@pentoshi/clai 4.11.7 → 4.11.8

package/dist/store/keys/secret-store.js

@@ -0,0 +1,249 @@
+import { fixOwner, handlePermissionError, safeExists } from "../../os/permissions.js";
+import { getConfig } from "../config.js";
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+export const serviceName = 'clai';
+// missing on a platform — falling back to a *restricted-permission plaintext*
+// is NOT encrypted; it is plaintext that the OS protects with file permissions.
+const keychainModuleName = '@napi-rs/keyring/keytar.js';
+export const keysFile = join(homedir(), '.clai', 'keys.json');
+let cachedKeytar;
+let keytarLoadAttempted = false;
+// (libsecret/DBus on Linux, Windows Credential Manager) is unreachable.
+// to the restricted-permission plaintext JSON file silently.
+export let keychainRuntimeUnavailable = false;
+let keychainRuntimeWarned = false;
+export async function loadKeytar() {
+    if (cachedKeytar)
+        return cachedKeytar;
+    if (keytarLoadAttempted)
+        return cachedKeytar;
+    keytarLoadAttempted = true;
+    try {
+        const imported = (await import(keychainModuleName));
+        cachedKeytar = imported.default ?? imported;
+        return cachedKeytar;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function isMissingKeychainError(error) {
+    // Best-effort detection so transient errors (eg locked keychain prompt
+    // dismissed) don't permanently disable the keychain. Anything that
+    const message = error instanceof Error ? error.message : String(error);
+    return /(no such (?:bus|service)|secret service|libsecret|dbus|keyring|gnome-keyring|kwallet|credential|keychain|security framework|access denied|not (?:available|implemented))/i.test(message);
+}
+function noteKeychainRuntimeFailure(error) {
+    if (isMissingKeychainError(error))
+        keychainRuntimeUnavailable = true;
+    if (!keychainRuntimeWarned) {
+        keychainRuntimeWarned = true;
+        const message = error instanceof Error ? error.message : String(error);
+        console.warn(`clai: OS keychain unavailable (${message.split('\n')[0]}); using restricted-permission plaintext file at ${keysFile}`);
+    }
+}
+function isCompiledLinuxBinary() {
+    if (process.platform !== 'linux')
+        return false;
+    if (typeof process.versions.bun !== 'string')
+        return false;
+    return basename(process.execPath).toLowerCase() !== 'bun';
+}
+async function withKeytar(fn) {
+    if (keychainRuntimeUnavailable)
+        return { ok: false };
+    if (process.env.CLAI_DISABLE_KEYCHAIN === "1" || getConfig().disableKeychain) {
+        return { ok: false };
+    }
+    if (isCompiledLinuxBinary() && process.env.CLAI_ENABLE_KEYCHAIN !== "1") {
+        return { ok: false };
+    }
+    const keytar = await loadKeytar();
+    if (!keytar)
+        return { ok: false };
+    try {
+        return { ok: true, value: await fn(keytar) };
+    }
+    catch (error) {
+        noteKeychainRuntimeFailure(error);
+        return { ok: false };
+    }
+}
+async function readFallback() {
+    if (!(await safeExists(keysFile))) {
+        return {};
+    }
+    try {
+        const raw = await readFile(keysFile, 'utf8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+async function writeFallback(keys) {
+    try {
+        const dir = dirname(keysFile);
+        await mkdir(dir, { recursive: true });
+        await fixOwner(dir);
+        const content = `${JSON.stringify(keys, null, 2)}\n`;
+        try {
+            await writeFile(keysFile, content, { mode: 0o600 });
+        }
+        catch (writeError) {
+            if (writeError?.code !== 'EACCES' && writeError?.code !== 'EPERM')
+                throw writeError;
+            await rm(keysFile, { force: true });
+            await writeFile(keysFile, content, { mode: 0o600 });
+        }
+        if (process.platform !== 'win32') {
+            try {
+                await chmod(keysFile, 0o600);
+            }
+            catch {
+                try {
+                    await rm(keysFile, { force: true });
+                    await writeFile(keysFile, content, { mode: 0o600 });
+                }
+                catch {
+                }
+            }
+        }
+        await fixOwner(keysFile);
+    }
+    catch (err) {
+        handlePermissionError(err);
+    }
+}
+/**
+ * Compose the keychain account name used for a `(namespace, id)` pair.
+ * Exposed so tests and callers can inspect the exact account string.
+ */
+export function secretAccount(namespace, id) {
+    return `${namespace}:${id}`;
+}
+/**
+ * Read a secret out of the OS keychain (preferred) or the restricted-permission
+ * plaintext fallback file. Returns `{ source: 'missing' }` when neither
+ * backend has a value.
+ *
+ * Legacy LLM entries that still live under the bare `<provider>` account
+ * name (no namespace prefix) are migrated lazily into `llm:<provider>` on
+ * first read so older installs keep working without manual intervention.
+ */
+export async function getSecret(namespace, id) {
+    const account = secretAccount(namespace, id);
+    // 1. Fallback file check first (ensures newer keys override keychain desync)
+    const fallback = await readFallback();
+    let fallbackValue = fallback[account];
+    let isLegacyFallback = false;
+    if (!fallbackValue && namespace === 'llm') {
+        fallbackValue = fallback[id];
+        if (fallbackValue) {
+            isLegacyFallback = true;
+        }
+    }
+    if (fallbackValue) {
+        // touching the OS keychain. Writing to the keychain on every read
+        // process is not in the keychain item's access-control list), which
+        // of truth; the keychain is written only when a key is explicitly
+        if (isLegacyFallback) {
+            delete fallback[id];
+            fallback[account] = fallbackValue;
+            await writeFallback(fallback);
+        }
+        return { value: fallbackValue, source: 'fallback' };
+    }
+    // 2. Keychain — primary store.
+    const keychainResult = await withKeytar((keytar) => keytar.getPassword(serviceName, account));
+    if (keychainResult.ok && keychainResult.value) {
+        // Heal: older versions drained keys.json into the keychain. Write the
+        // key back to the fallback file so it survives keychain backend changes.
+        const fb = await readFallback();
+        if (!(account in fb)) {
+            fb[account] = keychainResult.value;
+            await writeFallback(fb);
+        }
+        return { value: keychainResult.value, source: 'keychain' };
+    }
+    if (namespace === 'llm') {
+        const legacy = await withKeytar((keytar) => keytar.getPassword(serviceName, id));
+        if (legacy.ok && legacy.value) {
+            const migrated = await withKeytar((keytar) => keytar.setPassword(serviceName, account, legacy.value));
+            if (migrated.ok) {
+                await withKeytar((keytar) => keytar.deletePassword(serviceName, id));
+            }
+            const fb = await readFallback();
+            if (!(account in fb)) {
+                fb[account] = legacy.value;
+                await writeFallback(fb);
+            }
+            return { value: legacy.value, source: 'keychain' };
+        }
+    }
+    return { source: 'missing' };
+}
+export async function setSecret(namespace, id, value) {
+    const account = secretAccount(namespace, id);
+    // Always write to the plaintext fallback file so keys survive keychain
+    // the OS keychain is an opportunistic layer on top.
+    const fallback = await readFallback();
+    fallback[account] = value;
+    if (namespace === 'llm')
+        delete fallback[id];
+    await writeFallback(fallback);
+    // Also write to OS keychain if available (best-effort).
+    const keychainResult = await withKeytar((keytar) => keytar.setPassword(serviceName, account, value));
+    if (keychainResult.ok) {
+        if (namespace === 'llm') {
+            // Cleanup legacy bare-id entry from keychain.
+            await withKeytar((keytar) => keytar.deletePassword(serviceName, id));
+        }
+        return 'keychain';
+    }
+    // If we land in the plaintext fallback only, make sure a pre-existing
+    // keychain entry (which may still be readable) does not shadow the
+    await withKeytar((keytar) => keytar.deletePassword(serviceName, account));
+    if (namespace === 'llm') {
+        await withKeytar((keytar) => keytar.deletePassword(serviceName, id));
+    }
+    return 'fallback';
+}
+/**
+ * Best-effort delete: removes the secret from both the keychain and the
+ * fallback file. Never throws on keychain errors so unset always cleans
+ * up the on-disk fallback even when the OS keystore is unreachable.
+ */
+export async function unsetSecret(namespace, id) {
+    const account = secretAccount(namespace, id);
+    await withKeytar((keytar) => keytar.deletePassword(serviceName, account));
+    if (namespace === 'llm') {
+        await withKeytar((keytar) => keytar.deletePassword(serviceName, id));
+    }
+    if (await safeExists(keysFile)) {
+        const fallback = await readFallback();
+        let mutated = false;
+        if (account in fallback) {
+            delete fallback[account];
+            mutated = true;
+        }
+        if (namespace === 'llm' && id in fallback) {
+            delete fallback[id];
+            mutated = true;
+        }
+        if (mutated) {
+            if (Object.keys(fallback).length === 0) {
+                await rm(keysFile, { force: true });
+            }
+            else {
+                await writeFallback(fallback);
+            }
+        }
+    }
+}
+export function setKeychainRuntimeUnavailable(value) {
+    keychainRuntimeUnavailable = value;
+}
+//# sourceMappingURL=secret-store.js.map

package/dist/store/keys/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../../src/store/keys/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAElC,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAExD,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAoB9D,IAAI,YAAoC,CAAC;AAEzC,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC,wEAAwE;AACxE,6DAA6D;AAC7D,MAAM,CAAC,IAAI,0BAA0B,GAAG,KAAK,CAAC;AAE9C,IAAI,qBAAqB,GAAG,KAAK,CAAC;AAElC,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,mBAAmB;QAAE,OAAO,YAAY,CAAC;IAC7C,mBAAmB,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAA0C,CAAC;QAC7F,YAAY,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC;QAC5C,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,uEAAuE;IACvE,mEAAmE;IACnE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,2KAA2K,CAAC,IAAI,CACrL,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,IAAI,sBAAsB,CAAC,KAAK,CAAC;QAAE,0BAA0B,GAAG,IAAI,CAAC;IACrE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,qBAAqB,GAAG,IAAI,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CACV,kCAAkC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oDAAoD,QAAQ,EAAE,CACvH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,EAAsC;IAEtC,IAAI,0BAA0B;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACrD,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG,IAAI,SAAS,EAAE,CAAC,eAAe,EAAE,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,qBAAqB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0BAA0B,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAkB;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,UAAe,EAAE,CAAC;YACzB,IAAI,UAAU,EAAE,IAAI,KAAK,QAAQ,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO;gBAAE,MAAM,UAAU,CAAC;YACpF,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC;oBACH,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBACpC,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACtD,CAAC;gBAAC,MAAM,CAAC;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,SAA0B,EAAE,EAAU;IAClE,OAAO,GAAG,SAAS,IAAI,EAAE,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAA0B,EAC1B,EAAU;IAEV,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAE7C,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,IAAI,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,IAAI,CAAC,aAAa,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QAC1C,aAAa,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,aAAa,EAAE,CAAC;YAClB,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,kEAAkE;QAClE,oEAAoE;QACpE,kEAAkE;QAClE,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC;YACpB,QAAQ,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC;YAClC,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACtD,CAAC;IAED,+BAA+B;IAC/B,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CACjD,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CACzC,CAAC;IACF,IAAI,cAAc,CAAC,EAAE,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;QAC9C,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YACrB,EAAE,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC;YACnC,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC,CACpC,CAAC;QACF,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3C,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,KAAe,CAAC,CACjE,CAAC;YACF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAC1B,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC,CACvC,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrB,EAAE,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC3B,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;YAC1B,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAA0B,EAC1B,EAAU,EACV,KAAa;IAEb,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAE7C,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IAC1B,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAE9B,wDAAwD;IACxD,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CACjD,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAChD,CAAC;IACF,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;QACtB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,8CAA8C;YAC9C,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1E,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAA0B,EAC1B,EAAU;IAEV,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAE7C,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1E,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;QACtC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,SAAS,KAAK,KAAK,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC;YACpB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,0BAA0B,GAAG,KAAK,CAAC;AACrC,CAAC"}

package/dist/store/keys.d.ts

@@ -1,65 +1,16 @@
 import type { ProviderId, ProviderStatus } from '../types.js';
 import { maskSecret } from '../llm/provider.js';
 import type { SearchProviderId } from '../tools/web/types.js';
-/**
- * Logical namespace for a stored secret. Search-provider keys live in the
- * same keyring service as LLM keys but under separate accounts so the two
- * keyspaces never collide.
- */
-export type SecretNamespace = 'llm' | 'search';
-/** Where a resolved secret value originated. Mirrors `ProviderStatus.source`. */
-export type SecretSource = ProviderStatus['source'];
+import { getSecret, setSecret, unsetSecret } from "./keys/secret-store.js";
+import { MAX_PROVIDER_KEYS, ProviderKeysResult, parseProviderKeysPayload, serializeProviderKeysPayload } from "./keys/search-providers.js";
+export { appendSearchProviderKey, getSearchProviderKey, getSearchProviderKeys, markSearchProviderKeySuccess, setSearchProviderKeyDisabled, setSearchProviderKeys, unsetSearchProviderSecret } from "./keys/search-providers.js";
+export { parseProviderKeysPayload, serializeProviderKeysPayload };
+export type { ProviderKeySlot, ProviderKeysResult } from "./keys/search-providers.js";
+export { secretAccount } from "./keys/secret-store.js";
+export { getSecret, setSecret, unsetSecret };
+export type { SecretNamespace, SecretSource } from "./keys/secret-store.js";
 export declare function getFallbackKeysPath(): string;
-/**
- * Compose the keychain account name used for a `(namespace, id)` pair.
- * Exposed so tests and callers can inspect the exact account string.
- */
-export declare function secretAccount(namespace: SecretNamespace, id: string): string;
 export declare function searchProviderEnvVar(id: SearchProviderId): string | undefined;
-/**
- * Read a secret out of the OS keychain (preferred) or the restricted-permission
- * plaintext fallback file. Returns `{ source: 'missing' }` when neither
- * backend has a value.
- *
- * Legacy LLM entries that still live under the bare `<provider>` account
- * name (no namespace prefix) are migrated lazily into `llm:<provider>` on
- * first read so older installs keep working without manual intervention.
- */
-export declare function getSecret(namespace: SecretNamespace, id: string): Promise<{
-    value?: string;
-    source: SecretSource;
-}>;
-export declare function setSecret(namespace: SecretNamespace, id: string, value: string): Promise<'keychain' | 'fallback'>;
-/**
- * Best-effort delete: removes the secret from both the keychain and the
- * fallback file. Never throws on keychain errors so unset always cleans
- * up the on-disk fallback even when the OS keystore is unreachable.
- */
-export declare function unsetSecret(namespace: SecretNamespace, id: string): Promise<void>;
-/** One stored API key slot for an LLM provider. */
-export interface ProviderKeySlot {
-    readonly id: string;
-    readonly value: string;
-    readonly createdAt: number;
-    readonly disabled?: boolean | undefined;
-}
-/** Resolved multi-key view for a provider (storage or env). */
-export interface ProviderKeysResult {
-    readonly keys: ProviderKeySlot[];
-    /** Sticky index used as the next rotation start (clamped). */
-    readonly activeIndex: number;
-    readonly source: ProviderStatus['source'];
-}
-declare const MAX_PROVIDER_KEYS = 10;
-/**
- * Parse a stored secret string into slots. Legacy plain API keys become a
- * single-slot list. Invalid JSON that looks like a key is treated as legacy.
- */
-export declare function parseProviderKeysPayload(raw: string | undefined): {
-    keys: ProviderKeySlot[];
-    activeIndex: number;
-};
-export declare function serializeProviderKeysPayload(keys: readonly ProviderKeySlot[], activeIndex: number): string;
 export declare function envValue(provider: ProviderId): string | undefined;
 /**
  * Resolve all API keys for a provider.
@@ -91,51 +42,13 @@ export declare function getProviderSecret(provider: ProviderId): Promise<{
     value?: string;
     source: ProviderStatus['source'];
 }>;
-/**
- * Replace the full key list for a provider (Keys editor Save).
- * Empty list clears storage (same as unset).
- */
 export declare function setProviderKeys(provider: ProviderId, values: readonly string[], activeIndex?: number, disabledValues?: readonly string[]): Promise<'keychain' | 'fallback'>;
-/**
- * Append one API key (CLI `/set provider key`). Dedupes exact matches.
- * Creates a multi-key envelope, migrating a legacy single string if needed.
- */
 export declare function appendProviderKey(provider: ProviderId, secret: string): Promise<'keychain' | 'fallback'>;
-/**
- * Compat: append a key (multi-key era). Prefer `appendProviderKey` or
- * `setProviderKeys` at new call sites.
- */
 export declare function setProviderSecret(provider: ProviderId, secret: string): Promise<'keychain' | 'fallback'>;
 export declare function unsetProviderSecret(provider: ProviderId): Promise<void>;
-/**
- * Remember which key last succeeded so the next request starts there.
- * No-op for env-only / ollama / missing storage.
- */
 export declare function markProviderKeySuccess(provider: ProviderId, index: number): Promise<void>;
 export declare function setProviderKeyDisabled(provider: ProviderId, value: string, disabled: boolean): Promise<boolean>;
 export { MAX_PROVIDER_KEYS };
-/**
- * Resolve every API key for a keyed search provider.
- *
- * This intentionally mirrors LLM key semantics: stored multi/single keys
- * win over an ambient environment variable, and an environment value is only
- * a synthetic single-key fallback when nothing has been stored. DuckDuckGo
- * is keyless and therefore never exposes stored key slots.
- */
-export declare function getSearchProviderKeys(id: SearchProviderId): Promise<ProviderKeysResult>;
-/** Resolve the sticky active key for compatibility with single-key callers. */
-export declare function getSearchProviderKey(id: SearchProviderId): Promise<{
-    value?: string;
-    source: SecretSource;
-}>;
-/** Replace all stored keys for a search provider (the shared keys editor). */
-export declare function setSearchProviderKeys(id: SearchProviderId, values: readonly string[], activeIndex?: number, disabledValues?: readonly string[]): Promise<'keychain' | 'fallback'>;
-/** Append a search API key, preserving the existing sticky active key. */
-export declare function appendSearchProviderKey(id: SearchProviderId, secret: string): Promise<'keychain' | 'fallback'>;
-export declare function unsetSearchProviderSecret(id: SearchProviderId): Promise<void>;
-export declare function setSearchProviderKeyDisabled(id: SearchProviderId, value: string, disabled: boolean): Promise<boolean>;
-/** Persist the key that last completed a search successfully as the sticky key. */
-export declare function markSearchProviderKeySuccess(id: SearchProviderId, index: number): Promise<void>;
 export type KeychainStatus = {
     available: true;
 } | {