@planu/cli 4.13.0 → 4.14.1

package/dist/security/adapters/environment.js

@@ -0,0 +1,25 @@
+/** Explicit, read-only adapter. IDs must be mapped to named process environment variables. */
+export class EnvironmentSecretAdapter {
+    variables;
+    env;
+    kind = 'environment';
+    constructor(variables, env = process.env) {
+        this.variables = variables;
+        this.env = env;
+    }
+    get(id) {
+        const variable = this.variables[id];
+        if (!variable) {
+            return Promise.resolve(null);
+        }
+        const value = this.env[variable];
+        return Promise.resolve(value?.trim() ? value : null);
+    }
+    set(_id, _value) {
+        return Promise.reject(new Error('[Planu] Environment secret adapter is read-only'));
+    }
+    delete(_id) {
+        return Promise.reject(new Error('[Planu] Environment secret adapter is read-only'));
+    }
+}
+//# sourceMappingURL=environment.js.map

package/dist/security/adapters/linux-secret-service.d.ts

@@ -0,0 +1,8 @@
+import type { SecretStoreAdapter } from '../../types/security.js';
+export declare class LinuxSecretServiceAdapter implements SecretStoreAdapter {
+    readonly kind: 'linux-secret-service';
+    get(id: string): Promise<string | null>;
+    set(id: string, value: string): Promise<void>;
+    delete(id: string): Promise<void>;
+}
+//# sourceMappingURL=linux-secret-service.d.ts.map

package/dist/security/adapters/linux-secret-service.js

@@ -0,0 +1,60 @@
+import { execFile as execFileCallback, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+const execFile = promisify(execFileCallback);
+const TIMEOUT_MS = 10_000;
+async function storeWithSecretTool(id, value) {
+    await new Promise((resolve, reject) => {
+        const child = spawn('secret-tool', ['store', '--label=Planu', 'planu-id', id], {
+            stdio: ['pipe', 'ignore', 'pipe'],
+        });
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            reject(new Error('[Planu] Secret Service operation timed out'));
+        }, TIMEOUT_MS);
+        child.stderr.resume();
+        child.once('error', (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.once('close', (code) => {
+            clearTimeout(timer);
+            if (code === 0) {
+                resolve();
+            }
+            else {
+                reject(new Error(`[Planu] Secret Service store failed (${String(code)})`));
+            }
+        });
+        child.stdin.end(value);
+    });
+}
+export class LinuxSecretServiceAdapter {
+    kind = 'linux-secret-service';
+    async get(id) {
+        try {
+            const result = await execFile('secret-tool', ['lookup', 'planu-id', id], {
+                timeout: TIMEOUT_MS,
+            });
+            return result.stdout.trim() || null;
+        }
+        catch (error) {
+            // reliability-optional: LINUX_SECRET_LOOKUP — missing credentials resolve to null
+            reportClassifiedDegradation('LINUX_SECRET_LOOKUP', error);
+            return null;
+        }
+    }
+    async set(id, value) {
+        await storeWithSecretTool(id, value);
+    }
+    async delete(id) {
+        try {
+            await execFile('secret-tool', ['clear', 'planu-id', id], { timeout: TIMEOUT_MS });
+        }
+        catch (error) {
+            // reliability-cleanup: LINUX_SECRET_DELETE — deletion is idempotent
+            reportClassifiedDegradation('LINUX_SECRET_DELETE', error);
+        }
+    }
+}
+//# sourceMappingURL=linux-secret-service.js.map

package/dist/security/adapters/macos-keychain.d.ts

@@ -0,0 +1,18 @@
+import type { MacOSKeychainNativePort, MacOSKeychainOperation, SecretStoreAdapter } from '../../types/security.js';
+export declare class MacOSKeychainOperationError extends Error {
+    readonly code: 'KEYCHAIN_TIMEOUT' | 'KEYCHAIN_OUTCOME_UNKNOWN';
+    constructor(code: 'KEYCHAIN_TIMEOUT' | 'KEYCHAIN_OUTCOME_UNKNOWN', operation: MacOSKeychainOperation);
+}
+export declare class MacOSKeychainAdapter implements SecretStoreAdapter {
+    private readonly nativePort;
+    private readonly timeoutMs;
+    readonly kind: 'macos-keychain';
+    private readonly pending;
+    private nextFence;
+    constructor(nativePort?: () => MacOSKeychainNativePort, timeoutMs?: number);
+    get(id: string): Promise<string | null>;
+    set(id: string, value: string): Promise<void>;
+    delete(id: string): Promise<void>;
+    private enqueue;
+}
+//# sourceMappingURL=macos-keychain.d.ts.map

package/dist/security/adapters/macos-keychain.js

@@ -0,0 +1,90 @@
+import { requireMacOSKeychainNativePort } from '../../engine/core-bridge.js';
+const TIMEOUT_MS = 10_000;
+const decoder = new TextDecoder('utf-8', { fatal: true });
+export class MacOSKeychainOperationError extends Error {
+    code;
+    constructor(code, operation) {
+        super(code === 'KEYCHAIN_OUTCOME_UNKNOWN'
+            ? `[Planu] macOS Keychain ${operation} timed out; outcome is unknown`
+            : `[Planu] macOS Keychain ${operation} timed out`);
+        this.code = code;
+        this.name = 'MacOSKeychainOperationError';
+    }
+}
+export class MacOSKeychainAdapter {
+    nativePort;
+    timeoutMs;
+    kind = 'macos-keychain';
+    pending = new Map();
+    nextFence = 0;
+    constructor(nativePort = requireMacOSKeychainNativePort, timeoutMs = TIMEOUT_MS) {
+        this.nativePort = nativePort;
+        this.timeoutMs = timeoutMs;
+        if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1) {
+            throw new Error('[Planu] macOS Keychain timeout must be a positive integer');
+        }
+    }
+    get(id) {
+        return this.enqueue(id, 'get', false, async () => {
+            const secret = await this.nativePort().get(id);
+            if (secret === null) {
+                return null;
+            }
+            try {
+                return decoder.decode(secret);
+            }
+            finally {
+                secret.fill(0);
+            }
+        });
+    }
+    set(id, value) {
+        return this.enqueue(id, 'set', true, () => {
+            const secret = Buffer.from(value, 'utf8');
+            try {
+                return this.nativePort().set(id, secret);
+            }
+            finally {
+                secret.fill(0);
+            }
+        });
+    }
+    delete(id) {
+        return this.enqueue(id, 'delete', true, () => this.nativePort().delete(id));
+    }
+    enqueue(id, operation, mutates, execute) {
+        const predecessor = this.pending.get(id)?.settled ?? Promise.resolve();
+        const fence = (this.nextFence += 1);
+        let dispatched = false;
+        let timedOut = false;
+        let timer;
+        const underlying = predecessor.then(() => {
+            if (timedOut) {
+                throw new MacOSKeychainOperationError('KEYCHAIN_TIMEOUT', operation);
+            }
+            dispatched = true;
+            return execute();
+        });
+        const settled = underlying.then(() => undefined, () => undefined);
+        this.pending.set(id, { fence, settled });
+        void settled.then(() => {
+            if (this.pending.get(id)?.fence === fence) {
+                this.pending.delete(id);
+            }
+        });
+        const timeout = new Promise((_resolve, reject) => {
+            timer = setTimeout(() => {
+                timedOut = true;
+                reject(new MacOSKeychainOperationError(mutates && dispatched ? 'KEYCHAIN_OUTCOME_UNKNOWN' : 'KEYCHAIN_TIMEOUT', operation));
+            }, this.timeoutMs);
+            timer.unref();
+        });
+        void underlying.then(() => {
+            clearTimeout(timer);
+        }, () => {
+            clearTimeout(timer);
+        });
+        return Promise.race([underlying, timeout]);
+    }
+}
+//# sourceMappingURL=macos-keychain.js.map

package/dist/security/adapters/windows-credential-manager.d.ts

@@ -0,0 +1,8 @@
+import type { SecretStoreAdapter } from '../../types/security.js';
+export declare class WindowsCredentialManagerAdapter implements SecretStoreAdapter {
+    readonly kind: 'windows-credential-manager';
+    get(id: string): Promise<string | null>;
+    set(id: string, value: string): Promise<void>;
+    delete(id: string): Promise<void>;
+}
+//# sourceMappingURL=windows-credential-manager.d.ts.map

package/dist/security/adapters/windows-credential-manager.js

@@ -0,0 +1,58 @@
+import { execFile as execFileCallback, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+const execFile = promisify(execFileCallback);
+const TIMEOUT_MS = 10_000;
+const GET_SCRIPT = "$v=New-Object Windows.Security.Credentials.PasswordVault;$c=$v.Retrieve('Planu',$args[0]);$c.RetrievePassword();[Console]::Out.Write($c.Password)";
+const SET_SCRIPT = "$v=New-Object Windows.Security.Credentials.PasswordVault;$p=[Console]::In.ReadToEnd();$v.Add((New-Object Windows.Security.Credentials.PasswordCredential('Planu',$args[0],$p)))";
+const DELETE_SCRIPT = "$v=New-Object Windows.Security.Credentials.PasswordVault;$c=$v.Retrieve('Planu',$args[0]);$v.Remove($c)";
+async function storeWithoutArgv(id, value) {
+    await new Promise((resolve, reject) => {
+        const child = spawn('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', SET_SCRIPT, id], { stdio: ['pipe', 'ignore', 'ignore'] });
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            reject(new Error('[Planu] Credential Manager operation timed out'));
+        }, TIMEOUT_MS);
+        child.once('error', (error) => {
+            clearTimeout(timer);
+            reject(new Error(`[Planu] Credential Manager store failed: ${error.name}`));
+        });
+        child.once('close', (code) => {
+            clearTimeout(timer);
+            if (code === 0) {
+                resolve();
+            }
+            else {
+                reject(new Error(`[Planu] Credential Manager store failed (${String(code)})`));
+            }
+        });
+        child.stdin.end(value);
+    });
+}
+export class WindowsCredentialManagerAdapter {
+    kind = 'windows-credential-manager';
+    async get(id) {
+        try {
+            const result = await execFile('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', GET_SCRIPT, id], { timeout: TIMEOUT_MS });
+            return result.stdout || null;
+        }
+        catch (error) {
+            // reliability-optional: WINDOWS_SECRET_LOOKUP — missing credentials resolve to null
+            reportClassifiedDegradation('WINDOWS_SECRET_LOOKUP', error);
+            return null;
+        }
+    }
+    async set(id, value) {
+        await storeWithoutArgv(id, value);
+    }
+    async delete(id) {
+        try {
+            await execFile('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', DELETE_SCRIPT, id], { timeout: TIMEOUT_MS });
+        }
+        catch (error) {
+            // reliability-cleanup: WINDOWS_SECRET_DELETE — deletion is idempotent
+            reportClassifiedDegradation('WINDOWS_SECRET_DELETE', error);
+        }
+    }
+}
+//# sourceMappingURL=windows-credential-manager.js.map

package/dist/security/redactor.d.ts

@@ -0,0 +1,5 @@
+/** Redact sensitive substrings without mutating the input string. */
+export declare function redactText(value: string): string;
+/** Return a detached, redacted representation. Unsupported or cyclic values fail closed. */
+export declare function redactSensitiveValue(value: unknown): unknown;
+//# sourceMappingURL=redactor.d.ts.map

package/dist/security/redactor.js

@@ -0,0 +1,58 @@
+const REDACTED = '[REDACTED]';
+import { emitClassifiedDegradation } from '../errors/degradation-sink.js';
+const SENSITIVE_KEY = /(?:api[-_]?key|token|authorization|client[-_]?secret|license[-_]?key|password|private[-_]?key|seed|mnemonic|service[-_]?role|webhook[-_]?(?:url|secret)|dsn)/iu;
+const TEXT_PATTERNS = [
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gu,
+    /\b(?:eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})\b/gu,
+    /\b(?:sk|ghp|github_pat|xox[baprs])[-_A-Za-z0-9]{12,}\b/gu,
+    /(?:\/Users\/|\/home\/)[^/\s]+/gu,
+    /[A-Za-z]:\\Users\\[^\\\s]+/gu,
+    /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/giu,
+    /\b(?:api[-_]?key|token|authorization|client[-_]?secret|license[-_]?key|password|private[-_]?key|seed|mnemonic|service[-_]?role|webhook[-_]?(?:url|secret)|dsn)\s*[:=]\s*[^\s,;]+/giu,
+];
+/** Redact sensitive substrings without mutating the input string. */
+export function redactText(value) {
+    return TEXT_PATTERNS.reduce((current, pattern) => current.replace(pattern, REDACTED), value);
+}
+function redactRecord(value, seen) {
+    const output = {};
+    for (const [key, entry] of Object.entries(value)) {
+        output[key] = SENSITIVE_KEY.test(key) ? REDACTED : redactUnknown(entry, seen);
+    }
+    return output;
+}
+function redactUnknown(value, seen) {
+    if (typeof value === 'string') {
+        return redactText(value);
+    }
+    if (value === null || typeof value === 'number' || typeof value === 'boolean') {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        if (seen.has(value)) {
+            return REDACTED;
+        }
+        seen.add(value);
+        return value.map((entry) => redactUnknown(entry, seen));
+    }
+    if (typeof value === 'object') {
+        if (seen.has(value)) {
+            return REDACTED;
+        }
+        seen.add(value);
+        return redactRecord(value, seen);
+    }
+    return REDACTED;
+}
+/** Return a detached, redacted representation. Unsupported or cyclic values fail closed. */
+export function redactSensitiveValue(value) {
+    try {
+        return redactUnknown(value, new WeakSet());
+    }
+    catch {
+        // reliability-cleanup: REDACTION_FALLBACK — unsupported hostile values stay hidden
+        emitClassifiedDegradation('REDACTION_FALLBACK', REDACTED);
+        return REDACTED;
+    }
+}
+//# sourceMappingURL=redactor.js.map

package/dist/security/secret-field.d.ts

@@ -0,0 +1,5 @@
+import type { SecretPurpose } from '../types/security.js';
+export declare function storeSecretField(id: string, purpose: SecretPurpose, value: string): Promise<string>;
+export declare function resolveSecretField(value: string): Promise<string>;
+export declare function deleteSecretField(value: string | undefined): Promise<void>;
+//# sourceMappingURL=secret-field.d.ts.map

package/dist/security/secret-field.js

@@ -0,0 +1,17 @@
+import { formatSecretReference, getSecretProvider, parseSecretReference, } from './secret-provider.js';
+export async function storeSecretField(id, purpose, value) {
+    const provider = getSecretProvider();
+    const reference = provider.reference(id, purpose);
+    await provider.store(reference, value);
+    return formatSecretReference(reference);
+}
+export async function resolveSecretField(value) {
+    return getSecretProvider().resolve(parseSecretReference(value));
+}
+export async function deleteSecretField(value) {
+    if (value === undefined) {
+        return;
+    }
+    await getSecretProvider().delete(parseSecretReference(value));
+}
+//# sourceMappingURL=secret-field.js.map

package/dist/security/secret-migration.d.ts

@@ -0,0 +1,3 @@
+import type { SecretMigrationOptions, SecretMigrationReport, SecretMigrationTarget } from '../types/security.js';
+export declare function migrateSecrets(targets: readonly SecretMigrationTarget[], options: SecretMigrationOptions): Promise<SecretMigrationReport>;
+//# sourceMappingURL=secret-migration.d.ts.map

package/dist/security/secret-migration.js

@@ -0,0 +1,123 @@
+import { readFile, readdir, unlink } from 'node:fs/promises';
+import { dirname, basename, join } from 'node:path';
+import { formatSecretReference, isSecretReference } from './secret-provider.js';
+import { writeSecureJson } from './secure-json.js';
+function readAtPath(root, path) {
+    let current = root;
+    for (const segment of path) {
+        if (current === null || typeof current !== 'object' || !(segment in current)) {
+            return undefined;
+        }
+        current = current[segment];
+    }
+    return current;
+}
+function writeAtPath(root, path, value) {
+    if (path.length === 0) {
+        throw new Error('[Planu] Secret migration path cannot be empty');
+    }
+    let current = root;
+    for (const segment of path.slice(0, -1)) {
+        if (current === null || typeof current !== 'object') {
+            throw new Error('[Planu] Secret migration path is invalid');
+        }
+        current = current[segment];
+    }
+    if (current === null || typeof current !== 'object') {
+        throw new Error('[Planu] Secret migration path is invalid');
+    }
+    const leaf = path[path.length - 1];
+    if (leaf === undefined) {
+        throw new Error('[Planu] Secret migration path cannot be empty');
+    }
+    current[leaf] = value;
+}
+async function removePlaintextBackups(sourcePath) {
+    const directory = dirname(sourcePath);
+    const fileName = basename(sourcePath);
+    const prefix = `${fileName}.bak.`;
+    const jsonStem = fileName.endsWith('.json') ? fileName.slice(0, -'.json'.length) : fileName;
+    let entries;
+    try {
+        entries = await readdir(directory);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            entries = [];
+        }
+        else {
+            throw error;
+        }
+    }
+    await Promise.all(entries
+        .filter((entry) => entry === `${fileName}.bak` ||
+        (entry.startsWith(prefix) && /^\d+$/u.test(entry.slice(prefix.length))) ||
+        (entry.startsWith(`${jsonStem}.backup-`) && entry.endsWith('.json')))
+        .map((entry) => unlink(join(directory, entry))));
+}
+export async function migrateSecrets(targets, options) {
+    const findings = [];
+    for (const target of targets) {
+        let document;
+        try {
+            document = JSON.parse(await readFile(target.sourcePath, 'utf8'));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                continue;
+            }
+            throw new Error('[Planu] Secret migration source is invalid', { cause: error });
+        }
+        let changed = false;
+        let hasSecureReference = false;
+        for (const binding of target.bindings) {
+            const existing = readAtPath(document, binding.jsonPath);
+            const destination = formatSecretReference(options.provider.reference(binding.secretId, binding.purpose));
+            if (isSecretReference(existing)) {
+                hasSecureReference = true;
+                findings.push({
+                    sourcePath: target.sourcePath,
+                    destination,
+                    jsonPath: binding.jsonPath.join('.'),
+                    state: 'already-secure',
+                });
+            }
+            else if (typeof existing !== 'string' || !existing.trim()) {
+                findings.push({
+                    sourcePath: target.sourcePath,
+                    destination,
+                    jsonPath: binding.jsonPath.join('.'),
+                    state: 'missing',
+                });
+            }
+            else {
+                findings.push({
+                    sourcePath: target.sourcePath,
+                    destination,
+                    jsonPath: binding.jsonPath.join('.'),
+                    state: options.mode === 'apply' ? 'migrated' : 'pending',
+                });
+                if (options.mode === 'apply') {
+                    const reference = options.provider.reference(binding.secretId, binding.purpose);
+                    await options.provider.store(reference, existing);
+                    writeAtPath(document, binding.jsonPath, destination);
+                    changed = true;
+                    hasSecureReference = true;
+                    await writeSecureJson(options.journalPath, { schemaVersion: 1, findings });
+                }
+            }
+        }
+        if (options.mode === 'apply' && changed) {
+            await writeSecureJson(target.sourcePath, document);
+        }
+        if (options.mode === 'apply' && hasSecureReference) {
+            await removePlaintextBackups(target.sourcePath);
+        }
+    }
+    const report = { schemaVersion: 1, mode: options.mode, findings };
+    if (options.mode === 'apply') {
+        await writeSecureJson(options.journalPath, report);
+    }
+    return report;
+}
+//# sourceMappingURL=secret-migration.js.map

package/dist/security/secret-provider.d.ts

@@ -0,0 +1,23 @@
+import type { SecretPurpose, SecretReference, SecretStoreAdapter } from '../types/security.js';
+export { EnvironmentSecretAdapter } from './adapters/environment.js';
+export declare class SecretProviderError extends Error {
+    readonly code: 'SECRET_REFERENCE_INVALID' | 'SECRET_NOT_FOUND' | 'SECRET_VERIFY_FAILED';
+    constructor(code: 'SECRET_REFERENCE_INVALID' | 'SECRET_NOT_FOUND' | 'SECRET_VERIFY_FAILED');
+}
+export declare function formatSecretReference(reference: SecretReference): string;
+export declare function parseSecretReference(value: string): SecretReference;
+export declare function isSecretReference(value: unknown): value is string;
+export declare class SecretProvider {
+    readonly adapter: SecretStoreAdapter;
+    constructor(adapter: SecretStoreAdapter);
+    reference(id: string, purpose: SecretPurpose): SecretReference;
+    store(reference: SecretReference, value: string): Promise<void>;
+    resolve(reference: SecretReference): Promise<string>;
+    delete(reference: SecretReference): Promise<void>;
+    private assertOwned;
+}
+export declare function getSecretProvider(): SecretProvider;
+/** Explicitly configure a provider (including the environment adapter) before secret access. */
+export declare function configureSecretProvider(provider: SecretProvider): void;
+export declare function resetSecretProviderForTests(): void;
+//# sourceMappingURL=secret-provider.d.ts.map

package/dist/security/secret-provider.js

@@ -0,0 +1,145 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { LinuxSecretServiceAdapter } from './adapters/linux-secret-service.js';
+import { MacOSKeychainAdapter } from './adapters/macos-keychain.js';
+import { WindowsCredentialManagerAdapter } from './adapters/windows-credential-manager.js';
+export { EnvironmentSecretAdapter } from './adapters/environment.js';
+const REFERENCE_PREFIX = 'planu-secret:v1:';
+const SECRET_ID = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/u;
+const PROVIDERS = new Set([
+    'macos-keychain',
+    'linux-secret-service',
+    'windows-credential-manager',
+    'environment',
+]);
+const PURPOSES = new Set([
+    'license',
+    'oauth-access',
+    'oauth-refresh',
+    'registry-pat',
+    'figma-pat',
+    'supabase-service-role',
+    'supabase-anon',
+    'sentry-auth',
+    'slack-webhook',
+    'validation-signing',
+]);
+export class SecretProviderError extends Error {
+    code;
+    constructor(code) {
+        super(`[Planu] ${code}`);
+        this.code = code;
+        this.name = 'SecretProviderError';
+    }
+}
+export function formatSecretReference(reference) {
+    const id = Buffer.from(reference.id, 'utf8').toString('base64url');
+    return `${REFERENCE_PREFIX}${reference.provider}:${reference.purpose}:${id}`;
+}
+export function parseSecretReference(value) {
+    const parts = value.split(':');
+    if (parts.length !== 5 || `${parts[0]}:${parts[1]}:` !== REFERENCE_PREFIX) {
+        throw new SecretProviderError('SECRET_REFERENCE_INVALID');
+    }
+    const provider = parts[2];
+    const purpose = parts[3];
+    const encodedId = parts[4];
+    if (!provider || !purpose || !encodedId) {
+        throw new SecretProviderError('SECRET_REFERENCE_INVALID');
+    }
+    const id = Buffer.from(encodedId, 'base64url').toString('utf8');
+    if (!PROVIDERS.has(provider) ||
+        !PURPOSES.has(purpose)) {
+        throw new SecretProviderError('SECRET_REFERENCE_INVALID');
+    }
+    const reference = { schemaVersion: 1, provider, purpose, id };
+    if (formatSecretReference(reference) !== value || !SECRET_ID.test(id)) {
+        throw new SecretProviderError('SECRET_REFERENCE_INVALID');
+    }
+    return reference;
+}
+export function isSecretReference(value) {
+    if (typeof value !== 'string' || !value.startsWith(REFERENCE_PREFIX)) {
+        return false;
+    }
+    try {
+        parseSecretReference(value);
+        return true;
+    }
+    catch (error) {
+        if (error instanceof SecretProviderError && error.code === 'SECRET_REFERENCE_INVALID') {
+            return false;
+        }
+        throw error;
+    }
+}
+function sameSecret(left, right) {
+    const leftDigest = createHash('sha256').update(left).digest();
+    const rightDigest = createHash('sha256').update(right).digest();
+    return timingSafeEqual(leftDigest, rightDigest);
+}
+export class SecretProvider {
+    adapter;
+    constructor(adapter) {
+        this.adapter = adapter;
+    }
+    reference(id, purpose) {
+        if (!SECRET_ID.test(id)) {
+            throw new SecretProviderError('SECRET_REFERENCE_INVALID');
+        }
+        return { schemaVersion: 1, provider: this.adapter.kind, id, purpose };
+    }
+    async store(reference, value) {
+        this.assertOwned(reference);
+        if (!value.trim()) {
+            throw new SecretProviderError('SECRET_VERIFY_FAILED');
+        }
+        await this.adapter.set(reference.id, value);
+        const verified = await this.adapter.get(reference.id);
+        if (verified === null || !sameSecret(verified, value)) {
+            await this.adapter.delete(reference.id);
+            throw new SecretProviderError('SECRET_VERIFY_FAILED');
+        }
+    }
+    async resolve(reference) {
+        this.assertOwned(reference);
+        const value = await this.adapter.get(reference.id);
+        if (value === null) {
+            throw new SecretProviderError('SECRET_NOT_FOUND');
+        }
+        return value;
+    }
+    async delete(reference) {
+        this.assertOwned(reference);
+        await this.adapter.delete(reference.id);
+    }
+    assertOwned(reference) {
+        if (reference.provider !== this.adapter.kind || !SECRET_ID.test(reference.id)) {
+            throw new SecretProviderError('SECRET_REFERENCE_INVALID');
+        }
+    }
+}
+function platformAdapter() {
+    if (process.platform === 'darwin') {
+        return new MacOSKeychainAdapter();
+    }
+    if (process.platform === 'linux') {
+        return new LinuxSecretServiceAdapter();
+    }
+    if (process.platform === 'win32') {
+        return new WindowsCredentialManagerAdapter();
+    }
+    throw new Error(`[Planu] Unsupported secure secret store platform: ${process.platform}`);
+}
+let configuredProvider;
+export function getSecretProvider() {
+    configuredProvider ??= new SecretProvider(platformAdapter());
+    return configuredProvider;
+}
+/** Explicitly configure a provider (including the environment adapter) before secret access. */
+export function configureSecretProvider(provider) {
+    configuredProvider = provider;
+}
+export function resetSecretProviderForTests() {
+    configuredProvider = undefined;
+}
+//# sourceMappingURL=secret-provider.js.map

package/dist/security/secure-json.d.ts

@@ -0,0 +1,3 @@
+/** Atomically write a secret-reference projection without plaintext backup rotation. */
+export declare function writeSecureJson(path: string, value: unknown): Promise<void>;
+//# sourceMappingURL=secure-json.d.ts.map