@executor-js/plugin-file-secrets 0.0.1-beta.6 → 0.0.2

package/README.md

@@ -1,23 +1,23 @@
-# @executor/plugin-file-secrets
+# @executor-js/plugin-file-secrets
 
 File-backed secret store for the executor. Persists secrets to a single JSON file at an XDG-compliant path so they survive between process restarts — useful for local development, CLIs, and scripts where a system keychain isn't available.
 
 ## Install
 
 ```sh
-bun add @executor/sdk @executor/plugin-file-secrets
+bun add @executor-js/sdk @executor-js/plugin-file-secrets
 # or
-npm install @executor/sdk @executor/plugin-file-secrets
+npm install @executor-js/sdk @executor-js/plugin-file-secrets
 ```
 
 ## Usage
 
 ```ts
-import { createExecutor } from "@executor/sdk";
-import { fileSecretsPlugin } from "@executor/plugin-file-secrets";
+import { createExecutor } from "@executor-js/sdk";
+import { fileSecretsPlugin } from "@executor-js/plugin-file-secrets";
 
 const executor = await createExecutor({
-  scope: { name: "my-app" },
+  onElicitation: "accept-all",
   plugins: [fileSecretsPlugin()] as const,
 });
 
@@ -26,29 +26,29 @@ await executor.secrets.set({
   id: "api-key",
   name: "My API Key",
   value: "secret123",
-  purpose: "authentication",
+  scope: executor.scopes[0]!.id,
 });
 
 // Read it back
-const value = await executor.secrets.resolve("api-key");
+const value = await executor.secrets.get("api-key");
 
 // Check where it's stored
 console.log("Secret file:", executor.fileSecrets.filePath);
 ```
 
-Secrets written through `executor.secrets.set(...)` become available to every other plugin that resolves them, so you can (for example) store a GitHub token here and have `@executor/plugin-openapi` or `@executor/plugin-graphql` pick it up via `{ secretId, prefix }` headers.
+Secrets written through `executor.secrets.set(...)` become available to every other plugin that resolves them, so you can (for example) store a GitHub token here and have `@executor-js/plugin-openapi` or `@executor-js/plugin-graphql` pick it up via `{ secretId, prefix }` headers.
 
 ## Using with Effect
 
-If you're building on `@executor/sdk` (the raw Effect entry), import this plugin from its `/core` subpath instead:
+If you're building on `@executor-js/sdk/core` (the raw Effect entry), import this plugin from its `/core` subpath instead — it returns the Effect-shaped plugin with `Effect.Effect<...>`-returning methods rather than promisified wrappers:
 
 ```ts
-import { fileSecretsPlugin } from "@executor/plugin-file-secrets";
+import { fileSecretsPlugin } from "@executor-js/plugin-file-secrets/core";
 ```
 
 ## Security note
 
-Secrets are stored unencrypted in a plain JSON file. Use [`@executor/plugin-keychain`](https://www.npmjs.com/package/@executor/plugin-keychain) for OS-keychain-backed storage, or [`@executor/plugin-onepassword`](https://www.npmjs.com/package/@executor/plugin-onepassword) for 1Password-backed storage when you need encryption at rest.
+Secrets are stored unencrypted in a plain JSON file. Use [`@executor-js/plugin-keychain`](https://www.npmjs.com/package/@executor-js/plugin-keychain) for OS-keychain-backed storage, or [`@executor-js/plugin-onepassword`](https://www.npmjs.com/package/@executor-js/plugin-onepassword) for 1Password-backed storage when you need encryption at rest.
 
 ## Status
 

package/dist/chunk-6YB3FO4B.js

@@ -0,0 +1,118 @@
+// src/index.ts
+import { Effect, Schema } from "effect";
+import * as fs from "fs";
+import * as path from "path";
+import {
+  definePlugin,
+  StorageError
+} from "@executor-js/sdk/core";
+var APP_NAME = "executor";
+var xdgDataHome = () => {
+  if (process.env.XDG_DATA_HOME?.trim()) return process.env.XDG_DATA_HOME.trim();
+  if (process.platform === "win32") {
+    return process.env.LOCALAPPDATA || process.env.APPDATA || path.join(process.env.USERPROFILE || "~", "AppData", "Local");
+  }
+  return path.join(process.env.HOME || "~", ".local", "share");
+};
+var authDir = (overrideDir) => overrideDir ?? path.join(xdgDataHome(), APP_NAME);
+var authFilePath = (overrideDir) => path.join(authDir(overrideDir), "auth.json");
+var ScopedAuthFile = Schema.Record(
+  Schema.String,
+  Schema.Record(Schema.String, Schema.String)
+);
+var decodeScopedAuthFile = Schema.decodeUnknownSync(ScopedAuthFile);
+var readFullFile = (filePath) => {
+  if (!fs.existsSync(filePath)) return {};
+  let raw;
+  try {
+    raw = fs.readFileSync(filePath, "utf-8");
+  } catch (cause) {
+    if (cause.code === "ENOENT") return {};
+    throw cause;
+  }
+  return decodeScopedAuthFile(JSON.parse(raw));
+};
+var readScopeSecrets = (filePath, scopeId) => readFullFile(filePath)[scopeId] ?? {};
+var writeScopeSecrets = (filePath, scopeId, secrets) => {
+  const dir = path.dirname(filePath);
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  }
+  const full = readFullFile(filePath);
+  if (Object.keys(secrets).length === 0) {
+    delete full[scopeId];
+  } else {
+    full[scopeId] = secrets;
+  }
+  const tmp = `${filePath}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(full, null, 2), { mode: 384 });
+  fs.renameSync(tmp, filePath);
+};
+var toStorageError = (cause) => new StorageError({
+  message: cause instanceof Error ? cause.message : String(cause),
+  cause
+});
+var makeScopedProvider = (filePath, listScope) => ({
+  key: "file",
+  writable: true,
+  get: (secretId, scope) => Effect.try({
+    try: () => {
+      const data = readScopeSecrets(filePath, scope);
+      return data[secretId] ?? null;
+    },
+    catch: toStorageError
+  }),
+  has: (secretId, scope) => Effect.try({
+    try: () => {
+      const data = readScopeSecrets(filePath, scope);
+      return secretId in data;
+    },
+    catch: toStorageError
+  }),
+  set: (secretId, value, scope) => Effect.try({
+    try: () => {
+      const data = readScopeSecrets(filePath, scope);
+      data[secretId] = value;
+      writeScopeSecrets(filePath, scope, data);
+    },
+    catch: toStorageError
+  }),
+  delete: (secretId, scope) => Effect.try({
+    try: () => {
+      const data = readScopeSecrets(filePath, scope);
+      const had = secretId in data;
+      delete data[secretId];
+      if (had) writeScopeSecrets(filePath, scope, data);
+      return had;
+    },
+    catch: toStorageError
+  }),
+  list: () => Effect.try({
+    try: () => {
+      const data = readScopeSecrets(filePath, listScope);
+      return Object.keys(data).map((k) => ({ id: k, name: k }));
+    },
+    catch: toStorageError
+  })
+});
+var resolveFilePath = (config) => authFilePath(config?.directory);
+var fileSecretsPlugin = definePlugin(
+  (options) => ({
+    id: "fileSecrets",
+    storage: () => ({}),
+    extension: (_ctx) => ({
+      filePath: resolveFilePath(options)
+    }),
+    secretProviders: (ctx) => [
+      // list() falls back to the innermost scope for display; per-call
+      // get/set/delete honor the scope arg threaded from the secrets facade.
+      makeScopedProvider(resolveFilePath(options), ctx.scopes[0].id)
+    ]
+  })
+);
+
+export {
+  xdgDataHome,
+  fileSecretsPlugin
+};
+//# sourceMappingURL=chunk-6YB3FO4B.js.map

package/dist/chunk-6YB3FO4B.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\n\nimport {\n  definePlugin,\n  StorageError,\n  type PluginCtx,\n  type SecretProvider,\n} from \"@executor-js/sdk/core\";\n\n// ---------------------------------------------------------------------------\n// XDG data dir resolution\n// ---------------------------------------------------------------------------\n\nconst APP_NAME = \"executor\";\n\nexport const xdgDataHome = (): string => {\n  if (process.env.XDG_DATA_HOME?.trim()) return process.env.XDG_DATA_HOME.trim();\n  if (process.platform === \"win32\") {\n    return (\n      process.env.LOCALAPPDATA ||\n      process.env.APPDATA ||\n      path.join(process.env.USERPROFILE || \"~\", \"AppData\", \"Local\")\n    );\n  }\n  return path.join(process.env.HOME || \"~\", \".local\", \"share\");\n};\n\nconst authDir = (overrideDir?: string): string =>\n  overrideDir ?? path.join(xdgDataHome(), APP_NAME);\n\nconst authFilePath = (overrideDir?: string): string =>\n  path.join(authDir(overrideDir), \"auth.json\");\n\n// ---------------------------------------------------------------------------\n// Schema for the auth file\n//\n// Top-level keys are scope IDs, values are { secretId: secretValue } maps.\n//   { \"web-a1b2c3d4\": { \"github-token\": \"ghp_xxx\" } }\n// ---------------------------------------------------------------------------\n\nconst ScopedAuthFile = Schema.Record(\n  Schema.String,\n  Schema.Record(Schema.String, Schema.String),\n);\nconst decodeScopedAuthFile = Schema.decodeUnknownSync(ScopedAuthFile);\n\n// ---------------------------------------------------------------------------\n// File I/O with restricted permissions\n//\n// These helpers throw on real I/O or decode failures — the provider wraps\n// every call in `Effect.try` so those throws surface as typed\n// `StorageError` on the Effect error channel. Previously `readFullFile`\n// used a blanket `try { ... } catch { return {}; }` which masked JSON\n// parse errors, schema decode failures, and permission errors as\n// \"empty file\", making misconfigured installs silently return null from\n// every `get`.\n// ---------------------------------------------------------------------------\n\nconst readFullFile = (filePath: string): Record<string, Record<string, string>> => {\n  if (!fs.existsSync(filePath)) return {};\n  let raw: string;\n  try {\n    raw = fs.readFileSync(filePath, \"utf-8\");\n  } catch (cause) {\n    // Treat \"file disappeared between existsSync and readFileSync\" as\n    // absence — anything else (EACCES, EISDIR, …) propagates.\n    if ((cause as NodeJS.ErrnoException).code === \"ENOENT\") return {};\n    throw cause;\n  }\n  return decodeScopedAuthFile(JSON.parse(raw));\n};\n\nconst readScopeSecrets = (filePath: string, scopeId: string): Record<string, string> =>\n  readFullFile(filePath)[scopeId] ?? {};\n\nconst writeScopeSecrets = (\n  filePath: string,\n  scopeId: string,\n  secrets: Record<string, string>,\n): void => {\n  const dir = path.dirname(filePath);\n  if (!fs.existsSync(dir)) {\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n  const full = readFullFile(filePath);\n  if (Object.keys(secrets).length === 0) {\n    delete full[scopeId];\n  } else {\n    full[scopeId] = secrets;\n  }\n  const tmp = `${filePath}.tmp`;\n  fs.writeFileSync(tmp, JSON.stringify(full, null, 2), { mode: 0o600 });\n  fs.renameSync(tmp, filePath);\n};\n\n// ---------------------------------------------------------------------------\n// Plugin config\n// ---------------------------------------------------------------------------\n\nexport interface FileSecretsPluginConfig {\n  /** Override the directory for auth.json (default: XDG data dir) */\n  readonly directory?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin extension — public API on executor.fileSecrets\n// ---------------------------------------------------------------------------\n\nexport interface FileSecretsExtension {\n  /** Path to the auth file */\n  readonly filePath: string;\n}\n\n// ---------------------------------------------------------------------------\n// Provider factory (internal)\n// ---------------------------------------------------------------------------\n\nconst toStorageError = (cause: unknown) =>\n  new StorageError({\n    message: cause instanceof Error ? cause.message : String(cause),\n    cause,\n  });\n\n// Scope arg is honored at every call: the auth.json is partitioned by\n// scope id, so read/write/delete route to `file[scope][secretId]`. The\n// provider is a singleton per executor; scope routing happens via the\n// arg passed from the executor's secrets facade.\n//\n// `list` enumerates the innermost scope the provider was configured\n// for — the executor's fallback/list path passes scope separately but\n// the SecretProvider.list signature is scope-agnostic. That's fine for\n// the current use: `list` feeds `secrets.list()` which already walks\n// the stack at the caller layer. Innermost-first is the display default.\nconst makeScopedProvider = (\n  filePath: string,\n  listScope: string,\n): SecretProvider => ({\n  key: \"file\",\n  writable: true,\n\n  get: (secretId, scope) =>\n    Effect.try({\n      try: () => {\n        const data = readScopeSecrets(filePath, scope);\n        return data[secretId] ?? null;\n      },\n      catch: toStorageError,\n    }),\n\n  has: (secretId, scope) =>\n    Effect.try({\n      try: () => {\n        const data = readScopeSecrets(filePath, scope);\n        return secretId in data;\n      },\n      catch: toStorageError,\n    }),\n\n  set: (secretId, value, scope) =>\n    Effect.try({\n      try: () => {\n        const data = readScopeSecrets(filePath, scope);\n        data[secretId] = value;\n        writeScopeSecrets(filePath, scope, data);\n      },\n      catch: toStorageError,\n    }),\n\n  delete: (secretId, scope) =>\n    Effect.try({\n      try: () => {\n        const data = readScopeSecrets(filePath, scope);\n        const had = secretId in data;\n        delete data[secretId];\n        if (had) writeScopeSecrets(filePath, scope, data);\n        return had;\n      },\n      catch: toStorageError,\n    }),\n\n  list: () =>\n    Effect.try({\n      try: () => {\n        const data = readScopeSecrets(filePath, listScope);\n        return Object.keys(data).map((k) => ({ id: k, name: k }));\n      },\n      catch: toStorageError,\n    }),\n});\n\n// ---------------------------------------------------------------------------\n// Plugin definition\n//\n// Compute the scoped file path identically in `extension` (for `filePath`)\n// and `secretProviders` (for the provider's read/write). Both receive ctx\n// and both are called once per createExecutor.\n// ---------------------------------------------------------------------------\n\nconst resolveFilePath = (config: FileSecretsPluginConfig | undefined): string =>\n  authFilePath(config?.directory);\n\nexport const fileSecretsPlugin = definePlugin(\n  (options?: FileSecretsPluginConfig) => ({\n    id: \"fileSecrets\" as const,\n    storage: () => ({}),\n\n    extension: (_ctx): FileSecretsExtension => ({\n      filePath: resolveFilePath(options),\n    }),\n\n    secretProviders: (ctx: PluginCtx<unknown>) => [\n      // list() falls back to the innermost scope for display; per-call\n      // get/set/delete honor the scope arg threaded from the secrets facade.\n      makeScopedProvider(resolveFilePath(options), ctx.scopes[0]!.id as string),\n    ],\n  }),\n);\n"],"mappings":";AAAA,SAAS,QAAQ,cAAc;AAC/B,YAAY,QAAQ;AACpB,YAAY,UAAU;AAEtB;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAMP,IAAM,WAAW;AAEV,IAAM,cAAc,MAAc;AACvC,MAAI,QAAQ,IAAI,eAAe,KAAK,EAAG,QAAO,QAAQ,IAAI,cAAc,KAAK;AAC7E,MAAI,QAAQ,aAAa,SAAS;AAChC,WACE,QAAQ,IAAI,gBACZ,QAAQ,IAAI,WACP,UAAK,QAAQ,IAAI,eAAe,KAAK,WAAW,OAAO;AAAA,EAEhE;AACA,SAAY,UAAK,QAAQ,IAAI,QAAQ,KAAK,UAAU,OAAO;AAC7D;AAEA,IAAM,UAAU,CAAC,gBACf,eAAoB,UAAK,YAAY,GAAG,QAAQ;AAElD,IAAM,eAAe,CAAC,gBACf,UAAK,QAAQ,WAAW,GAAG,WAAW;AAS7C,IAAM,iBAAiB,OAAO;AAAA,EAC5B,OAAO;AAAA,EACP,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM;AAC5C;AACA,IAAM,uBAAuB,OAAO,kBAAkB,cAAc;AAcpE,IAAM,eAAe,CAAC,aAA6D;AACjF,MAAI,CAAI,cAAW,QAAQ,EAAG,QAAO,CAAC;AACtC,MAAI;AACJ,MAAI;AACF,UAAS,gBAAa,UAAU,OAAO;AAAA,EACzC,SAAS,OAAO;AAGd,QAAK,MAAgC,SAAS,SAAU,QAAO,CAAC;AAChE,UAAM;AAAA,EACR;AACA,SAAO,qBAAqB,KAAK,MAAM,GAAG,CAAC;AAC7C;AAEA,IAAM,mBAAmB,CAAC,UAAkB,YAC1C,aAAa,QAAQ,EAAE,OAAO,KAAK,CAAC;AAEtC,IAAM,oBAAoB,CACxB,UACA,SACA,YACS;AACT,QAAM,MAAW,aAAQ,QAAQ;AACjC,MAAI,CAAI,cAAW,GAAG,GAAG;AACvB,IAAG,aAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,EACpD;AACA,QAAM,OAAO,aAAa,QAAQ;AAClC,MAAI,OAAO,KAAK,OAAO,EAAE,WAAW,GAAG;AACrC,WAAO,KAAK,OAAO;AAAA,EACrB,OAAO;AACL,SAAK,OAAO,IAAI;AAAA,EAClB;AACA,QAAM,MAAM,GAAG,QAAQ;AACvB,EAAG,iBAAc,KAAK,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACpE,EAAG,cAAW,KAAK,QAAQ;AAC7B;AAwBA,IAAM,iBAAiB,CAAC,UACtB,IAAI,aAAa;AAAA,EACf,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EAC9D;AACF,CAAC;AAYH,IAAM,qBAAqB,CACzB,UACA,eACoB;AAAA,EACpB,KAAK;AAAA,EACL,UAAU;AAAA,EAEV,KAAK,CAAC,UAAU,UACd,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,aAAO,KAAK,QAAQ,KAAK;AAAA,IAC3B;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AAAA,EAEH,KAAK,CAAC,UAAU,UACd,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,aAAO,YAAY;AAAA,IACrB;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AAAA,EAEH,KAAK,CAAC,UAAU,OAAO,UACrB,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,WAAK,QAAQ,IAAI;AACjB,wBAAkB,UAAU,OAAO,IAAI;AAAA,IACzC;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AAAA,EAEH,QAAQ,CAAC,UAAU,UACjB,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,YAAM,MAAM,YAAY;AACxB,aAAO,KAAK,QAAQ;AACpB,UAAI,IAAK,mBAAkB,UAAU,OAAO,IAAI;AAChD,aAAO;AAAA,IACT;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AAAA,EAEH,MAAM,MACJ,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,OAAO,iBAAiB,UAAU,SAAS;AACjD,aAAO,OAAO,KAAK,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,MAAM,EAAE,EAAE;AAAA,IAC1D;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AACL;AAUA,IAAM,kBAAkB,CAAC,WACvB,aAAa,QAAQ,SAAS;AAEzB,IAAM,oBAAoB;AAAA,EAC/B,CAAC,aAAuC;AAAA,IACtC,IAAI;AAAA,IACJ,SAAS,OAAO,CAAC;AAAA,IAEjB,WAAW,CAAC,UAAgC;AAAA,MAC1C,UAAU,gBAAgB,OAAO;AAAA,IACnC;AAAA,IAEA,iBAAiB,CAAC,QAA4B;AAAA;AAAA;AAAA,MAG5C,mBAAmB,gBAAgB,OAAO,GAAG,IAAI,OAAO,CAAC,EAAG,EAAY;AAAA,IAC1E;AAAA,EACF;AACF;","names":[]}

package/dist/core.js

@@ -1,7 +1,9 @@
 import {
-  fileSecretsPlugin
-} from "./chunk-PBQRMQCD.js";
+  fileSecretsPlugin,
+  xdgDataHome
+} from "./chunk-6YB3FO4B.js";
 export {
-  fileSecretsPlugin
+  fileSecretsPlugin,
+  xdgDataHome
 };
 //# sourceMappingURL=core.js.map

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { type ExecutorPlugin } from "@executor-js/sdk";
+export declare const xdgDataHome: () => string;
 export interface FileSecretsPluginConfig {
     /** Override the directory for auth.json (default: XDG data dir) */
     readonly directory?: string;
@@ -7,6 +7,4 @@ export interface FileSecretsExtension {
     /** Path to the auth file */
     readonly filePath: string;
 }
-declare const PLUGIN_KEY = "fileSecrets";
-export declare const fileSecretsPlugin: (config?: FileSecretsPluginConfig) => ExecutorPlugin<typeof PLUGIN_KEY, FileSecretsExtension>;
-export {};
+export declare const fileSecretsPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"fileSecrets", FileSecretsExtension, {}, FileSecretsPluginConfig, undefined>;

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   fileSecretsPlugin
-} from "./chunk-PBQRMQCD.js";
+} from "./chunk-6YB3FO4B.js";
 
 // src/promise.ts
 var fileSecretsPlugin2 = (config) => fileSecretsPlugin(config);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/promise.ts"],"sourcesContent":["import { fileSecretsPlugin as fileSecretsPluginEffect } from \"./index\";\n\nexport type { FileSecretsPluginConfig } from \"./index\";\n\nexport const fileSecretsPlugin = (config?: { readonly directory?: string }) =>\n  fileSecretsPluginEffect(config);\n"],"mappings":";;;;;AAIO,IAAMA,qBAAoB,CAAC,WAChC,kBAAwB,MAAM;","names":["fileSecretsPlugin"]}
+{"version":3,"sources":["../src/promise.ts"],"sourcesContent":["import { type Plugin } from \"@executor-js/sdk/core\";\n\nimport {\n  fileSecretsPlugin as fileSecretsPluginEffect,\n  type FileSecretsExtension,\n  type FileSecretsPluginConfig,\n} from \"./index\";\n\nexport type { FileSecretsPluginConfig } from \"./index\";\n\n// Explicit return type so the emitted dist/promise.d.ts references\n// `import(\"@executor-js/sdk/core\").Plugin` (where `Plugin` lives) rather\n// than `import(\"@executor-js/sdk\").Plugin` (the Promise surface, which\n// doesn't re-export Plugin).\nexport const fileSecretsPlugin = (\n  config?: FileSecretsPluginConfig,\n): Plugin<\"fileSecrets\", FileSecretsExtension, Record<string, never>, undefined> =>\n  fileSecretsPluginEffect(config);\n"],"mappings":";;;;;AAcO,IAAMA,qBAAoB,CAC/B,WAEA,kBAAwB,MAAM;","names":["fileSecretsPlugin"]}

package/dist/promise.d.ts

@@ -1,4 +1,4 @@
+import { type Plugin } from "@executor-js/sdk/core";
+import { type FileSecretsExtension, type FileSecretsPluginConfig } from "./index";
 export type { FileSecretsPluginConfig } from "./index";
-export declare const fileSecretsPlugin: (config?: {
-    readonly directory?: string;
-}) => import("@executor-js/sdk").ExecutorPlugin<"fileSecrets", import("./index").FileSecretsExtension>;
+export declare const fileSecretsPlugin: (config?: FileSecretsPluginConfig) => Plugin<"fileSecrets", FileSecretsExtension, Record<string, never>, undefined>;

package/dist/xdg.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/plugin-file-secrets",
-  "version": "0.0.1-beta.6",
+  "version": "0.0.2",
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/file-secrets",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
@@ -40,13 +40,13 @@
     "typecheck:slow": "bunx tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@executor-js/sdk": "0.0.1-beta.6",
-    "effect": "^3.21.0"
+    "@executor-js/sdk": "0.0.2",
+    "effect": "4.0.0-beta.59"
   },
   "devDependencies": {
     "@types/node": "^24.3.1",
     "bun-types": "^1.2.22",
     "tsup": "^8.5.0",
-    "vitest": "^4.1.3"
+    "vitest": "^4.1.5"
   }
 }

package/dist/chunk-PBQRMQCD.js

@@ -1,79 +0,0 @@
-// src/index.ts
-import { Effect, Schema } from "effect";
-import { definePlugin } from "@executor-js/sdk";
-import * as fs from "fs";
-import * as path from "path";
-var APP_NAME = "executor";
-var xdgDataHome = () => process.env.XDG_DATA_HOME?.trim() || path.join(process.env.HOME || process.env.USERPROFILE || "~", ".local", "share");
-var authDir = (overrideDir) => overrideDir ?? path.join(xdgDataHome(), APP_NAME);
-var authFilePath = (overrideDir) => path.join(authDir(overrideDir), "auth.json");
-var ScopedAuthFile = Schema.Record({
-  key: Schema.String,
-  value: Schema.Record({ key: Schema.String, value: Schema.String })
-});
-var decodeScopedAuthFile = Schema.decodeUnknownSync(ScopedAuthFile);
-var readFullFile = (filePath) => {
-  try {
-    if (!fs.existsSync(filePath)) return {};
-    const raw = fs.readFileSync(filePath, "utf-8");
-    return decodeScopedAuthFile(JSON.parse(raw));
-  } catch {
-    return {};
-  }
-};
-var readScopeSecrets = (filePath, scopeId) => readFullFile(filePath)[scopeId] ?? {};
-var writeScopeSecrets = (filePath, scopeId, secrets) => {
-  const dir = path.dirname(filePath);
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true, mode: 448 });
-  }
-  const full = readFullFile(filePath);
-  if (Object.keys(secrets).length === 0) {
-    delete full[scopeId];
-  } else {
-    full[scopeId] = secrets;
-  }
-  const tmp = `${filePath}.tmp`;
-  fs.writeFileSync(tmp, JSON.stringify(full, null, 2), { mode: 384 });
-  fs.renameSync(tmp, filePath);
-};
-var makeScopedProvider = (filePath, scopeId) => ({
-  key: "file",
-  writable: true,
-  get: (secretId) => Effect.sync(() => {
-    const data = readScopeSecrets(filePath, scopeId);
-    return data[secretId] ?? null;
-  }),
-  set: (secretId, value) => Effect.sync(() => {
-    const data = readScopeSecrets(filePath, scopeId);
-    data[secretId] = value;
-    writeScopeSecrets(filePath, scopeId, data);
-  }),
-  delete: (secretId) => Effect.sync(() => {
-    const data = readScopeSecrets(filePath, scopeId);
-    const had = secretId in data;
-    delete data[secretId];
-    if (had) writeScopeSecrets(filePath, scopeId, data);
-    return had;
-  }),
-  list: () => Effect.sync(() => {
-    const data = readScopeSecrets(filePath, scopeId);
-    return Object.keys(data).map((k) => ({ id: k, name: k }));
-  })
-});
-var PLUGIN_KEY = "fileSecrets";
-var fileSecretsPlugin = (config) => definePlugin({
-  key: PLUGIN_KEY,
-  init: (ctx) => Effect.gen(function* () {
-    const filePath = authFilePath(config?.directory);
-    yield* ctx.secrets.addProvider(makeScopedProvider(filePath, ctx.scope.id));
-    return {
-      extension: { filePath }
-    };
-  })
-});
-
-export {
-  fileSecretsPlugin
-};
-//# sourceMappingURL=chunk-PBQRMQCD.js.map

package/dist/chunk-PBQRMQCD.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\nimport { definePlugin, type ExecutorPlugin, type SecretProvider } from \"@executor/sdk\";\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\n\n// ---------------------------------------------------------------------------\n// XDG data dir resolution\n// ---------------------------------------------------------------------------\n\nconst APP_NAME = \"executor\";\n\nconst xdgDataHome = (): string =>\n  process.env.XDG_DATA_HOME?.trim() ||\n  path.join(process.env.HOME || process.env.USERPROFILE || \"~\", \".local\", \"share\");\n\nconst authDir = (overrideDir?: string): string => overrideDir ?? path.join(xdgDataHome(), APP_NAME);\n\nconst authFilePath = (overrideDir?: string): string => path.join(authDir(overrideDir), \"auth.json\");\n\n// ---------------------------------------------------------------------------\n// Schema for the auth file\n//\n// Top-level keys are scope IDs, values are { secretId: secretValue } maps.\n//   { \"web-a1b2c3d4\": { \"github-token\": \"ghp_xxx\" } }\n// ---------------------------------------------------------------------------\n\nconst ScopedAuthFile = Schema.Record({\n  key: Schema.String,\n  value: Schema.Record({ key: Schema.String, value: Schema.String }),\n});\nconst decodeScopedAuthFile = Schema.decodeUnknownSync(ScopedAuthFile);\n\n// ---------------------------------------------------------------------------\n// File I/O with restricted permissions\n// ---------------------------------------------------------------------------\n\nconst readFullFile = (filePath: string): Record<string, Record<string, string>> => {\n  try {\n    if (!fs.existsSync(filePath)) return {};\n    const raw = fs.readFileSync(filePath, \"utf-8\");\n    return decodeScopedAuthFile(JSON.parse(raw));\n  } catch {\n    return {};\n  }\n};\n\nconst readScopeSecrets = (filePath: string, scopeId: string): Record<string, string> =>\n  readFullFile(filePath)[scopeId] ?? {};\n\nconst writeScopeSecrets = (\n  filePath: string,\n  scopeId: string,\n  secrets: Record<string, string>,\n): void => {\n  const dir = path.dirname(filePath);\n  if (!fs.existsSync(dir)) {\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n  const full = readFullFile(filePath);\n  if (Object.keys(secrets).length === 0) {\n    delete full[scopeId];\n  } else {\n    full[scopeId] = secrets;\n  }\n  const tmp = `${filePath}.tmp`;\n  fs.writeFileSync(tmp, JSON.stringify(full, null, 2), { mode: 0o600 });\n  fs.renameSync(tmp, filePath);\n};\n\n// ---------------------------------------------------------------------------\n// Plugin config\n// ---------------------------------------------------------------------------\n\nexport interface FileSecretsPluginConfig {\n  /** Override the directory for auth.json (default: XDG data dir) */\n  readonly directory?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin extension — public API on executor.fileSecrets\n// ---------------------------------------------------------------------------\n\nexport interface FileSecretsExtension {\n  /** Path to the auth file */\n  readonly filePath: string;\n}\n\n// ---------------------------------------------------------------------------\n// Provider factory (internal)\n// ---------------------------------------------------------------------------\n\nconst makeScopedProvider = (filePath: string, scopeId: string): SecretProvider => ({\n  key: \"file\",\n  writable: true,\n\n  get: (secretId) =>\n    Effect.sync(() => {\n      const data = readScopeSecrets(filePath, scopeId);\n      return data[secretId] ?? null;\n    }),\n\n  set: (secretId, value) =>\n    Effect.sync(() => {\n      const data = readScopeSecrets(filePath, scopeId);\n      data[secretId] = value;\n      writeScopeSecrets(filePath, scopeId, data);\n    }),\n\n  delete: (secretId) =>\n    Effect.sync(() => {\n      const data = readScopeSecrets(filePath, scopeId);\n      const had = secretId in data;\n      delete data[secretId];\n      if (had) writeScopeSecrets(filePath, scopeId, data);\n      return had;\n    }),\n\n  list: () =>\n    Effect.sync(() => {\n      const data = readScopeSecrets(filePath, scopeId);\n      return Object.keys(data).map((k) => ({ id: k, name: k }));\n    }),\n});\n\n// ---------------------------------------------------------------------------\n// Plugin definition\n// ---------------------------------------------------------------------------\n\nconst PLUGIN_KEY = \"fileSecrets\";\n\nexport const fileSecretsPlugin = (\n  config?: FileSecretsPluginConfig,\n): ExecutorPlugin<typeof PLUGIN_KEY, FileSecretsExtension> =>\n  definePlugin({\n    key: PLUGIN_KEY,\n    init: (ctx) =>\n      Effect.gen(function* () {\n        const filePath = authFilePath(config?.directory);\n\n        yield* ctx.secrets.addProvider(makeScopedProvider(filePath, ctx.scope.id));\n\n        return {\n          extension: { filePath },\n        };\n      }),\n  });\n"],"mappings":";AAAA,SAAS,QAAQ,cAAc;AAC/B,SAAS,oBAA8D;AACvE,YAAY,QAAQ;AACpB,YAAY,UAAU;AAMtB,IAAM,WAAW;AAEjB,IAAM,cAAc,MAClB,QAAQ,IAAI,eAAe,KAAK,KAC3B,UAAK,QAAQ,IAAI,QAAQ,QAAQ,IAAI,eAAe,KAAK,UAAU,OAAO;AAEjF,IAAM,UAAU,CAAC,gBAAiC,eAAoB,UAAK,YAAY,GAAG,QAAQ;AAElG,IAAM,eAAe,CAAC,gBAAsC,UAAK,QAAQ,WAAW,GAAG,WAAW;AASlG,IAAM,iBAAiB,OAAO,OAAO;AAAA,EACnC,KAAK,OAAO;AAAA,EACZ,OAAO,OAAO,OAAO,EAAE,KAAK,OAAO,QAAQ,OAAO,OAAO,OAAO,CAAC;AACnE,CAAC;AACD,IAAM,uBAAuB,OAAO,kBAAkB,cAAc;AAMpE,IAAM,eAAe,CAAC,aAA6D;AACjF,MAAI;AACF,QAAI,CAAI,cAAW,QAAQ,EAAG,QAAO,CAAC;AACtC,UAAM,MAAS,gBAAa,UAAU,OAAO;AAC7C,WAAO,qBAAqB,KAAK,MAAM,GAAG,CAAC;AAAA,EAC7C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,IAAM,mBAAmB,CAAC,UAAkB,YAC1C,aAAa,QAAQ,EAAE,OAAO,KAAK,CAAC;AAEtC,IAAM,oBAAoB,CACxB,UACA,SACA,YACS;AACT,QAAM,MAAW,aAAQ,QAAQ;AACjC,MAAI,CAAI,cAAW,GAAG,GAAG;AACvB,IAAG,aAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,EACpD;AACA,QAAM,OAAO,aAAa,QAAQ;AAClC,MAAI,OAAO,KAAK,OAAO,EAAE,WAAW,GAAG;AACrC,WAAO,KAAK,OAAO;AAAA,EACrB,OAAO;AACL,SAAK,OAAO,IAAI;AAAA,EAClB;AACA,QAAM,MAAM,GAAG,QAAQ;AACvB,EAAG,iBAAc,KAAK,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACpE,EAAG,cAAW,KAAK,QAAQ;AAC7B;AAwBA,IAAM,qBAAqB,CAAC,UAAkB,aAAqC;AAAA,EACjF,KAAK;AAAA,EACL,UAAU;AAAA,EAEV,KAAK,CAAC,aACJ,OAAO,KAAK,MAAM;AAChB,UAAM,OAAO,iBAAiB,UAAU,OAAO;AAC/C,WAAO,KAAK,QAAQ,KAAK;AAAA,EAC3B,CAAC;AAAA,EAEH,KAAK,CAAC,UAAU,UACd,OAAO,KAAK,MAAM;AAChB,UAAM,OAAO,iBAAiB,UAAU,OAAO;AAC/C,SAAK,QAAQ,IAAI;AACjB,sBAAkB,UAAU,SAAS,IAAI;AAAA,EAC3C,CAAC;AAAA,EAEH,QAAQ,CAAC,aACP,OAAO,KAAK,MAAM;AAChB,UAAM,OAAO,iBAAiB,UAAU,OAAO;AAC/C,UAAM,MAAM,YAAY;AACxB,WAAO,KAAK,QAAQ;AACpB,QAAI,IAAK,mBAAkB,UAAU,SAAS,IAAI;AAClD,WAAO;AAAA,EACT,CAAC;AAAA,EAEH,MAAM,MACJ,OAAO,KAAK,MAAM;AAChB,UAAM,OAAO,iBAAiB,UAAU,OAAO;AAC/C,WAAO,OAAO,KAAK,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,MAAM,EAAE,EAAE;AAAA,EAC1D,CAAC;AACL;AAMA,IAAM,aAAa;AAEZ,IAAM,oBAAoB,CAC/B,WAEA,aAAa;AAAA,EACX,KAAK;AAAA,EACL,MAAM,CAAC,QACL,OAAO,IAAI,aAAa;AACtB,UAAM,WAAW,aAAa,QAAQ,SAAS;AAE/C,WAAO,IAAI,QAAQ,YAAY,mBAAmB,UAAU,IAAI,MAAM,EAAE,CAAC;AAEzE,WAAO;AAAA,MACL,WAAW,EAAE,SAAS;AAAA,IACxB;AAAA,EACF,CAAC;AACL,CAAC;","names":[]}