@executor-js/plugin-keychain 0.0.2 → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"sources":["../src/index.ts","../src/keyring.ts","../src/errors.ts","../src/provider.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport {\n definePlugin,\n type PluginCtx,\n type SecretProvider,\n} from \"@executor-js/sdk/core\";\n\nimport {\n deletePassword,\n displayName,\n getPassword,\n isSupportedPlatform,\n resolveServiceName,\n setPassword,\n} from \"./keyring\";\nimport { makeKeychainProvider } from \"./provider\";\n\n// Probe the keychain by writing and then deleting a sentinel entry. A\n// read-only probe isn't enough — on some Linux environments (WSL2,\n// headless CI) `getPassword` for a missing key returns null without\n// error, but `setPassword` fails because the secret-service backend\n// isn't actually reachable. Writing is the capability the executor\n// cares about, so test it directly.\nconst PROBE_ACCOUNT = \"__executor_keychain_probe__\";\nconst PROBE_VALUE = \"probe\";\n\n// ---------------------------------------------------------------------------\n// Re-exports\n// ---------------------------------------------------------------------------\n\nexport { KeychainError } from \"./errors\";\nexport { makeKeychainProvider } from \"./provider\";\nexport { isSupportedPlatform, displayName } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// Plugin config\n// ---------------------------------------------------------------------------\n\nexport interface KeychainPluginConfig {\n /** Override the keychain service name (default: \"executor\") */\n readonly serviceName?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin extension — public API on executor.keychain\n// ---------------------------------------------------------------------------\n\nexport interface KeychainExtension {\n /** Human-readable name for the keychain on this platform */\n readonly displayName: string;\n\n /** Whether the current platform supports system keychain */\n readonly isSupported: boolean;\n\n /** Check if a secret exists in the system keychain */\n readonly has: (id: string) => Effect.Effect<boolean>;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin definition\n// ---------------------------------------------------------------------------\n\n// Scope the keychain service name to the current executor scope so each\n// folder / workspace gets its own set of keychain entries. Computed\n// identically in `extension` and `secretProviders` — both receive ctx and\n// both are called once per createExecutor, so the derivation stays pure.\nconst scopedServiceName = (\n ctx: PluginCtx<unknown>,\n options: KeychainPluginConfig | undefined,\n): string =>\n `${resolveServiceName(options?.serviceName)}/${ctx.scopes[0]!.id as string}`;\n\nexport const keychainPlugin = definePlugin(\n (options?: KeychainPluginConfig) => ({\n id: \"keychain\" as const,\n storage: () => ({}),\n\n extension: (ctx): KeychainExtension => {\n const serviceName = scopedServiceName(ctx, options);\n return {\n displayName: displayName(),\n isSupported: isSupportedPlatform(),\n has: (id) =>\n getPassword(serviceName, id).pipe(\n Effect.map((v) => v !== null),\n Effect.orElseSucceed(() => false),\n ),\n };\n },\n\n secretProviders: (ctx): Effect.Effect<readonly SecretProvider[]> =>\n Effect.gen(function* () {\n const serviceName = scopedServiceName(ctx, options);\n const reachable = yield* setPassword(\n serviceName,\n PROBE_ACCOUNT,\n PROBE_VALUE,\n ).pipe(\n Effect.andThen(\n deletePassword(serviceName, PROBE_ACCOUNT).pipe(\n Effect.catch(() => Effect.void),\n ),\n ),\n Effect.as(true),\n Effect.catch((cause) =>\n Effect.logWarning(\n `keychain unavailable, skipping provider registration: ${cause.message}`,\n ).pipe(Effect.as(false)),\n ),\n );\n return reachable ? [makeKeychainProvider(serviceName)] : [];\n }),\n }),\n);\n","import { createRequire } from \"node:module\";\n\nimport { Effect } from \"effect\";\n\nimport { KeychainError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst DEFAULT_SERVICE_NAME = \"executor\";\nconst SERVICE_NAME_ENV = \"EXECUTOR_KEYCHAIN_SERVICE_NAME\";\n\n// ---------------------------------------------------------------------------\n// Platform helpers\n// ---------------------------------------------------------------------------\n\nexport const isSupportedPlatform = () =>\n process.platform === \"darwin\" || process.platform === \"linux\" || process.platform === \"win32\";\n\nexport const displayName = () =>\n process.platform === \"darwin\"\n ? \"macOS Keychain\"\n : process.platform === \"win32\"\n ? \"Windows Credential Manager\"\n : \"Desktop Keyring\";\n\nexport const resolveServiceName = (explicit?: string): string =>\n explicit?.trim() || process.env[SERVICE_NAME_ENV]?.trim() || DEFAULT_SERVICE_NAME;\n\n// ---------------------------------------------------------------------------\n// Lazy-load @napi-rs/keyring (native module)\n// ---------------------------------------------------------------------------\n\ntype EntryConstructor = (typeof import(\"@napi-rs/keyring\"))[\"Entry\"];\n\nlet entryCtorPromise: Promise<EntryConstructor> | null = null;\n\n// In compiled bun binaries (`bun build --compile`) `.node` modules aren't\n// included in bunfs and there's no node_modules at runtime, so\n// @napi-rs/keyring's loader can't find its platform-specific binding.\n// `apps/cli/src/build.ts` copies the .node next to the executor and\n// `apps/cli/src/main.ts` exports its absolute path here. We load it\n// directly because @napi-rs/keyring@1.2.0's NAPI_RS_NATIVE_LIBRARY_PATH\n// branch is buggy (assigns to a local that gets overwritten before return).\nconst loadEntryCtor = async (): Promise<EntryConstructor> => {\n const directPath = process.env.EXECUTOR_KEYRING_NATIVE_PATH;\n if (directPath) {\n const req = createRequire(import.meta.url);\n return (req(directPath) as { Entry: EntryConstructor }).Entry;\n }\n const { Entry } = await import(\"@napi-rs/keyring\");\n return Entry;\n};\n\nconst loadEntry = (): Effect.Effect<EntryConstructor, KeychainError> =>\n Effect.tryPromise({\n try: async () => {\n if (!isSupportedPlatform()) {\n throw new Error(`unsupported platform '${process.platform}'`);\n }\n entryCtorPromise ??= loadEntryCtor();\n return await entryCtorPromise;\n },\n catch: (cause) =>\n new KeychainError({\n message: `Failed loading native keyring: ${cause instanceof Error ? cause.message : String(cause)}`,\n cause,\n }),\n });\n\nconst createEntry = (serviceName: string, account: string) =>\n Effect.flatMap(loadEntry(), (Entry) =>\n Effect.try({\n try: () => new Entry(serviceName, account),\n catch: (cause) =>\n new KeychainError({\n message: `Failed creating keyring entry: ${cause instanceof Error ? cause.message : String(cause)}`,\n cause,\n }),\n }),\n );\n\n// ---------------------------------------------------------------------------\n// Low-level keychain operations\n// ---------------------------------------------------------------------------\n\nexport const getPassword = (\n serviceName: string,\n account: string,\n): Effect.Effect<string | null, KeychainError> =>\n Effect.flatMap(createEntry(serviceName, account), (entry) =>\n Effect.try({\n try: () => entry.getPassword(),\n catch: () => new KeychainError({ message: `Failed reading secret for account '${account}'` }),\n }),\n );\n\nexport const setPassword = (\n serviceName: string,\n account: string,\n value: string,\n): Effect.Effect<void, KeychainError> =>\n Effect.flatMap(createEntry(serviceName, account), (entry) =>\n Effect.try({\n try: () => entry.setPassword(value),\n catch: (cause) =>\n new KeychainError({\n message: `Failed writing secret: ${cause instanceof Error ? cause.message : String(cause)}`,\n cause,\n }),\n }).pipe(Effect.asVoid),\n );\n\nexport const deletePassword = (\n serviceName: string,\n account: string,\n): Effect.Effect<boolean, KeychainError> =>\n Effect.flatMap(createEntry(serviceName, account), (entry) =>\n Effect.try({\n try: () => {\n entry.deletePassword();\n return true;\n },\n catch: () =>\n new KeychainError({ message: `Failed deleting secret for account '${account}'` }),\n }),\n );\n","import { Data } from \"effect\";\n\nexport class KeychainError extends Data.TaggedError(\"KeychainError\")<{\n readonly message: string;\n readonly cause?: unknown;\n}> {}\n","import { Effect } from \"effect\";\n\nimport { StorageError, type SecretProvider } from \"@executor-js/sdk/core\";\n\nimport { getPassword, setPassword, deletePassword } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// SecretProvider adapter — bridges keyring into SDK resolution chain\n//\n// The underlying `@napi-rs/keyring` sync API encodes \"no entry\" as an\n// ordinary return value (`getPassword()` → `null`, `deletePassword()` →\n// `false`), and only throws on real failures (keychain locked, permission\n// denied, platform init failure, etc.). `keyring.ts` wraps those thrown\n// failures as `KeychainError`. We translate `KeychainError` →\n// `StorageError` so the HTTP edge can capture it to telemetry and surface\n// an opaque `InternalError({ traceId })` — previously `orElseSucceed`\n// silently converted every failure into \"nothing found\", which made it\n// impossible to debug why secrets weren't resolving.\n// ---------------------------------------------------------------------------\n\nconst toStorageError = (cause: { readonly message: string; readonly cause?: unknown }) =>\n new StorageError({ message: cause.message, cause: cause.cause ?? cause });\n\n// Scope arg is ignored — keychain partitions by `serviceName`, which the\n// host fixes per executor at construction time. A future refactor could\n// fold `scope` into the service name, but today a keychain provider\n// instance is already one-scope.\nexport const makeKeychainProvider = (serviceName: string): SecretProvider => ({\n key: \"keychain\",\n writable: true,\n get: (secretId, _scope) =>\n getPassword(serviceName, secretId).pipe(Effect.mapError(toStorageError)),\n set: (secretId, value, _scope) =>\n setPassword(serviceName, secretId, value).pipe(Effect.mapError(toStorageError)),\n delete: (secretId, _scope) =>\n deletePassword(serviceName, secretId).pipe(Effect.mapError(toStorageError)),\n // Keychain doesn't support enumerating — you need to know the account name\n list: undefined,\n});\n"],"mappings":";AAAA,SAAS,UAAAA,eAAc;AAEvB;AAAA,EACE;AAAA,OAGK;;;ACNP,SAAS,qBAAqB;AAE9B,SAAS,cAAc;;;ACFvB,SAAS,YAAY;AAEd,IAAM,gBAAN,cAA4B,KAAK,YAAY,eAAe,EAGhE;AAAC;;;ADKJ,IAAM,uBAAuB;AAC7B,IAAM,mBAAmB;AAMlB,IAAM,sBAAsB,MACjC,QAAQ,aAAa,YAAY,QAAQ,aAAa,WAAW,QAAQ,aAAa;AAEjF,IAAM,cAAc,MACzB,QAAQ,aAAa,WACjB,mBACA,QAAQ,aAAa,UACnB,+BACA;AAED,IAAM,qBAAqB,CAAC,aACjC,UAAU,KAAK,KAAK,QAAQ,IAAI,gBAAgB,GAAG,KAAK,KAAK;AAQ/D,IAAI,mBAAqD;AASzD,IAAM,gBAAgB,YAAuC;AAC3D,QAAM,aAAa,QAAQ,IAAI;AAC/B,MAAI,YAAY;AACd,UAAM,MAAM,cAAc,YAAY,GAAG;AACzC,WAAQ,IAAI,UAAU,EAAkC;AAAA,EAC1D;AACA,QAAM,EAAE,MAAM,IAAI,MAAM,OAAO,kBAAkB;AACjD,SAAO;AACT;AAEA,IAAM,YAAY,MAChB,OAAO,WAAW;AAAA,EAChB,KAAK,YAAY;AACf,QAAI,CAAC,oBAAoB,GAAG;AAC1B,YAAM,IAAI,MAAM,yBAAyB,QAAQ,QAAQ,GAAG;AAAA,IAC9D;AACA,yBAAqB,cAAc;AACnC,WAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,IAChB,SAAS,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACjG;AAAA,EACF,CAAC;AACL,CAAC;AAEH,IAAM,cAAc,CAAC,aAAqB,YACxC,OAAO;AAAA,EAAQ,UAAU;AAAA,EAAG,CAAC,UAC3B,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,IAAI,MAAM,aAAa,OAAO;AAAA,IACzC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACjG;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACH;AAMK,IAAM,cAAc,CACzB,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY;AAAA,IAC7B,OAAO,MAAM,IAAI,cAAc,EAAE,SAAS,sCAAsC,OAAO,IAAI,CAAC;AAAA,EAC9F,CAAC;AACH;AAEK,IAAM,cAAc,CACzB,aACA,SACA,UAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY,KAAK;AAAA,IAClC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACzF;AAAA,IACF,CAAC;AAAA,EACL,CAAC,EAAE,KAAK,OAAO,MAAM;AACvB;AAEK,IAAM,iBAAiB,CAC5B,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,eAAe;AACrB,aAAO;AAAA,IACT;AAAA,IACA,OAAO,MACL,IAAI,cAAc,EAAE,SAAS,uCAAuC,OAAO,IAAI,CAAC;AAAA,EACpF,CAAC;AACH;;;AE/HF,SAAS,UAAAC,eAAc;AAEvB,SAAS,oBAAyC;AAkBlD,IAAM,iBAAiB,CAAC,UACtB,IAAI,aAAa,EAAE,SAAS,MAAM,SAAS,OAAO,MAAM,SAAS,MAAM,CAAC;AAMnE,IAAM,uBAAuB,CAAC,iBAAyC;AAAA,EAC5E,KAAK;AAAA,EACL,UAAU;AAAA,EACV,KAAK,CAAC,UAAU,WACd,YAAY,aAAa,QAAQ,EAAE,KAAKC,QAAO,SAAS,cAAc,CAAC;AAAA,EACzE,KAAK,CAAC,UAAU,OAAO,WACrB,YAAY,aAAa,UAAU,KAAK,EAAE,KAAKA,QAAO,SAAS,cAAc,CAAC;AAAA,EAChF,QAAQ,CAAC,UAAU,WACjB,eAAe,aAAa,QAAQ,EAAE,KAAKA,QAAO,SAAS,cAAc,CAAC;AAAA;AAAA,EAE5E,MAAM;AACR;;;AHdA,IAAM,gBAAgB;AACtB,IAAM,cAAc;AA0CpB,IAAM,oBAAoB,CACxB,KACA,YAEA,GAAG,mBAAmB,SAAS,WAAW,CAAC,IAAI,IAAI,OAAO,CAAC,EAAG,EAAY;AAErE,IAAM,iBAAiB;AAAA,EAC5B,CAAC,aAAoC;AAAA,IACnC,IAAI;AAAA,IACJ,SAAS,OAAO,CAAC;AAAA,IAEjB,WAAW,CAAC,QAA2B;AACrC,YAAM,cAAc,kBAAkB,KAAK,OAAO;AAClD,aAAO;AAAA,QACL,aAAa,YAAY;AAAA,QACzB,aAAa,oBAAoB;AAAA,QACjC,KAAK,CAAC,OACJ,YAAY,aAAa,EAAE,EAAE;AAAA,UAC3BC,QAAO,IAAI,CAAC,MAAM,MAAM,IAAI;AAAA,UAC5BA,QAAO,cAAc,MAAM,KAAK;AAAA,QAClC;AAAA,MACJ;AAAA,IACF;AAAA,IAEA,iBAAiB,CAAC,QAChBA,QAAO,IAAI,aAAa;AACtB,YAAM,cAAc,kBAAkB,KAAK,OAAO;AAClD,YAAM,YAAY,OAAO;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE;AAAA,QACAA,QAAO;AAAA,UACL,eAAe,aAAa,aAAa,EAAE;AAAA,YACzCA,QAAO,MAAM,MAAMA,QAAO,IAAI;AAAA,UAChC;AAAA,QACF;AAAA,QACAA,QAAO,GAAG,IAAI;AAAA,QACdA,QAAO;AAAA,UAAM,CAAC,UACZA,QAAO;AAAA,YACL,yDAAyD,MAAM,OAAO;AAAA,UACxE,EAAE,KAAKA,QAAO,GAAG,KAAK,CAAC;AAAA,QACzB;AAAA,MACF;AACA,aAAO,YAAY,CAAC,qBAAqB,WAAW,CAAC,IAAI,CAAC;AAAA,IAC5D,CAAC;AAAA,EACL;AACF;","names":["Effect","Effect","Effect","Effect"]}
|
package/dist/core.js
CHANGED
package/dist/index.d.ts
CHANGED
|
@@ -14,4 +14,4 @@ export interface KeychainExtension {
|
|
|
14
14
|
/** Check if a secret exists in the system keychain */
|
|
15
15
|
readonly has: (id: string) => Effect.Effect<boolean>;
|
|
16
16
|
}
|
|
17
|
-
export declare const keychainPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"keychain", KeychainExtension, {}, KeychainPluginConfig, undefined>;
|
|
17
|
+
export declare const keychainPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"keychain", KeychainExtension, {}, KeychainPluginConfig, undefined, undefined, import("effect/Layer").Layer<unknown, never, never>, import("effect/unstable/httpapi/HttpApiGroup").Any>;
|
package/dist/index.js
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@executor-js/plugin-keychain",
|
|
3
|
-
"version": "0.0
|
|
3
|
+
"version": "0.1.0",
|
|
4
4
|
"homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/keychain",
|
|
5
5
|
"bugs": {
|
|
6
6
|
"url": "https://github.com/RhysSullivan/executor/issues"
|
|
@@ -40,7 +40,7 @@
|
|
|
40
40
|
"typecheck:slow": "bunx tsc --noEmit -p tsconfig.json"
|
|
41
41
|
},
|
|
42
42
|
"dependencies": {
|
|
43
|
-
"@executor-js/sdk": "0.0
|
|
43
|
+
"@executor-js/sdk": "0.1.0",
|
|
44
44
|
"@napi-rs/keyring": "^1.2.0",
|
|
45
45
|
"effect": "4.0.0-beta.59"
|
|
46
46
|
},
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/index.ts","../src/keyring.ts","../src/errors.ts","../src/provider.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport {\n definePlugin,\n type PluginCtx,\n type SecretProvider,\n} from \"@executor-js/sdk/core\";\n\nimport {\n deletePassword,\n displayName,\n getPassword,\n isSupportedPlatform,\n resolveServiceName,\n setPassword,\n} from \"./keyring\";\nimport { makeKeychainProvider } from \"./provider\";\n\n// Probe the keychain by writing and then deleting a sentinel entry. A\n// read-only probe isn't enough — on some Linux environments (WSL2,\n// headless CI) `getPassword` for a missing key returns null without\n// error, but `setPassword` fails because the secret-service backend\n// isn't actually reachable. Writing is the capability the executor\n// cares about, so test it directly.\nconst PROBE_ACCOUNT = \"__executor_keychain_probe__\";\nconst PROBE_VALUE = \"probe\";\n\n// ---------------------------------------------------------------------------\n// Re-exports\n// ---------------------------------------------------------------------------\n\nexport { KeychainError } from \"./errors\";\nexport { makeKeychainProvider } from \"./provider\";\nexport { isSupportedPlatform, displayName } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// Plugin config\n// ---------------------------------------------------------------------------\n\nexport interface KeychainPluginConfig {\n /** Override the keychain service name (default: \"executor\") */\n readonly serviceName?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin extension — public API on executor.keychain\n// ---------------------------------------------------------------------------\n\nexport interface KeychainExtension {\n /** Human-readable name for the keychain on this platform */\n readonly displayName: string;\n\n /** Whether the current platform supports system keychain */\n readonly isSupported: boolean;\n\n /** Check if a secret exists in the system keychain */\n readonly has: (id: string) => Effect.Effect<boolean>;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin definition\n// ---------------------------------------------------------------------------\n\n// Scope the keychain service name to the current executor scope so each\n// folder / workspace gets its own set of keychain entries. Computed\n// identically in `extension` and `secretProviders` — both receive ctx and\n// both are called once per createExecutor, so the derivation stays pure.\nconst scopedServiceName = (\n ctx: PluginCtx<unknown>,\n options: KeychainPluginConfig | undefined,\n): string =>\n `${resolveServiceName(options?.serviceName)}/${ctx.scopes[0]!.id as string}`;\n\nexport const keychainPlugin = definePlugin<\n \"keychain\",\n KeychainExtension,\n {},\n undefined,\n KeychainPluginConfig\n>(\n (options?: KeychainPluginConfig) => ({\n id: \"keychain\" as const,\n storage: () => ({}),\n\n extension: (ctx): KeychainExtension => {\n const serviceName = scopedServiceName(ctx, options);\n return {\n displayName: displayName(),\n isSupported: isSupportedPlatform(),\n has: (id) =>\n getPassword(serviceName, id).pipe(\n Effect.map((v) => v !== null),\n Effect.orElseSucceed(() => false),\n ),\n };\n },\n\n secretProviders: (ctx): Effect.Effect<readonly SecretProvider[]> =>\n Effect.gen(function* () {\n const serviceName = scopedServiceName(ctx, options);\n const reachable = yield* setPassword(\n serviceName,\n PROBE_ACCOUNT,\n PROBE_VALUE,\n ).pipe(\n Effect.andThen(\n deletePassword(serviceName, PROBE_ACCOUNT).pipe(\n Effect.catch(() => Effect.void),\n ),\n ),\n Effect.as(true),\n Effect.catch((cause) =>\n Effect.logWarning(\n `keychain unavailable, skipping provider registration: ${cause.message}`,\n ).pipe(Effect.as(false)),\n ),\n );\n return reachable ? [makeKeychainProvider(serviceName)] : [];\n }),\n }),\n);\n","import { createRequire } from \"node:module\";\n\nimport { Effect } from \"effect\";\n\nimport { KeychainError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst DEFAULT_SERVICE_NAME = \"executor\";\nconst SERVICE_NAME_ENV = \"EXECUTOR_KEYCHAIN_SERVICE_NAME\";\n\n// ---------------------------------------------------------------------------\n// Platform helpers\n// ---------------------------------------------------------------------------\n\nexport const isSupportedPlatform = () =>\n process.platform === \"darwin\" || process.platform === \"linux\" || process.platform === \"win32\";\n\nexport const displayName = () =>\n process.platform === \"darwin\"\n ? \"macOS Keychain\"\n : process.platform === \"win32\"\n ? \"Windows Credential Manager\"\n : \"Desktop Keyring\";\n\nexport const resolveServiceName = (explicit?: string): string =>\n explicit?.trim() || process.env[SERVICE_NAME_ENV]?.trim() || DEFAULT_SERVICE_NAME;\n\n// ---------------------------------------------------------------------------\n// Lazy-load @napi-rs/keyring (native module)\n// ---------------------------------------------------------------------------\n\ntype EntryConstructor = (typeof import(\"@napi-rs/keyring\"))[\"Entry\"];\n\nlet entryCtorPromise: Promise<EntryConstructor> | null = null;\n\n// In compiled bun binaries (`bun build --compile`) `.node` modules aren't\n// included in bunfs and there's no node_modules at runtime, so\n// @napi-rs/keyring's loader can't find its platform-specific binding.\n// `apps/cli/src/build.ts` copies the .node next to the executor and\n// `apps/cli/src/main.ts` exports its absolute path here. We load it\n// directly because @napi-rs/keyring@1.2.0's NAPI_RS_NATIVE_LIBRARY_PATH\n// branch is buggy (assigns to a local that gets overwritten before return).\nconst loadEntryCtor = async (): Promise<EntryConstructor> => {\n const directPath = process.env.EXECUTOR_KEYRING_NATIVE_PATH;\n if (directPath) {\n const req = createRequire(import.meta.url);\n return (req(directPath) as { Entry: EntryConstructor }).Entry;\n }\n const { Entry } = await import(\"@napi-rs/keyring\");\n return Entry;\n};\n\nconst loadEntry = (): Effect.Effect<EntryConstructor, KeychainError> =>\n Effect.tryPromise({\n try: async () => {\n if (!isSupportedPlatform()) {\n throw new Error(`unsupported platform '${process.platform}'`);\n }\n entryCtorPromise ??= loadEntryCtor();\n return await entryCtorPromise;\n },\n catch: (cause) =>\n new KeychainError({\n message: `Failed loading native keyring: ${cause instanceof Error ? cause.message : String(cause)}`,\n cause,\n }),\n });\n\nconst createEntry = (serviceName: string, account: string) =>\n Effect.flatMap(loadEntry(), (Entry) =>\n Effect.try({\n try: () => new Entry(serviceName, account),\n catch: (cause) =>\n new KeychainError({\n message: `Failed creating keyring entry: ${cause instanceof Error ? cause.message : String(cause)}`,\n cause,\n }),\n }),\n );\n\n// ---------------------------------------------------------------------------\n// Low-level keychain operations\n// ---------------------------------------------------------------------------\n\nexport const getPassword = (\n serviceName: string,\n account: string,\n): Effect.Effect<string | null, KeychainError> =>\n Effect.flatMap(createEntry(serviceName, account), (entry) =>\n Effect.try({\n try: () => entry.getPassword(),\n catch: () => new KeychainError({ message: `Failed reading secret for account '${account}'` }),\n }),\n );\n\nexport const setPassword = (\n serviceName: string,\n account: string,\n value: string,\n): Effect.Effect<void, KeychainError> =>\n Effect.flatMap(createEntry(serviceName, account), (entry) =>\n Effect.try({\n try: () => entry.setPassword(value),\n catch: (cause) =>\n new KeychainError({\n message: `Failed writing secret: ${cause instanceof Error ? cause.message : String(cause)}`,\n cause,\n }),\n }).pipe(Effect.asVoid),\n );\n\nexport const deletePassword = (\n serviceName: string,\n account: string,\n): Effect.Effect<boolean, KeychainError> =>\n Effect.flatMap(createEntry(serviceName, account), (entry) =>\n Effect.try({\n try: () => {\n entry.deletePassword();\n return true;\n },\n catch: () =>\n new KeychainError({ message: `Failed deleting secret for account '${account}'` }),\n }),\n );\n","import { Data } from \"effect\";\n\nexport class KeychainError extends Data.TaggedError(\"KeychainError\")<{\n readonly message: string;\n readonly cause?: unknown;\n}> {}\n","import { Effect } from \"effect\";\n\nimport { StorageError, type SecretProvider } from \"@executor-js/sdk/core\";\n\nimport { getPassword, setPassword, deletePassword } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// SecretProvider adapter — bridges keyring into SDK resolution chain\n//\n// The underlying `@napi-rs/keyring` sync API encodes \"no entry\" as an\n// ordinary return value (`getPassword()` → `null`, `deletePassword()` →\n// `false`), and only throws on real failures (keychain locked, permission\n// denied, platform init failure, etc.). `keyring.ts` wraps those thrown\n// failures as `KeychainError`. We translate `KeychainError` →\n// `StorageError` so the HTTP edge can capture it to telemetry and surface\n// an opaque `InternalError({ traceId })` — previously `orElseSucceed`\n// silently converted every failure into \"nothing found\", which made it\n// impossible to debug why secrets weren't resolving.\n// ---------------------------------------------------------------------------\n\nconst toStorageError = (cause: { readonly message: string; readonly cause?: unknown }) =>\n new StorageError({ message: cause.message, cause: cause.cause ?? cause });\n\n// Scope arg is ignored — keychain partitions by `serviceName`, which the\n// host fixes per executor at construction time. A future refactor could\n// fold `scope` into the service name, but today a keychain provider\n// instance is already one-scope.\nexport const makeKeychainProvider = (serviceName: string): SecretProvider => ({\n key: \"keychain\",\n writable: true,\n get: (secretId, _scope) =>\n getPassword(serviceName, secretId).pipe(Effect.mapError(toStorageError)),\n set: (secretId, value, _scope) =>\n setPassword(serviceName, secretId, value).pipe(Effect.mapError(toStorageError)),\n delete: (secretId, _scope) =>\n deletePassword(serviceName, secretId).pipe(Effect.mapError(toStorageError)),\n // Keychain doesn't support enumerating — you need to know the account name\n list: undefined,\n});\n"],"mappings":";AAAA,SAAS,UAAAA,eAAc;AAEvB;AAAA,EACE;AAAA,OAGK;;;ACNP,SAAS,qBAAqB;AAE9B,SAAS,cAAc;;;ACFvB,SAAS,YAAY;AAEd,IAAM,gBAAN,cAA4B,KAAK,YAAY,eAAe,EAGhE;AAAC;;;ADKJ,IAAM,uBAAuB;AAC7B,IAAM,mBAAmB;AAMlB,IAAM,sBAAsB,MACjC,QAAQ,aAAa,YAAY,QAAQ,aAAa,WAAW,QAAQ,aAAa;AAEjF,IAAM,cAAc,MACzB,QAAQ,aAAa,WACjB,mBACA,QAAQ,aAAa,UACnB,+BACA;AAED,IAAM,qBAAqB,CAAC,aACjC,UAAU,KAAK,KAAK,QAAQ,IAAI,gBAAgB,GAAG,KAAK,KAAK;AAQ/D,IAAI,mBAAqD;AASzD,IAAM,gBAAgB,YAAuC;AAC3D,QAAM,aAAa,QAAQ,IAAI;AAC/B,MAAI,YAAY;AACd,UAAM,MAAM,cAAc,YAAY,GAAG;AACzC,WAAQ,IAAI,UAAU,EAAkC;AAAA,EAC1D;AACA,QAAM,EAAE,MAAM,IAAI,MAAM,OAAO,kBAAkB;AACjD,SAAO;AACT;AAEA,IAAM,YAAY,MAChB,OAAO,WAAW;AAAA,EAChB,KAAK,YAAY;AACf,QAAI,CAAC,oBAAoB,GAAG;AAC1B,YAAM,IAAI,MAAM,yBAAyB,QAAQ,QAAQ,GAAG;AAAA,IAC9D;AACA,yBAAqB,cAAc;AACnC,WAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,IAChB,SAAS,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACjG;AAAA,EACF,CAAC;AACL,CAAC;AAEH,IAAM,cAAc,CAAC,aAAqB,YACxC,OAAO;AAAA,EAAQ,UAAU;AAAA,EAAG,CAAC,UAC3B,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,IAAI,MAAM,aAAa,OAAO;AAAA,IACzC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACjG;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACH;AAMK,IAAM,cAAc,CACzB,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY;AAAA,IAC7B,OAAO,MAAM,IAAI,cAAc,EAAE,SAAS,sCAAsC,OAAO,IAAI,CAAC;AAAA,EAC9F,CAAC;AACH;AAEK,IAAM,cAAc,CACzB,aACA,SACA,UAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY,KAAK;AAAA,IAClC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACzF;AAAA,IACF,CAAC;AAAA,EACL,CAAC,EAAE,KAAK,OAAO,MAAM;AACvB;AAEK,IAAM,iBAAiB,CAC5B,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,eAAe;AACrB,aAAO;AAAA,IACT;AAAA,IACA,OAAO,MACL,IAAI,cAAc,EAAE,SAAS,uCAAuC,OAAO,IAAI,CAAC;AAAA,EACpF,CAAC;AACH;;;AE/HF,SAAS,UAAAC,eAAc;AAEvB,SAAS,oBAAyC;AAkBlD,IAAM,iBAAiB,CAAC,UACtB,IAAI,aAAa,EAAE,SAAS,MAAM,SAAS,OAAO,MAAM,SAAS,MAAM,CAAC;AAMnE,IAAM,uBAAuB,CAAC,iBAAyC;AAAA,EAC5E,KAAK;AAAA,EACL,UAAU;AAAA,EACV,KAAK,CAAC,UAAU,WACd,YAAY,aAAa,QAAQ,EAAE,KAAKC,QAAO,SAAS,cAAc,CAAC;AAAA,EACzE,KAAK,CAAC,UAAU,OAAO,WACrB,YAAY,aAAa,UAAU,KAAK,EAAE,KAAKA,QAAO,SAAS,cAAc,CAAC;AAAA,EAChF,QAAQ,CAAC,UAAU,WACjB,eAAe,aAAa,QAAQ,EAAE,KAAKA,QAAO,SAAS,cAAc,CAAC;AAAA;AAAA,EAE5E,MAAM;AACR;;;AHdA,IAAM,gBAAgB;AACtB,IAAM,cAAc;AA0CpB,IAAM,oBAAoB,CACxB,KACA,YAEA,GAAG,mBAAmB,SAAS,WAAW,CAAC,IAAI,IAAI,OAAO,CAAC,EAAG,EAAY;AAErE,IAAM,iBAAiB;AAAA,EAO5B,CAAC,aAAoC;AAAA,IACnC,IAAI;AAAA,IACJ,SAAS,OAAO,CAAC;AAAA,IAEjB,WAAW,CAAC,QAA2B;AACrC,YAAM,cAAc,kBAAkB,KAAK,OAAO;AAClD,aAAO;AAAA,QACL,aAAa,YAAY;AAAA,QACzB,aAAa,oBAAoB;AAAA,QACjC,KAAK,CAAC,OACJ,YAAY,aAAa,EAAE,EAAE;AAAA,UAC3BC,QAAO,IAAI,CAAC,MAAM,MAAM,IAAI;AAAA,UAC5BA,QAAO,cAAc,MAAM,KAAK;AAAA,QAClC;AAAA,MACJ;AAAA,IACF;AAAA,IAEA,iBAAiB,CAAC,QAChBA,QAAO,IAAI,aAAa;AACtB,YAAM,cAAc,kBAAkB,KAAK,OAAO;AAClD,YAAM,YAAY,OAAO;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE;AAAA,QACAA,QAAO;AAAA,UACL,eAAe,aAAa,aAAa,EAAE;AAAA,YACzCA,QAAO,MAAM,MAAMA,QAAO,IAAI;AAAA,UAChC;AAAA,QACF;AAAA,QACAA,QAAO,GAAG,IAAI;AAAA,QACdA,QAAO;AAAA,UAAM,CAAC,UACZA,QAAO;AAAA,YACL,yDAAyD,MAAM,OAAO;AAAA,UACxE,EAAE,KAAKA,QAAO,GAAG,KAAK,CAAC;AAAA,QACzB;AAAA,MACF;AACA,aAAO,YAAY,CAAC,qBAAqB,WAAW,CAAC,IAAI,CAAC;AAAA,IAC5D,CAAC;AAAA,EACL;AACF;","names":["Effect","Effect","Effect","Effect"]}
|