingURL=memory-store.js.map

package/dist/memory-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-store.js","sourceRoot":"","sources":["../src/memory-store.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE7C,2DAA2D;AAC3D,MAAM,CAAC,MAAM,kBAAkB,GAAiB;IAC9C,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,OAAO,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC7B,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;QAClB,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC7B,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IACD,KAAK,CAAC,IAAI;QACR,OAAO,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IAChC,CAAC;IACD,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA;AAED,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,KAAa;IACxD,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB;IAChC,WAAW,CAAC,KAAK,EAAE,CAAA;AACrB,CAAC"}

package/dist/os-keychain-account-key.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Canonical logical key for OS storage.
+ * @category Secrets
+ */
+export declare function canonicalSecretKeyForOsStorage(key: string): string;
+/**
+ * OS keyring target for `Entry.withTarget`.
+ * @category Secrets
+ */
+export declare function osKeychainCredentialTarget(logicalKey: string): string;
+/**
+ * Map a key to a dotted `ecp.*` name (legacy display helpers only).
+ * @category Secrets
+ */
+export declare function normalizeOsKeychainAccountKey(key: string): string;
+//# sourceMappingURL=os-keychain-account-key.d.ts.map

package/dist/os-keychain-account-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"os-keychain-account-key.d.ts","sourceRoot":"","sources":["../src/os-keychain-account-key.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUjE"}

package/dist/os-keychain-account-key.js

@@ -0,0 +1,32 @@
+import { ECP_KEYRING_ACCOUNT_PREFIX } from "./constants.js";
+import { canonicalSecretKey, secretRefIdFromLogicalKey } from "./ref.js";
+/**
+ * Canonical logical key for OS storage.
+ * @category Secrets
+ */
+export function canonicalSecretKeyForOsStorage(key) {
+    return canonicalSecretKey(key);
+}
+/**
+ * OS keyring target for `Entry.withTarget`.
+ * @category Secrets
+ */
+export function osKeychainCredentialTarget(logicalKey) {
+    return secretRefIdFromLogicalKey(logicalKey);
+}
+/**
+ * Map a key to a dotted `ecp.*` name (legacy display helpers only).
+ * @category Secrets
+ */
+export function normalizeOsKeychainAccountKey(key) {
+    let k = key.trim().replace(/\\/g, "/");
+    if (k.startsWith("ecp/")) {
+        k = k.slice(4);
+    }
+    k = k.replace(/\//g, ".");
+    if (!k.startsWith(ECP_KEYRING_ACCOUNT_PREFIX)) {
+        k = `${ECP_KEYRING_ACCOUNT_PREFIX}${k}`;
+    }
+    return k;
+}
+//# sourceMappingURL=os-keychain-account-key.js.map

package/dist/os-keychain-account-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"os-keychain-account-key.js","sourceRoot":"","sources":["../src/os-keychain-account-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAExE;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAO,yBAAyB,CAAC,UAAU,CAAC,CAAA;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,GAAW;IACvD,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACtC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC;IACD,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAC9C,CAAC,GAAG,GAAG,0BAA0B,GAAG,CAAC,EAAE,CAAA;IACzC,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/os-keychain-store.d.ts

@@ -0,0 +1,16 @@
+import type { SecretsStore } from "./store.js";
+/** OS keychain / credential manager store. @category Secrets */
+export declare class OsKeychainSecretsStore implements SecretsStore {
+    isAvailable(): Promise<boolean>;
+    private entryForLogicalKey;
+    private listAccountToKey;
+    set(key: string, value: string): Promise<void>;
+    get(key: string): Promise<string | undefined>;
+    delete(key: string): Promise<void>;
+    list(): Promise<string[]>;
+}
+/** Shared OS keychain store for CLI and default runtime resolution. @category Secrets */
+export declare function createOsSecretsStore(): OsKeychainSecretsStore;
+/** Ref id for a logical key (CLI display). @category Secrets */
+export declare function secretRefId(key: string): string;
+//# sourceMappingURL=os-keychain-store.d.ts.map

package/dist/os-keychain-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"os-keychain-store.d.ts","sourceRoot":"","sources":["../src/os-keychain-store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,gEAAgE;AAChE,qBAAa,sBAAuB,YAAW,YAAY;IACnD,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAerC,OAAO,CAAC,kBAAkB;IAS1B,OAAO,CAAC,gBAAgB;IAYlB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAY7C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUlC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CAYhC;AAID,yFAAyF;AACzF,wBAAgB,oBAAoB,IAAI,sBAAsB,CAG7D;AAED,gEAAgE;AAChE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C"}

package/dist/os-keychain-store.js

@@ -0,0 +1,90 @@
+import { ECP_KEYRING_SERVICE, ECP_SECRET_REF_PROTOCOL_PREFIX, ECP_SECRET_REF_WIN32_ENUM_FILTER, } from "./constants.js";
+import { canonicalSecretKeyForOsStorage, osKeychainCredentialTarget, } from "./os-keychain-account-key.js";
+import { canonicalSecretKey, secretRefIdFromLogicalKey } from "./ref.js";
+/** OS keychain / credential manager store. @category Secrets */
+export class OsKeychainSecretsStore {
+    async isAvailable() {
+        try {
+            const { Entry } = await import("@napi-rs/keyring");
+            const entry = new Entry(ECP_KEYRING_SERVICE, "__ecp_availability_probe__");
+            try {
+                entry.getPassword();
+            }
+            catch {
+                // NoEntry is expected
+            }
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    entryForLogicalKey(logicalKey, Entry) {
+        const user = canonicalSecretKeyForOsStorage(logicalKey);
+        const target = osKeychainCredentialTarget(logicalKey);
+        return Entry.withTarget(target, ECP_KEYRING_SERVICE, user);
+    }
+    listAccountToKey(account) {
+        if (account.startsWith(ECP_SECRET_REF_PROTOCOL_PREFIX)) {
+            const rest = account.slice(ECP_SECRET_REF_PROTOCOL_PREFIX.length);
+            const legacy = "os.secrets/";
+            if (rest.startsWith(legacy)) {
+                return canonicalSecretKey(rest.slice(legacy.length));
+            }
+            return canonicalSecretKey(rest);
+        }
+        return canonicalSecretKeyForOsStorage(account);
+    }
+    async set(key, value) {
+        const { Entry } = await import("@napi-rs/keyring");
+        const entry = this.entryForLogicalKey(key, Entry);
+        entry.setPassword(value);
+    }
+    async get(key) {
+        try {
+            const { Entry } = await import("@napi-rs/keyring");
+            const entry = this.entryForLogicalKey(key, Entry);
+            const password = entry.getPassword();
+            if (password == null || password === "")
+                return undefined;
+            return password;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async delete(key) {
+        const { Entry } = await import("@napi-rs/keyring");
+        const entry = this.entryForLogicalKey(key, Entry);
+        try {
+            entry.deletePassword();
+        }
+        catch {
+            // ignore missing
+        }
+    }
+    async list() {
+        try {
+            const { findCredentials } = await import("@napi-rs/keyring");
+            const creds = process.platform === "win32"
+                ? findCredentials(ECP_KEYRING_SERVICE, ECP_SECRET_REF_WIN32_ENUM_FILTER)
+                : findCredentials(ECP_KEYRING_SERVICE);
+            return creds.map((c) => this.listAccountToKey(c.account));
+        }
+        catch {
+            return [];
+        }
+    }
+}
+let osStore;
+/** Shared OS keychain store for CLI and default runtime resolution. @category Secrets */
+export function createOsSecretsStore() {
+    if (!osStore)
+        osStore = new OsKeychainSecretsStore();
+    return osStore;
+}
+/** Ref id for a logical key (CLI display). @category Secrets */
+export function secretRefId(key) {
+    return secretRefIdFromLogicalKey(key);
+}
+//# sourceMappingURL=os-keychain-store.js.map

package/dist/os-keychain-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"os-keychain-store.js","sourceRoot":"","sources":["../src/os-keychain-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAGxE,gEAAgE;AAChE,MAAM,OAAO,sBAAsB;IACjC,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;YAClD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAA;YAC1E,IAAI,CAAC;gBACH,KAAK,CAAC,WAAW,EAAE,CAAA;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAEO,kBAAkB,CACxB,UAAkB,EAClB,KAA8C;QAE9C,MAAM,IAAI,GAAG,8BAA8B,CAAC,UAAU,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAA;QACrD,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAA;IAC5D,CAAC;IAEO,gBAAgB,CAAC,OAAe;QACtC,IAAI,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAA;YACjE,MAAM,MAAM,GAAG,aAAa,CAAA;YAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YACtD,CAAC;YACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAA;QACjC,CAAC;QACD,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACjD,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;YAClD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;YACpC,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,EAAE;gBAAE,OAAO,SAAS,CAAA;YACzD,OAAO,QAAQ,CAAA;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACjD,IAAI,CAAC;YACH,KAAK,CAAC,cAAc,EAAE,CAAA;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;YAC5D,MAAM,KAAK,GACT,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC1B,CAAC,CAAC,eAAe,CAAC,mBAAmB,EAAE,gCAAgC,CAAC;gBACxE,CAAC,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAA;YAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;CACF;AAED,IAAI,OAA2C,CAAA;AAE/C,yFAAyF;AACzF,MAAM,UAAU,oBAAoB;IAClC,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IACpD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,yBAAyB,CAAC,GAAG,CAAC,CAAA;AACvC,CAAC"}

package/dist/redaction.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Redact a secret for logs and CLI output.
+ * @category Secrets
+ */
+export declare function redactSecret(value: string): string;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGlD"}

package/dist/redaction.js

@@ -0,0 +1,10 @@
+/**
+ * Redact a secret for logs and CLI output.
+ * @category Secrets
+ */
+export function redactSecret(value) {
+    if (value.length <= 8)
+        return "****";
+    return `${value.slice(0, 2)}****${value.slice(-4)}`;
+}
+//# sourceMappingURL=redaction.js.map

package/dist/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAA;IACpC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACrD,CAAC"}

package/dist/ref.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Normalize a logical secret key (trim, backslashes to `/`).
+ * @category Secrets
+ */
+export declare function canonicalSecretKey(key: string): string;
+/**
+ * Default secret ref id: `ecp://` plus normalized key.
+ * @category Secrets
+ */
+export declare function secretRefIdFromLogicalKey(key: string): string;
+//# sourceMappingURL=ref.d.ts.map

package/dist/ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref.d.ts","sourceRoot":"","sources":["../src/ref.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/dist/ref.js

@@ -0,0 +1,16 @@
+import { ECP_SECRET_REF_PROTOCOL_PREFIX } from "./constants.js";
+/**
+ * Normalize a logical secret key (trim, backslashes to `/`).
+ * @category Secrets
+ */
+export function canonicalSecretKey(key) {
+    return key.trim().replace(/\\/g, "/");
+}
+/**
+ * Default secret ref id: `ecp://` plus normalized key.
+ * @category Secrets
+ */
+export function secretRefIdFromLogicalKey(key) {
+    return `${ECP_SECRET_REF_PROTOCOL_PREFIX}${canonicalSecretKey(key)}`;
+}
+//# sourceMappingURL=ref.js.map

package/dist/ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref.js","sourceRoot":"","sources":["../src/ref.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAA;AAE/D;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,GAAG,8BAA8B,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAA;AACtE,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,14 @@
+/** OS secrets backend for lookup and CLI CRUD. @category Secrets */
+export interface SecretsStore {
+    /** Load a secret value or undefined when missing. */
+    get(key: string): Promise<string | undefined>;
+    /** Store or replace a secret value. */
+    set(key: string, value: string): Promise<void>;
+    /** Delete a secret when present. */
+    delete(key: string): Promise<void>;
+    /** List logical keys in the store. */
+    list(): Promise<string[]>;
+    /** Whether this backend is available on the current host. */
+    isAvailable(): Promise<boolean>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAC7C,uCAAuC;IACvC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,oCAAoC;IACpC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,sCAAsC;IACtC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACzB,6DAA6D;IAC7D,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAChC"}

package/dist/store.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@executioncontrolprotocol/secrets",
+  "version": "0.10.0",
+  "description": "OS secrets extension for ECP (keychain / credential manager)",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -b"
+  },
+  "optionalDependencies": {
+    "@napi-rs/keyring": "^1.2.0"
+  },
+  "peerDependencies": {
+    "@executioncontrolprotocol/core": "^0.10.0",
+    "@executioncontrolprotocol/types": "^0.10.0",
+    "zod": "^3.24.0"
+  },
+  "devDependencies": {
+    "@executioncontrolprotocol/core": "0.10.0",
+    "@executioncontrolprotocol/types": "0.10.0",
+    "typescript": "^5.7.0",
+    "zod": "^3.24.0"
+  }
+}