@rafads/plugin-keychain 1.5.38

package/README.md

@@ -0,0 +1,59 @@
+# @rafads/plugin-keychain
+
+OS-keychain-backed secret store for the executor. Reads and writes secrets to:
+
+- **macOS / iOS** — Keychain
+- **Linux** — Secret Service (GNOME Keyring, KWallet)
+- **Windows** — Credential Manager
+
+Secrets are encrypted at rest by the operating system and never touch your project's filesystem.
+
+## Install
+
+```sh
+bun add @rafads/sdk @rafads/plugin-keychain
+# or
+npm install @rafads/sdk @rafads/plugin-keychain
+```
+
+## Usage
+
+```ts
+import { createExecutor } from "@rafads/sdk";
+import { keychainPlugin } from "@rafads/plugin-keychain";
+
+const executor = await createExecutor({
+  onElicitation: "accept-all",
+  plugins: [keychainPlugin()] as const,
+});
+
+// Check whether the current OS has a supported keychain
+if (executor.keychain.isSupported) {
+  await executor.secrets.set({
+    id: "github-token",
+    name: "GitHub Token",
+    value: "ghp_...",
+    scope: executor.scopes[0]!.id,
+  });
+
+  const value = await executor.secrets.get("github-token");
+}
+```
+
+Secrets written through this plugin are available to every other plugin that resolves secrets by ID — so you can store a token once and use it across `@rafads/plugin-openapi`, `@rafads/plugin-graphql`, etc. via `{ secretId, prefix }` headers.
+
+## Using with Effect
+
+If you're building on `@rafads/sdk/core` (the raw Effect entry), import this plugin from its `/core` subpath instead — it returns the Effect-shaped plugin with `Effect.Effect<...>`-returning methods rather than promisified wrappers:
+
+```ts
+import { keychainPlugin } from "@rafads/plugin-keychain/core";
+```
+
+## Status
+
+Pre-`1.0`. APIs may still change between beta releases. Part of the [executor monorepo](https://github.com/UsefulSoftwareCo/executor).
+
+## License
+
+MIT

package/dist/chunk-G7JVMQOY.js

@@ -0,0 +1,152 @@
+// src/index.ts
+import { Effect as Effect3 } from "effect";
+import { definePlugin } from "@rafads/sdk";
+
+// src/keyring.ts
+import { createRequire } from "module";
+import { Effect } from "effect";
+
+// src/errors.ts
+import { Data } from "effect";
+var KeychainError = class extends Data.TaggedError("KeychainError") {
+};
+
+// src/keyring.ts
+var DEFAULT_SERVICE_NAME = "executor";
+var SERVICE_NAME_ENV = "EXECUTOR_KEYCHAIN_SERVICE_NAME";
+var isSupportedPlatform = () => process.platform === "darwin" || process.platform === "linux" || process.platform === "win32";
+var displayName = () => process.platform === "darwin" ? "macOS Keychain" : process.platform === "win32" ? "Windows Credential Manager" : "Desktop Keyring";
+var resolveServiceName = (explicit) => explicit?.trim() || process.env[SERVICE_NAME_ENV]?.trim() || DEFAULT_SERVICE_NAME;
+var entryCtorPromise = null;
+var loadEntryCtor = async () => {
+  const directPath = process.env.EXECUTOR_KEYRING_NATIVE_PATH;
+  if (directPath) {
+    const req = createRequire(import.meta.url);
+    return req(directPath).Entry;
+  }
+  const { Entry } = await import("@napi-rs/keyring");
+  return Entry;
+};
+var loadEntry = () => isSupportedPlatform() ? Effect.tryPromise({
+  try: async () => {
+    entryCtorPromise ??= loadEntryCtor();
+    return await entryCtorPromise;
+  },
+  catch: (cause) => new KeychainError({
+    message: "Failed loading native keyring",
+    cause
+  })
+}) : Effect.fail(
+  new KeychainError({
+    message: `Failed loading native keyring: unsupported platform '${process.platform}'`
+  })
+);
+var createEntry = (serviceName, account) => Effect.flatMap(
+  loadEntry(),
+  (Entry) => Effect.try({
+    try: () => new Entry(serviceName, account),
+    catch: (cause) => new KeychainError({
+      message: "Failed creating keyring entry",
+      cause
+    })
+  })
+);
+var getPassword = (serviceName, account) => Effect.flatMap(
+  createEntry(serviceName, account),
+  (entry) => Effect.try({
+    try: () => entry.getPassword(),
+    catch: () => new KeychainError({ message: `Failed reading secret for account '${account}'` })
+  })
+);
+var setPassword = (serviceName, account, value) => Effect.flatMap(
+  createEntry(serviceName, account),
+  (entry) => Effect.try({
+    try: () => entry.setPassword(value),
+    catch: (cause) => new KeychainError({
+      message: "Failed writing secret",
+      cause
+    })
+  }).pipe(Effect.asVoid)
+);
+var deletePassword = (serviceName, account) => Effect.flatMap(
+  createEntry(serviceName, account),
+  (entry) => Effect.try({
+    try: () => {
+      entry.deletePassword();
+      return true;
+    },
+    catch: () => new KeychainError({ message: `Failed deleting secret for account '${account}'` })
+  })
+);
+
+// src/provider.ts
+import { Effect as Effect2 } from "effect";
+import {
+  StorageError,
+  ProviderKey
+} from "@rafads/sdk";
+var toStorageError = (cause) => {
+  const { cause: underlyingCause } = cause;
+  return new StorageError({ message: cause.message, cause: underlyingCause ?? cause });
+};
+var KEYCHAIN_PROVIDER_KEY = ProviderKey.make("keychain");
+var makeKeychainProvider = (serviceName) => ({
+  key: KEYCHAIN_PROVIDER_KEY,
+  writable: true,
+  get: (id) => getPassword(serviceName, id).pipe(Effect2.mapError(toStorageError)),
+  has: (id) => getPassword(serviceName, id).pipe(
+    Effect2.map((value) => value !== null),
+    Effect2.mapError(toStorageError)
+  ),
+  set: (id, value) => setPassword(serviceName, id, value).pipe(Effect2.mapError(toStorageError)),
+  delete: (id) => deletePassword(serviceName, id).pipe(Effect2.asVoid, Effect2.mapError(toStorageError)),
+  // Keychain doesn't support enumerating — you need to know the account name.
+  list: void 0
+});
+
+// src/index.ts
+var PROBE_VALUE = "probe";
+var probeAccount = () => `__executor_keychain_probe__:${process.pid}:${Date.now()}:${Math.random().toString(36).slice(2)}`;
+var makeKeychainExtension = (_ctx, options) => {
+  const serviceName = resolveServiceName(options?.serviceName);
+  return {
+    /** Human-readable name for the keychain on this platform */
+    displayName: displayName(),
+    /** Whether the current platform supports system keychain */
+    isSupported: isSupportedPlatform(),
+    /** Check if a secret exists in the system keychain. `id` is the opaque
+     *  provider item id (the keychain account); v2 has no scope partitioning. */
+    has: (id) => getPassword(serviceName, id).pipe(
+      Effect3.map((value) => value !== null),
+      Effect3.orElseSucceed(() => false)
+    )
+  };
+};
+var keychainPlugin = definePlugin((options) => ({
+  id: "keychain",
+  storage: () => ({}),
+  extension: (ctx) => makeKeychainExtension(ctx, options),
+  credentialProviders: () => Effect3.gen(function* () {
+    const serviceName = resolveServiceName(options?.serviceName);
+    const account = probeAccount();
+    const reachable = yield* setPassword(serviceName, account, PROBE_VALUE).pipe(
+      Effect3.andThen(deletePassword(serviceName, account).pipe(Effect3.catch(() => Effect3.void))),
+      Effect3.as(true),
+      Effect3.catch(
+        () => Effect3.logWarning("keychain unavailable, skipping provider registration").pipe(
+          Effect3.as(false)
+        )
+      )
+    );
+    return reachable ? [makeKeychainProvider(serviceName)] : [];
+  })
+}));
+
+export {
+  KeychainError,
+  isSupportedPlatform,
+  displayName,
+  makeKeychainProvider,
+  keychainPlugin
+};
+//# sourceMappingURL=chunk-G7JVMQOY.js.map

package/dist/chunk-G7JVMQOY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/keyring.ts","../src/errors.ts","../src/provider.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport { definePlugin, type CredentialProvider, type PluginCtx } from \"@rafads/sdk\";\n\nimport {\n  deletePassword,\n  displayName,\n  getPassword,\n  isSupportedPlatform,\n  resolveServiceName,\n  setPassword,\n} from \"./keyring\";\nimport { makeKeychainProvider } from \"./provider\";\n\n// Probe the keychain by writing and then deleting a sentinel entry. A\n// read-only probe isn't enough — on some Linux environments (WSL2,\n// headless CI) `getPassword` for a missing key returns null without\n// error, but `setPassword` fails because the secret-service backend\n// isn't actually reachable. Writing is the capability the executor\n// cares about, so test it directly.\nconst PROBE_VALUE = \"probe\";\nconst probeAccount = (): string =>\n  `__executor_keychain_probe__:${process.pid}:${Date.now()}:${Math.random().toString(36).slice(2)}`;\n\n// ---------------------------------------------------------------------------\n// Re-exports\n// ---------------------------------------------------------------------------\n\nexport { KeychainError } from \"./errors\";\nexport { makeKeychainProvider } from \"./provider\";\nexport { isSupportedPlatform, displayName } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// Plugin config\n// ---------------------------------------------------------------------------\n\nexport interface KeychainPluginConfig {\n  /** Override the keychain service name (default: \"executor\") */\n  readonly serviceName?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Plugin extension — public API on executor.keychain\n// ---------------------------------------------------------------------------\n\nexport type KeychainExtension = ReturnType<typeof makeKeychainExtension>;\n\n// ---------------------------------------------------------------------------\n// Plugin definition\n// ---------------------------------------------------------------------------\n\nconst makeKeychainExtension = (\n  _ctx: PluginCtx<unknown>,\n  options: KeychainPluginConfig | undefined,\n) => {\n  const serviceName = resolveServiceName(options?.serviceName);\n  return {\n    /** Human-readable name for the keychain on this platform */\n    displayName: displayName(),\n\n    /** Whether the current platform supports system keychain */\n    isSupported: isSupportedPlatform(),\n\n    /** Check if a secret exists in the system keychain. `id` is the opaque\n     *  provider item id (the keychain account); v2 has no scope partitioning. */\n    has: (id: string) =>\n      getPassword(serviceName, id).pipe(\n        Effect.map((value: string | null) => value !== null),\n        Effect.orElseSucceed(() => false),\n      ),\n  };\n};\n\nexport const keychainPlugin = definePlugin((options?: KeychainPluginConfig) => ({\n  id: \"keychain\" as const,\n  storage: () => ({}),\n\n  extension: (ctx: PluginCtx<unknown>): KeychainExtension => makeKeychainExtension(ctx, options),\n\n  credentialProviders: (): Effect.Effect<readonly CredentialProvider[]> =>\n    Effect.gen(function* () {\n      const serviceName = resolveServiceName(options?.serviceName);\n      const account = probeAccount();\n      const reachable = yield* setPassword(serviceName, account, PROBE_VALUE).pipe(\n        Effect.andThen(deletePassword(serviceName, account).pipe(Effect.catch(() => Effect.void))),\n        Effect.as(true),\n        Effect.catch(() =>\n          Effect.logWarning(\"keychain unavailable, skipping provider registration\").pipe(\n            Effect.as(false),\n          ),\n        ),\n      );\n      return reachable ? [makeKeychainProvider(serviceName)] : [];\n    }),\n}));\n","import { createRequire } from \"node:module\";\n\nimport { Effect } from \"effect\";\n\nimport { KeychainError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst DEFAULT_SERVICE_NAME = \"executor\";\nconst SERVICE_NAME_ENV = \"EXECUTOR_KEYCHAIN_SERVICE_NAME\";\n\n// ---------------------------------------------------------------------------\n// Platform helpers\n// ---------------------------------------------------------------------------\n\nexport const isSupportedPlatform = () =>\n  process.platform === \"darwin\" || process.platform === \"linux\" || process.platform === \"win32\";\n\nexport const displayName = () =>\n  process.platform === \"darwin\"\n    ? \"macOS Keychain\"\n    : process.platform === \"win32\"\n      ? \"Windows Credential Manager\"\n      : \"Desktop Keyring\";\n\nexport const resolveServiceName = (explicit?: string): string =>\n  explicit?.trim() || process.env[SERVICE_NAME_ENV]?.trim() || DEFAULT_SERVICE_NAME;\n\n// ---------------------------------------------------------------------------\n// Lazy-load @napi-rs/keyring (native module)\n// ---------------------------------------------------------------------------\n\ntype EntryConstructor = (typeof import(\"@napi-rs/keyring\"))[\"Entry\"];\n\nlet entryCtorPromise: Promise<EntryConstructor> | null = null;\n\n// In compiled bun binaries (`bun build --compile`) `.node` modules aren't\n// included in bunfs and there's no node_modules at runtime, so\n// @napi-rs/keyring's loader can't find its platform-specific binding.\n// `apps/cli/src/build.ts` copies the .node next to the executor and\n// `apps/cli/src/main.ts` exports its absolute path here. We load it\n// directly because @napi-rs/keyring@1.2.0's NAPI_RS_NATIVE_LIBRARY_PATH\n// branch is buggy (assigns to a local that gets overwritten before return).\nconst loadEntryCtor = async (): Promise<EntryConstructor> => {\n  const directPath = process.env.EXECUTOR_KEYRING_NATIVE_PATH;\n  if (directPath) {\n    const req = createRequire(import.meta.url);\n    return (req(directPath) as { Entry: EntryConstructor }).Entry;\n  }\n  const { Entry } = await import(\"@napi-rs/keyring\");\n  return Entry;\n};\n\nconst loadEntry = (): Effect.Effect<EntryConstructor, KeychainError> =>\n  isSupportedPlatform()\n    ? Effect.tryPromise({\n        try: async () => {\n          entryCtorPromise ??= loadEntryCtor();\n          return await entryCtorPromise;\n        },\n        catch: (cause) =>\n          new KeychainError({\n            message: \"Failed loading native keyring\",\n            cause,\n          }),\n      })\n    : Effect.fail(\n        new KeychainError({\n          message: `Failed loading native keyring: unsupported platform '${process.platform}'`,\n        }),\n      );\n\nconst createEntry = (serviceName: string, account: string) =>\n  Effect.flatMap(loadEntry(), (Entry) =>\n    Effect.try({\n      try: () => new Entry(serviceName, account),\n      catch: (cause) =>\n        new KeychainError({\n          message: \"Failed creating keyring entry\",\n          cause,\n        }),\n    }),\n  );\n\n// ---------------------------------------------------------------------------\n// Low-level keychain operations\n// ---------------------------------------------------------------------------\n\nexport const getPassword = (\n  serviceName: string,\n  account: string,\n): Effect.Effect<string | null, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => entry.getPassword(),\n      catch: () => new KeychainError({ message: `Failed reading secret for account '${account}'` }),\n    }),\n  );\n\nexport const setPassword = (\n  serviceName: string,\n  account: string,\n  value: string,\n): Effect.Effect<void, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => entry.setPassword(value),\n      catch: (cause) =>\n        new KeychainError({\n          message: \"Failed writing secret\",\n          cause,\n        }),\n    }).pipe(Effect.asVoid),\n  );\n\nexport const deletePassword = (\n  serviceName: string,\n  account: string,\n): Effect.Effect<boolean, KeychainError> =>\n  Effect.flatMap(createEntry(serviceName, account), (entry) =>\n    Effect.try({\n      try: () => {\n        entry.deletePassword();\n        return true;\n      },\n      catch: () =>\n        new KeychainError({ message: `Failed deleting secret for account '${account}'` }),\n    }),\n  );\n","import { Data } from \"effect\";\n\nexport class KeychainError extends Data.TaggedError(\"KeychainError\")<{\n  readonly message: string;\n  readonly cause?: unknown;\n}> {}\n","import { Effect } from \"effect\";\n\nimport {\n  StorageError,\n  ProviderKey,\n  type CredentialProvider,\n  type ProviderItemId,\n} from \"@rafads/sdk\";\n\nimport type { KeychainError } from \"./errors\";\nimport { getPassword, setPassword, deletePassword } from \"./keyring\";\n\n// ---------------------------------------------------------------------------\n// CredentialProvider adapter — bridges keyring into the v2 resolution chain.\n//\n// The underlying `@napi-rs/keyring` sync API encodes \"no entry\" as an\n// ordinary return value (`getPassword()` → `null`, `deletePassword()` →\n// `false`), and only throws on real failures (keychain locked, permission\n// denied, platform init failure, etc.). `keyring.ts` wraps those thrown\n// failures as `KeychainError`. We translate `KeychainError` →\n// `StorageError` so the HTTP edge can capture it to telemetry and surface\n// an opaque `InternalError({ traceId })` — previously `orElseSucceed`\n// silently converted every failure into \"nothing found\", which made it\n// impossible to debug why secrets weren't resolving.\n//\n// v2: the provider sees only an opaque `ProviderItemId` (the keychain\n// account). There is NO scope arg — the connection row owns the (tenant,\n// owner, subject) partition. We use a single, flat keychain service name;\n// the connection's opaque id is the account that uniquely keys the entry.\n// ---------------------------------------------------------------------------\n\nconst toStorageError = (cause: KeychainError) => {\n  const { cause: underlyingCause } = cause;\n  // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: typed KeychainError message becomes StorageError message\n  return new StorageError({ message: cause.message, cause: underlyingCause ?? cause });\n};\n\nconst KEYCHAIN_PROVIDER_KEY = ProviderKey.make(\"keychain\");\n\nexport const makeKeychainProvider = (serviceName: string): CredentialProvider => ({\n  key: KEYCHAIN_PROVIDER_KEY,\n  writable: true,\n  get: (id: ProviderItemId) => getPassword(serviceName, id).pipe(Effect.mapError(toStorageError)),\n  has: (id: ProviderItemId) =>\n    getPassword(serviceName, id).pipe(\n      Effect.map((value: string | null) => value !== null),\n      Effect.mapError(toStorageError),\n    ),\n  set: (id: ProviderItemId, value: string) =>\n    setPassword(serviceName, id, value).pipe(Effect.mapError(toStorageError)),\n  delete: (id: ProviderItemId) =>\n    deletePassword(serviceName, id).pipe(Effect.asVoid, Effect.mapError(toStorageError)),\n  // Keychain doesn't support enumerating — you need to know the account name.\n  list: undefined,\n});\n"],"mappings":";AAAA,SAAS,UAAAA,eAAc;AAEvB,SAAS,oBAA6D;;;ACFtE,SAAS,qBAAqB;AAE9B,SAAS,cAAc;;;ACFvB,SAAS,YAAY;AAEd,IAAM,gBAAN,cAA4B,KAAK,YAAY,eAAe,EAGhE;AAAC;;;ADKJ,IAAM,uBAAuB;AAC7B,IAAM,mBAAmB;AAMlB,IAAM,sBAAsB,MACjC,QAAQ,aAAa,YAAY,QAAQ,aAAa,WAAW,QAAQ,aAAa;AAEjF,IAAM,cAAc,MACzB,QAAQ,aAAa,WACjB,mBACA,QAAQ,aAAa,UACnB,+BACA;AAED,IAAM,qBAAqB,CAAC,aACjC,UAAU,KAAK,KAAK,QAAQ,IAAI,gBAAgB,GAAG,KAAK,KAAK;AAQ/D,IAAI,mBAAqD;AASzD,IAAM,gBAAgB,YAAuC;AAC3D,QAAM,aAAa,QAAQ,IAAI;AAC/B,MAAI,YAAY;AACd,UAAM,MAAM,cAAc,YAAY,GAAG;AACzC,WAAQ,IAAI,UAAU,EAAkC;AAAA,EAC1D;AACA,QAAM,EAAE,MAAM,IAAI,MAAM,OAAO,kBAAkB;AACjD,SAAO;AACT;AAEA,IAAM,YAAY,MAChB,oBAAoB,IAChB,OAAO,WAAW;AAAA,EAChB,KAAK,YAAY;AACf,yBAAqB,cAAc;AACnC,WAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,IAChB,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACL,CAAC,IACD,OAAO;AAAA,EACL,IAAI,cAAc;AAAA,IAChB,SAAS,wDAAwD,QAAQ,QAAQ;AAAA,EACnF,CAAC;AACH;AAEN,IAAM,cAAc,CAAC,aAAqB,YACxC,OAAO;AAAA,EAAQ,UAAU;AAAA,EAAG,CAAC,UAC3B,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,IAAI,MAAM,aAAa,OAAO;AAAA,IACzC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACH;AAMK,IAAM,cAAc,CACzB,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY;AAAA,IAC7B,OAAO,MAAM,IAAI,cAAc,EAAE,SAAS,sCAAsC,OAAO,IAAI,CAAC;AAAA,EAC9F,CAAC;AACH;AAEK,IAAM,cAAc,CACzB,aACA,SACA,UAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM,MAAM,YAAY,KAAK;AAAA,IAClC,OAAO,CAAC,UACN,IAAI,cAAc;AAAA,MAChB,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACL,CAAC,EAAE,KAAK,OAAO,MAAM;AACvB;AAEK,IAAM,iBAAiB,CAC5B,aACA,YAEA,OAAO;AAAA,EAAQ,YAAY,aAAa,OAAO;AAAA,EAAG,CAAC,UACjD,OAAO,IAAI;AAAA,IACT,KAAK,MAAM;AACT,YAAM,eAAe;AACrB,aAAO;AAAA,IACT;AAAA,IACA,OAAO,MACL,IAAI,cAAc,EAAE,SAAS,uCAAuC,OAAO,IAAI,CAAC;AAAA,EACpF,CAAC;AACH;;;AElIF,SAAS,UAAAC,eAAc;AAEvB;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAwBP,IAAM,iBAAiB,CAAC,UAAyB;AAC/C,QAAM,EAAE,OAAO,gBAAgB,IAAI;AAEnC,SAAO,IAAI,aAAa,EAAE,SAAS,MAAM,SAAS,OAAO,mBAAmB,MAAM,CAAC;AACrF;AAEA,IAAM,wBAAwB,YAAY,KAAK,UAAU;AAElD,IAAM,uBAAuB,CAAC,iBAA6C;AAAA,EAChF,KAAK;AAAA,EACL,UAAU;AAAA,EACV,KAAK,CAAC,OAAuB,YAAY,aAAa,EAAE,EAAE,KAAKC,QAAO,SAAS,cAAc,CAAC;AAAA,EAC9F,KAAK,CAAC,OACJ,YAAY,aAAa,EAAE,EAAE;AAAA,IAC3BA,QAAO,IAAI,CAAC,UAAyB,UAAU,IAAI;AAAA,IACnDA,QAAO,SAAS,cAAc;AAAA,EAChC;AAAA,EACF,KAAK,CAAC,IAAoB,UACxB,YAAY,aAAa,IAAI,KAAK,EAAE,KAAKA,QAAO,SAAS,cAAc,CAAC;AAAA,EAC1E,QAAQ,CAAC,OACP,eAAe,aAAa,EAAE,EAAE,KAAKA,QAAO,QAAQA,QAAO,SAAS,cAAc,CAAC;AAAA;AAAA,EAErF,MAAM;AACR;;;AHlCA,IAAM,cAAc;AACpB,IAAM,eAAe,MACnB,+BAA+B,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AA6BjG,IAAM,wBAAwB,CAC5B,MACA,YACG;AACH,QAAM,cAAc,mBAAmB,SAAS,WAAW;AAC3D,SAAO;AAAA;AAAA,IAEL,aAAa,YAAY;AAAA;AAAA,IAGzB,aAAa,oBAAoB;AAAA;AAAA;AAAA,IAIjC,KAAK,CAAC,OACJ,YAAY,aAAa,EAAE,EAAE;AAAA,MAC3BC,QAAO,IAAI,CAAC,UAAyB,UAAU,IAAI;AAAA,MACnDA,QAAO,cAAc,MAAM,KAAK;AAAA,IAClC;AAAA,EACJ;AACF;AAEO,IAAM,iBAAiB,aAAa,CAAC,aAAoC;AAAA,EAC9E,IAAI;AAAA,EACJ,SAAS,OAAO,CAAC;AAAA,EAEjB,WAAW,CAAC,QAA+C,sBAAsB,KAAK,OAAO;AAAA,EAE7F,qBAAqB,MACnBA,QAAO,IAAI,aAAa;AACtB,UAAM,cAAc,mBAAmB,SAAS,WAAW;AAC3D,UAAM,UAAU,aAAa;AAC7B,UAAM,YAAY,OAAO,YAAY,aAAa,SAAS,WAAW,EAAE;AAAA,MACtEA,QAAO,QAAQ,eAAe,aAAa,OAAO,EAAE,KAAKA,QAAO,MAAM,MAAMA,QAAO,IAAI,CAAC,CAAC;AAAA,MACzFA,QAAO,GAAG,IAAI;AAAA,MACdA,QAAO;AAAA,QAAM,MACXA,QAAO,WAAW,sDAAsD,EAAE;AAAA,UACxEA,QAAO,GAAG,KAAK;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AACA,WAAO,YAAY,CAAC,qBAAqB,WAAW,CAAC,IAAI,CAAC;AAAA,EAC5D,CAAC;AACL,EAAE;","names":["Effect","Effect","Effect","Effect"]}

package/dist/core.js

@@ -0,0 +1,15 @@
+import {
+  KeychainError,
+  displayName,
+  isSupportedPlatform,
+  keychainPlugin,
+  makeKeychainProvider
+} from "./chunk-G7JVMQOY.js";
+export {
+  KeychainError,
+  displayName,
+  isSupportedPlatform,
+  keychainPlugin,
+  makeKeychainProvider
+};
+//# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/errors.d.ts

@@ -0,0 +1,9 @@
+declare const KeychainError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "KeychainError";
+} & Readonly<A>;
+export declare class KeychainError extends KeychainError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export {};

package/dist/index.d.ts

@@ -0,0 +1,28 @@
+import { Effect } from "effect";
+import { type PluginCtx } from "@rafads/sdk";
+export { KeychainError } from "./errors";
+export { makeKeychainProvider } from "./provider";
+export { isSupportedPlatform, displayName } from "./keyring";
+export interface KeychainPluginConfig {
+    /** Override the keychain service name (default: "executor") */
+    readonly serviceName?: string;
+}
+export type KeychainExtension = ReturnType<typeof makeKeychainExtension>;
+declare const makeKeychainExtension: (_ctx: PluginCtx<unknown>, options: KeychainPluginConfig | undefined) => {
+    /** Human-readable name for the keychain on this platform */
+    displayName: string;
+    /** Whether the current platform supports system keychain */
+    isSupported: boolean;
+    /** Check if a secret exists in the system keychain. `id` is the opaque
+     *  provider item id (the keychain account); v2 has no scope partitioning. */
+    has: (id: string) => Effect.Effect<boolean, never, never>;
+};
+export declare const keychainPlugin: import("@rafads/sdk").ConfiguredPlugin<"keychain", {
+    /** Human-readable name for the keychain on this platform */
+    displayName: string;
+    /** Whether the current platform supports system keychain */
+    isSupported: boolean;
+    /** Check if a secret exists in the system keychain. `id` is the opaque
+     *  provider item id (the keychain account); v2 has no scope partitioning. */
+    has: (id: string) => Effect.Effect<boolean, never, never>;
+}, {}, KeychainPluginConfig, undefined, import("effect/Layer").Layer<unknown, never, never>, import("effect/unstable/httpapi/HttpApiGroup").Any>;

package/dist/index.js

@@ -0,0 +1,10 @@
+import {
+  keychainPlugin
+} from "./chunk-G7JVMQOY.js";
+
+// src/promise.ts
+var keychainPlugin2 = (config) => keychainPlugin(config);
+export {
+  keychainPlugin2 as keychainPlugin
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/promise.ts"],"sourcesContent":["import { type Plugin } from \"@rafads/sdk\";\n\nimport {\n  keychainPlugin as keychainPluginEffect,\n  type KeychainExtension,\n  type KeychainPluginConfig,\n} from \"./index\";\n\nexport type { KeychainPluginConfig } from \"./index\";\n\n// Explicit return type so the emitted dist/promise.d.ts references\n// `import(\"@rafads/sdk\").Plugin` rather than the Promise-surface\n// root specifier (which doesn't re-export Plugin).\nexport const keychainPlugin = (\n  config?: KeychainPluginConfig,\n): Plugin<\"keychain\", KeychainExtension, Record<string, never>> => keychainPluginEffect(config);\n"],"mappings":";;;;;AAaO,IAAMA,kBAAiB,CAC5B,WACiE,eAAqB,MAAM;","names":["keychainPlugin"]}

package/dist/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/keyring.d.ts

@@ -0,0 +1,8 @@
+import { Effect } from "effect";
+import { KeychainError } from "./errors";
+export declare const isSupportedPlatform: () => boolean;
+export declare const displayName: () => "macOS Keychain" | "Windows Credential Manager" | "Desktop Keyring";
+export declare const resolveServiceName: (explicit?: string) => string;
+export declare const getPassword: (serviceName: string, account: string) => Effect.Effect<string | null, KeychainError>;
+export declare const setPassword: (serviceName: string, account: string, value: string) => Effect.Effect<void, KeychainError>;
+export declare const deletePassword: (serviceName: string, account: string) => Effect.Effect<boolean, KeychainError>;

package/dist/promise.d.ts

@@ -0,0 +1,4 @@
+import { type Plugin } from "@rafads/sdk";
+import { type KeychainExtension, type KeychainPluginConfig } from "./index";
+export type { KeychainPluginConfig } from "./index";
+export declare const keychainPlugin: (config?: KeychainPluginConfig) => Plugin<"keychain", KeychainExtension, Record<string, never>>;

package/dist/provider.d.ts

@@ -0,0 +1,2 @@
+import { type CredentialProvider } from "@rafads/sdk";
+export declare const makeKeychainProvider: (serviceName: string) => CredentialProvider;

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@rafads/plugin-keychain",
+  "version": "1.5.38",
+  "homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/plugins/keychain",
+  "bugs": {
+    "url": "https://github.com/UsefulSoftwareCo/executor/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/UsefulSoftwareCo/executor.git",
+    "directory": "packages/plugins/keychain"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/promise.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./core": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/core.js"
+      }
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup && tsc --declaration --emitDeclarationOnly --outDir dist --rootDir src",
+    "typecheck": "tsgo --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck:slow": "bunx tsc --noEmit -p tsconfig.json"
+  },
+  "dependencies": {
+    "@napi-rs/keyring": "^1.2.0",
+    "@rafads/sdk": "1.5.38"
+  },
+  "devDependencies": {
+    "@effect/vitest": "4.0.0-beta.59",
+    "@types/node": "^24.3.1",
+    "bun-types": "^1.2.22",
+    "effect": "4.0.0-beta.59",
+    "tsup": "^8.5.0",
+    "vitest": "^4.1.5"
+  },
+  "peerDependencies": {
+    "effect": "4.0.0-beta.59"
+  }
+}