@executor-js/plugin-keychain 1.5.6 → 1.5.8

package/dist/{chunk-H26O4VZW.js → chunk-Y62YAXEQ.js}

@@ -1,6 +1,6 @@
 // src/index.ts
 import { Effect as Effect3 } from "effect";
-import { definePlugin } from "@executor-js/sdk/core";
+import { definePlugin } from "@executor-js/sdk";
 
 // src/keyring.ts
 import { createRequire } from "module";
@@ -84,7 +84,7 @@ import { Effect as Effect2 } from "effect";
 import {
   StorageError,
   ProviderKey
-} from "@executor-js/sdk/core";
+} from "@executor-js/sdk";
 var toStorageError = (cause) => {
   const { cause: underlyingCause } = cause;
   return new StorageError({ message: cause.message, cause: underlyingCause ?? cause });
@@ -149,4 +149,4 @@ export {
   makeKeychainProvider,
   keychainPlugin
 };
-//# sourceMappingURL=chunk-H26O4VZW.js.map
+//# sourceMappingURL=chunk-Y62YAXEQ.js.map

package/dist/chunk-Y62YAXEQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/keyring.ts","../src/errors.ts","../src/provider.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport { definePlugin, type CredentialProvider, type PluginCtx } from \"@executor-js/sdk\";\n\nimport {\n  deletePassword,\n  displayName,\n  getPassword,\n  isSupportedPlatform,\n  resolveServiceName,\n  setPassword,\n} from \"./keyring\";\nimport { makeKeychainProvider } from \"./provider\";\n\n// Probe the keychain by writing and then deleting a sentinel entry. A\n// read-only probe isn't enough — on some Linux environments (WSL2,\n// headless CI) `getPassword` for a missing key returns null without\n// error, but `setPassword` fails because the secret-service backend\n// isn't actually reachable. Writing is the capability the executor\n// cares about, so test it directly.\nconst PROBE_VALUE = \"probe\";\nconst probeAccount = (): string =>\n  `__executor_keychain_probe__:${process.pid}:${Date.now()}:${Math.random().toString(36).slice(2)}`;\n\n// ---------------------------------------------------------------------------\n// Re-exports\n// ---------------------------------------------------------------------------\n\nexport { KeychainError } from \"./errors\";\nexport { makeKeychainProvider } from \"./provider\";\nexport { isSupportedPlatform, displayName } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// Plugin config\n// ---------------------------------------------------------------------------\n\nexport interface KeychainPluginConfig {\n  /** Override the keychain service name (default: \"executor\") */\n  readonly serviceName?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin extension — public API on executor.keychain\n// ---------------------------------------------------------------------------\n\nexport type KeychainExtension = ReturnType<typeof makeKeychainExtension>;\n\n// ---------------------------------------------------------------------------\n// Plugin definition\n// ---------------------------------------------------------------------------\n\nconst makeKeychainExtension = (\n  _ctx: PluginCtx<unknown>,\n  options: KeychainPluginConfig | undefined,\n) => {\n  const serviceName = resolveServiceName(options?.serviceName);\n  return {\n    /** Human-readable name for the keychain on this platform */\n    displayName: displayName(),\n\n    /** Whether the current platform supports system keychain */\n    isSupported: isSupportedPlatform(),\n\n    /** Check if a secret exists in the system keychain. `id` is the opaque\n     *  provider item id (the keychain account); v2 has no scope partitioning. */\n    has: (id: string) =>\n      getPassword(serviceName, id).pipe(\n        Effect.map((value: string | null) => value !== null),\n        Effect.orElseSucceed(() => false),\n      ),\n  };\n};\n\nexport const keychainPlugin = definePlugin((options?: KeychainPluginConfig) => ({\n  id: \"keychain\" as const,\n  storage: () => ({}),\n\n  extension: (ctx: PluginCtx<unknown>): KeychainExtension => makeKeychainExtension(ctx, options),\n\n  credentialProviders: (): Effect.Effect<readonly CredentialProvider[]> =>\n    Effect.gen(function* () {\n      const serviceName = resolveServiceName(options?.serviceName);\n      const account = probeAccount();\n      const reachable = yield* setPassword(serviceName, account, PROBE_VALUE).pipe(\n        Effect.andThen(deletePassword(serviceName, account).pipe(Effect.catch(() => Effect.void))),\n        Effect.as(true),\n        Effect.catch(() =>\n          Effect.logWarning(\"keychain unavailable, skipping provider registration\").pipe(\n            Effect.as(false),\n          ),\n        ),\n      );\n      return reachable ? [makeKeychainProvider(serviceName)] : [];\n    }),\n}));\n","import { createRequire } from \"node:module\";\n\nimport { Effect } from \"effect\";\n\nimport { KeychainError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst DEFAULT_SERVICE_NAME = \"executor\";\nconst SERVICE_NAME_ENV = \"EXECUTOR_KEYCHAIN_SERVICE_NAME\";\n\n// ---------------------------------------------------------------------------\n// Platform helpers\n// ---------------------------------------------------------------------------\n\nexport const isSupportedPlatform = () =>\n  process.platform === \"darwin\" || process.platform === \"linux\" || process.platform === \"win32\";\n\nexport const displayName = () =>\n  process.platform === \"darwin\"\n    ? \"macOS Keychain\"\n    : process.platform === \"win32\"\n      ? \"Windows Credential Manager\"\n      : \"Desktop Keyring\";\n\nexport const resolveServiceName = (explicit?: string): string =>\n  explicit?.trim() || process.env[SERVICE_NAME_ENV]?.trim() || DEFAULT_SERVICE_NAME;\n\n// ---------------------------------------------------------------------------\n// Lazy-load @napi-rs/keyring (native module)\n// ---------------------------------------------------------------------------\n\ntype EntryConstructor = (typeof import(\"@napi-rs/keyring\"))[\"Entry\"];\n\nlet entryCtorPromise: Promise<EntryConstructor> | null = null;\n\n// In compiled bun binaries (`bun build --compile`) `.node` modules aren't\n// included in bunfs and there's no node_modules at runtime, so\n// @napi-rs/keyring's loader can't find its platform-specific binding.\n// `apps/cli/src/build.ts` copies the .node next to the executor and\n// `apps/cli/src/main.ts` exports its absolute path here. We load it\n// directly because @napi-rs/keyring@1.2.0's NAPI_RS_NATIVE_LIBRARY_PATH\n// branch is buggy (assigns to a local that gets overwritten before return).\nconst loadEntryCtor = async (): Promise<EntryConstructor> => {\n  const directPath = process.env.EXECUTOR_KEYRING_NATIVE_PATH;\n  if (directPath) {\n    const req = createRequire(import.meta.url);\n    return (req(directPath) as { Entry: EntryConstructor }).Entry;\n  }\n  const { Entry } = await import(\"@napi-rs/keyring\");\n  return Entry;\n};\n\nconst loadEntry = (): Effect.Effect<EntryConstructor, KeychainError> =>\n  isSupportedPlatform()\n    ? Effect.tryPromise({\n        try: async () => {\n          entryCtorPromise ??= loadEntryCtor();\n          return await entryCtorPromise;\n        },\n        catch: (cause) =>\n          new KeychainError({\n            message: \"Failed loading native keyring\",\n            cause,\n          }),\n      })\n    : Effect.fail(\n        new KeychainError({\n          message: `Failed loading native keyring: unsupported platform '${process.platform}'`,\n        }),\n      );\n\nconst createEntry = (serviceName: string, account: string) =>\n  Effect.flatMap(loadEntry(), (Entry) =>\n    Effect.try({\n      try: () => new Entry(serviceName, account),\n      catch: (cause) =>\n        new KeychainError({\n          message: \"Failed creating keyring entry\",\n          cause,\n        }),\n    }),\n  );\n\n// ---------------------------------------------------------------------------\n// Low-level keychain operations\n// ---------------------------------------------------------------------------\n\nexport const getPassword = (\n  serviceName: string,\n  account: string,\n): Effect.Effect<string | null, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => entry.getPassword(),\n      catch: () => new KeychainError({ message: `Failed reading secret for account '${account}'` }),\n    }),\n  );\n\nexport const setPassword = (\n  serviceName: string,\n  account: string,\n  value: string,\n): Effect.Effect<void, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => entry.setPassword(value),\n      catch: (cause) =>\n        new KeychainError({\n          message: \"Failed writing secret\",\n          cause,\n        }),\n    }).pipe(Effect.asVoid),\n  );\n\nexport const deletePassword = (\n  serviceName: string,\n  account: string,\n): Effect.Effect<boolean, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => {\n        entry.deletePassword();\n        return true;\n      },\n      catch: () =>\n        new KeychainError({ message: `Failed deleting secret for account '${account}'` }),\n    }),\n  );\n","import { Data } from \"effect\";\n\nexport class KeychainError extends Data.TaggedError(\"KeychainError\")<{\n  readonly message: string;\n  readonly cause?: unknown;\n}> {}\n","import { Effect } from \"effect\";\n\nimport {\n  StorageError,\n  ProviderKey,\n  type CredentialProvider,\n  type ProviderItemId,\n} from \"@executor-js/sdk\";\n\nimport type { KeychainError } from \"./errors\";\nimport { getPassword, setPassword, deletePassword } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// CredentialProvider adapter — bridges keyring into the v2 resolution chain.\n//\n// The underlying `@napi-rs/keyring` sync API encodes \"no entry\" as an\n// ordinary return value (`getPassword()` → `null`, `deletePassword()` →\n// `false`), and only throws on real failures (keychain locked, permission\n// denied, platform init failure, etc.). `keyring.ts` wraps those thrown\n// failures as `KeychainError`. We translate `KeychainError` →\n// `StorageError` so the HTTP edge can capture it to telemetry and surface\n// an opaque `InternalError({ traceId })` — previously `orElseSucceed`\n// silently converted every failure into \"nothing found\", which made it\n// impossible to debug why secrets weren't resolving.\n//\n// v2: the provider sees only an opaque `ProviderItemId` (the keychain\n// account). There is NO scope arg — the connection row owns the (tenant,\n// owner, subject) partition. We use a single, flat keychain service name;\n// the connection's opaque id is the account that uniquely keys the entry.\n// ---------------------------------------------------------------------------\n\nconst toStorageError = (cause: KeychainError) => {\n  const { cause: underlyingCause } = cause;\n  // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: typed KeychainError message becomes StorageError message\n  return new StorageError({ message: cause.message, cause: underlyingCause ?? cause });\n};\n\nconst KEYCHAIN_PROVIDER_KEY = ProviderKey.make(\"keychain\");\n\nexport const makeKeychainProvider = (serviceName: string): CredentialProvider => ({\n  key: KEYCHAIN_PROVIDER_KEY,\n  writable: true,\n  get: (id: ProviderItemId) => getPassword(serviceName, id).pipe(Effect.mapError(toStorageError)),\n  has: (id: ProviderItemId) =>\n    getPassword(serviceName, id).pipe(\n      Effect.map((value: string | null) => value !== null),\n      Effect.mapError(toStorageError),\n    ),\n  set: (id: ProviderItemId, value: string) =>\n    setPassword(serviceName, id, value).pipe(Effect.mapError(toStorageError)),\n  delete: (id: ProviderItemId) =>\n    deletePassword(serviceName, id).pipe(Effect.asVoid, Effect.mapError(toStorageError)),\n  // Keychain doesn't support enumerating — you need to know the account name.\n  list: undefined,\n});\n"],"mappings":";AAAA,SAAS,UAAAA,eAAc;AAEvB,SAAS,oBAA6D;;;ACFtE,SAAS,qBAAqB;AAE9B,SAAS,cAAc;;;ACFvB,SAAS,YAAY;AAEd,IAAM,gBAAN,cAA4B,KAAK,YAAY,eAAe,EAGhE;AAAC;;;ADKJ,IAAM,uBAAuB;AAC7B,IAAM,mBAAmB;AAMlB,IAAM,sBAAsB,MACjC,QAAQ,aAAa,YAAY,QAAQ,aAAa,WAAW,QAAQ,aAAa;AAEjF,IAAM,cAAc,MACzB,QAAQ,aAAa,WACjB,mBACA,QAAQ,aAAa,UACnB,+BACA;AAED,IAAM,qBAAqB,CAAC,aACjC,UAAU,KAAK,KAAK,QAAQ,IAAI,gBAAgB,GAAG,KAAK,KAAK;AAQ/D,IAAI,mBAAqD;AASzD,IAAM,gBAAgB,YAAuC;AAC3D,QAAM,aAAa,QAAQ,IAAI;AAC/B,MAAI,YAAY;AACd,UAAM,MAAM,cAAc,YAAY,GAAG;AACzC,WAAQ,IAAI,UAAU,EAAkC;AAAA,EAC1D;AACA,QAAM,EAAE,MAAM,IAAI,MAAM,OAAO,kBAAkB;AACjD,SAAO;AACT;AAEA,IAAM,YAAY,MAChB,oBAAoB,IAChB,OAAO,WAAW;AAAA,EAChB,KAAK,YAAY;AACf,yBAAqB,cAAc;AACnC,WAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,IAChB,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACL,CAAC,IACD,OAAO;AAAA,EACL,IAAI,cAAc;AAAA,IAChB,SAAS,wDAAwD,QAAQ,QAAQ;AAAA,EACnF,CAAC;AACH;AAEN,IAAM,cAAc,CAAC,aAAqB,YACxC,OAAO;AAAA,EAAQ,UAAU;AAAA,EAAG,CAAC,UAC3B,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,IAAI,MAAM,aAAa,OAAO;AAAA,IACzC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACH;AAMK,IAAM,cAAc,CACzB,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY;AAAA,IAC7B,OAAO,MAAM,IAAI,cAAc,EAAE,SAAS,sCAAsC,OAAO,IAAI,CAAC;AAAA,EAC9F,CAAC;AACH;AAEK,IAAM,cAAc,CACzB,aACA,SACA,UAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY,KAAK;AAAA,IAClC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACL,CAAC,EAAE,KAAK,OAAO,MAAM;AACvB;AAEK,IAAM,iBAAiB,CAC5B,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,eAAe;AACrB,aAAO;AAAA,IACT;AAAA,IACA,OAAO,MACL,IAAI,cAAc,EAAE,SAAS,uCAAuC,OAAO,IAAI,CAAC;AAAA,EACpF,CAAC;AACH;;;AElIF,SAAS,UAAAC,eAAc;AAEvB;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAwBP,IAAM,iBAAiB,CAAC,UAAyB;AAC/C,QAAM,EAAE,OAAO,gBAAgB,IAAI;AAEnC,SAAO,IAAI,aAAa,EAAE,SAAS,MAAM,SAAS,OAAO,mBAAmB,MAAM,CAAC;AACrF;AAEA,IAAM,wBAAwB,YAAY,KAAK,UAAU;AAElD,IAAM,uBAAuB,CAAC,iBAA6C;AAAA,EAChF,KAAK;AAAA,EACL,UAAU;AAAA,EACV,KAAK,CAAC,OAAuB,YAAY,aAAa,EAAE,EAAE,KAAKC,QAAO,SAAS,cAAc,CAAC;AAAA,EAC9F,KAAK,CAAC,OACJ,YAAY,aAAa,EAAE,EAAE;AAAA,IAC3BA,QAAO,IAAI,CAAC,UAAyB,UAAU,IAAI;AAAA,IACnDA,QAAO,SAAS,cAAc;AAAA,EAChC;AAAA,EACF,KAAK,CAAC,IAAoB,UACxB,YAAY,aAAa,IAAI,KAAK,EAAE,KAAKA,QAAO,SAAS,cAAc,CAAC;AAAA,EAC1E,QAAQ,CAAC,OACP,eAAe,aAAa,EAAE,EAAE,KAAKA,QAAO,QAAQA,QAAO,SAAS,cAAc,CAAC;AAAA;AAAA,EAErF,MAAM;AACR;;;AHlCA,IAAM,cAAc;AACpB,IAAM,eAAe,MACnB,+BAA+B,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AA6BjG,IAAM,wBAAwB,CAC5B,MACA,YACG;AACH,QAAM,cAAc,mBAAmB,SAAS,WAAW;AAC3D,SAAO;AAAA;AAAA,IAEL,aAAa,YAAY;AAAA;AAAA,IAGzB,aAAa,oBAAoB;AAAA;AAAA;AAAA,IAIjC,KAAK,CAAC,OACJ,YAAY,aAAa,EAAE,EAAE;AAAA,MAC3BC,QAAO,IAAI,CAAC,UAAyB,UAAU,IAAI;AAAA,MACnDA,QAAO,cAAc,MAAM,KAAK;AAAA,IAClC;AAAA,EACJ;AACF;AAEO,IAAM,iBAAiB,aAAa,CAAC,aAAoC;AAAA,EAC9E,IAAI;AAAA,EACJ,SAAS,OAAO,CAAC;AAAA,EAEjB,WAAW,CAAC,QAA+C,sBAAsB,KAAK,OAAO;AAAA,EAE7F,qBAAqB,MACnBA,QAAO,IAAI,aAAa;AACtB,UAAM,cAAc,mBAAmB,SAAS,WAAW;AAC3D,UAAM,UAAU,aAAa;AAC7B,UAAM,YAAY,OAAO,YAAY,aAAa,SAAS,WAAW,EAAE;AAAA,MACtEA,QAAO,QAAQ,eAAe,aAAa,OAAO,EAAE,KAAKA,QAAO,MAAM,MAAMA,QAAO,IAAI,CAAC,CAAC;AAAA,MACzFA,QAAO,GAAG,IAAI;AAAA,MACdA,QAAO;AAAA,QAAM,MACXA,QAAO,WAAW,sDAAsD,EAAE;AAAA,UACxEA,QAAO,GAAG,KAAK;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AACA,WAAO,YAAY,CAAC,qBAAqB,WAAW,CAAC,IAAI,CAAC;AAAA,EAC5D,CAAC;AACL,EAAE;","names":["Effect","Effect","Effect","Effect"]}

package/dist/core.js

@@ -4,7 +4,7 @@ import {
   isSupportedPlatform,
   keychainPlugin,
   makeKeychainProvider
-} from "./chunk-H26O4VZW.js";
+} from "./chunk-Y62YAXEQ.js";
 export {
   KeychainError,
   displayName,

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { Effect } from "effect";
-import { type PluginCtx } from "@executor-js/sdk/core";
+import { type PluginCtx } from "@executor-js/sdk";
 export { KeychainError } from "./errors";
 export { makeKeychainProvider } from "./provider";
 export { isSupportedPlatform, displayName } from "./keyring";
@@ -17,7 +17,7 @@ declare const makeKeychainExtension: (_ctx: PluginCtx<unknown>, options: Keychai
      *  provider item id (the keychain account); v2 has no scope partitioning. */
     has: (id: string) => Effect.Effect<boolean, never, never>;
 };
-export declare const keychainPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"keychain", {
+export declare const keychainPlugin: import("@executor-js/sdk").ConfiguredPlugin<"keychain", {
     /** Human-readable name for the keychain on this platform */
     displayName: string;
     /** Whether the current platform supports system keychain */

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   keychainPlugin
-} from "./chunk-H26O4VZW.js";
+} from "./chunk-Y62YAXEQ.js";
 
 // src/promise.ts
 var keychainPlugin2 = (config) => keychainPlugin(config);

package/dist/provider.d.ts

@@ -1,2 +1,2 @@
-import { type CredentialProvider } from "@executor-js/sdk/core";
+import { type CredentialProvider } from "@executor-js/sdk";
 export declare const makeKeychainProvider: (serviceName: string) => CredentialProvider;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/plugin-keychain",
-  "version": "1.5.6",
+  "version": "1.5.8",
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/keychain",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
@@ -40,7 +40,7 @@
     "typecheck:slow": "bunx tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@executor-js/sdk": "1.5.6",
+    "@executor-js/sdk": "1.5.8",
     "@napi-rs/keyring": "^1.2.0"
   },
   "devDependencies": {

package/dist/chunk-H26O4VZW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts","../src/keyring.ts","../src/errors.ts","../src/provider.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport { definePlugin, type CredentialProvider, type PluginCtx } from \"@executor-js/sdk/core\";\n\nimport {\n  deletePassword,\n  displayName,\n  getPassword,\n  isSupportedPlatform,\n  resolveServiceName,\n  setPassword,\n} from \"./keyring\";\nimport { makeKeychainProvider } from \"./provider\";\n\n// Probe the keychain by writing and then deleting a sentinel entry. A\n// read-only probe isn't enough — on some Linux environments (WSL2,\n// headless CI) `getPassword` for a missing key returns null without\n// error, but `setPassword` fails because the secret-service backend\n// isn't actually reachable. Writing is the capability the executor\n// cares about, so test it directly.\nconst PROBE_VALUE = \"probe\";\nconst probeAccount = (): string =>\n  `__executor_keychain_probe__:${process.pid}:${Date.now()}:${Math.random().toString(36).slice(2)}`;\n\n// ---------------------------------------------------------------------------\n// Re-exports\n// ---------------------------------------------------------------------------\n\nexport { KeychainError } from \"./errors\";\nexport { makeKeychainProvider } from \"./provider\";\nexport { isSupportedPlatform, displayName } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// Plugin config\n// ---------------------------------------------------------------------------\n\nexport interface KeychainPluginConfig {\n  /** Override the keychain service name (default: \"executor\") */\n  readonly serviceName?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin extension — public API on executor.keychain\n// ---------------------------------------------------------------------------\n\nexport type KeychainExtension = ReturnType<typeof makeKeychainExtension>;\n\n// ---------------------------------------------------------------------------\n// Plugin definition\n// ---------------------------------------------------------------------------\n\nconst makeKeychainExtension = (\n  _ctx: PluginCtx<unknown>,\n  options: KeychainPluginConfig | undefined,\n) => {\n  const serviceName = resolveServiceName(options?.serviceName);\n  return {\n    /** Human-readable name for the keychain on this platform */\n    displayName: displayName(),\n\n    /** Whether the current platform supports system keychain */\n    isSupported: isSupportedPlatform(),\n\n    /** Check if a secret exists in the system keychain. `id` is the opaque\n     *  provider item id (the keychain account); v2 has no scope partitioning. */\n    has: (id: string) =>\n      getPassword(serviceName, id).pipe(\n        Effect.map((value: string | null) => value !== null),\n        Effect.orElseSucceed(() => false),\n      ),\n  };\n};\n\nexport const keychainPlugin = definePlugin((options?: KeychainPluginConfig) => ({\n  id: \"keychain\" as const,\n  storage: () => ({}),\n\n  extension: (ctx: PluginCtx<unknown>): KeychainExtension => makeKeychainExtension(ctx, options),\n\n  credentialProviders: (): Effect.Effect<readonly CredentialProvider[]> =>\n    Effect.gen(function* () {\n      const serviceName = resolveServiceName(options?.serviceName);\n      const account = probeAccount();\n      const reachable = yield* setPassword(serviceName, account, PROBE_VALUE).pipe(\n        Effect.andThen(deletePassword(serviceName, account).pipe(Effect.catch(() => Effect.void))),\n        Effect.as(true),\n        Effect.catch(() =>\n          Effect.logWarning(\"keychain unavailable, skipping provider registration\").pipe(\n            Effect.as(false),\n          ),\n        ),\n      );\n      return reachable ? [makeKeychainProvider(serviceName)] : [];\n    }),\n}));\n","import { createRequire } from \"node:module\";\n\nimport { Effect } from \"effect\";\n\nimport { KeychainError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst DEFAULT_SERVICE_NAME = \"executor\";\nconst SERVICE_NAME_ENV = \"EXECUTOR_KEYCHAIN_SERVICE_NAME\";\n\n// ---------------------------------------------------------------------------\n// Platform helpers\n// ---------------------------------------------------------------------------\n\nexport const isSupportedPlatform = () =>\n  process.platform === \"darwin\" || process.platform === \"linux\" || process.platform === \"win32\";\n\nexport const displayName = () =>\n  process.platform === \"darwin\"\n    ? \"macOS Keychain\"\n    : process.platform === \"win32\"\n      ? \"Windows Credential Manager\"\n      : \"Desktop Keyring\";\n\nexport const resolveServiceName = (explicit?: string): string =>\n  explicit?.trim() || process.env[SERVICE_NAME_ENV]?.trim() || DEFAULT_SERVICE_NAME;\n\n// ---------------------------------------------------------------------------\n// Lazy-load @napi-rs/keyring (native module)\n// ---------------------------------------------------------------------------\n\ntype EntryConstructor = (typeof import(\"@napi-rs/keyring\"))[\"Entry\"];\n\nlet entryCtorPromise: Promise<EntryConstructor> | null = null;\n\n// In compiled bun binaries (`bun build --compile`) `.node` modules aren't\n// included in bunfs and there's no node_modules at runtime, so\n// @napi-rs/keyring's loader can't find its platform-specific binding.\n// `apps/cli/src/build.ts` copies the .node next to the executor and\n// `apps/cli/src/main.ts` exports its absolute path here. We load it\n// directly because @napi-rs/keyring@1.2.0's NAPI_RS_NATIVE_LIBRARY_PATH\n// branch is buggy (assigns to a local that gets overwritten before return).\nconst loadEntryCtor = async (): Promise<EntryConstructor> => {\n  const directPath = process.env.EXECUTOR_KEYRING_NATIVE_PATH;\n  if (directPath) {\n    const req = createRequire(import.meta.url);\n    return (req(directPath) as { Entry: EntryConstructor }).Entry;\n  }\n  const { Entry } = await import(\"@napi-rs/keyring\");\n  return Entry;\n};\n\nconst loadEntry = (): Effect.Effect<EntryConstructor, KeychainError> =>\n  isSupportedPlatform()\n    ? Effect.tryPromise({\n        try: async () => {\n          entryCtorPromise ??= loadEntryCtor();\n          return await entryCtorPromise;\n        },\n        catch: (cause) =>\n          new KeychainError({\n            message: \"Failed loading native keyring\",\n            cause,\n          }),\n      })\n    : Effect.fail(\n        new KeychainError({\n          message: `Failed loading native keyring: unsupported platform '${process.platform}'`,\n        }),\n      );\n\nconst createEntry = (serviceName: string, account: string) =>\n  Effect.flatMap(loadEntry(), (Entry) =>\n    Effect.try({\n      try: () => new Entry(serviceName, account),\n      catch: (cause) =>\n        new KeychainError({\n          message: \"Failed creating keyring entry\",\n          cause,\n        }),\n    }),\n  );\n\n// ---------------------------------------------------------------------------\n// Low-level keychain operations\n// ---------------------------------------------------------------------------\n\nexport const getPassword = (\n  serviceName: string,\n  account: string,\n): Effect.Effect<string | null, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => entry.getPassword(),\n      catch: () => new KeychainError({ message: `Failed reading secret for account '${account}'` }),\n    }),\n  );\n\nexport const setPassword = (\n  serviceName: string,\n  account: string,\n  value: string,\n): Effect.Effect<void, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => entry.setPassword(value),\n      catch: (cause) =>\n        new KeychainError({\n          message: \"Failed writing secret\",\n          cause,\n        }),\n    }).pipe(Effect.asVoid),\n  );\n\nexport const deletePassword = (\n  serviceName: string,\n  account: string,\n): Effect.Effect<boolean, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => {\n        entry.deletePassword();\n        return true;\n      },\n      catch: () =>\n        new KeychainError({ message: `Failed deleting secret for account '${account}'` }),\n    }),\n  );\n","import { Data } from \"effect\";\n\nexport class KeychainError extends Data.TaggedError(\"KeychainError\")<{\n  readonly message: string;\n  readonly cause?: unknown;\n}> {}\n","import { Effect } from \"effect\";\n\nimport {\n  StorageError,\n  ProviderKey,\n  type CredentialProvider,\n  type ProviderItemId,\n} from \"@executor-js/sdk/core\";\n\nimport type { KeychainError } from \"./errors\";\nimport { getPassword, setPassword, deletePassword } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// CredentialProvider adapter — bridges keyring into the v2 resolution chain.\n//\n// The underlying `@napi-rs/keyring` sync API encodes \"no entry\" as an\n// ordinary return value (`getPassword()` → `null`, `deletePassword()` →\n// `false`), and only throws on real failures (keychain locked, permission\n// denied, platform init failure, etc.). `keyring.ts` wraps those thrown\n// failures as `KeychainError`. We translate `KeychainError` →\n// `StorageError` so the HTTP edge can capture it to telemetry and surface\n// an opaque `InternalError({ traceId })` — previously `orElseSucceed`\n// silently converted every failure into \"nothing found\", which made it\n// impossible to debug why secrets weren't resolving.\n//\n// v2: the provider sees only an opaque `ProviderItemId` (the keychain\n// account). There is NO scope arg — the connection row owns the (tenant,\n// owner, subject) partition. We use a single, flat keychain service name;\n// the connection's opaque id is the account that uniquely keys the entry.\n// ---------------------------------------------------------------------------\n\nconst toStorageError = (cause: KeychainError) => {\n  const { cause: underlyingCause } = cause;\n  // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: typed KeychainError message becomes StorageError message\n  return new StorageError({ message: cause.message, cause: underlyingCause ?? cause });\n};\n\nconst KEYCHAIN_PROVIDER_KEY = ProviderKey.make(\"keychain\");\n\nexport const makeKeychainProvider = (serviceName: string): CredentialProvider => ({\n  key: KEYCHAIN_PROVIDER_KEY,\n  writable: true,\n  get: (id: ProviderItemId) => getPassword(serviceName, id).pipe(Effect.mapError(toStorageError)),\n  has: (id: ProviderItemId) =>\n    getPassword(serviceName, id).pipe(\n      Effect.map((value: string | null) => value !== null),\n      Effect.mapError(toStorageError),\n    ),\n  set: (id: ProviderItemId, value: string) =>\n    setPassword(serviceName, id, value).pipe(Effect.mapError(toStorageError)),\n  delete: (id: ProviderItemId) =>\n    deletePassword(serviceName, id).pipe(Effect.asVoid, Effect.mapError(toStorageError)),\n  // Keychain doesn't support enumerating — you need to know the account name.\n  list: undefined,\n});\n"],"mappings":";AAAA,SAAS,UAAAA,eAAc;AAEvB,SAAS,oBAA6D;;;ACFtE,SAAS,qBAAqB;AAE9B,SAAS,cAAc;;;ACFvB,SAAS,YAAY;AAEd,IAAM,gBAAN,cAA4B,KAAK,YAAY,eAAe,EAGhE;AAAC;;;ADKJ,IAAM,uBAAuB;AAC7B,IAAM,mBAAmB;AAMlB,IAAM,sBAAsB,MACjC,QAAQ,aAAa,YAAY,QAAQ,aAAa,WAAW,QAAQ,aAAa;AAEjF,IAAM,cAAc,MACzB,QAAQ,aAAa,WACjB,mBACA,QAAQ,aAAa,UACnB,+BACA;AAED,IAAM,qBAAqB,CAAC,aACjC,UAAU,KAAK,KAAK,QAAQ,IAAI,gBAAgB,GAAG,KAAK,KAAK;AAQ/D,IAAI,mBAAqD;AASzD,IAAM,gBAAgB,YAAuC;AAC3D,QAAM,aAAa,QAAQ,IAAI;AAC/B,MAAI,YAAY;AACd,UAAM,MAAM,cAAc,YAAY,GAAG;AACzC,WAAQ,IAAI,UAAU,EAAkC;AAAA,EAC1D;AACA,QAAM,EAAE,MAAM,IAAI,MAAM,OAAO,kBAAkB;AACjD,SAAO;AACT;AAEA,IAAM,YAAY,MAChB,oBAAoB,IAChB,OAAO,WAAW;AAAA,EAChB,KAAK,YAAY;AACf,yBAAqB,cAAc;AACnC,WAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,IAChB,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACL,CAAC,IACD,OAAO;AAAA,EACL,IAAI,cAAc;AAAA,IAChB,SAAS,wDAAwD,QAAQ,QAAQ;AAAA,EACnF,CAAC;AACH;AAEN,IAAM,cAAc,CAAC,aAAqB,YACxC,OAAO;AAAA,EAAQ,UAAU;AAAA,EAAG,CAAC,UAC3B,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,IAAI,MAAM,aAAa,OAAO;AAAA,IACzC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACH;AAMK,IAAM,cAAc,CACzB,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY;AAAA,IAC7B,OAAO,MAAM,IAAI,cAAc,EAAE,SAAS,sCAAsC,OAAO,IAAI,CAAC;AAAA,EAC9F,CAAC;AACH;AAEK,IAAM,cAAc,CACzB,aACA,SACA,UAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY,KAAK;AAAA,IAClC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACL,CAAC,EAAE,KAAK,OAAO,MAAM;AACvB;AAEK,IAAM,iBAAiB,CAC5B,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,eAAe;AACrB,aAAO;AAAA,IACT;AAAA,IACA,OAAO,MACL,IAAI,cAAc,EAAE,SAAS,uCAAuC,OAAO,IAAI,CAAC;AAAA,EACpF,CAAC;AACH;;;AElIF,SAAS,UAAAC,eAAc;AAEvB;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAwBP,IAAM,iBAAiB,CAAC,UAAyB;AAC/C,QAAM,EAAE,OAAO,gBAAgB,IAAI;AAEnC,SAAO,IAAI,aAAa,EAAE,SAAS,MAAM,SAAS,OAAO,mBAAmB,MAAM,CAAC;AACrF;AAEA,IAAM,wBAAwB,YAAY,KAAK,UAAU;AAElD,IAAM,uBAAuB,CAAC,iBAA6C;AAAA,EAChF,KAAK;AAAA,EACL,UAAU;AAAA,EACV,KAAK,CAAC,OAAuB,YAAY,aAAa,EAAE,EAAE,KAAKC,QAAO,SAAS,cAAc,CAAC;AAAA,EAC9F,KAAK,CAAC,OACJ,YAAY,aAAa,EAAE,EAAE;AAAA,IAC3BA,QAAO,IAAI,CAAC,UAAyB,UAAU,IAAI;AAAA,IACnDA,QAAO,SAAS,cAAc;AAAA,EAChC;AAAA,EACF,KAAK,CAAC,IAAoB,UACxB,YAAY,aAAa,IAAI,KAAK,EAAE,KAAKA,QAAO,SAAS,cAAc,CAAC;AAAA,EAC1E,QAAQ,CAAC,OACP,eAAe,aAAa,EAAE,EAAE,KAAKA,QAAO,QAAQA,QAAO,SAAS,cAAc,CAAC;AAAA;AAAA,EAErF,MAAM;AACR;;;AHlCA,IAAM,cAAc;AACpB,IAAM,eAAe,MACnB,+BAA+B,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AA6BjG,IAAM,wBAAwB,CAC5B,MACA,YACG;AACH,QAAM,cAAc,mBAAmB,SAAS,WAAW;AAC3D,SAAO;AAAA;AAAA,IAEL,aAAa,YAAY;AAAA;AAAA,IAGzB,aAAa,oBAAoB;AAAA;AAAA;AAAA,IAIjC,KAAK,CAAC,OACJ,YAAY,aAAa,EAAE,EAAE;AAAA,MAC3BC,QAAO,IAAI,CAAC,UAAyB,UAAU,IAAI;AAAA,MACnDA,QAAO,cAAc,MAAM,KAAK;AAAA,IAClC;AAAA,EACJ;AACF;AAEO,IAAM,iBAAiB,aAAa,CAAC,aAAoC;AAAA,EAC9E,IAAI;AAAA,EACJ,SAAS,OAAO,CAAC;AAAA,EAEjB,WAAW,CAAC,QAA+C,sBAAsB,KAAK,OAAO;AAAA,EAE7F,qBAAqB,MACnBA,QAAO,IAAI,aAAa;AACtB,UAAM,cAAc,mBAAmB,SAAS,WAAW;AAC3D,UAAM,UAAU,aAAa;AAC7B,UAAM,YAAY,OAAO,YAAY,aAAa,SAAS,WAAW,EAAE;AAAA,MACtEA,QAAO,QAAQ,eAAe,aAAa,OAAO,EAAE,KAAKA,QAAO,MAAM,MAAMA,QAAO,IAAI,CAAC,CAAC;AAAA,MACzFA,QAAO,GAAG,IAAI;AAAA,MACdA,QAAO;AAAA,QAAM,MACXA,QAAO,WAAW,sDAAsD,EAAE;AAAA,UACxEA,QAAO,GAAG,KAAK;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AACA,WAAO,YAAY,CAAC,qBAAqB,WAAW,CAAC,IAAI,CAAC;AAAA,EAC5D,CAAC;AACL,EAAE;","names":["Effect","Effect","Effect","Effect"]}