@executor-js/plugin-keychain 0.1.0 → 0.2.1

package/dist/chunk-Y2ES5ICS.js

@@ -0,0 +1,162 @@
+// src/index.ts
+import { Effect as Effect3 } from "effect";
+import { definePlugin } from "@executor-js/sdk/core";
+
+// src/keyring.ts
+import { createRequire } from "module";
+import { Effect } from "effect";
+
+// src/errors.ts
+import { Data } from "effect";
+var KeychainError = class extends Data.TaggedError("KeychainError") {
+};
+
+// src/keyring.ts
+var DEFAULT_SERVICE_NAME = "executor";
+var SERVICE_NAME_ENV = "EXECUTOR_KEYCHAIN_SERVICE_NAME";
+var isSupportedPlatform = () => process.platform === "darwin" || process.platform === "linux" || process.platform === "win32";
+var displayName = () => process.platform === "darwin" ? "macOS Keychain" : process.platform === "win32" ? "Windows Credential Manager" : "Desktop Keyring";
+var resolveServiceName = (explicit) => explicit?.trim() || process.env[SERVICE_NAME_ENV]?.trim() || DEFAULT_SERVICE_NAME;
+var entryCtorPromise = null;
+var loadEntryCtor = async () => {
+  const directPath = process.env.EXECUTOR_KEYRING_NATIVE_PATH;
+  if (directPath) {
+    const req = createRequire(import.meta.url);
+    return req(directPath).Entry;
+  }
+  const { Entry } = await import("@napi-rs/keyring");
+  return Entry;
+};
+var loadEntry = () => isSupportedPlatform() ? Effect.tryPromise({
+  try: async () => {
+    entryCtorPromise ??= loadEntryCtor();
+    return await entryCtorPromise;
+  },
+  catch: (cause) => new KeychainError({
+    message: "Failed loading native keyring",
+    cause
+  })
+}) : Effect.fail(
+  new KeychainError({
+    message: `Failed loading native keyring: unsupported platform '${process.platform}'`
+  })
+);
+var createEntry = (serviceName, account) => Effect.flatMap(
+  loadEntry(),
+  (Entry) => Effect.try({
+    try: () => new Entry(serviceName, account),
+    catch: (cause) => new KeychainError({
+      message: "Failed creating keyring entry",
+      cause
+    })
+  })
+);
+var getPassword = (serviceName, account) => Effect.flatMap(
+  createEntry(serviceName, account),
+  (entry) => Effect.try({
+    try: () => entry.getPassword(),
+    catch: () => new KeychainError({ message: `Failed reading secret for account '${account}'` })
+  })
+);
+var setPassword = (serviceName, account, value) => Effect.flatMap(
+  createEntry(serviceName, account),
+  (entry) => Effect.try({
+    try: () => entry.setPassword(value),
+    catch: (cause) => new KeychainError({
+      message: "Failed writing secret",
+      cause
+    })
+  }).pipe(Effect.asVoid)
+);
+var deletePassword = (serviceName, account) => Effect.flatMap(
+  createEntry(serviceName, account),
+  (entry) => Effect.try({
+    try: () => {
+      entry.deletePassword();
+      return true;
+    },
+    catch: () => new KeychainError({ message: `Failed deleting secret for account '${account}'` })
+  })
+);
+
+// src/provider.ts
+import { Effect as Effect2 } from "effect";
+import { StorageError } from "@executor-js/sdk/core";
+var toStorageError = (cause) => {
+  const { cause: underlyingCause } = cause;
+  return new StorageError({ message: cause.message, cause: underlyingCause ?? cause });
+};
+var scopedKeychainServiceName = (baseServiceName, scope) => `${baseServiceName}/${scope}`;
+var makeKeychainProvider = (baseServiceName) => ({
+  key: "keychain",
+  writable: true,
+  get: (secretId, scope) => getPassword(scopedKeychainServiceName(baseServiceName, scope), secretId).pipe(
+    Effect2.mapError(toStorageError)
+  ),
+  set: (secretId, value, scope) => setPassword(scopedKeychainServiceName(baseServiceName, scope), secretId, value).pipe(
+    Effect2.mapError(toStorageError)
+  ),
+  delete: (secretId, scope) => deletePassword(scopedKeychainServiceName(baseServiceName, scope), secretId).pipe(
+    Effect2.mapError(toStorageError)
+  ),
+  // Keychain doesn't support enumerating — you need to know the account name
+  list: void 0
+});
+
+// src/index.ts
+var PROBE_VALUE = "probe";
+var probeAccount = () => `__executor_keychain_probe__:${process.pid}:${Date.now()}:${Math.random().toString(36).slice(2)}`;
+var makeKeychainExtension = (ctx, options) => {
+  const baseServiceName = resolveServiceName(options?.serviceName);
+  return {
+    /** Human-readable name for the keychain on this platform */
+    displayName: displayName(),
+    /** Whether the current platform supports system keychain */
+    isSupported: isSupportedPlatform(),
+    /** Check if a secret exists in the system keychain */
+    has: (id) => Effect3.gen(function* () {
+      for (const scope of ctx.scopes) {
+        const exists = yield* getPassword(
+          scopedKeychainServiceName(baseServiceName, scope.id),
+          id
+        ).pipe(
+          Effect3.map((v) => v !== null),
+          Effect3.orElseSucceed(() => false)
+        );
+        if (exists) return true;
+      }
+      return false;
+    })
+  };
+};
+var keychainPlugin = definePlugin((options) => ({
+  id: "keychain",
+  storage: () => ({}),
+  extension: (ctx) => makeKeychainExtension(ctx, options),
+  secretProviders: (ctx) => Effect3.gen(function* () {
+    const baseServiceName = resolveServiceName(options?.serviceName);
+    const probeServiceName = scopedKeychainServiceName(baseServiceName, ctx.scopes[0].id);
+    const account = probeAccount();
+    const reachable = yield* setPassword(probeServiceName, account, PROBE_VALUE).pipe(
+      Effect3.andThen(
+        deletePassword(probeServiceName, account).pipe(Effect3.catch(() => Effect3.void))
+      ),
+      Effect3.as(true),
+      Effect3.catch(
+        () => Effect3.logWarning("keychain unavailable, skipping provider registration").pipe(
+          Effect3.as(false)
+        )
+      )
+    );
+    return reachable ? [makeKeychainProvider(baseServiceName)] : [];
+  })
+}));
+
+export {
+  KeychainError,
+  isSupportedPlatform,
+  displayName,
+  makeKeychainProvider,
+  keychainPlugin
+};
+//# sourceMappingURL=chunk-Y2ES5ICS.js.map

package/dist/chunk-Y2ES5ICS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/keyring.ts","../src/errors.ts","../src/provider.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport { definePlugin, type PluginCtx, type SecretProvider } from \"@executor-js/sdk/core\";\n\nimport {\n  deletePassword,\n  displayName,\n  getPassword,\n  isSupportedPlatform,\n  resolveServiceName,\n  setPassword,\n} from \"./keyring\";\nimport { makeKeychainProvider, scopedKeychainServiceName } from \"./provider\";\n\n// Probe the keychain by writing and then deleting a sentinel entry. A\n// read-only probe isn't enough — on some Linux environments (WSL2,\n// headless CI) `getPassword` for a missing key returns null without\n// error, but `setPassword` fails because the secret-service backend\n// isn't actually reachable. Writing is the capability the executor\n// cares about, so test it directly.\nconst PROBE_VALUE = \"probe\";\nconst probeAccount = (): string =>\n  `__executor_keychain_probe__:${process.pid}:${Date.now()}:${Math.random().toString(36).slice(2)}`;\n\n// ---------------------------------------------------------------------------\n// Re-exports\n// ---------------------------------------------------------------------------\n\nexport { KeychainError } from \"./errors\";\nexport { makeKeychainProvider } from \"./provider\";\nexport { isSupportedPlatform, displayName } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// Plugin config\n// ---------------------------------------------------------------------------\n\nexport interface KeychainPluginConfig {\n  /** Override the keychain service name (default: \"executor\") */\n  readonly serviceName?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin extension — public API on executor.keychain\n// ---------------------------------------------------------------------------\n\nexport type KeychainExtension = ReturnType<typeof makeKeychainExtension>;\n\n// ---------------------------------------------------------------------------\n// Plugin definition\n// ---------------------------------------------------------------------------\n\nconst makeKeychainExtension = (\n  ctx: PluginCtx<unknown>,\n  options: KeychainPluginConfig | undefined,\n) => {\n  const baseServiceName = resolveServiceName(options?.serviceName);\n  return {\n    /** Human-readable name for the keychain on this platform */\n    displayName: displayName(),\n\n    /** Whether the current platform supports system keychain */\n    isSupported: isSupportedPlatform(),\n\n    /** Check if a secret exists in the system keychain */\n    has: (id: string) =>\n      Effect.gen(function* () {\n        for (const scope of ctx.scopes) {\n          const exists = yield* getPassword(\n            scopedKeychainServiceName(baseServiceName, scope.id),\n            id,\n          ).pipe(\n            Effect.map((v) => v !== null),\n            Effect.orElseSucceed(() => false),\n          );\n          if (exists) return true;\n        }\n        return false;\n      }),\n  };\n};\n\nexport const keychainPlugin = definePlugin((options?: KeychainPluginConfig) => ({\n  id: \"keychain\" as const,\n  storage: () => ({}),\n\n  extension: (ctx): KeychainExtension => makeKeychainExtension(ctx, options),\n\n  secretProviders: (ctx): Effect.Effect<readonly SecretProvider[]> =>\n    Effect.gen(function* () {\n      const baseServiceName = resolveServiceName(options?.serviceName);\n      const probeServiceName = scopedKeychainServiceName(baseServiceName, ctx.scopes[0]!.id);\n      const account = probeAccount();\n      const reachable = yield* setPassword(probeServiceName, account, PROBE_VALUE).pipe(\n        Effect.andThen(\n          deletePassword(probeServiceName, account).pipe(Effect.catch(() => Effect.void)),\n        ),\n        Effect.as(true),\n        Effect.catch(() =>\n          Effect.logWarning(\"keychain unavailable, skipping provider registration\").pipe(\n            Effect.as(false),\n          ),\n        ),\n      );\n      return reachable ? [makeKeychainProvider(baseServiceName)] : [];\n    }),\n}));\n","import { createRequire } from \"node:module\";\n\nimport { Effect } from \"effect\";\n\nimport { KeychainError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst DEFAULT_SERVICE_NAME = \"executor\";\nconst SERVICE_NAME_ENV = \"EXECUTOR_KEYCHAIN_SERVICE_NAME\";\n\n// ---------------------------------------------------------------------------\n// Platform helpers\n// ---------------------------------------------------------------------------\n\nexport const isSupportedPlatform = () =>\n  process.platform === \"darwin\" || process.platform === \"linux\" || process.platform === \"win32\";\n\nexport const displayName = () =>\n  process.platform === \"darwin\"\n    ? \"macOS Keychain\"\n    : process.platform === \"win32\"\n      ? \"Windows Credential Manager\"\n      : \"Desktop Keyring\";\n\nexport const resolveServiceName = (explicit?: string): string =>\n  explicit?.trim() || process.env[SERVICE_NAME_ENV]?.trim() || DEFAULT_SERVICE_NAME;\n\n// ---------------------------------------------------------------------------\n// Lazy-load @napi-rs/keyring (native module)\n// ---------------------------------------------------------------------------\n\ntype EntryConstructor = (typeof import(\"@napi-rs/keyring\"))[\"Entry\"];\n\nlet entryCtorPromise: Promise<EntryConstructor> | null = null;\n\n// In compiled bun binaries (`bun build --compile`) `.node` modules aren't\n// included in bunfs and there's no node_modules at runtime, so\n// @napi-rs/keyring's loader can't find its platform-specific binding.\n// `apps/cli/src/build.ts` copies the .node next to the executor and\n// `apps/cli/src/main.ts` exports its absolute path here. We load it\n// directly because @napi-rs/keyring@1.2.0's NAPI_RS_NATIVE_LIBRARY_PATH\n// branch is buggy (assigns to a local that gets overwritten before return).\nconst loadEntryCtor = async (): Promise<EntryConstructor> => {\n  const directPath = process.env.EXECUTOR_KEYRING_NATIVE_PATH;\n  if (directPath) {\n    const req = createRequire(import.meta.url);\n    return (req(directPath) as { Entry: EntryConstructor }).Entry;\n  }\n  const { Entry } = await import(\"@napi-rs/keyring\");\n  return Entry;\n};\n\nconst loadEntry = (): Effect.Effect<EntryConstructor, KeychainError> =>\n  isSupportedPlatform()\n    ? Effect.tryPromise({\n        try: async () => {\n          entryCtorPromise ??= loadEntryCtor();\n          return await entryCtorPromise;\n        },\n        catch: (cause) =>\n          new KeychainError({\n            message: \"Failed loading native keyring\",\n            cause,\n          }),\n      })\n    : Effect.fail(\n        new KeychainError({\n          message: `Failed loading native keyring: unsupported platform '${process.platform}'`,\n        }),\n      );\n\nconst createEntry = (serviceName: string, account: string) =>\n  Effect.flatMap(loadEntry(), (Entry) =>\n    Effect.try({\n      try: () => new Entry(serviceName, account),\n      catch: (cause) =>\n        new KeychainError({\n          message: \"Failed creating keyring entry\",\n          cause,\n        }),\n    }),\n  );\n\n// ---------------------------------------------------------------------------\n// Low-level keychain operations\n// ---------------------------------------------------------------------------\n\nexport const getPassword = (\n  serviceName: string,\n  account: string,\n): Effect.Effect<string | null, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => entry.getPassword(),\n      catch: () => new KeychainError({ message: `Failed reading secret for account '${account}'` }),\n    }),\n  );\n\nexport const setPassword = (\n  serviceName: string,\n  account: string,\n  value: string,\n): Effect.Effect<void, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => entry.setPassword(value),\n      catch: (cause) =>\n        new KeychainError({\n          message: \"Failed writing secret\",\n          cause,\n        }),\n    }).pipe(Effect.asVoid),\n  );\n\nexport const deletePassword = (\n  serviceName: string,\n  account: string,\n): Effect.Effect<boolean, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => {\n        entry.deletePassword();\n        return true;\n      },\n      catch: () =>\n        new KeychainError({ message: `Failed deleting secret for account '${account}'` }),\n    }),\n  );\n","import { Data } from \"effect\";\n\nexport class KeychainError extends Data.TaggedError(\"KeychainError\")<{\n  readonly message: string;\n  readonly cause?: unknown;\n}> {}\n","import { Effect } from \"effect\";\n\nimport { StorageError, type SecretProvider } from \"@executor-js/sdk/core\";\n\nimport type { KeychainError } from \"./errors\";\nimport { getPassword, setPassword, deletePassword } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// SecretProvider adapter — bridges keyring into SDK resolution chain\n//\n// The underlying `@napi-rs/keyring` sync API encodes \"no entry\" as an\n// ordinary return value (`getPassword()` → `null`, `deletePassword()` →\n// `false`), and only throws on real failures (keychain locked, permission\n// denied, platform init failure, etc.). `keyring.ts` wraps those thrown\n// failures as `KeychainError`. We translate `KeychainError` →\n// `StorageError` so the HTTP edge can capture it to telemetry and surface\n// an opaque `InternalError({ traceId })` — previously `orElseSucceed`\n// silently converted every failure into \"nothing found\", which made it\n// impossible to debug why secrets weren't resolving.\n// ---------------------------------------------------------------------------\n\nconst toStorageError = (cause: KeychainError) => {\n  const { cause: underlyingCause } = cause;\n  // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: typed KeychainError message becomes StorageError message\n  return new StorageError({ message: cause.message, cause: underlyingCause ?? cause });\n};\n\nexport const scopedKeychainServiceName = (baseServiceName: string, scope: string): string =>\n  `${baseServiceName}/${scope}`;\n\nexport const makeKeychainProvider = (baseServiceName: string): SecretProvider => ({\n  key: \"keychain\",\n  writable: true,\n  get: (secretId, scope) =>\n    getPassword(scopedKeychainServiceName(baseServiceName, scope), secretId).pipe(\n      Effect.mapError(toStorageError),\n    ),\n  set: (secretId, value, scope) =>\n    setPassword(scopedKeychainServiceName(baseServiceName, scope), secretId, value).pipe(\n      Effect.mapError(toStorageError),\n    ),\n  delete: (secretId, scope) =>\n    deletePassword(scopedKeychainServiceName(baseServiceName, scope), secretId).pipe(\n      Effect.mapError(toStorageError),\n    ),\n  // Keychain doesn't support enumerating — you need to know the account name\n  list: undefined,\n});\n"],"mappings":";AAAA,SAAS,UAAAA,eAAc;AAEvB,SAAS,oBAAyD;;;ACFlE,SAAS,qBAAqB;AAE9B,SAAS,cAAc;;;ACFvB,SAAS,YAAY;AAEd,IAAM,gBAAN,cAA4B,KAAK,YAAY,eAAe,EAGhE;AAAC;;;ADKJ,IAAM,uBAAuB;AAC7B,IAAM,mBAAmB;AAMlB,IAAM,sBAAsB,MACjC,QAAQ,aAAa,YAAY,QAAQ,aAAa,WAAW,QAAQ,aAAa;AAEjF,IAAM,cAAc,MACzB,QAAQ,aAAa,WACjB,mBACA,QAAQ,aAAa,UACnB,+BACA;AAED,IAAM,qBAAqB,CAAC,aACjC,UAAU,KAAK,KAAK,QAAQ,IAAI,gBAAgB,GAAG,KAAK,KAAK;AAQ/D,IAAI,mBAAqD;AASzD,IAAM,gBAAgB,YAAuC;AAC3D,QAAM,aAAa,QAAQ,IAAI;AAC/B,MAAI,YAAY;AACd,UAAM,MAAM,cAAc,YAAY,GAAG;AACzC,WAAQ,IAAI,UAAU,EAAkC;AAAA,EAC1D;AACA,QAAM,EAAE,MAAM,IAAI,MAAM,OAAO,kBAAkB;AACjD,SAAO;AACT;AAEA,IAAM,YAAY,MAChB,oBAAoB,IAChB,OAAO,WAAW;AAAA,EAChB,KAAK,YAAY;AACf,yBAAqB,cAAc;AACnC,WAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,IAChB,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACL,CAAC,IACD,OAAO;AAAA,EACL,IAAI,cAAc;AAAA,IAChB,SAAS,wDAAwD,QAAQ,QAAQ;AAAA,EACnF,CAAC;AACH;AAEN,IAAM,cAAc,CAAC,aAAqB,YACxC,OAAO;AAAA,EAAQ,UAAU;AAAA,EAAG,CAAC,UAC3B,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,IAAI,MAAM,aAAa,OAAO;AAAA,IACzC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACH;AAMK,IAAM,cAAc,CACzB,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY;AAAA,IAC7B,OAAO,MAAM,IAAI,cAAc,EAAE,SAAS,sCAAsC,OAAO,IAAI,CAAC;AAAA,EAC9F,CAAC;AACH;AAEK,IAAM,cAAc,CACzB,aACA,SACA,UAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY,KAAK;AAAA,IAClC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACL,CAAC,EAAE,KAAK,OAAO,MAAM;AACvB;AAEK,IAAM,iBAAiB,CAC5B,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,eAAe;AACrB,aAAO;AAAA,IACT;AAAA,IACA,OAAO,MACL,IAAI,cAAc,EAAE,SAAS,uCAAuC,OAAO,IAAI,CAAC;AAAA,EACpF,CAAC;AACH;;;AElIF,SAAS,UAAAC,eAAc;AAEvB,SAAS,oBAAyC;AAmBlD,IAAM,iBAAiB,CAAC,UAAyB;AAC/C,QAAM,EAAE,OAAO,gBAAgB,IAAI;AAEnC,SAAO,IAAI,aAAa,EAAE,SAAS,MAAM,SAAS,OAAO,mBAAmB,MAAM,CAAC;AACrF;AAEO,IAAM,4BAA4B,CAAC,iBAAyB,UACjE,GAAG,eAAe,IAAI,KAAK;AAEtB,IAAM,uBAAuB,CAAC,qBAA6C;AAAA,EAChF,KAAK;AAAA,EACL,UAAU;AAAA,EACV,KAAK,CAAC,UAAU,UACd,YAAY,0BAA0B,iBAAiB,KAAK,GAAG,QAAQ,EAAE;AAAA,IACvEC,QAAO,SAAS,cAAc;AAAA,EAChC;AAAA,EACF,KAAK,CAAC,UAAU,OAAO,UACrB,YAAY,0BAA0B,iBAAiB,KAAK,GAAG,UAAU,KAAK,EAAE;AAAA,IAC9EA,QAAO,SAAS,cAAc;AAAA,EAChC;AAAA,EACF,QAAQ,CAAC,UAAU,UACjB,eAAe,0BAA0B,iBAAiB,KAAK,GAAG,QAAQ,EAAE;AAAA,IAC1EA,QAAO,SAAS,cAAc;AAAA,EAChC;AAAA;AAAA,EAEF,MAAM;AACR;;;AH3BA,IAAM,cAAc;AACpB,IAAM,eAAe,MACnB,+BAA+B,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AA6BjG,IAAM,wBAAwB,CAC5B,KACA,YACG;AACH,QAAM,kBAAkB,mBAAmB,SAAS,WAAW;AAC/D,SAAO;AAAA;AAAA,IAEL,aAAa,YAAY;AAAA;AAAA,IAGzB,aAAa,oBAAoB;AAAA;AAAA,IAGjC,KAAK,CAAC,OACJC,QAAO,IAAI,aAAa;AACtB,iBAAW,SAAS,IAAI,QAAQ;AAC9B,cAAM,SAAS,OAAO;AAAA,UACpB,0BAA0B,iBAAiB,MAAM,EAAE;AAAA,UACnD;AAAA,QACF,EAAE;AAAA,UACAA,QAAO,IAAI,CAAC,MAAM,MAAM,IAAI;AAAA,UAC5BA,QAAO,cAAc,MAAM,KAAK;AAAA,QAClC;AACA,YAAI,OAAQ,QAAO;AAAA,MACrB;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACL;AACF;AAEO,IAAM,iBAAiB,aAAa,CAAC,aAAoC;AAAA,EAC9E,IAAI;AAAA,EACJ,SAAS,OAAO,CAAC;AAAA,EAEjB,WAAW,CAAC,QAA2B,sBAAsB,KAAK,OAAO;AAAA,EAEzE,iBAAiB,CAAC,QAChBA,QAAO,IAAI,aAAa;AACtB,UAAM,kBAAkB,mBAAmB,SAAS,WAAW;AAC/D,UAAM,mBAAmB,0BAA0B,iBAAiB,IAAI,OAAO,CAAC,EAAG,EAAE;AACrF,UAAM,UAAU,aAAa;AAC7B,UAAM,YAAY,OAAO,YAAY,kBAAkB,SAAS,WAAW,EAAE;AAAA,MAC3EA,QAAO;AAAA,QACL,eAAe,kBAAkB,OAAO,EAAE,KAAKA,QAAO,MAAM,MAAMA,QAAO,IAAI,CAAC;AAAA,MAChF;AAAA,MACAA,QAAO,GAAG,IAAI;AAAA,MACdA,QAAO;AAAA,QAAM,MACXA,QAAO,WAAW,sDAAsD,EAAE;AAAA,UACxEA,QAAO,GAAG,KAAK;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AACA,WAAO,YAAY,CAAC,qBAAqB,eAAe,CAAC,IAAI,CAAC;AAAA,EAChE,CAAC;AACL,EAAE;","names":["Effect","Effect","Effect","Effect"]}

package/dist/core.js

@@ -4,7 +4,7 @@ import {
   isSupportedPlatform,
   keychainPlugin,
   makeKeychainProvider
-} from "./chunk-OJMNHBMH.js";
+} from "./chunk-Y2ES5ICS.js";
 export {
   KeychainError,
   displayName,

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { Effect } from "effect";
+import { type PluginCtx } from "@executor-js/sdk/core";
 export { KeychainError } from "./errors";
 export { makeKeychainProvider } from "./provider";
 export { isSupportedPlatform, displayName } from "./keyring";
@@ -6,12 +7,20 @@ export interface KeychainPluginConfig {
     /** Override the keychain service name (default: "executor") */
     readonly serviceName?: string;
 }
-export interface KeychainExtension {
+export type KeychainExtension = ReturnType<typeof makeKeychainExtension>;
+declare const makeKeychainExtension: (ctx: PluginCtx<unknown>, options: KeychainPluginConfig | undefined) => {
     /** Human-readable name for the keychain on this platform */
-    readonly displayName: string;
+    displayName: string;
     /** Whether the current platform supports system keychain */
-    readonly isSupported: boolean;
+    isSupported: boolean;
     /** Check if a secret exists in the system keychain */
-    readonly has: (id: string) => Effect.Effect<boolean>;
-}
-export declare const keychainPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"keychain", KeychainExtension, {}, KeychainPluginConfig, undefined, undefined, import("effect/Layer").Layer<unknown, never, never>, import("effect/unstable/httpapi/HttpApiGroup").Any>;
+    has: (id: string) => Effect.Effect<boolean, never, never>;
+};
+export declare const keychainPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"keychain", {
+    /** Human-readable name for the keychain on this platform */
+    displayName: string;
+    /** Whether the current platform supports system keychain */
+    isSupported: boolean;
+    /** Check if a secret exists in the system keychain */
+    has: (id: string) => Effect.Effect<boolean, never, never>;
+}, {}, KeychainPluginConfig, undefined, undefined, import("effect/Layer").Layer<unknown, never, never>, import("effect/unstable/httpapi/HttpApiGroup").Any>;

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   keychainPlugin
-} from "./chunk-OJMNHBMH.js";
+} from "./chunk-Y2ES5ICS.js";
 
 // src/promise.ts
 var keychainPlugin2 = (config) => keychainPlugin(config);

package/dist/provider.d.ts

@@ -1,2 +1,3 @@
 import { type SecretProvider } from "@executor-js/sdk/core";
-export declare const makeKeychainProvider: (serviceName: string) => SecretProvider;
+export declare const scopedKeychainServiceName: (baseServiceName: string, scope: string) => string;
+export declare const makeKeychainProvider: (baseServiceName: string) => SecretProvider;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/plugin-keychain",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/keychain",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
@@ -40,7 +40,7 @@
     "typecheck:slow": "bunx tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@executor-js/sdk": "0.1.0",
+    "@executor-js/sdk": "0.2.1",
     "@napi-rs/keyring": "^1.2.0",
     "effect": "4.0.0-beta.59"
   },

package/dist/chunk-OJMNHBMH.js

@@ -1,147 +0,0 @@
-// src/index.ts
-import { Effect as Effect3 } from "effect";
-import {
-  definePlugin
-} from "@executor-js/sdk/core";
-
-// src/keyring.ts
-import { createRequire } from "module";
-import { Effect } from "effect";
-
-// src/errors.ts
-import { Data } from "effect";
-var KeychainError = class extends Data.TaggedError("KeychainError") {
-};
-
-// src/keyring.ts
-var DEFAULT_SERVICE_NAME = "executor";
-var SERVICE_NAME_ENV = "EXECUTOR_KEYCHAIN_SERVICE_NAME";
-var isSupportedPlatform = () => process.platform === "darwin" || process.platform === "linux" || process.platform === "win32";
-var displayName = () => process.platform === "darwin" ? "macOS Keychain" : process.platform === "win32" ? "Windows Credential Manager" : "Desktop Keyring";
-var resolveServiceName = (explicit) => explicit?.trim() || process.env[SERVICE_NAME_ENV]?.trim() || DEFAULT_SERVICE_NAME;
-var entryCtorPromise = null;
-var loadEntryCtor = async () => {
-  const directPath = process.env.EXECUTOR_KEYRING_NATIVE_PATH;
-  if (directPath) {
-    const req = createRequire(import.meta.url);
-    return req(directPath).Entry;
-  }
-  const { Entry } = await import("@napi-rs/keyring");
-  return Entry;
-};
-var loadEntry = () => Effect.tryPromise({
-  try: async () => {
-    if (!isSupportedPlatform()) {
-      throw new Error(`unsupported platform '${process.platform}'`);
-    }
-    entryCtorPromise ??= loadEntryCtor();
-    return await entryCtorPromise;
-  },
-  catch: (cause) => new KeychainError({
-    message: `Failed loading native keyring: ${cause instanceof Error ? cause.message : String(cause)}`,
-    cause
-  })
-});
-var createEntry = (serviceName, account) => Effect.flatMap(
-  loadEntry(),
-  (Entry) => Effect.try({
-    try: () => new Entry(serviceName, account),
-    catch: (cause) => new KeychainError({
-      message: `Failed creating keyring entry: ${cause instanceof Error ? cause.message : String(cause)}`,
-      cause
-    })
-  })
-);
-var getPassword = (serviceName, account) => Effect.flatMap(
-  createEntry(serviceName, account),
-  (entry) => Effect.try({
-    try: () => entry.getPassword(),
-    catch: () => new KeychainError({ message: `Failed reading secret for account '${account}'` })
-  })
-);
-var setPassword = (serviceName, account, value) => Effect.flatMap(
-  createEntry(serviceName, account),
-  (entry) => Effect.try({
-    try: () => entry.setPassword(value),
-    catch: (cause) => new KeychainError({
-      message: `Failed writing secret: ${cause instanceof Error ? cause.message : String(cause)}`,
-      cause
-    })
-  }).pipe(Effect.asVoid)
-);
-var deletePassword = (serviceName, account) => Effect.flatMap(
-  createEntry(serviceName, account),
-  (entry) => Effect.try({
-    try: () => {
-      entry.deletePassword();
-      return true;
-    },
-    catch: () => new KeychainError({ message: `Failed deleting secret for account '${account}'` })
-  })
-);
-
-// src/provider.ts
-import { Effect as Effect2 } from "effect";
-import { StorageError } from "@executor-js/sdk/core";
-var toStorageError = (cause) => new StorageError({ message: cause.message, cause: cause.cause ?? cause });
-var makeKeychainProvider = (serviceName) => ({
-  key: "keychain",
-  writable: true,
-  get: (secretId, _scope) => getPassword(serviceName, secretId).pipe(Effect2.mapError(toStorageError)),
-  set: (secretId, value, _scope) => setPassword(serviceName, secretId, value).pipe(Effect2.mapError(toStorageError)),
-  delete: (secretId, _scope) => deletePassword(serviceName, secretId).pipe(Effect2.mapError(toStorageError)),
-  // Keychain doesn't support enumerating — you need to know the account name
-  list: void 0
-});
-
-// src/index.ts
-var PROBE_ACCOUNT = "__executor_keychain_probe__";
-var PROBE_VALUE = "probe";
-var scopedServiceName = (ctx, options) => `${resolveServiceName(options?.serviceName)}/${ctx.scopes[0].id}`;
-var keychainPlugin = definePlugin(
-  (options) => ({
-    id: "keychain",
-    storage: () => ({}),
-    extension: (ctx) => {
-      const serviceName = scopedServiceName(ctx, options);
-      return {
-        displayName: displayName(),
-        isSupported: isSupportedPlatform(),
-        has: (id) => getPassword(serviceName, id).pipe(
-          Effect3.map((v) => v !== null),
-          Effect3.orElseSucceed(() => false)
-        )
-      };
-    },
-    secretProviders: (ctx) => Effect3.gen(function* () {
-      const serviceName = scopedServiceName(ctx, options);
-      const reachable = yield* setPassword(
-        serviceName,
-        PROBE_ACCOUNT,
-        PROBE_VALUE
-      ).pipe(
-        Effect3.andThen(
-          deletePassword(serviceName, PROBE_ACCOUNT).pipe(
-            Effect3.catch(() => Effect3.void)
-          )
-        ),
-        Effect3.as(true),
-        Effect3.catch(
-          (cause) => Effect3.logWarning(
-            `keychain unavailable, skipping provider registration: ${cause.message}`
-          ).pipe(Effect3.as(false))
-        )
-      );
-      return reachable ? [makeKeychainProvider(serviceName)] : [];
-    })
-  })
-);
-
-export {
-  KeychainError,
-  isSupportedPlatform,
-  displayName,
-  makeKeychainProvider,
-  keychainPlugin
-};
-//# sourceMappingURL=chunk-OJMNHBMH.js.map

package/dist/chunk-OJMNHBMH.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts","../src/keyring.ts","../src/errors.ts","../src/provider.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport {\n  definePlugin,\n  type PluginCtx,\n  type SecretProvider,\n} from \"@executor-js/sdk/core\";\n\nimport {\n  deletePassword,\n  displayName,\n  getPassword,\n  isSupportedPlatform,\n  resolveServiceName,\n  setPassword,\n} from \"./keyring\";\nimport { makeKeychainProvider } from \"./provider\";\n\n// Probe the keychain by writing and then deleting a sentinel entry. A\n// read-only probe isn't enough — on some Linux environments (WSL2,\n// headless CI) `getPassword` for a missing key returns null without\n// error, but `setPassword` fails because the secret-service backend\n// isn't actually reachable. Writing is the capability the executor\n// cares about, so test it directly.\nconst PROBE_ACCOUNT = \"__executor_keychain_probe__\";\nconst PROBE_VALUE = \"probe\";\n\n// ---------------------------------------------------------------------------\n// Re-exports\n// ---------------------------------------------------------------------------\n\nexport { KeychainError } from \"./errors\";\nexport { makeKeychainProvider } from \"./provider\";\nexport { isSupportedPlatform, displayName } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// Plugin config\n// ---------------------------------------------------------------------------\n\nexport interface KeychainPluginConfig {\n  /** Override the keychain service name (default: \"executor\") */\n  readonly serviceName?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin extension — public API on executor.keychain\n// ---------------------------------------------------------------------------\n\nexport interface KeychainExtension {\n  /** Human-readable name for the keychain on this platform */\n  readonly displayName: string;\n\n  /** Whether the current platform supports system keychain */\n  readonly isSupported: boolean;\n\n  /** Check if a secret exists in the system keychain */\n  readonly has: (id: string) => Effect.Effect<boolean>;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin definition\n// ---------------------------------------------------------------------------\n\n// Scope the keychain service name to the current executor scope so each\n// folder / workspace gets its own set of keychain entries. Computed\n// identically in `extension` and `secretProviders` — both receive ctx and\n// both are called once per createExecutor, so the derivation stays pure.\nconst scopedServiceName = (\n  ctx: PluginCtx<unknown>,\n  options: KeychainPluginConfig | undefined,\n): string =>\n  `${resolveServiceName(options?.serviceName)}/${ctx.scopes[0]!.id as string}`;\n\nexport const keychainPlugin = definePlugin(\n  (options?: KeychainPluginConfig) => ({\n    id: \"keychain\" as const,\n    storage: () => ({}),\n\n    extension: (ctx): KeychainExtension => {\n      const serviceName = scopedServiceName(ctx, options);\n      return {\n        displayName: displayName(),\n        isSupported: isSupportedPlatform(),\n        has: (id) =>\n          getPassword(serviceName, id).pipe(\n            Effect.map((v) => v !== null),\n            Effect.orElseSucceed(() => false),\n          ),\n      };\n    },\n\n    secretProviders: (ctx): Effect.Effect<readonly SecretProvider[]> =>\n      Effect.gen(function* () {\n        const serviceName = scopedServiceName(ctx, options);\n        const reachable = yield* setPassword(\n          serviceName,\n          PROBE_ACCOUNT,\n          PROBE_VALUE,\n        ).pipe(\n          Effect.andThen(\n            deletePassword(serviceName, PROBE_ACCOUNT).pipe(\n              Effect.catch(() => Effect.void),\n            ),\n          ),\n          Effect.as(true),\n          Effect.catch((cause) =>\n            Effect.logWarning(\n              `keychain unavailable, skipping provider registration: ${cause.message}`,\n            ).pipe(Effect.as(false)),\n          ),\n        );\n        return reachable ? [makeKeychainProvider(serviceName)] : [];\n      }),\n  }),\n);\n","import { createRequire } from \"node:module\";\n\nimport { Effect } from \"effect\";\n\nimport { KeychainError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst DEFAULT_SERVICE_NAME = \"executor\";\nconst SERVICE_NAME_ENV = \"EXECUTOR_KEYCHAIN_SERVICE_NAME\";\n\n// ---------------------------------------------------------------------------\n// Platform helpers\n// ---------------------------------------------------------------------------\n\nexport const isSupportedPlatform = () =>\n  process.platform === \"darwin\" || process.platform === \"linux\" || process.platform === \"win32\";\n\nexport const displayName = () =>\n  process.platform === \"darwin\"\n    ? \"macOS Keychain\"\n    : process.platform === \"win32\"\n      ? \"Windows Credential Manager\"\n      : \"Desktop Keyring\";\n\nexport const resolveServiceName = (explicit?: string): string =>\n  explicit?.trim() || process.env[SERVICE_NAME_ENV]?.trim() || DEFAULT_SERVICE_NAME;\n\n// ---------------------------------------------------------------------------\n// Lazy-load @napi-rs/keyring (native module)\n// ---------------------------------------------------------------------------\n\ntype EntryConstructor = (typeof import(\"@napi-rs/keyring\"))[\"Entry\"];\n\nlet entryCtorPromise: Promise<EntryConstructor> | null = null;\n\n// In compiled bun binaries (`bun build --compile`) `.node` modules aren't\n// included in bunfs and there's no node_modules at runtime, so\n// @napi-rs/keyring's loader can't find its platform-specific binding.\n// `apps/cli/src/build.ts` copies the .node next to the executor and\n// `apps/cli/src/main.ts` exports its absolute path here. We load it\n// directly because @napi-rs/keyring@1.2.0's NAPI_RS_NATIVE_LIBRARY_PATH\n// branch is buggy (assigns to a local that gets overwritten before return).\nconst loadEntryCtor = async (): Promise<EntryConstructor> => {\n  const directPath = process.env.EXECUTOR_KEYRING_NATIVE_PATH;\n  if (directPath) {\n    const req = createRequire(import.meta.url);\n    return (req(directPath) as { Entry: EntryConstructor }).Entry;\n  }\n  const { Entry } = await import(\"@napi-rs/keyring\");\n  return Entry;\n};\n\nconst loadEntry = (): Effect.Effect<EntryConstructor, KeychainError> =>\n  Effect.tryPromise({\n    try: async () => {\n      if (!isSupportedPlatform()) {\n        throw new Error(`unsupported platform '${process.platform}'`);\n      }\n      entryCtorPromise ??= loadEntryCtor();\n      return await entryCtorPromise;\n    },\n    catch: (cause) =>\n      new KeychainError({\n        message: `Failed loading native keyring: ${cause instanceof Error ? cause.message : String(cause)}`,\n        cause,\n      }),\n  });\n\nconst createEntry = (serviceName: string, account: string) =>\n  Effect.flatMap(loadEntry(), (Entry) =>\n    Effect.try({\n      try: () => new Entry(serviceName, account),\n      catch: (cause) =>\n        new KeychainError({\n          message: `Failed creating keyring entry: ${cause instanceof Error ? cause.message : String(cause)}`,\n          cause,\n        }),\n    }),\n  );\n\n// ---------------------------------------------------------------------------\n// Low-level keychain operations\n// ---------------------------------------------------------------------------\n\nexport const getPassword = (\n  serviceName: string,\n  account: string,\n): Effect.Effect<string | null, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => entry.getPassword(),\n      catch: () => new KeychainError({ message: `Failed reading secret for account '${account}'` }),\n    }),\n  );\n\nexport const setPassword = (\n  serviceName: string,\n  account: string,\n  value: string,\n): Effect.Effect<void, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => entry.setPassword(value),\n      catch: (cause) =>\n        new KeychainError({\n          message: `Failed writing secret: ${cause instanceof Error ? cause.message : String(cause)}`,\n          cause,\n        }),\n    }).pipe(Effect.asVoid),\n  );\n\nexport const deletePassword = (\n  serviceName: string,\n  account: string,\n): Effect.Effect<boolean, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => {\n        entry.deletePassword();\n        return true;\n      },\n      catch: () =>\n        new KeychainError({ message: `Failed deleting secret for account '${account}'` }),\n    }),\n  );\n","import { Data } from \"effect\";\n\nexport class KeychainError extends Data.TaggedError(\"KeychainError\")<{\n  readonly message: string;\n  readonly cause?: unknown;\n}> {}\n","import { Effect } from \"effect\";\n\nimport { StorageError, type SecretProvider } from \"@executor-js/sdk/core\";\n\nimport { getPassword, setPassword, deletePassword } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// SecretProvider adapter — bridges keyring into SDK resolution chain\n//\n// The underlying `@napi-rs/keyring` sync API encodes \"no entry\" as an\n// ordinary return value (`getPassword()` → `null`, `deletePassword()` →\n// `false`), and only throws on real failures (keychain locked, permission\n// denied, platform init failure, etc.). `keyring.ts` wraps those thrown\n// failures as `KeychainError`. We translate `KeychainError` →\n// `StorageError` so the HTTP edge can capture it to telemetry and surface\n// an opaque `InternalError({ traceId })` — previously `orElseSucceed`\n// silently converted every failure into \"nothing found\", which made it\n// impossible to debug why secrets weren't resolving.\n// ---------------------------------------------------------------------------\n\nconst toStorageError = (cause: { readonly message: string; readonly cause?: unknown }) =>\n  new StorageError({ message: cause.message, cause: cause.cause ?? cause });\n\n// Scope arg is ignored — keychain partitions by `serviceName`, which the\n// host fixes per executor at construction time. A future refactor could\n// fold `scope` into the service name, but today a keychain provider\n// instance is already one-scope.\nexport const makeKeychainProvider = (serviceName: string): SecretProvider => ({\n  key: \"keychain\",\n  writable: true,\n  get: (secretId, _scope) =>\n    getPassword(serviceName, secretId).pipe(Effect.mapError(toStorageError)),\n  set: (secretId, value, _scope) =>\n    setPassword(serviceName, secretId, value).pipe(Effect.mapError(toStorageError)),\n  delete: (secretId, _scope) =>\n    deletePassword(serviceName, secretId).pipe(Effect.mapError(toStorageError)),\n  // Keychain doesn't support enumerating — you need to know the account name\n  list: undefined,\n});\n"],"mappings":";AAAA,SAAS,UAAAA,eAAc;AAEvB;AAAA,EACE;AAAA,OAGK;;;ACNP,SAAS,qBAAqB;AAE9B,SAAS,cAAc;;;ACFvB,SAAS,YAAY;AAEd,IAAM,gBAAN,cAA4B,KAAK,YAAY,eAAe,EAGhE;AAAC;;;ADKJ,IAAM,uBAAuB;AAC7B,IAAM,mBAAmB;AAMlB,IAAM,sBAAsB,MACjC,QAAQ,aAAa,YAAY,QAAQ,aAAa,WAAW,QAAQ,aAAa;AAEjF,IAAM,cAAc,MACzB,QAAQ,aAAa,WACjB,mBACA,QAAQ,aAAa,UACnB,+BACA;AAED,IAAM,qBAAqB,CAAC,aACjC,UAAU,KAAK,KAAK,QAAQ,IAAI,gBAAgB,GAAG,KAAK,KAAK;AAQ/D,IAAI,mBAAqD;AASzD,IAAM,gBAAgB,YAAuC;AAC3D,QAAM,aAAa,QAAQ,IAAI;AAC/B,MAAI,YAAY;AACd,UAAM,MAAM,cAAc,YAAY,GAAG;AACzC,WAAQ,IAAI,UAAU,EAAkC;AAAA,EAC1D;AACA,QAAM,EAAE,MAAM,IAAI,MAAM,OAAO,kBAAkB;AACjD,SAAO;AACT;AAEA,IAAM,YAAY,MAChB,OAAO,WAAW;AAAA,EAChB,KAAK,YAAY;AACf,QAAI,CAAC,oBAAoB,GAAG;AAC1B,YAAM,IAAI,MAAM,yBAAyB,QAAQ,QAAQ,GAAG;AAAA,IAC9D;AACA,yBAAqB,cAAc;AACnC,WAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,IAChB,SAAS,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACjG;AAAA,EACF,CAAC;AACL,CAAC;AAEH,IAAM,cAAc,CAAC,aAAqB,YACxC,OAAO;AAAA,EAAQ,UAAU;AAAA,EAAG,CAAC,UAC3B,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,IAAI,MAAM,aAAa,OAAO;AAAA,IACzC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACjG;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACH;AAMK,IAAM,cAAc,CACzB,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY;AAAA,IAC7B,OAAO,MAAM,IAAI,cAAc,EAAE,SAAS,sCAAsC,OAAO,IAAI,CAAC;AAAA,EAC9F,CAAC;AACH;AAEK,IAAM,cAAc,CACzB,aACA,SACA,UAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY,KAAK;AAAA,IAClC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACzF;AAAA,IACF,CAAC;AAAA,EACL,CAAC,EAAE,KAAK,OAAO,MAAM;AACvB;AAEK,IAAM,iBAAiB,CAC5B,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,eAAe;AACrB,aAAO;AAAA,IACT;AAAA,IACA,OAAO,MACL,IAAI,cAAc,EAAE,SAAS,uCAAuC,OAAO,IAAI,CAAC;AAAA,EACpF,CAAC;AACH;;;AE/HF,SAAS,UAAAC,eAAc;AAEvB,SAAS,oBAAyC;AAkBlD,IAAM,iBAAiB,CAAC,UACtB,IAAI,aAAa,EAAE,SAAS,MAAM,SAAS,OAAO,MAAM,SAAS,MAAM,CAAC;AAMnE,IAAM,uBAAuB,CAAC,iBAAyC;AAAA,EAC5E,KAAK;AAAA,EACL,UAAU;AAAA,EACV,KAAK,CAAC,UAAU,WACd,YAAY,aAAa,QAAQ,EAAE,KAAKC,QAAO,SAAS,cAAc,CAAC;AAAA,EACzE,KAAK,CAAC,UAAU,OAAO,WACrB,YAAY,aAAa,UAAU,KAAK,EAAE,KAAKA,QAAO,SAAS,cAAc,CAAC;AAAA,EAChF,QAAQ,CAAC,UAAU,WACjB,eAAe,aAAa,QAAQ,EAAE,KAAKA,QAAO,SAAS,cAAc,CAAC;AAAA;AAAA,EAE5E,MAAM;AACR;;;AHdA,IAAM,gBAAgB;AACtB,IAAM,cAAc;AA0CpB,IAAM,oBAAoB,CACxB,KACA,YAEA,GAAG,mBAAmB,SAAS,WAAW,CAAC,IAAI,IAAI,OAAO,CAAC,EAAG,EAAY;AAErE,IAAM,iBAAiB;AAAA,EAC5B,CAAC,aAAoC;AAAA,IACnC,IAAI;AAAA,IACJ,SAAS,OAAO,CAAC;AAAA,IAEjB,WAAW,CAAC,QAA2B;AACrC,YAAM,cAAc,kBAAkB,KAAK,OAAO;AAClD,aAAO;AAAA,QACL,aAAa,YAAY;AAAA,QACzB,aAAa,oBAAoB;AAAA,QACjC,KAAK,CAAC,OACJ,YAAY,aAAa,EAAE,EAAE;AAAA,UAC3BC,QAAO,IAAI,CAAC,MAAM,MAAM,IAAI;AAAA,UAC5BA,QAAO,cAAc,MAAM,KAAK;AAAA,QAClC;AAAA,MACJ;AAAA,IACF;AAAA,IAEA,iBAAiB,CAAC,QAChBA,QAAO,IAAI,aAAa;AACtB,YAAM,cAAc,kBAAkB,KAAK,OAAO;AAClD,YAAM,YAAY,OAAO;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE;AAAA,QACAA,QAAO;AAAA,UACL,eAAe,aAAa,aAAa,EAAE;AAAA,YACzCA,QAAO,MAAM,MAAMA,QAAO,IAAI;AAAA,UAChC;AAAA,QACF;AAAA,QACAA,QAAO,GAAG,IAAI;AAAA,QACdA,QAAO;AAAA,UAAM,CAAC,UACZA,QAAO;AAAA,YACL,yDAAyD,MAAM,OAAO;AAAA,UACxE,EAAE,KAAKA,QAAO,GAAG,KAAK,CAAC;AAAA,QACzB;AAAA,MACF;AACA,aAAO,YAAY,CAAC,qBAAqB,WAAW,CAAC,IAAI,CAAC;AAAA,IAC5D,CAAC;AAAA,EACL;AACF;","names":["Effect","Effect","Effect","Effect"]}