@inf-monkeys-tech/monkeys-cli 0.10.0

package/dist/credential/open-browser.js

@@ -0,0 +1,54 @@
+import { spawn } from 'node:child_process';
+import { CliError, EXIT_CODES } from '../errors/cli-error.js';
+export function validateBrowserUrl(value, context) {
+    let target;
+    let deployment;
+    try {
+        target = new URL(value);
+        deployment = new URL(context.baseUrl);
+    }
+    catch (cause) {
+        throw new CliError('浏览器登录地址无效。', {
+            cause,
+            code: 'DEVICE_AUTH_URL_INVALID',
+            exitCode: EXIT_CODES.compatibility,
+        });
+    }
+    const localHttp = target.protocol === 'http:' && ['127.0.0.1', 'localhost', '::1'].includes(target.hostname);
+    if ((!localHttp && target.protocol !== 'https:') ||
+        target.origin !== deployment.origin ||
+        target.username ||
+        target.password ||
+        target.hash) {
+        throw new CliError('浏览器登录地址不属于当前 Deployment。', {
+            code: 'DEVICE_AUTH_URL_UNTRUSTED',
+            exitCode: EXIT_CODES.compatibility,
+            safeDetails: { deploymentOrigin: deployment.origin, verificationOrigin: target.origin },
+        });
+    }
+    return target;
+}
+export async function openBrowser(value, context) {
+    const url = validateBrowserUrl(value, context).toString();
+    const command = process.platform === 'darwin'
+        ? { args: [url], file: '/usr/bin/open' }
+        : process.platform === 'win32'
+            ? { args: ['url.dll,FileProtocolHandler', url], file: 'rundll32.exe' }
+            : { args: [url], file: 'xdg-open' };
+    return new Promise((resolve) => {
+        const child = spawn(command.file, command.args, { detached: true, stdio: 'ignore' });
+        let settled = false;
+        child.once('error', () => {
+            if (!settled)
+                resolve(false);
+            settled = true;
+        });
+        child.once('spawn', () => {
+            child.unref();
+            if (!settled)
+                resolve(true);
+            settled = true;
+        });
+    });
+}
+//# sourceMappingURL=open-browser.js.map

package/dist/credential/open-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-browser.js","sourceRoot":"","sources":["../../src/credential/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAG9D,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,OAAwB;IACxE,IAAI,MAAW,CAAC;IAChB,IAAI,UAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,YAAY,EAAE;YAC/B,KAAK;YACL,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,UAAU,CAAC,aAAa;SACnC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7G,IACE,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC5C,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;QACnC,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,IAAI,EACX,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE;YAC7C,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,UAAU,CAAC,aAAa;YAClC,WAAW,EAAE,EAAE,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE;SACxF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,OAAwB;IACvE,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1D,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE;QACxC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE;YACtE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAE1C,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/credential/runtime.d.ts

@@ -0,0 +1,9 @@
+import type { ResolvedContext } from '../context/resolver.js';
+import { HttpClient } from '../transport/http-client.js';
+import type { TransportContext } from '../transport/types.js';
+import type { SecretStore } from './secret-store.js';
+export declare function resolveAuthSurface(context: ResolvedContext): 'kernel' | 'workspace';
+export declare function toTransportContext(context: ResolvedContext, token?: string, proxyUrl?: string): TransportContext;
+export declare function createContextClient(context: ResolvedContext, secrets: SecretStore, token?: string): Promise<HttpClient>;
+export declare function createAuthenticatedClient(context: ResolvedContext, secrets: SecretStore): Promise<HttpClient>;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/credential/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/credential/runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,GAAG,WAAW,CAEnF;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAUhH;AAkBD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAG7H;AAED,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAYnH"}

package/dist/credential/runtime.js

@@ -0,0 +1,51 @@
+import { CliError, EXIT_CODES } from '../errors/cli-error.js';
+import { HttpClient } from '../transport/http-client.js';
+export function resolveAuthSurface(context) {
+    return context.expectedSurfaces.includes('kernel') && !context.expectedSurfaces.includes('workspace') ? 'kernel' : 'workspace';
+}
+export function toTransportContext(context, token, proxyUrl) {
+    return {
+        authSurface: resolveAuthSurface(context),
+        baseUrl: context.baseUrl,
+        ...(context.caBundle ? { caPath: context.caBundle } : {}),
+        ...(proxyUrl ? { proxyUrl } : {}),
+        ...(context.team ? { teamId: context.team } : {}),
+        tenant: context.tenant,
+        ...(token ? { token } : {}),
+    };
+}
+async function resolveProxyUrl(context, secrets) {
+    let proxyUrl;
+    if (context.proxyRef) {
+        const proxyBytes = await secrets.get(context.proxyRef);
+        try {
+            proxyUrl = Buffer.from(proxyBytes).toString('utf8').trim();
+        }
+        finally {
+            proxyBytes.fill(0);
+        }
+        if (!proxyUrl) {
+            throw new CliError('Proxy Secret 为空。', { code: 'PROXY_SECRET_EMPTY', exitCode: EXIT_CODES.configuration });
+        }
+    }
+    return proxyUrl;
+}
+export async function createContextClient(context, secrets, token) {
+    const proxyUrl = await resolveProxyUrl(context, secrets);
+    return HttpClient.create(toTransportContext(context, token, proxyUrl));
+}
+export async function createAuthenticatedClient(context, secrets) {
+    const bytes = await secrets.get(context.credential.secretRef);
+    let token;
+    try {
+        token = Buffer.from(bytes).toString('utf8').trim();
+    }
+    finally {
+        bytes.fill(0);
+    }
+    if (!token) {
+        throw new CliError('Credential Secret 为空。', { code: 'CREDENTIAL_EMPTY', exitCode: EXIT_CODES.authentication });
+    }
+    return createContextClient(context, secrets, token);
+}
+//# sourceMappingURL=runtime.js.map

package/dist/credential/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/credential/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAIzD,MAAM,UAAU,kBAAkB,CAAC,OAAwB;IACzD,OAAO,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAwB,EAAE,KAAc,EAAE,QAAiB;IAC5F,OAAO;QACL,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAwB,EAAE,OAAoB;IAC3E,IAAI,QAA4B,CAAC;IACjC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAwB,EAAE,OAAoB,EAAE,KAAc;IACtG,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,OAAO,UAAU,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAwB,EAAE,OAAoB;IAC5F,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC"}

package/dist/credential/secret-reference.d.ts

@@ -0,0 +1,22 @@
+export type ParsedSecretReference = {
+    kind: 'env';
+    variable: string;
+} | {
+    account: string;
+    kind: 'keyring';
+    service: string;
+} | {
+    account: string;
+    kind: 'session_file';
+    service: string;
+};
+export type PersistentSecretProvider = 'keyring' | 'session_file';
+export interface SecretProviderMetadata {
+    persistent: boolean;
+    provider: ParsedSecretReference['kind'];
+    writable: boolean;
+}
+export declare function parseSecretReference(reference: string): ParsedSecretReference;
+export declare function secretProvider(reference: string): ParsedSecretReference['kind'];
+export declare function secretProviderMetadata(reference: string): SecretProviderMetadata;
+//# sourceMappingURL=secret-reference.d.ts.map

package/dist/credential/secret-reference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-reference.d.ts","sourceRoot":"","sources":["../../src/credential/secret-reference.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,cAAc,CAAC;AAElE,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAmB7E;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAE/E;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAGhF"}

package/dist/credential/secret-reference.js

@@ -0,0 +1,26 @@
+import { configurationError } from '../config/errors.js';
+import { secretReferenceSchema } from '../config/schema.js';
+export function parseSecretReference(reference) {
+    const parsed = secretReferenceSchema.safeParse(reference);
+    if (!parsed.success) {
+        throw configurationError('SECRET_REFERENCE_INVALID', 'Secret 引用必须使用 env:VARIABLE、keyring:service/account 或 session-file:service/account。');
+    }
+    if (reference.startsWith('env:'))
+        return { kind: 'env', variable: reference.slice(4) };
+    const sessionFile = reference.startsWith('session-file:');
+    const value = reference.slice(sessionFile ? 'session-file:'.length : 'keyring:'.length);
+    const separator = value.lastIndexOf('/');
+    return {
+        account: value.slice(separator + 1),
+        kind: sessionFile ? 'session_file' : 'keyring',
+        service: value.slice(0, separator),
+    };
+}
+export function secretProvider(reference) {
+    return parseSecretReference(reference).kind;
+}
+export function secretProviderMetadata(reference) {
+    const provider = secretProvider(reference);
+    return { persistent: provider !== 'env', provider, writable: provider !== 'env' };
+}
+//# sourceMappingURL=secret-reference.js.map

package/dist/credential/secret-reference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-reference.js","sourceRoot":"","sources":["../../src/credential/secret-reference.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAe5D,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,kBAAkB,CACtB,0BAA0B,EAC1B,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvF,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QACnC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QAC9C,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,oBAAoB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,EAAE,UAAU,EAAE,QAAQ,KAAK,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK,KAAK,EAAE,CAAC;AACpF,CAAC"}

package/dist/credential/secret-store.d.ts

@@ -0,0 +1,37 @@
+export interface SecretStore {
+    delete(ref: string, signal?: AbortSignal): Promise<void>;
+    get(ref: string, signal?: AbortSignal): Promise<Uint8Array>;
+    put(ref: string, value: Uint8Array, signal?: AbortSignal): Promise<void>;
+}
+export interface KeyringEntry {
+    deleteCredential(signal?: AbortSignal): Promise<boolean>;
+    getSecret(signal?: AbortSignal): Promise<Uint8Array | undefined>;
+    setSecret(value: Uint8Array, signal?: AbortSignal): Promise<void>;
+}
+export type KeyringEntryFactory = (service: string, account: string) => Promise<KeyringEntry>;
+export declare class EnvironmentSecretStore implements SecretStore {
+    private readonly env;
+    constructor(env?: NodeJS.ProcessEnv);
+    delete(ref: string, signal?: AbortSignal): Promise<void>;
+    get(ref: string, signal?: AbortSignal): Promise<Uint8Array>;
+    put(ref: string, _value: Uint8Array, signal?: AbortSignal): Promise<void>;
+}
+export declare class KeyringSecretStore implements SecretStore {
+    private readonly createEntry;
+    constructor(createEntry?: KeyringEntryFactory);
+    delete(ref: string, signal?: AbortSignal): Promise<void>;
+    get(ref: string, signal?: AbortSignal): Promise<Uint8Array>;
+    put(ref: string, value: Uint8Array, signal?: AbortSignal): Promise<void>;
+    private entry;
+}
+export declare class RoutedSecretStore implements SecretStore {
+    private readonly environment;
+    private readonly keyring;
+    private readonly sessionFile;
+    constructor(environment?: SecretStore, keyring?: SecretStore, sessionFile?: SecretStore);
+    delete(ref: string, signal?: AbortSignal): Promise<void>;
+    get(ref: string, signal?: AbortSignal): Promise<Uint8Array>;
+    put(ref: string, value: Uint8Array, signal?: AbortSignal): Promise<void>;
+    private provider;
+}
+//# sourceMappingURL=secret-store.d.ts.map

package/dist/credential/secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../../src/credential/secret-store.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,YAAY;IAC3B,gBAAgB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,SAAS,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACjE,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAoB9F,qBAAa,sBAAuB,YAAW,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAhC,YAA6B,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAI;IAE/D,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7D;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAWhE;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9E;CACF;AAED,qBAAa,kBAAmB,YAAW,WAAW;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAxC,YAA6B,WAAW,GAAE,mBAAgD,EAAI;IAExF,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAU7D;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAWhE;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ7E;YAEa,KAAK;CAKpB;AAED,qBAAa,iBAAkB,YAAW,WAAW;IAEjD,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAH9B,YACmB,WAAW,GAAE,WAA0C,EACvD,OAAO,GAAE,WAAsC,EAC/C,WAAW,GAAE,WAA0C,EACtE;IAEE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7D;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAEhE;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;IAED,OAAO,CAAC,QAAQ;CAIjB"}

package/dist/credential/secret-store.js

@@ -0,0 +1,130 @@
+import { configurationError } from '../config/errors.js';
+import { CliError } from '../errors/cli-error.js';
+import { parseSecretReference } from './secret-reference.js';
+import { SessionFileSecretStore } from './session-file-store.js';
+async function defaultKeyringEntryFactory(service, account) {
+    try {
+        const { AsyncEntry } = await import('@napi-rs/keyring');
+        return new AsyncEntry(service, account);
+    }
+    catch (error) {
+        throw configurationError('KEYRING_UNAVAILABLE', '操作系统 Secret Store 不可用。', {
+            cause: error,
+            recovery: ['安装当前平台的 @napi-rs/keyring 可选依赖；账户 Session 也可在受支持的 POSIX 无头环境显式改用 session-file:。'],
+        });
+    }
+}
+function assertNotAborted(signal) {
+    if (signal?.aborted) {
+        throw configurationError('SECRET_OPERATION_ABORTED', 'Secret 操作已取消。', { cause: signal.reason });
+    }
+}
+export class EnvironmentSecretStore {
+    env;
+    constructor(env = process.env) {
+        this.env = env;
+    }
+    async delete(ref, signal) {
+        assertNotAborted(signal);
+        const parsed = parseSecretReference(ref);
+        if (parsed.kind !== 'env')
+            throw configurationError('SECRET_PROVIDER_MISMATCH', '该引用不是环境变量 Secret。');
+        throw configurationError('SECRET_STORE_READ_ONLY', '环境变量 Secret Store 是只读的。');
+    }
+    async get(ref, signal) {
+        assertNotAborted(signal);
+        const parsed = parseSecretReference(ref);
+        if (parsed.kind !== 'env')
+            throw configurationError('SECRET_PROVIDER_MISMATCH', '该引用不是环境变量 Secret。');
+        const value = this.env[parsed.variable];
+        if (value === undefined) {
+            throw configurationError('SECRET_NOT_FOUND', `环境变量未设置：${parsed.variable}`, {
+                safeDetails: { reference: ref },
+            });
+        }
+        return Uint8Array.from(Buffer.from(value, 'utf8'));
+    }
+    async put(ref, _value, signal) {
+        assertNotAborted(signal);
+        const parsed = parseSecretReference(ref);
+        if (parsed.kind !== 'env')
+            throw configurationError('SECRET_PROVIDER_MISMATCH', '该引用不是环境变量 Secret。');
+        throw configurationError('SECRET_STORE_READ_ONLY', '环境变量 Secret Store 是只读的。');
+    }
+}
+export class KeyringSecretStore {
+    createEntry;
+    constructor(createEntry = defaultKeyringEntryFactory) {
+        this.createEntry = createEntry;
+    }
+    async delete(ref, signal) {
+        assertNotAborted(signal);
+        const entry = await this.entry(ref);
+        try {
+            const deleted = await entry.deleteCredential(signal);
+            if (!deleted)
+                throw configurationError('SECRET_NOT_FOUND', 'Keyring 中不存在该 Secret。');
+        }
+        catch (error) {
+            if (error instanceof CliError)
+                throw error;
+            throw configurationError('KEYRING_DELETE_FAILED', '无法从操作系统 Secret Store 删除 Secret。', { cause: error });
+        }
+    }
+    async get(ref, signal) {
+        assertNotAborted(signal);
+        const entry = await this.entry(ref);
+        try {
+            const value = await entry.getSecret(signal);
+            if (value === undefined)
+                throw configurationError('SECRET_NOT_FOUND', 'Keyring 中不存在该 Secret。');
+            return Uint8Array.from(value);
+        }
+        catch (error) {
+            if (error instanceof CliError)
+                throw error;
+            throw configurationError('KEYRING_READ_FAILED', '无法从操作系统 Secret Store 读取 Secret。', { cause: error });
+        }
+    }
+    async put(ref, value, signal) {
+        assertNotAborted(signal);
+        const entry = await this.entry(ref);
+        try {
+            await entry.setSecret(Uint8Array.from(value), signal);
+        }
+        catch (error) {
+            throw configurationError('KEYRING_WRITE_FAILED', '无法写入操作系统 Secret Store。', { cause: error });
+        }
+    }
+    async entry(ref) {
+        const parsed = parseSecretReference(ref);
+        if (parsed.kind !== 'keyring')
+            throw configurationError('SECRET_PROVIDER_MISMATCH', '该引用不是 Keyring Secret。');
+        return this.createEntry(parsed.service, parsed.account);
+    }
+}
+export class RoutedSecretStore {
+    environment;
+    keyring;
+    sessionFile;
+    constructor(environment = new EnvironmentSecretStore(), keyring = new KeyringSecretStore(), sessionFile = new SessionFileSecretStore()) {
+        this.environment = environment;
+        this.keyring = keyring;
+        this.sessionFile = sessionFile;
+    }
+    async delete(ref, signal) {
+        return this.provider(parseSecretReference(ref)).delete(ref, signal);
+    }
+    async get(ref, signal) {
+        return this.provider(parseSecretReference(ref)).get(ref, signal);
+    }
+    async put(ref, value, signal) {
+        return this.provider(parseSecretReference(ref)).put(ref, value, signal);
+    }
+    provider(reference) {
+        if (reference.kind === 'env')
+            return this.environment;
+        return reference.kind === 'keyring' ? this.keyring : this.sessionFile;
+    }
+}
+//# sourceMappingURL=secret-store.js.map

package/dist/credential/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../src/credential/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAA8B,MAAM,uBAAuB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAgBjE,KAAK,UAAU,0BAA0B,CAAC,OAAe,EAAE,OAAe;IACxE,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACxD,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CAAC,qBAAqB,EAAE,wBAAwB,EAAE;YACxE,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,CAAC,gFAAgF,CAAC;SAC7F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAoB;IAC5C,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,MAAM,kBAAkB,CAAC,0BAA0B,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,MAAM,OAAO,sBAAsB;IACJ,GAAG;IAAhC,YAA6B,GAAG,GAAsB,OAAO,CAAC,GAAG;mBAApC,GAAG;IAAoC,CAAC;IAErE,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,MAAoB;QAC5C,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,MAAM,kBAAkB,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,CAAC;QACrG,MAAM,kBAAkB,CAAC,wBAAwB,EAAE,yBAAyB,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,MAAoB;QACzC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,MAAM,kBAAkB,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,kBAAkB,CAAC,kBAAkB,EAAE,WAAW,MAAM,CAAC,QAAQ,EAAE,EAAE;gBACzE,WAAW,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,MAAkB,EAAE,MAAoB;QAC7D,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,MAAM,kBAAkB,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,CAAC;QACrG,MAAM,kBAAkB,CAAC,wBAAwB,EAAE,yBAAyB,CAAC,CAAC;IAChF,CAAC;CACF;AAED,MAAM,OAAO,kBAAkB;IACA,WAAW;IAAxC,YAA6B,WAAW,GAAwB,0BAA0B;2BAA7D,WAAW;IAAqD,CAAC;IAE9F,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,MAAoB;QAC5C,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO;gBAAE,MAAM,kBAAkB,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAC3C,MAAM,kBAAkB,CAAC,uBAAuB,EAAE,iCAAiC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,MAAoB;QACzC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,kBAAkB,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;YAC/F,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAC3C,MAAM,kBAAkB,CAAC,qBAAqB,EAAE,iCAAiC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAiB,EAAE,MAAoB;QAC5D,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,kBAAkB,CAAC,sBAAsB,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAW;QAC7B,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,kBAAkB,CAAC,0BAA0B,EAAE,uBAAuB,CAAC,CAAC;QAC7G,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,OAAO,iBAAiB;IAET,WAAW;IACX,OAAO;IACP,WAAW;IAH9B,YACmB,WAAW,GAAgB,IAAI,sBAAsB,EAAE,EACvD,OAAO,GAAgB,IAAI,kBAAkB,EAAE,EAC/C,WAAW,GAAgB,IAAI,sBAAsB,EAAE;2BAFvD,WAAW;uBACX,OAAO;2BACP,WAAW;IAC3B,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,MAAoB;QAC5C,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,MAAoB;QACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAiB,EAAE,MAAoB;QAC5D,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1E,CAAC;IAEO,QAAQ,CAAC,SAAgC;QAC/C,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QACtD,OAAO,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IACxE,CAAC;CACF"}

package/dist/credential/session-file-store.d.ts

@@ -0,0 +1,23 @@
+import { type Stats } from 'node:fs';
+import type { SecretStore } from './secret-store.js';
+export type SessionEntryKind = 'directory' | 'file';
+export type SessionMetadataValidator = (metadata: Stats, kind: SessionEntryKind, currentUid: number) => void;
+export interface SessionFileSecretStoreOptions {
+    currentUid?: number;
+    platform?: NodeJS.Platform;
+    root?: string;
+    validateMetadata?: SessionMetadataValidator;
+}
+export declare function validateSessionFileMetadata(metadata: Stats, kind: SessionEntryKind, currentUid: number): void;
+export declare class SessionFileSecretStore implements SecretStore {
+    #private;
+    constructor(options?: SessionFileSecretStoreOptions);
+    delete(ref: string, signal?: AbortSignal): Promise<void>;
+    get(ref: string, signal?: AbortSignal): Promise<Uint8Array>;
+    put(ref: string, value: Uint8Array, signal?: AbortSignal): Promise<void>;
+    private assertSupported;
+    private ensureDirectory;
+    private syncDirectory;
+    private target;
+}
+//# sourceMappingURL=session-file-store.d.ts.map

package/dist/credential/session-file-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-file-store.d.ts","sourceRoot":"","sources":["../../src/credential/session-file-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAOhD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAOrD,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,MAAM,CAAC;AACpD,MAAM,MAAM,wBAAwB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;AAE7G,MAAM,WAAW,6BAA6B;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;CAC7C;AAYD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CA6B7G;AAED,qBAAa,sBAAuB,YAAW,WAAW;;IAMxD,YAAY,OAAO,GAAE,6BAAkC,EAKtD;IAEK,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAe7D;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA6ChE;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwC7E;IAED,OAAO,CAAC,eAAe;YAST,eAAe;YAKf,aAAa;YAUb,MAAM;CAmBrB"}

package/dist/credential/session-file-store.js

@@ -0,0 +1,226 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, rename, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { configurationError } from '../config/errors.js';
+import { configDirectory, resolveConfigPath } from '../config/paths.js';
+import { CliError } from '../errors/cli-error.js';
+import { parseSecretReference } from './secret-reference.js';
+const DIRECTORY_MODE = 0o700;
+const FILE_MODE = 0o600;
+const MAX_SESSION_BYTES = 64 * 1024;
+const STORE_VERSION = 'v1';
+function isNodeError(error, code) {
+    return error instanceof Error && 'code' in error && error.code === code;
+}
+function assertNotAborted(signal) {
+    if (signal?.aborted) {
+        throw configurationError('SECRET_OPERATION_ABORTED', 'Session 文件操作已取消。', { cause: signal.reason });
+    }
+}
+export function validateSessionFileMetadata(metadata, kind, currentUid) {
+    if (metadata.isSymbolicLink()) {
+        throw configurationError('SESSION_FILE_UNSAFE_ENTRY', 'Session 存储拒绝符号链接。', {
+            recovery: ['删除不安全的 Session 存储条目后重新运行 auth doctor。'],
+            safeDetails: { entryKind: kind, reason: 'symbolic_link' },
+        });
+    }
+    const expectedType = kind === 'directory' ? metadata.isDirectory() : metadata.isFile();
+    if (!expectedType) {
+        throw configurationError('SESSION_FILE_UNSAFE_ENTRY', 'Session 存储条目类型不安全。', {
+            recovery: ['删除不安全的 Session 存储条目后重新运行 auth doctor。'],
+            safeDetails: { entryKind: kind, reason: 'unexpected_type' },
+        });
+    }
+    if (metadata.uid !== currentUid) {
+        throw configurationError('SESSION_FILE_UNSAFE_OWNER', 'Session 存储条目不属于当前操作系统用户。', {
+            recovery: ['修复 Session 存储目录的所有者后重新运行 auth doctor。'],
+            safeDetails: { entryKind: kind },
+        });
+    }
+    const required = kind === 'directory' ? DIRECTORY_MODE : FILE_MODE;
+    if ((metadata.mode & 0o077) !== 0 || (metadata.mode & required) !== required) {
+        throw configurationError('SESSION_FILE_UNSAFE_PERMISSIONS', 'Session 存储权限不安全。', {
+            recovery: [
+                `将 ${kind === 'directory' ? '目录' : '文件'}权限修复为 ${kind === 'directory' ? '0700' : '0600'} 后重新运行 auth doctor。`,
+            ],
+            safeDetails: { entryKind: kind },
+        });
+    }
+}
+export class SessionFileSecretStore {
+    #currentUid;
+    #platform;
+    #root;
+    #validateMetadata;
+    constructor(options = {}) {
+        this.#platform = options.platform ?? process.platform;
+        this.#currentUid = options.currentUid ?? process.getuid?.();
+        this.#root = options.root ?? join(configDirectory(resolveConfigPath()), 'sessions');
+        this.#validateMetadata = options.validateMetadata ?? validateSessionFileMetadata;
+    }
+    async delete(ref, signal) {
+        assertNotAborted(signal);
+        this.assertSupported();
+        const target = await this.target(ref, false);
+        try {
+            const metadata = await lstat(target);
+            this.#validateMetadata(metadata, 'file', this.#currentUid);
+            assertNotAborted(signal);
+            await unlink(target);
+            await this.syncDirectory();
+        }
+        catch (error) {
+            if (error instanceof CliError)
+                throw error;
+            if (isNodeError(error, 'ENOENT'))
+                throw configurationError('SECRET_NOT_FOUND', 'Session 文件不存在。');
+            throw configurationError('SESSION_FILE_DELETE_FAILED', '无法删除 Session 文件。', { cause: error });
+        }
+    }
+    async get(ref, signal) {
+        assertNotAborted(signal);
+        this.assertSupported();
+        const target = await this.target(ref, false);
+        let handle;
+        try {
+            const noFollow = constants.O_NOFOLLOW ?? 0;
+            handle = await open(target, constants.O_RDONLY | noFollow);
+            const metadata = await handle.stat();
+            this.#validateMetadata(metadata, 'file', this.#currentUid);
+            if (metadata.size <= 0 || metadata.size > MAX_SESSION_BYTES) {
+                throw configurationError('SESSION_FILE_INVALID_SIZE', 'Session 文件大小无效。', {
+                    safeDetails: { maximumBytes: MAX_SESSION_BYTES },
+                });
+            }
+            assertNotAborted(signal);
+            const buffer = Buffer.allocUnsafe(MAX_SESSION_BYTES + 1);
+            let offset = 0;
+            try {
+                while (offset < buffer.byteLength) {
+                    const { bytesRead } = await handle.read(buffer, offset, buffer.byteLength - offset, offset);
+                    if (bytesRead === 0)
+                        break;
+                    offset += bytesRead;
+                }
+                if (offset <= 0 || offset > MAX_SESSION_BYTES) {
+                    throw configurationError('SESSION_FILE_INVALID_SIZE', 'Session 文件大小无效。', {
+                        safeDetails: { maximumBytes: MAX_SESSION_BYTES },
+                    });
+                }
+                return Uint8Array.from(buffer.subarray(0, offset));
+            }
+            finally {
+                buffer.fill(0);
+            }
+        }
+        catch (error) {
+            if (error instanceof CliError)
+                throw error;
+            if (isNodeError(error, 'ENOENT'))
+                throw configurationError('SECRET_NOT_FOUND', 'Session 文件不存在。');
+            if (isNodeError(error, 'ELOOP')) {
+                throw configurationError('SESSION_FILE_UNSAFE_ENTRY', 'Session 存储拒绝符号链接。', {
+                    safeDetails: { entryKind: 'file', reason: 'symbolic_link' },
+                });
+            }
+            throw configurationError('SESSION_FILE_READ_FAILED', '无法读取 Session 文件。', { cause: error });
+        }
+        finally {
+            await handle?.close();
+        }
+    }
+    async put(ref, value, signal) {
+        assertNotAborted(signal);
+        this.assertSupported();
+        if (value.byteLength <= 0 || value.byteLength > MAX_SESSION_BYTES) {
+            throw configurationError('SESSION_FILE_INVALID_SIZE', '拒绝写入空或过大的 Session。', {
+                safeDetails: { maximumBytes: MAX_SESSION_BYTES },
+            });
+        }
+        const target = await this.target(ref, true);
+        const temporary = `${target}.tmp-${process.pid}-${randomUUID()}`;
+        let handle;
+        try {
+            try {
+                const existing = await lstat(target);
+                this.#validateMetadata(existing, 'file', this.#currentUid);
+            }
+            catch (error) {
+                if (!isNodeError(error, 'ENOENT'))
+                    throw error;
+            }
+            handle = await open(temporary, 'wx', FILE_MODE);
+            await handle.writeFile(value);
+            await handle.sync();
+            await handle.close();
+            handle = undefined;
+            assertNotAborted(signal);
+            await rename(temporary, target);
+            this.#validateMetadata(await lstat(target), 'file', this.#currentUid);
+            await this.syncDirectory();
+        }
+        catch (error) {
+            if (error instanceof CliError)
+                throw error;
+            throw configurationError('SESSION_FILE_WRITE_FAILED', '无法安全写入 Session 文件。', { cause: error });
+        }
+        finally {
+            await handle?.close();
+            try {
+                await unlink(temporary);
+            }
+            catch (error) {
+                if (!isNodeError(error, 'ENOENT')) {
+                    throw configurationError('SESSION_FILE_TEMP_CLEANUP_FAILED', '无法清理 Session 临时文件。', { cause: error });
+                }
+            }
+        }
+    }
+    assertSupported() {
+        if (this.#platform === 'win32' || this.#currentUid === undefined) {
+            throw configurationError('SESSION_FILE_UNSUPPORTED', '当前平台不支持受保护的 Session 文件存储。', {
+                recovery: ['桌面系统请使用 keyring:；长期 Agent/CI 请优先使用 API Key。'],
+                safeDetails: { platform: this.#platform },
+            });
+        }
+    }
+    async ensureDirectory(path) {
+        await mkdir(path, { mode: DIRECTORY_MODE, recursive: true });
+        this.#validateMetadata(await lstat(path), 'directory', this.#currentUid);
+    }
+    async syncDirectory() {
+        if (process.platform === 'win32')
+            return;
+        const directory = await open(join(this.#root, STORE_VERSION), 'r');
+        try {
+            await directory.sync();
+        }
+        finally {
+            await directory.close();
+        }
+    }
+    async target(ref, createDirectories) {
+        const parsed = parseSecretReference(ref);
+        if (parsed.kind !== 'session_file') {
+            throw configurationError('SECRET_PROVIDER_MISMATCH', '该引用不是 Session 文件 Secret。');
+        }
+        if (createDirectories) {
+            await this.ensureDirectory(this.#root);
+            await this.ensureDirectory(join(this.#root, STORE_VERSION));
+        }
+        else {
+            try {
+                this.#validateMetadata(await lstat(this.#root), 'directory', this.#currentUid);
+                this.#validateMetadata(await lstat(join(this.#root, STORE_VERSION)), 'directory', this.#currentUid);
+            }
+            catch (error) {
+                if (isNodeError(error, 'ENOENT'))
+                    throw configurationError('SECRET_NOT_FOUND', 'Session 文件不存在。');
+                throw error;
+            }
+        }
+        return join(this.#root, STORE_VERSION, `${createHash('sha256').update(ref).digest('hex')}.session`);
+    }
+}
+//# sourceMappingURL=session-file-store.js.map