@executor-js/plugin-file-secrets 0.0.2 → 0.2.1

package/dist/chunk-P2XE3FGE.js

@@ -0,0 +1,107 @@
+// src/index.ts
+import { Effect, Schema } from "effect";
+import * as fs from "fs";
+import * as path from "path";
+import {
+  definePlugin,
+  StorageError
+} from "@executor-js/sdk/core";
+var APP_NAME = "executor";
+var xdgDataHome = () => {
+  if (process.env.XDG_DATA_HOME?.trim()) return process.env.XDG_DATA_HOME.trim();
+  if (process.platform === "win32") {
+    return process.env.LOCALAPPDATA || process.env.APPDATA || path.join(process.env.USERPROFILE || "~", "AppData", "Local");
+  }
+  return path.join(process.env.HOME || "~", ".local", "share");
+};
+var authDir = (overrideDir) => overrideDir ?? path.join(xdgDataHome(), APP_NAME);
+var authFilePath = (overrideDir) => path.join(authDir(overrideDir), "auth.json");
+var ScopedAuthFile = Schema.Record(Schema.String, Schema.Record(Schema.String, Schema.String));
+var decodeScopedAuthFile = Schema.decodeUnknownEffect(Schema.fromJsonString(ScopedAuthFile));
+var isFileNotFoundCause = (cause) => typeof cause === "object" && cause !== null && "code" in cause && cause.code === "ENOENT";
+var toStorageError = (message) => (cause) => new StorageError({ message, cause });
+var readFullFile = (filePath) => {
+  if (!fs.existsSync(filePath)) return Effect.succeed({});
+  return Effect.try({
+    try: () => fs.readFileSync(filePath, "utf-8"),
+    catch: toStorageError("Failed to read auth file")
+  }).pipe(
+    Effect.catchIf(
+      (error) => isFileNotFoundCause(error.cause),
+      () => Effect.succeed("")
+    ),
+    Effect.flatMap(
+      (raw) => raw === "" ? Effect.succeed({}) : decodeScopedAuthFile(raw).pipe(
+        Effect.mapError(toStorageError("Failed to parse auth file"))
+      )
+    )
+  );
+};
+var readScopeSecrets = (filePath, scopeId) => readFullFile(filePath).pipe(Effect.map((file) => file[scopeId] ?? {}));
+var writeScopeSecrets = (filePath, scopeId, secrets) => {
+  const dir = path.dirname(filePath);
+  const tmp = `${filePath}.tmp`;
+  return Effect.gen(function* () {
+    if (!fs.existsSync(dir)) {
+      yield* Effect.try({
+        try: () => fs.mkdirSync(dir, { recursive: true, mode: 448 }),
+        catch: toStorageError("Failed to create auth directory")
+      });
+    }
+    const full = yield* readFullFile(filePath);
+    if (Object.keys(secrets).length === 0) {
+      delete full[scopeId];
+    } else {
+      full[scopeId] = secrets;
+    }
+    yield* Effect.try({
+      try: () => fs.writeFileSync(tmp, JSON.stringify(full, null, 2), { mode: 384 }),
+      catch: toStorageError("Failed to write temporary auth file")
+    });
+    yield* Effect.try({
+      try: () => fs.renameSync(tmp, filePath),
+      catch: toStorageError("Failed to replace auth file")
+    });
+  });
+};
+var makeFileSecretsExtension = (options) => ({
+  filePath: resolveFilePath(options)
+});
+var makeScopedProvider = (filePath, listScope) => ({
+  key: "file",
+  writable: true,
+  get: (secretId, scope) => readScopeSecrets(filePath, scope).pipe(Effect.map((data) => data[secretId] ?? null)),
+  has: (secretId, scope) => readScopeSecrets(filePath, scope).pipe(Effect.map((data) => secretId in data)),
+  set: (secretId, value, scope) => Effect.gen(function* () {
+    const data = yield* readScopeSecrets(filePath, scope);
+    data[secretId] = value;
+    yield* writeScopeSecrets(filePath, scope, data);
+  }),
+  delete: (secretId, scope) => Effect.gen(function* () {
+    const data = yield* readScopeSecrets(filePath, scope);
+    const had = secretId in data;
+    delete data[secretId];
+    if (had) yield* writeScopeSecrets(filePath, scope, data);
+    return had;
+  }),
+  list: () => readScopeSecrets(filePath, listScope).pipe(
+    Effect.map((data) => Object.keys(data).map((k) => ({ id: k, name: k })))
+  )
+});
+var resolveFilePath = (config) => authFilePath(config?.directory);
+var fileSecretsPlugin = definePlugin((options) => ({
+  id: "fileSecrets",
+  storage: () => ({}),
+  extension: () => makeFileSecretsExtension(options),
+  secretProviders: (ctx) => [
+    // list() falls back to the innermost scope for display; per-call
+    // get/set/delete honor the scope arg threaded from the secrets facade.
+    makeScopedProvider(resolveFilePath(options), ctx.scopes[0].id)
+  ]
+}));
+
+export {
+  xdgDataHome,
+  fileSecretsPlugin
+};
+//# sourceMappingURL=chunk-P2XE3FGE.js.map

package/dist/chunk-P2XE3FGE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\n\nimport {\n  definePlugin,\n  StorageError,\n  type PluginCtx,\n  type SecretProvider,\n} from \"@executor-js/sdk/core\";\n\n// ---------------------------------------------------------------------------\n// XDG data dir resolution\n// ---------------------------------------------------------------------------\n\nconst APP_NAME = \"executor\";\n\nexport const xdgDataHome = (): string => {\n  if (process.env.XDG_DATA_HOME?.trim()) return process.env.XDG_DATA_HOME.trim();\n  if (process.platform === \"win32\") {\n    return (\n      process.env.LOCALAPPDATA ||\n      process.env.APPDATA ||\n      path.join(process.env.USERPROFILE || \"~\", \"AppData\", \"Local\")\n    );\n  }\n  return path.join(process.env.HOME || \"~\", \".local\", \"share\");\n};\n\nconst authDir = (overrideDir?: string): string => overrideDir ?? path.join(xdgDataHome(), APP_NAME);\n\nconst authFilePath = (overrideDir?: string): string => path.join(authDir(overrideDir), \"auth.json\");\n\n// ---------------------------------------------------------------------------\n// Schema for the auth file\n//\n// Top-level keys are scope IDs, values are { secretId: secretValue } maps.\n//   { \"web-a1b2c3d4\": { \"github-token\": \"ghp_xxx\" } }\n// ---------------------------------------------------------------------------\n\nconst ScopedAuthFile = Schema.Record(Schema.String, Schema.Record(Schema.String, Schema.String));\nconst decodeScopedAuthFile = Schema.decodeUnknownEffect(Schema.fromJsonString(ScopedAuthFile));\n\n// ---------------------------------------------------------------------------\n// File I/O with restricted permissions\n//\n// These helpers keep real I/O and decode failures in the Effect error\n// channel as `StorageError`. Missing files are still treated as an empty\n// auth file, but malformed JSON, schema decode failures, and permission\n// errors no longer collapse into \"empty file\".\n// ---------------------------------------------------------------------------\n\nconst isFileNotFoundCause = (cause: unknown): cause is NodeJS.ErrnoException =>\n  typeof cause === \"object\" && cause !== null && \"code\" in cause && cause.code === \"ENOENT\";\n\nconst toStorageError =\n  (message: string) =>\n  (cause: unknown): StorageError =>\n    new StorageError({ message, cause });\n\nconst readFullFile = (\n  filePath: string,\n): Effect.Effect<Record<string, Record<string, string>>, StorageError> => {\n  if (!fs.existsSync(filePath)) return Effect.succeed({});\n  return Effect.try({\n    try: () => fs.readFileSync(filePath, \"utf-8\"),\n    catch: toStorageError(\"Failed to read auth file\"),\n  }).pipe(\n    Effect.catchIf(\n      (error) => isFileNotFoundCause(error.cause),\n      () => Effect.succeed(\"\"),\n    ),\n    Effect.flatMap((raw) =>\n      raw === \"\"\n        ? Effect.succeed({})\n        : decodeScopedAuthFile(raw).pipe(\n            Effect.mapError(toStorageError(\"Failed to parse auth file\")),\n          ),\n    ),\n  );\n};\n\nconst readScopeSecrets = (\n  filePath: string,\n  scopeId: string,\n): Effect.Effect<Record<string, string>, StorageError> =>\n  readFullFile(filePath).pipe(Effect.map((file) => file[scopeId] ?? {}));\n\nconst writeScopeSecrets = (\n  filePath: string,\n  scopeId: string,\n  secrets: Record<string, string>,\n): Effect.Effect<void, StorageError> => {\n  const dir = path.dirname(filePath);\n  const tmp = `${filePath}.tmp`;\n  return Effect.gen(function* () {\n    if (!fs.existsSync(dir)) {\n      yield* Effect.try({\n        try: () => fs.mkdirSync(dir, { recursive: true, mode: 0o700 }),\n        catch: toStorageError(\"Failed to create auth directory\"),\n      });\n    }\n    const full = yield* readFullFile(filePath);\n    if (Object.keys(secrets).length === 0) {\n      delete full[scopeId];\n    } else {\n      full[scopeId] = secrets;\n    }\n    yield* Effect.try({\n      try: () => fs.writeFileSync(tmp, JSON.stringify(full, null, 2), { mode: 0o600 }),\n      catch: toStorageError(\"Failed to write temporary auth file\"),\n    });\n    yield* Effect.try({\n      try: () => fs.renameSync(tmp, filePath),\n      catch: toStorageError(\"Failed to replace auth file\"),\n    });\n  });\n};\n\n// ---------------------------------------------------------------------------\n// Plugin config\n// ---------------------------------------------------------------------------\n\nexport interface FileSecretsPluginConfig {\n  /** Override the directory for auth.json (default: XDG data dir) */\n  readonly directory?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin extension — public API on executor.fileSecrets\n// ---------------------------------------------------------------------------\n\nconst makeFileSecretsExtension = (options: FileSecretsPluginConfig | undefined) => ({\n  filePath: resolveFilePath(options),\n});\n\nexport type FileSecretsExtension = ReturnType<typeof makeFileSecretsExtension>;\n\n// ---------------------------------------------------------------------------\n// Provider factory (internal)\n// ---------------------------------------------------------------------------\n\n// Scope arg is honored at every call: the auth.json is partitioned by\n// scope id, so read/write/delete route to `file[scope][secretId]`. The\n// provider is a singleton per executor; scope routing happens via the\n// arg passed from the executor's secrets facade.\n//\n// `list` enumerates the innermost scope the provider was configured\n// for — the executor's fallback/list path passes scope separately but\n// the SecretProvider.list signature is scope-agnostic. That's fine for\n// the current use: `list` feeds `secrets.list()` which already walks\n// the stack at the caller layer. Innermost-first is the display default.\nconst makeScopedProvider = (filePath: string, listScope: string): SecretProvider => ({\n  key: \"file\",\n  writable: true,\n\n  get: (secretId, scope) =>\n    readScopeSecrets(filePath, scope).pipe(Effect.map((data) => data[secretId] ?? null)),\n\n  has: (secretId, scope) =>\n    readScopeSecrets(filePath, scope).pipe(Effect.map((data) => secretId in data)),\n\n  set: (secretId, value, scope) =>\n    Effect.gen(function* () {\n      const data = yield* readScopeSecrets(filePath, scope);\n      data[secretId] = value;\n      yield* writeScopeSecrets(filePath, scope, data);\n    }),\n\n  delete: (secretId, scope) =>\n    Effect.gen(function* () {\n      const data = yield* readScopeSecrets(filePath, scope);\n      const had = secretId in data;\n      delete data[secretId];\n      if (had) yield* writeScopeSecrets(filePath, scope, data);\n      return had;\n    }),\n\n  list: () =>\n    readScopeSecrets(filePath, listScope).pipe(\n      Effect.map((data) => Object.keys(data).map((k) => ({ id: k, name: k }))),\n    ),\n});\n\n// ---------------------------------------------------------------------------\n// Plugin definition\n//\n// Compute the scoped file path identically in `extension` (for `filePath`)\n// and `secretProviders` (for the provider's read/write). Both receive ctx\n// and both are called once per createExecutor.\n// ---------------------------------------------------------------------------\n\nconst resolveFilePath = (config: FileSecretsPluginConfig | undefined): string =>\n  authFilePath(config?.directory);\n\nexport const fileSecretsPlugin = definePlugin((options?: FileSecretsPluginConfig) => ({\n  id: \"fileSecrets\" as const,\n  storage: () => ({}),\n\n  extension: () => makeFileSecretsExtension(options),\n\n  secretProviders: (ctx: PluginCtx<unknown>) => [\n    // list() falls back to the innermost scope for display; per-call\n    // get/set/delete honor the scope arg threaded from the secrets facade.\n    makeScopedProvider(resolveFilePath(options), ctx.scopes[0]!.id),\n  ],\n}));\n"],"mappings":";AAAA,SAAS,QAAQ,cAAc;AAC/B,YAAY,QAAQ;AACpB,YAAY,UAAU;AAEtB;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAMP,IAAM,WAAW;AAEV,IAAM,cAAc,MAAc;AACvC,MAAI,QAAQ,IAAI,eAAe,KAAK,EAAG,QAAO,QAAQ,IAAI,cAAc,KAAK;AAC7E,MAAI,QAAQ,aAAa,SAAS;AAChC,WACE,QAAQ,IAAI,gBACZ,QAAQ,IAAI,WACP,UAAK,QAAQ,IAAI,eAAe,KAAK,WAAW,OAAO;AAAA,EAEhE;AACA,SAAY,UAAK,QAAQ,IAAI,QAAQ,KAAK,UAAU,OAAO;AAC7D;AAEA,IAAM,UAAU,CAAC,gBAAiC,eAAoB,UAAK,YAAY,GAAG,QAAQ;AAElG,IAAM,eAAe,CAAC,gBAAsC,UAAK,QAAQ,WAAW,GAAG,WAAW;AASlG,IAAM,iBAAiB,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM,CAAC;AAC/F,IAAM,uBAAuB,OAAO,oBAAoB,OAAO,eAAe,cAAc,CAAC;AAW7F,IAAM,sBAAsB,CAAC,UAC3B,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS;AAEnF,IAAM,iBACJ,CAAC,YACD,CAAC,UACC,IAAI,aAAa,EAAE,SAAS,MAAM,CAAC;AAEvC,IAAM,eAAe,CACnB,aACwE;AACxE,MAAI,CAAI,cAAW,QAAQ,EAAG,QAAO,OAAO,QAAQ,CAAC,CAAC;AACtD,SAAO,OAAO,IAAI;AAAA,IAChB,KAAK,MAAS,gBAAa,UAAU,OAAO;AAAA,IAC5C,OAAO,eAAe,0BAA0B;AAAA,EAClD,CAAC,EAAE;AAAA,IACD,OAAO;AAAA,MACL,CAAC,UAAU,oBAAoB,MAAM,KAAK;AAAA,MAC1C,MAAM,OAAO,QAAQ,EAAE;AAAA,IACzB;AAAA,IACA,OAAO;AAAA,MAAQ,CAAC,QACd,QAAQ,KACJ,OAAO,QAAQ,CAAC,CAAC,IACjB,qBAAqB,GAAG,EAAE;AAAA,QACxB,OAAO,SAAS,eAAe,2BAA2B,CAAC;AAAA,MAC7D;AAAA,IACN;AAAA,EACF;AACF;AAEA,IAAM,mBAAmB,CACvB,UACA,YAEA,aAAa,QAAQ,EAAE,KAAK,OAAO,IAAI,CAAC,SAAS,KAAK,OAAO,KAAK,CAAC,CAAC,CAAC;AAEvE,IAAM,oBAAoB,CACxB,UACA,SACA,YACsC;AACtC,QAAM,MAAW,aAAQ,QAAQ;AACjC,QAAM,MAAM,GAAG,QAAQ;AACvB,SAAO,OAAO,IAAI,aAAa;AAC7B,QAAI,CAAI,cAAW,GAAG,GAAG;AACvB,aAAO,OAAO,IAAI;AAAA,QAChB,KAAK,MAAS,aAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,QAC7D,OAAO,eAAe,iCAAiC;AAAA,MACzD,CAAC;AAAA,IACH;AACA,UAAM,OAAO,OAAO,aAAa,QAAQ;AACzC,QAAI,OAAO,KAAK,OAAO,EAAE,WAAW,GAAG;AACrC,aAAO,KAAK,OAAO;AAAA,IACrB,OAAO;AACL,WAAK,OAAO,IAAI;AAAA,IAClB;AACA,WAAO,OAAO,IAAI;AAAA,MAChB,KAAK,MAAS,iBAAc,KAAK,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AAAA,MAC/E,OAAO,eAAe,qCAAqC;AAAA,IAC7D,CAAC;AACD,WAAO,OAAO,IAAI;AAAA,MAChB,KAAK,MAAS,cAAW,KAAK,QAAQ;AAAA,MACtC,OAAO,eAAe,6BAA6B;AAAA,IACrD,CAAC;AAAA,EACH,CAAC;AACH;AAeA,IAAM,2BAA2B,CAAC,aAAkD;AAAA,EAClF,UAAU,gBAAgB,OAAO;AACnC;AAkBA,IAAM,qBAAqB,CAAC,UAAkB,eAAuC;AAAA,EACnF,KAAK;AAAA,EACL,UAAU;AAAA,EAEV,KAAK,CAAC,UAAU,UACd,iBAAiB,UAAU,KAAK,EAAE,KAAK,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,KAAK,IAAI,CAAC;AAAA,EAErF,KAAK,CAAC,UAAU,UACd,iBAAiB,UAAU,KAAK,EAAE,KAAK,OAAO,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC;AAAA,EAE/E,KAAK,CAAC,UAAU,OAAO,UACrB,OAAO,IAAI,aAAa;AACtB,UAAM,OAAO,OAAO,iBAAiB,UAAU,KAAK;AACpD,SAAK,QAAQ,IAAI;AACjB,WAAO,kBAAkB,UAAU,OAAO,IAAI;AAAA,EAChD,CAAC;AAAA,EAEH,QAAQ,CAAC,UAAU,UACjB,OAAO,IAAI,aAAa;AACtB,UAAM,OAAO,OAAO,iBAAiB,UAAU,KAAK;AACpD,UAAM,MAAM,YAAY;AACxB,WAAO,KAAK,QAAQ;AACpB,QAAI,IAAK,QAAO,kBAAkB,UAAU,OAAO,IAAI;AACvD,WAAO;AAAA,EACT,CAAC;AAAA,EAEH,MAAM,MACJ,iBAAiB,UAAU,SAAS,EAAE;AAAA,IACpC,OAAO,IAAI,CAAC,SAAS,OAAO,KAAK,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,MAAM,EAAE,EAAE,CAAC;AAAA,EACzE;AACJ;AAUA,IAAM,kBAAkB,CAAC,WACvB,aAAa,QAAQ,SAAS;AAEzB,IAAM,oBAAoB,aAAa,CAAC,aAAuC;AAAA,EACpF,IAAI;AAAA,EACJ,SAAS,OAAO,CAAC;AAAA,EAEjB,WAAW,MAAM,yBAAyB,OAAO;AAAA,EAEjD,iBAAiB,CAAC,QAA4B;AAAA;AAAA;AAAA,IAG5C,mBAAmB,gBAAgB,OAAO,GAAG,IAAI,OAAO,CAAC,EAAG,EAAE;AAAA,EAChE;AACF,EAAE;","names":[]}

package/dist/core.js

@@ -1,7 +1,7 @@
 import {
   fileSecretsPlugin,
   xdgDataHome
-} from "./chunk-6YB3FO4B.js";
+} from "./chunk-P2XE3FGE.js";
 export {
   fileSecretsPlugin,
   xdgDataHome

package/dist/index.d.ts

@@ -3,8 +3,11 @@ export interface FileSecretsPluginConfig {
     /** Override the directory for auth.json (default: XDG data dir) */
     readonly directory?: string;
 }
-export interface FileSecretsExtension {
-    /** Path to the auth file */
-    readonly filePath: string;
-}
-export declare const fileSecretsPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"fileSecrets", FileSecretsExtension, {}, FileSecretsPluginConfig, undefined>;
+declare const makeFileSecretsExtension: (options: FileSecretsPluginConfig | undefined) => {
+    filePath: string;
+};
+export type FileSecretsExtension = ReturnType<typeof makeFileSecretsExtension>;
+export declare const fileSecretsPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"fileSecrets", {
+    filePath: string;
+}, {}, FileSecretsPluginConfig, undefined, undefined, import("effect/Layer").Layer<unknown, never, never>, import("effect/unstable/httpapi/HttpApiGroup").Any>;
+export {};

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   fileSecretsPlugin
-} from "./chunk-6YB3FO4B.js";
+} from "./chunk-P2XE3FGE.js";
 
 // src/promise.ts
 var fileSecretsPlugin2 = (config) => fileSecretsPlugin(config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/plugin-file-secrets",
-  "version": "0.0.2",
+  "version": "0.2.1",
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/file-secrets",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
@@ -40,7 +40,7 @@
     "typecheck:slow": "bunx tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@executor-js/sdk": "0.0.2",
+    "@executor-js/sdk": "0.2.1",
     "effect": "4.0.0-beta.59"
   },
   "devDependencies": {

package/dist/chunk-6YB3FO4B.js

@@ -1,118 +0,0 @@
-// src/index.ts
-import { Effect, Schema } from "effect";
-import * as fs from "fs";
-import * as path from "path";
-import {
-  definePlugin,
-  StorageError
-} from "@executor-js/sdk/core";
-var APP_NAME = "executor";
-var xdgDataHome = () => {
-  if (process.env.XDG_DATA_HOME?.trim()) return process.env.XDG_DATA_HOME.trim();
-  if (process.platform === "win32") {
-    return process.env.LOCALAPPDATA || process.env.APPDATA || path.join(process.env.USERPROFILE || "~", "AppData", "Local");
-  }
-  return path.join(process.env.HOME || "~", ".local", "share");
-};
-var authDir = (overrideDir) => overrideDir ?? path.join(xdgDataHome(), APP_NAME);
-var authFilePath = (overrideDir) => path.join(authDir(overrideDir), "auth.json");
-var ScopedAuthFile = Schema.Record(
-  Schema.String,
-  Schema.Record(Schema.String, Schema.String)
-);
-var decodeScopedAuthFile = Schema.decodeUnknownSync(ScopedAuthFile);
-var readFullFile = (filePath) => {
-  if (!fs.existsSync(filePath)) return {};
-  let raw;
-  try {
-    raw = fs.readFileSync(filePath, "utf-8");
-  } catch (cause) {
-    if (cause.code === "ENOENT") return {};
-    throw cause;
-  }
-  return decodeScopedAuthFile(JSON.parse(raw));
-};
-var readScopeSecrets = (filePath, scopeId) => readFullFile(filePath)[scopeId] ?? {};
-var writeScopeSecrets = (filePath, scopeId, secrets) => {
-  const dir = path.dirname(filePath);
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true, mode: 448 });
-  }
-  const full = readFullFile(filePath);
-  if (Object.keys(secrets).length === 0) {
-    delete full[scopeId];
-  } else {
-    full[scopeId] = secrets;
-  }
-  const tmp = `${filePath}.tmp`;
-  fs.writeFileSync(tmp, JSON.stringify(full, null, 2), { mode: 384 });
-  fs.renameSync(tmp, filePath);
-};
-var toStorageError = (cause) => new StorageError({
-  message: cause instanceof Error ? cause.message : String(cause),
-  cause
-});
-var makeScopedProvider = (filePath, listScope) => ({
-  key: "file",
-  writable: true,
-  get: (secretId, scope) => Effect.try({
-    try: () => {
-      const data = readScopeSecrets(filePath, scope);
-      return data[secretId] ?? null;
-    },
-    catch: toStorageError
-  }),
-  has: (secretId, scope) => Effect.try({
-    try: () => {
-      const data = readScopeSecrets(filePath, scope);
-      return secretId in data;
-    },
-    catch: toStorageError
-  }),
-  set: (secretId, value, scope) => Effect.try({
-    try: () => {
-      const data = readScopeSecrets(filePath, scope);
-      data[secretId] = value;
-      writeScopeSecrets(filePath, scope, data);
-    },
-    catch: toStorageError
-  }),
-  delete: (secretId, scope) => Effect.try({
-    try: () => {
-      const data = readScopeSecrets(filePath, scope);
-      const had = secretId in data;
-      delete data[secretId];
-      if (had) writeScopeSecrets(filePath, scope, data);
-      return had;
-    },
-    catch: toStorageError
-  }),
-  list: () => Effect.try({
-    try: () => {
-      const data = readScopeSecrets(filePath, listScope);
-      return Object.keys(data).map((k) => ({ id: k, name: k }));
-    },
-    catch: toStorageError
-  })
-});
-var resolveFilePath = (config) => authFilePath(config?.directory);
-var fileSecretsPlugin = definePlugin(
-  (options) => ({
-    id: "fileSecrets",
-    storage: () => ({}),
-    extension: (_ctx) => ({
-      filePath: resolveFilePath(options)
-    }),
-    secretProviders: (ctx) => [
-      // list() falls back to the innermost scope for display; per-call
-      // get/set/delete honor the scope arg threaded from the secrets facade.
-      makeScopedProvider(resolveFilePath(options), ctx.scopes[0].id)
-    ]
-  })
-);
-
-export {
-  xdgDataHome,
-  fileSecretsPlugin
-};
-//# sourceMappingURL=chunk-6YB3FO4B.js.map

package/dist/chunk-6YB3FO4B.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\nimport * as fs from \"node:fs\";\nimport * as path from \"node:path\";\n\nimport {\n  definePlugin,\n  StorageError,\n  type PluginCtx,\n  type SecretProvider,\n} from \"@executor-js/sdk/core\";\n\n// ---------------------------------------------------------------------------\n// XDG data dir resolution\n// ---------------------------------------------------------------------------\n\nconst APP_NAME = \"executor\";\n\nexport const xdgDataHome = (): string => {\n  if (process.env.XDG_DATA_HOME?.trim()) return process.env.XDG_DATA_HOME.trim();\n  if (process.platform === \"win32\") {\n    return (\n      process.env.LOCALAPPDATA ||\n      process.env.APPDATA ||\n      path.join(process.env.USERPROFILE || \"~\", \"AppData\", \"Local\")\n    );\n  }\n  return path.join(process.env.HOME || \"~\", \".local\", \"share\");\n};\n\nconst authDir = (overrideDir?: string): string =>\n  overrideDir ?? path.join(xdgDataHome(), APP_NAME);\n\nconst authFilePath = (overrideDir?: string): string =>\n  path.join(authDir(overrideDir), \"auth.json\");\n\n// ---------------------------------------------------------------------------\n// Schema for the auth file\n//\n// Top-level keys are scope IDs, values are { secretId: secretValue } maps.\n//   { \"web-a1b2c3d4\": { \"github-token\": \"ghp_xxx\" } }\n// ---------------------------------------------------------------------------\n\nconst ScopedAuthFile = Schema.Record(\n  Schema.String,\n  Schema.Record(Schema.String, Schema.String),\n);\nconst decodeScopedAuthFile = Schema.decodeUnknownSync(ScopedAuthFile);\n\n// ---------------------------------------------------------------------------\n// File I/O with restricted permissions\n//\n// These helpers throw on real I/O or decode failures — the provider wraps\n// every call in `Effect.try` so those throws surface as typed\n// `StorageError` on the Effect error channel. Previously `readFullFile`\n// used a blanket `try { ... } catch { return {}; }` which masked JSON\n// parse errors, schema decode failures, and permission errors as\n// \"empty file\", making misconfigured installs silently return null from\n// every `get`.\n// ---------------------------------------------------------------------------\n\nconst readFullFile = (filePath: string): Record<string, Record<string, string>> => {\n  if (!fs.existsSync(filePath)) return {};\n  let raw: string;\n  try {\n    raw = fs.readFileSync(filePath, \"utf-8\");\n  } catch (cause) {\n    // Treat \"file disappeared between existsSync and readFileSync\" as\n    // absence — anything else (EACCES, EISDIR, …) propagates.\n    if ((cause as NodeJS.ErrnoException).code === \"ENOENT\") return {};\n    throw cause;\n  }\n  return decodeScopedAuthFile(JSON.parse(raw));\n};\n\nconst readScopeSecrets = (filePath: string, scopeId: string): Record<string, string> =>\n  readFullFile(filePath)[scopeId] ?? {};\n\nconst writeScopeSecrets = (\n  filePath: string,\n  scopeId: string,\n  secrets: Record<string, string>,\n): void => {\n  const dir = path.dirname(filePath);\n  if (!fs.existsSync(dir)) {\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n  const full = readFullFile(filePath);\n  if (Object.keys(secrets).length === 0) {\n    delete full[scopeId];\n  } else {\n    full[scopeId] = secrets;\n  }\n  const tmp = `${filePath}.tmp`;\n  fs.writeFileSync(tmp, JSON.stringify(full, null, 2), { mode: 0o600 });\n  fs.renameSync(tmp, filePath);\n};\n\n// ---------------------------------------------------------------------------\n// Plugin config\n// ---------------------------------------------------------------------------\n\nexport interface FileSecretsPluginConfig {\n  /** Override the directory for auth.json (default: XDG data dir) */\n  readonly directory?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin extension — public API on executor.fileSecrets\n// ---------------------------------------------------------------------------\n\nexport interface FileSecretsExtension {\n  /** Path to the auth file */\n  readonly filePath: string;\n}\n\n// ---------------------------------------------------------------------------\n// Provider factory (internal)\n// ---------------------------------------------------------------------------\n\nconst toStorageError = (cause: unknown) =>\n  new StorageError({\n    message: cause instanceof Error ? cause.message : String(cause),\n    cause,\n  });\n\n// Scope arg is honored at every call: the auth.json is partitioned by\n// scope id, so read/write/delete route to `file[scope][secretId]`. The\n// provider is a singleton per executor; scope routing happens via the\n// arg passed from the executor's secrets facade.\n//\n// `list` enumerates the innermost scope the provider was configured\n// for — the executor's fallback/list path passes scope separately but\n// the SecretProvider.list signature is scope-agnostic. That's fine for\n// the current use: `list` feeds `secrets.list()` which already walks\n// the stack at the caller layer. Innermost-first is the display default.\nconst makeScopedProvider = (\n  filePath: string,\n  listScope: string,\n): SecretProvider => ({\n  key: \"file\",\n  writable: true,\n\n  get: (secretId, scope) =>\n    Effect.try({\n      try: () => {\n        const data = readScopeSecrets(filePath, scope);\n        return data[secretId] ?? null;\n      },\n      catch: toStorageError,\n    }),\n\n  has: (secretId, scope) =>\n    Effect.try({\n      try: () => {\n        const data = readScopeSecrets(filePath, scope);\n        return secretId in data;\n      },\n      catch: toStorageError,\n    }),\n\n  set: (secretId, value, scope) =>\n    Effect.try({\n      try: () => {\n        const data = readScopeSecrets(filePath, scope);\n        data[secretId] = value;\n        writeScopeSecrets(filePath, scope, data);\n      },\n      catch: toStorageError,\n    }),\n\n  delete: (secretId, scope) =>\n    Effect.try({\n      try: () => {\n        const data = readScopeSecrets(filePath, scope);\n        const had = secretId in data;\n        delete data[secretId];\n        if (had) writeScopeSecrets(filePath, scope, data);\n        return had;\n      },\n      catch: toStorageError,\n    }),\n\n  list: () =>\n    Effect.try({\n      try: () => {\n        const data = readScopeSecrets(filePath, listScope);\n        return Object.keys(data).map((k) => ({ id: k, name: k }));\n      },\n      catch: toStorageError,\n    }),\n});\n\n// ---------------------------------------------------------------------------\n// Plugin definition\n//\n// Compute the scoped file path identically in `extension` (for `filePath`)\n// and `secretProviders` (for the provider's read/write). Both receive ctx\n// and both are called once per createExecutor.\n// ---------------------------------------------------------------------------\n\nconst resolveFilePath = (config: FileSecretsPluginConfig | undefined): string =>\n  authFilePath(config?.directory);\n\nexport const fileSecretsPlugin = definePlugin(\n  (options?: FileSecretsPluginConfig) => ({\n    id: \"fileSecrets\" as const,\n    storage: () => ({}),\n\n    extension: (_ctx): FileSecretsExtension => ({\n      filePath: resolveFilePath(options),\n    }),\n\n    secretProviders: (ctx: PluginCtx<unknown>) => [\n      // list() falls back to the innermost scope for display; per-call\n      // get/set/delete honor the scope arg threaded from the secrets facade.\n      makeScopedProvider(resolveFilePath(options), ctx.scopes[0]!.id as string),\n    ],\n  }),\n);\n"],"mappings":";AAAA,SAAS,QAAQ,cAAc;AAC/B,YAAY,QAAQ;AACpB,YAAY,UAAU;AAEtB;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAMP,IAAM,WAAW;AAEV,IAAM,cAAc,MAAc;AACvC,MAAI,QAAQ,IAAI,eAAe,KAAK,EAAG,QAAO,QAAQ,IAAI,cAAc,KAAK;AAC7E,MAAI,QAAQ,aAAa,SAAS;AAChC,WACE,QAAQ,IAAI,gBACZ,QAAQ,IAAI,WACP,UAAK,QAAQ,IAAI,eAAe,KAAK,WAAW,OAAO;AAAA,EAEhE;AACA,SAAY,UAAK,QAAQ,IAAI,QAAQ,KAAK,UAAU,OAAO;AAC7D;AAEA,IAAM,UAAU,CAAC,gBACf,eAAoB,UAAK,YAAY,GAAG,QAAQ;AAElD,IAAM,eAAe,CAAC,gBACf,UAAK,QAAQ,WAAW,GAAG,WAAW;AAS7C,IAAM,iBAAiB,OAAO;AAAA,EAC5B,OAAO;AAAA,EACP,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM;AAC5C;AACA,IAAM,uBAAuB,OAAO,kBAAkB,cAAc;AAcpE,IAAM,eAAe,CAAC,aAA6D;AACjF,MAAI,CAAI,cAAW,QAAQ,EAAG,QAAO,CAAC;AACtC,MAAI;AACJ,MAAI;AACF,UAAS,gBAAa,UAAU,OAAO;AAAA,EACzC,SAAS,OAAO;AAGd,QAAK,MAAgC,SAAS,SAAU,QAAO,CAAC;AAChE,UAAM;AAAA,EACR;AACA,SAAO,qBAAqB,KAAK,MAAM,GAAG,CAAC;AAC7C;AAEA,IAAM,mBAAmB,CAAC,UAAkB,YAC1C,aAAa,QAAQ,EAAE,OAAO,KAAK,CAAC;AAEtC,IAAM,oBAAoB,CACxB,UACA,SACA,YACS;AACT,QAAM,MAAW,aAAQ,QAAQ;AACjC,MAAI,CAAI,cAAW,GAAG,GAAG;AACvB,IAAG,aAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,EACpD;AACA,QAAM,OAAO,aAAa,QAAQ;AAClC,MAAI,OAAO,KAAK,OAAO,EAAE,WAAW,GAAG;AACrC,WAAO,KAAK,OAAO;AAAA,EACrB,OAAO;AACL,SAAK,OAAO,IAAI;AAAA,EAClB;AACA,QAAM,MAAM,GAAG,QAAQ;AACvB,EAAG,iBAAc,KAAK,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACpE,EAAG,cAAW,KAAK,QAAQ;AAC7B;AAwBA,IAAM,iBAAiB,CAAC,UACtB,IAAI,aAAa;AAAA,EACf,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EAC9D;AACF,CAAC;AAYH,IAAM,qBAAqB,CACzB,UACA,eACoB;AAAA,EACpB,KAAK;AAAA,EACL,UAAU;AAAA,EAEV,KAAK,CAAC,UAAU,UACd,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,aAAO,KAAK,QAAQ,KAAK;AAAA,IAC3B;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AAAA,EAEH,KAAK,CAAC,UAAU,UACd,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,aAAO,YAAY;AAAA,IACrB;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AAAA,EAEH,KAAK,CAAC,UAAU,OAAO,UACrB,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,WAAK,QAAQ,IAAI;AACjB,wBAAkB,UAAU,OAAO,IAAI;AAAA,IACzC;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AAAA,EAEH,QAAQ,CAAC,UAAU,UACjB,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,OAAO,iBAAiB,UAAU,KAAK;AAC7C,YAAM,MAAM,YAAY;AACxB,aAAO,KAAK,QAAQ;AACpB,UAAI,IAAK,mBAAkB,UAAU,OAAO,IAAI;AAChD,aAAO;AAAA,IACT;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AAAA,EAEH,MAAM,MACJ,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,OAAO,iBAAiB,UAAU,SAAS;AACjD,aAAO,OAAO,KAAK,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,MAAM,EAAE,EAAE;AAAA,IAC1D;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AACL;AAUA,IAAM,kBAAkB,CAAC,WACvB,aAAa,QAAQ,SAAS;AAEzB,IAAM,oBAAoB;AAAA,EAC/B,CAAC,aAAuC;AAAA,IACtC,IAAI;AAAA,IACJ,SAAS,OAAO,CAAC;AAAA,IAEjB,WAAW,CAAC,UAAgC;AAAA,MAC1C,UAAU,gBAAgB,OAAO;AAAA,IACnC;AAAA,IAEA,iBAAiB,CAAC,QAA4B;AAAA;AAAA;AAAA,MAG5C,mBAAmB,gBAAgB,OAAO,GAAG,IAAI,OAAO,CAAC,EAAG,EAAY;AAAA,IAC1E;AAAA,EACF;AACF;","names":[]}