@scopewatch/secrets 0.0.1

package/dist/errors.d.ts

@@ -0,0 +1,21 @@
+export type SecretErrorCategory = 'no_keychain_backend' | 'item_not_found' | 'not_a_tty' | 'prompt_cancelled' | 'unrecognized';
+export declare class SecretError extends Error {
+    category: SecretErrorCategory;
+    detail: string | undefined;
+    constructor(category: SecretErrorCategory, message: string, detail?: string);
+}
+/**
+ * Deliberate design decision (see CLAUDE.md Phase D): when no real OS keychain
+ * backend is available (e.g. headless Linux with no Secret Service/D-Bus session
+ * running), Scopewatch refuses to store secrets rather than falling back to an
+ * encrypted file. Any such fallback would require a custom encryption key stored
+ * *somewhere*, which recreates the exact "no plaintext anywhere" problem it's
+ * meant to solve. Failing loudly with a clear recovery path is the safe default
+ * required by the brief's UX rule 4, not a limitation to engineer around.
+ */
+export declare function noKeychainBackendError(platform: string, detail: string): SecretError;
+export declare function itemNotFoundError(ref: string): SecretError;
+export declare function notATtyError(): SecretError;
+export declare function promptCancelledError(): SecretError;
+export declare function unrecognizedSecretError(rawOutput: string): SecretError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAC3B,qBAAqB,GACrB,gBAAgB,GAChB,WAAW,GACX,kBAAkB,GAClB,cAAc,CAAC;AAEnB,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;gBAEf,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAM5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CASpF;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAE1D;AAED,wBAAgB,YAAY,IAAI,WAAW,CAM1C;AAED,wBAAgB,oBAAoB,IAAI,WAAW,CAElD;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAMtE"}

package/dist/errors.js

@@ -0,0 +1,43 @@
+export class SecretError extends Error {
+    category;
+    detail;
+    constructor(category, message, detail) {
+        super(message);
+        this.name = 'SecretError';
+        this.category = category;
+        this.detail = detail;
+    }
+}
+/**
+ * Deliberate design decision (see CLAUDE.md Phase D): when no real OS keychain
+ * backend is available (e.g. headless Linux with no Secret Service/D-Bus session
+ * running), Scopewatch refuses to store secrets rather than falling back to an
+ * encrypted file. Any such fallback would require a custom encryption key stored
+ * *somewhere*, which recreates the exact "no plaintext anywhere" problem it's
+ * meant to solve. Failing loudly with a clear recovery path is the safe default
+ * required by the brief's UX rule 4, not a limitation to engineer around.
+ */
+export function noKeychainBackendError(platform, detail) {
+    return new SecretError('no_keychain_backend', `No system keychain backend is available on this ${platform} machine (${detail}). ` +
+        `Scopewatch will not store secrets without a real OS keychain backing them - install ` +
+        `and run a Secret Service provider (e.g. gnome-keyring) within a session that has one, ` +
+        `then retry.`, detail);
+}
+export function itemNotFoundError(ref) {
+    return new SecretError('item_not_found', `No secret found in the system keychain for '${ref}'.`);
+}
+export function notATtyError() {
+    return new SecretError('not_a_tty', `Cannot securely prompt for a secret: stdin is not an interactive terminal. ` +
+        `Run this command directly in a terminal, not piped or redirected.`);
+}
+export function promptCancelledError() {
+    return new SecretError('prompt_cancelled', `Secret entry was cancelled.`);
+}
+export function unrecognizedSecretError(rawOutput) {
+    return new SecretError('unrecognized', `Keychain operation failed with an unrecognized error: ${truncate(rawOutput, 300)}`, rawOutput);
+}
+function truncate(s, max) {
+    const oneLine = s.replace(/\s+/g, ' ').trim();
+    return oneLine.length > max ? oneLine.slice(0, max) + '...' : oneLine;
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAsB;IAC9B,MAAM,CAAqB;IAE3B,YAAY,QAA6B,EAAE,OAAe,EAAE,MAAe;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,MAAc;IACrE,OAAO,IAAI,WAAW,CACpB,qBAAqB,EACrB,mDAAmD,QAAQ,aAAa,MAAM,KAAK;QACjF,sFAAsF;QACtF,wFAAwF;QACxF,aAAa,EACf,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,IAAI,WAAW,CAAC,gBAAgB,EAAE,+CAA+C,GAAG,IAAI,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,WAAW,CACpB,WAAW,EACX,6EAA6E;QAC3E,mEAAmE,CACtE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,WAAW,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,OAAO,IAAI,WAAW,CACpB,cAAc,EACd,yDAAyD,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EACnF,SAAS,CACV,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,GAAW;IACtC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,OAAO,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;AACxE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { secretRef, KEYCHAIN_SERVICE_NAME } from './secret-ref.js';
+export { storeSecret, retrieveSecret, deleteSecret, injectSecrets } from './keychain.js';
+export type { KeychainResult, RetrieveResult } from './keychain.js';
+export { promptSecret } from './prompt.js';
+export type { PromptStreams } from './prompt.js';
+export { createLogger, redact, registerLiveSecret, unregisterLiveSecret, _clearAllLiveSecretsForTesting, } from './logger.js';
+export type { Logger, LogLevel, LogSink } from './logger.js';
+export { SecretError, noKeychainBackendError, itemNotFoundError, notATtyError, promptCancelledError, unrecognizedSecretError, } from './errors.js';
+export type { SecretErrorCategory } from './errors.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,YAAY,EACZ,MAAM,EACN,kBAAkB,EAClB,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export { secretRef, KEYCHAIN_SERVICE_NAME } from './secret-ref.js';
+export { storeSecret, retrieveSecret, deleteSecret, injectSecrets } from './keychain.js';
+export { promptSecret } from './prompt.js';
+export { createLogger, redact, registerLiveSecret, unregisterLiveSecret, _clearAllLiveSecretsForTesting, } from './logger.js';
+export { SecretError, noKeychainBackendError, itemNotFoundError, notATtyError, promptCancelledError, unrecognizedSecretError, } from './errors.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEzF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,YAAY,EACZ,MAAM,EACN,kBAAkB,EAClB,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,aAAa,CAAC"}

package/dist/keychain-linux.d.ts

@@ -0,0 +1,17 @@
+import { SecretError } from './errors.js';
+export type SpawnFn = (command: string, args: string[], options: {
+    input?: string;
+}) => {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    spawnError?: NodeJS.ErrnoException | undefined;
+};
+export declare function linuxStore(ref: string, value: string, spawn?: SpawnFn): SecretError | null;
+export declare function linuxRetrieve(ref: string, spawn?: SpawnFn): {
+    value: string;
+} | {
+    error: SecretError;
+};
+export declare function linuxDelete(ref: string, spawn?: SpawnFn): SecretError | null;
+//# sourceMappingURL=keychain-linux.d.ts.map

package/dist/keychain-linux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-linux.d.ts","sourceRoot":"","sources":["../src/keychain-linux.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE9G,MAAM,MAAM,OAAO,GAAG,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KACxB;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC,cAAc,GAAG,SAAS,CAAA;CAAE,CAAC;AA+B/G,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,OAAsB,GAAG,WAAW,GAAG,IAAI,CAYxG;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,OAAsB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,CAapH;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,OAAsB,GAAG,WAAW,GAAG,IAAI,CAQ1F"}

package/dist/keychain-linux.js

@@ -0,0 +1,62 @@
+import { spawnSync } from 'node:child_process';
+import { KEYCHAIN_SERVICE_NAME } from './secret-ref.js';
+import { itemNotFoundError, noKeychainBackendError, unrecognizedSecretError } from './errors.js';
+const defaultSpawn = (command, args, options) => {
+    const result = spawnSync(command, args, { input: options.input, encoding: 'utf-8' });
+    return {
+        status: result.status,
+        stdout: result.stdout ?? '',
+        stderr: result.stderr ?? '',
+        spawnError: result.error,
+    };
+};
+/**
+ * `secret-tool` (from libsecret-tools) talks to the Secret Service API over
+ * D-Bus. On headless/CI Linux with no Secret Service daemon running (no
+ * gnome-keyring, no D-Bus session), either the binary itself is missing
+ * (ENOENT) or it runs but fails to connect - both are detected here and
+ * produce noKeychainBackendError rather than any file-based fallback (see
+ * errors.ts doc comment: a fallback would require its own encryption key
+ * stored somewhere, recreating the exact problem it claims to solve).
+ */
+function detectNoBackend(result) {
+    if (result.spawnError?.code === 'ENOENT') {
+        return 'secret-tool is not installed (part of the libsecret-tools / libsecret-utils package)';
+    }
+    if (/no such interface|cannot autolaunch|couldn'?t connect|not provided by any \.service|org\.freedesktop\.secrets/i.test(result.stderr)) {
+        return 'no D-Bus Secret Service is running (no gnome-keyring or equivalent available in this session)';
+    }
+    return null;
+}
+export function linuxStore(ref, value, spawn = defaultSpawn) {
+    const result = spawn('secret-tool', ['store', '--label', `scopewatch:${ref}`, 'service', KEYCHAIN_SERVICE_NAME, 'account', ref], { input: `${value}\n` });
+    const backendGap = detectNoBackend(result);
+    if (backendGap)
+        return noKeychainBackendError('Linux', backendGap);
+    if (result.status === 0)
+        return null;
+    return unrecognizedSecretError(result.stderr);
+}
+export function linuxRetrieve(ref, spawn = defaultSpawn) {
+    const result = spawn('secret-tool', ['lookup', 'service', KEYCHAIN_SERVICE_NAME, 'account', ref], {});
+    const backendGap = detectNoBackend(result);
+    if (backendGap)
+        return { error: noKeychainBackendError('Linux', backendGap) };
+    if (result.status === 0 && result.stdout.length > 0) {
+        return { value: result.stdout.replace(/\n$/, '') };
+    }
+    if (result.status !== 0) {
+        return { error: itemNotFoundError(ref) };
+    }
+    return { error: unrecognizedSecretError(result.stderr) };
+}
+export function linuxDelete(ref, spawn = defaultSpawn) {
+    const result = spawn('secret-tool', ['clear', 'service', KEYCHAIN_SERVICE_NAME, 'account', ref], {});
+    const backendGap = detectNoBackend(result);
+    if (backendGap)
+        return noKeychainBackendError('Linux', backendGap);
+    if (result.status === 0)
+        return null;
+    return itemNotFoundError(ref);
+}
+//# sourceMappingURL=keychain-linux.js.map

package/dist/keychain-linux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-linux.js","sourceRoot":"","sources":["../src/keychain-linux.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,uBAAuB,EAAe,MAAM,aAAa,CAAC;AAQ9G,MAAM,YAAY,GAAY,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,UAAU,EAAE,MAAM,CAAC,KAA0C;KAC9D,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,MAAiG;IACxH,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,sFAAsF,CAAC;IAChG,CAAC;IACD,IAAI,gHAAgH,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzI,OAAO,+FAA+F,CAAC;IACzG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,KAAa,EAAE,QAAiB,YAAY;IAClF,MAAM,MAAM,GAAG,KAAK,CAClB,aAAa,EACb,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,GAAG,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,GAAG,CAAC,EAC3F,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,EAAE,CACxB,CAAC;IAEF,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,UAAU;QAAE,OAAO,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAEnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,QAAiB,YAAY;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAEtG,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;IAE9E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,QAAiB,YAAY;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAErG,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,UAAU;QAAE,OAAO,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAEnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC"}

package/dist/keychain-macos.d.ts

@@ -0,0 +1,29 @@
+import { SecretError } from './errors.js';
+/** Injected for testability - avoids spawning the real `security` binary in unit tests. */
+export type SpawnFn = (command: string, args: string[], options: {
+    input?: string;
+}) => {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * Store a secret via macOS Keychain Services, using the `security` CLI.
+ *
+ * CRITICAL: `-w` must be the truly-last token in argv with NO value following
+ * it (confirmed via `security add-generic-password -h`: "Use of the -p or -w
+ * options is insecure. Specify -w as the last option to be prompted."). This
+ * makes `security` read the password from stdin instead (as a confirm+retype
+ * pair, "value\nvalue\n") rather than accepting it as a command-line argument -
+ * verified empirically on this dev machine: `security` with `-w <value>` puts
+ * the value in argv, visible via `ps`/Activity Monitor for the life of the
+ * subprocess; `-w` alone does not. Do not "simplify" this back to `-w <value>`.
+ */
+export declare function macosStore(ref: string, value: string, spawn?: SpawnFn): SecretError | null;
+export declare function macosRetrieve(ref: string, spawn?: SpawnFn): {
+    value: string;
+} | {
+    error: SecretError;
+};
+export declare function macosDelete(ref: string, spawn?: SpawnFn): SecretError | null;
+//# sourceMappingURL=keychain-macos.d.ts.map

package/dist/keychain-macos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-macos.d.ts","sourceRoot":"","sources":["../src/keychain-macos.ts"],"names":[],"mappings":"AAEA,OAAO,EAA8C,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtF,2FAA2F;AAC3F,MAAM,MAAM,OAAO,GAAG,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KACxB;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAO/D;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,OAAsB,GAAG,WAAW,GAAG,IAAI,CASxG;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,OAAsB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,CAUpH;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,OAAsB,GAAG,WAAW,GAAG,IAAI,CAQ1F"}

package/dist/keychain-macos.js

@@ -0,0 +1,45 @@
+import { spawnSync } from 'node:child_process';
+import { KEYCHAIN_SERVICE_NAME } from './secret-ref.js';
+import { itemNotFoundError, unrecognizedSecretError } from './errors.js';
+const defaultSpawn = (command, args, options) => {
+    const result = spawnSync(command, args, { input: options.input, encoding: 'utf-8' });
+    return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+};
+/**
+ * Store a secret via macOS Keychain Services, using the `security` CLI.
+ *
+ * CRITICAL: `-w` must be the truly-last token in argv with NO value following
+ * it (confirmed via `security add-generic-password -h`: "Use of the -p or -w
+ * options is insecure. Specify -w as the last option to be prompted."). This
+ * makes `security` read the password from stdin instead (as a confirm+retype
+ * pair, "value\nvalue\n") rather than accepting it as a command-line argument -
+ * verified empirically on this dev machine: `security` with `-w <value>` puts
+ * the value in argv, visible via `ps`/Activity Monitor for the life of the
+ * subprocess; `-w` alone does not. Do not "simplify" this back to `-w <value>`.
+ */
+export function macosStore(ref, value, spawn = defaultSpawn) {
+    const result = spawn('security', ['add-generic-password', '-a', ref, '-s', KEYCHAIN_SERVICE_NAME, '-U', '-w'], { input: `${value}\n${value}\n` });
+    if (result.status === 0)
+        return null;
+    return unrecognizedSecretError(result.stderr);
+}
+export function macosRetrieve(ref, spawn = defaultSpawn) {
+    const result = spawn('security', ['find-generic-password', '-a', ref, '-s', KEYCHAIN_SERVICE_NAME, '-w'], {});
+    if (result.status === 0) {
+        return { value: result.stdout.replace(/\n$/, '') };
+    }
+    if (/could not be found/i.test(result.stderr)) {
+        return { error: itemNotFoundError(ref) };
+    }
+    return { error: unrecognizedSecretError(result.stderr) };
+}
+export function macosDelete(ref, spawn = defaultSpawn) {
+    const result = spawn('security', ['delete-generic-password', '-a', ref, '-s', KEYCHAIN_SERVICE_NAME], {});
+    if (result.status === 0)
+        return null;
+    if (/could not be found/i.test(result.stderr)) {
+        return itemNotFoundError(ref);
+    }
+    return unrecognizedSecretError(result.stderr);
+}
+//# sourceMappingURL=keychain-macos.js.map

package/dist/keychain-macos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-macos.js","sourceRoot":"","sources":["../src/keychain-macos.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAe,MAAM,aAAa,CAAC;AAStF,MAAM,YAAY,GAAY,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AAC7F,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,KAAa,EAAE,QAAiB,YAAY;IAClF,MAAM,MAAM,GAAG,KAAK,CAClB,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,IAAI,CAAC,EAC5E,EAAE,KAAK,EAAE,GAAG,KAAK,KAAK,KAAK,IAAI,EAAE,CAClC,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,QAAiB,YAAY;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAE9G,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,QAAiB,YAAY;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,qBAAqB,CAAC,EAAE,EAAE,CAAC,CAAC;IAE1G,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC"}

package/dist/keychain-windows.d.ts

@@ -0,0 +1,24 @@
+import { SecretError } from './errors.js';
+/**
+ * IMPORTANT - unverified on real Windows: this repo's development environment
+ * is macOS (Darwin). This implementation is written strictly per the documented
+ * Win32 Credential Manager API contracts (CredWrite/CredRead/CredDelete in
+ * Advapi32.dll) and the standard PowerShell `Add-Type` P/Invoke pattern, but it
+ * has not been executed on a real Windows machine. It must be validated there
+ * before being relied on in production.
+ */
+export type SpawnFn = (command: string, args: string[], options: {
+    input?: string;
+}) => {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+};
+export declare function windowsStore(ref: string, value: string, spawn?: SpawnFn): SecretError | null;
+export declare function windowsRetrieve(ref: string, spawn?: SpawnFn): {
+    value: string;
+} | {
+    error: SecretError;
+};
+export declare function windowsDelete(ref: string, spawn?: SpawnFn): SecretError | null;
+//# sourceMappingURL=keychain-windows.d.ts.map

package/dist/keychain-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-windows.d.ts","sourceRoot":"","sources":["../src/keychain-windows.ts"],"names":[],"mappings":"AAEA,OAAO,EAA8C,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtF;;;;;;;GAOG;AAEH,MAAM,MAAM,OAAO,GAAG,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KACxB;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAgH/D,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,OAAsB,GAAG,WAAW,GAAG,IAAI,CAO1G;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,OAAsB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,CAMtH;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,OAAsB,GAAG,WAAW,GAAG,IAAI,CAM5F"}

package/dist/keychain-windows.js

@@ -0,0 +1,130 @@
+import { spawnSync } from 'node:child_process';
+import { itemNotFoundError, unrecognizedSecretError } from './errors.js';
+const defaultSpawn = (command, args, options) => {
+    const result = spawnSync(command, args, { input: options.input, encoding: 'utf-8' });
+    return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+};
+/**
+ * The P/Invoke glue, shared by store/retrieve/delete. Defined once via
+ * Add-Type so each invocation of powershell.exe only pays the compile cost once
+ * per process. TargetName is passed as a normal -TargetName argument (not
+ * sensitive - it's the "server_id:secret_id" reference, never the value).
+ *
+ * CRITICAL: the secret VALUE must never be interpolated into the -Command
+ * string or any argv element - that would expose it via Task Manager's
+ * "Command line" column / `Get-Process | Select CommandLine`, identically to
+ * the macOS argv exposure this design avoided. The store script instead reads
+ * the value from stdin via [Console]::In.ReadToEnd(), exactly as the macOS
+ * `security -w` (no value) and Linux `secret-tool store` paths do.
+ */
+const CRED_MANAGER_TYPE = `
+Add-Type -Namespace ScopewatchCred -Name Native -MemberDefinition @'
+[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+public struct CREDENTIAL {
+    public int Flags;
+    public int Type;
+    public string TargetName;
+    public string Comment;
+    public long LastWritten;
+    public int CredentialBlobSize;
+    public IntPtr CredentialBlob;
+    public int Persist;
+    public int AttributeCount;
+    public IntPtr Attributes;
+    public string TargetAlias;
+    public string UserName;
+}
+
+[DllImport("Advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+public static extern bool CredWrite(ref CREDENTIAL userCredential, uint flags);
+
+[DllImport("Advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+public static extern bool CredRead(string target, int type, int reservedFlag, out IntPtr credentialPtr);
+
+[DllImport("Advapi32.dll", SetLastError = true)]
+public static extern bool CredDelete(string target, int type, int flags);
+
+[DllImport("Advapi32.dll", SetLastError = true)]
+public static extern bool CredFree(IntPtr credentialPtr);
+'@
+`;
+const CRED_TYPE_GENERIC = 1;
+const CRED_PERSIST_LOCAL_MACHINE = 2;
+function storeScript(ref) {
+    return `
+${CRED_MANAGER_TYPE}
+$secretValue = [Console]::In.ReadToEnd()
+$secretValue = $secretValue.TrimEnd("\`r", "\`n")
+$blobBytes = [System.Text.Encoding]::Unicode.GetBytes($secretValue)
+$blobPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($blobBytes.Length)
+[System.Runtime.InteropServices.Marshal]::Copy($blobBytes, 0, $blobPtr, $blobBytes.Length)
+try {
+  $cred = New-Object ScopewatchCred.Native+CREDENTIAL
+  $cred.Type = ${CRED_TYPE_GENERIC}
+  $cred.TargetName = "${escapePs(ref)}"
+  $cred.CredentialBlobSize = $blobBytes.Length
+  $cred.CredentialBlob = $blobPtr
+  $cred.Persist = ${CRED_PERSIST_LOCAL_MACHINE}
+  $cred.UserName = "scopewatch"
+  $ok = [ScopewatchCred.Native]::CredWrite([ref]$cred, 0)
+  if (-not $ok) { exit 1 }
+} finally {
+  [System.Runtime.InteropServices.Marshal]::FreeHGlobal($blobPtr)
+}
+exit 0
+`;
+}
+function retrieveScript(ref) {
+    return `
+${CRED_MANAGER_TYPE}
+$credPtr = [IntPtr]::Zero
+$ok = [ScopewatchCred.Native]::CredRead("${escapePs(ref)}", ${CRED_TYPE_GENERIC}, 0, [ref]$credPtr)
+if (-not $ok) { exit 2 }
+try {
+  $cred = [System.Runtime.InteropServices.Marshal]::PtrToStructure($credPtr, [type][ScopewatchCred.Native+CREDENTIAL])
+  $bytes = New-Object byte[] $cred.CredentialBlobSize
+  [System.Runtime.InteropServices.Marshal]::Copy($cred.CredentialBlob, $bytes, 0, $cred.CredentialBlobSize)
+  $value = [System.Text.Encoding]::Unicode.GetString($bytes)
+  [Console]::Out.Write($value)
+} finally {
+  [ScopewatchCred.Native]::CredFree($credPtr) | Out-Null
+}
+exit 0
+`;
+}
+function deleteScript(ref) {
+    return `
+${CRED_MANAGER_TYPE}
+$ok = [ScopewatchCred.Native]::CredDelete("${escapePs(ref)}", ${CRED_TYPE_GENERIC}, 0)
+if (-not $ok) { exit 2 }
+exit 0
+`;
+}
+function escapePs(s) {
+    return s.replace(/"/g, '`"');
+}
+export function windowsStore(ref, value, spawn = defaultSpawn) {
+    const result = spawn('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', storeScript(ref)], {
+        input: `${value}\n`,
+    });
+    if (result.status === 0)
+        return null;
+    return unrecognizedSecretError(result.stderr);
+}
+export function windowsRetrieve(ref, spawn = defaultSpawn) {
+    const result = spawn('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', retrieveScript(ref)], {});
+    if (result.status === 0)
+        return { value: result.stdout };
+    if (result.status === 2)
+        return { error: itemNotFoundError(ref) };
+    return { error: unrecognizedSecretError(result.stderr) };
+}
+export function windowsDelete(ref, spawn = defaultSpawn) {
+    const result = spawn('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', deleteScript(ref)], {});
+    if (result.status === 0)
+        return null;
+    if (result.status === 2)
+        return itemNotFoundError(ref);
+    return unrecognizedSecretError(result.stderr);
+}
+//# sourceMappingURL=keychain-windows.js.map

package/dist/keychain-windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-windows.js","sourceRoot":"","sources":["../src/keychain-windows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAe,MAAM,aAAa,CAAC;AAiBtF,MAAM,YAAY,GAAY,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AAC7F,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BzB,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO;EACP,iBAAiB;;;;;;;;iBAQF,iBAAiB;wBACV,QAAQ,CAAC,GAAG,CAAC;;;oBAGjB,0BAA0B;;;;;;;;CAQ7C,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO;EACP,iBAAiB;;2CAEwB,QAAQ,CAAC,GAAG,CAAC,MAAM,iBAAiB;;;;;;;;;;;;CAY9E,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO;EACP,iBAAiB;6CAC0B,QAAQ,CAAC,GAAG,CAAC,MAAM,iBAAiB;;;CAGhF,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,KAAa,EAAE,QAAiB,YAAY;IACpF,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE;QACtG,KAAK,EAAE,GAAG,KAAK,IAAI;KACpB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,QAAiB,YAAY;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE/G,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,OAAO,EAAE,KAAK,EAAE,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,QAAiB,YAAY;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE7G,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvD,OAAO,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC"}

package/dist/keychain.d.ts

@@ -0,0 +1,44 @@
+import type { SecretError } from './errors.js';
+export type KeychainResult = {
+    ok: true;
+} | {
+    ok: false;
+    error: SecretError;
+};
+export type RetrieveResult = {
+    ok: true;
+    value: string;
+} | {
+    ok: false;
+    error: SecretError;
+};
+export declare function storeSecret(ref: string, value: string): KeychainResult;
+/**
+ * Retrieve a secret and register it for log redaction in the same call. The
+ * registration happens in a finally block around the platform-specific
+ * retrieval: if a value was actually obtained, it is guaranteed to be
+ * registered even if something else in this function throws afterward - a
+ * later log line can never mention a raw value that was successfully
+ * retrieved but not yet protected.
+ */
+export declare function retrieveSecret(ref: string): RetrieveResult;
+export declare function deleteSecret(ref: string): KeychainResult;
+/**
+ * Retrieve multiple secrets for injection into a spawned server process's env.
+ * Each retrieval is independently registered for redaction (via retrieveSecret's
+ * own finally block) BEFORE this function's loop can move to the next ref or
+ * throw - so if retrieving secret #2 fails, secret #1's value (already
+ * retrieved) is still protected, not skipped because the batch as a whole
+ * later errors.
+ */
+export declare function injectSecrets(refs: {
+    envVar: string;
+    ref: string;
+}[]): {
+    ok: true;
+    env: Record<string, string>;
+} | {
+    ok: false;
+    error: SecretError;
+};
+//# sourceMappingURL=keychain.d.ts.map

package/dist/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,MAAM,cAAc,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AAC9E,MAAM,MAAM,cAAc,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AAM7F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,CAMtE;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAc1D;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAKxD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAYpJ"}

package/dist/keychain.js

@@ -0,0 +1,61 @@
+import { macosStore, macosRetrieve, macosDelete } from './keychain-macos.js';
+import { linuxStore, linuxRetrieve, linuxDelete } from './keychain-linux.js';
+import { windowsStore, windowsRetrieve, windowsDelete } from './keychain-windows.js';
+import { registerLiveSecret } from './logger.js';
+function platform() {
+    return process.platform;
+}
+export function storeSecret(ref, value) {
+    const p = platform();
+    const error = p === 'darwin' ? macosStore(ref, value) : p === 'linux' ? linuxStore(ref, value) : windowsStore(ref, value);
+    return error ? { ok: false, error } : { ok: true };
+}
+/**
+ * Retrieve a secret and register it for log redaction in the same call. The
+ * registration happens in a finally block around the platform-specific
+ * retrieval: if a value was actually obtained, it is guaranteed to be
+ * registered even if something else in this function throws afterward - a
+ * later log line can never mention a raw value that was successfully
+ * retrieved but not yet protected.
+ */
+export function retrieveSecret(ref) {
+    const p = platform();
+    let value;
+    try {
+        const result = p === 'darwin' ? macosRetrieve(ref) : p === 'linux' ? linuxRetrieve(ref) : windowsRetrieve(ref);
+        if ('error' in result) {
+            return { ok: false, error: result.error };
+        }
+        value = result.value;
+        return { ok: true, value: result.value };
+    }
+    finally {
+        if (value !== undefined)
+            registerLiveSecret(value);
+    }
+}
+export function deleteSecret(ref) {
+    const p = platform();
+    const error = p === 'darwin' ? macosDelete(ref) : p === 'linux' ? linuxDelete(ref) : windowsDelete(ref);
+    return error ? { ok: false, error } : { ok: true };
+}
+/**
+ * Retrieve multiple secrets for injection into a spawned server process's env.
+ * Each retrieval is independently registered for redaction (via retrieveSecret's
+ * own finally block) BEFORE this function's loop can move to the next ref or
+ * throw - so if retrieving secret #2 fails, secret #1's value (already
+ * retrieved) is still protected, not skipped because the batch as a whole
+ * later errors.
+ */
+export function injectSecrets(refs) {
+    const env = {};
+    for (const { envVar, ref } of refs) {
+        const result = retrieveSecret(ref);
+        if (!result.ok) {
+            return { ok: false, error: result.error };
+        }
+        env[envVar] = result.value;
+    }
+    return { ok: true, env };
+}
+//# sourceMappingURL=keychain.js.map

package/dist/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAMjD,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,KAAa;IACpD,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,MAAM,KAAK,GACT,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE9G,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,KAAyB,CAAC;IAE9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC/G,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAExG,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAuC;IACnE,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,KAAK,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC"}

package/dist/logger.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Redaction-first structured logger. No logging module existed anywhere in the
+ * codebase before this - built fresh with redaction as a first-class feature,
+ * not retrofitted onto an existing logger.
+ *
+ * Redaction works by content, not by key name: any string that is currently
+ * registered as a "live secret value" gets replaced with [REDACTED] wherever it
+ * appears in a log line, including inside unrelated text (e.g. an error message
+ * that happens to embed the value) - not just when logged under an obviously
+ * secret-sounding field name.
+ *
+ * A short substring of unrelated log text can occasionally be over-redacted if
+ * it happens to match a live secret value. That's the safe failure direction
+ * (over-redaction, not under-redaction) and is accepted as-is.
+ */
+/** Register a value for redaction in all subsequent log output. Idempotent. */
+export declare function registerLiveSecret(value: string): void;
+/** Stop redacting a value (e.g. once a process using it has exited). */
+export declare function unregisterLiveSecret(value: string): void;
+/** Exposed for tests only - never call in production code paths. */
+export declare function _clearAllLiveSecretsForTesting(): void;
+export declare function redact(text: string): string;
+export type LogLevel = 'info' | 'warn' | 'error';
+export type LogSink = (level: LogLevel, line: string) => void;
+export type Logger = {
+    info: (...args: unknown[]) => void;
+    warn: (...args: unknown[]) => void;
+    error: (...args: unknown[]) => void;
+};
+/** Create a logger. Pass a custom sink for testing (capture output without touching real stdout/stderr). */
+export declare function createLogger(sink?: LogSink): Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEtD;AAED,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO3C;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,MAAM,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAE9D,MAAM,MAAM,MAAM,GAAG;IACnB,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACnC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACnC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACrC,CAAC;AAUF,4GAA4G;AAC5G,wBAAgB,YAAY,CAAC,IAAI,GAAE,OAAqB,GAAG,MAAM,CAahE"}

package/dist/logger.js

@@ -0,0 +1,69 @@
+/**
+ * Redaction-first structured logger. No logging module existed anywhere in the
+ * codebase before this - built fresh with redaction as a first-class feature,
+ * not retrofitted onto an existing logger.
+ *
+ * Redaction works by content, not by key name: any string that is currently
+ * registered as a "live secret value" gets replaced with [REDACTED] wherever it
+ * appears in a log line, including inside unrelated text (e.g. an error message
+ * that happens to embed the value) - not just when logged under an obviously
+ * secret-sounding field name.
+ *
+ * A short substring of unrelated log text can occasionally be over-redacted if
+ * it happens to match a live secret value. That's the safe failure direction
+ * (over-redaction, not under-redaction) and is accepted as-is.
+ */
+const liveSecrets = new Set();
+/** Register a value for redaction in all subsequent log output. Idempotent. */
+export function registerLiveSecret(value) {
+    if (value.length > 0)
+        liveSecrets.add(value);
+}
+/** Stop redacting a value (e.g. once a process using it has exited). */
+export function unregisterLiveSecret(value) {
+    liveSecrets.delete(value);
+}
+/** Exposed for tests only - never call in production code paths. */
+export function _clearAllLiveSecretsForTesting() {
+    liveSecrets.clear();
+}
+export function redact(text) {
+    let result = text;
+    for (const secret of liveSecrets) {
+        if (secret.length === 0)
+            continue;
+        result = result.split(secret).join('[REDACTED]');
+    }
+    return result;
+}
+const defaultSink = (level, line) => {
+    if (level === 'error') {
+        process.stderr.write(line + '\n');
+    }
+    else {
+        process.stdout.write(line + '\n');
+    }
+};
+/** Create a logger. Pass a custom sink for testing (capture output without touching real stdout/stderr). */
+export function createLogger(sink = defaultSink) {
+    const write = (level, args) => {
+        const rendered = args
+            .map((a) => (typeof a === 'string' ? a : safeStringify(a)))
+            .join(' ');
+        sink(level, redact(rendered));
+    };
+    return {
+        info: (...args) => write('info', args),
+        warn: (...args) => write('warn', args),
+        error: (...args) => write('error', args),
+    };
+}
+function safeStringify(value) {
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;AAEtC,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,8BAA8B;IAC5C,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAYD,MAAM,WAAW,GAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IAC3C,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC;AAEF,4GAA4G;AAC5G,MAAM,UAAU,YAAY,CAAC,OAAgB,WAAW;IACtD,MAAM,KAAK,GAAG,CAAC,KAAe,EAAE,IAAe,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,IAAI;aAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;aAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;QACtC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;QACtC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/prompt.d.ts

@@ -0,0 +1,19 @@
+export type PromptStreams = {
+    input: NodeJS.ReadableStream & {
+        isTTY?: boolean;
+    };
+    output: NodeJS.WritableStream;
+};
+/**
+ * Securely prompt for a secret value: no terminal echo, and the value never
+ * appears on the command line or in shell history (it's only ever read as
+ * stdin during this interactive prompt).
+ *
+ * Requires a real TTY on stdin by default (checked via `isTTY`) - a non-TTY
+ * context (piped/redirected input) is refused rather than silently read some
+ * other way, since that would be an unaudited path that could bypass the
+ * "never printed/logged" guarantee this function exists to provide. Tests
+ * inject streams explicitly instead of relying on isTTY.
+ */
+export declare function promptSecret(message: string, streams?: PromptStreams): Promise<string>;
+//# sourceMappingURL=prompt.d.ts.map

package/dist/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC,cAAc,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACnD,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCtF"}

package/dist/prompt.js

@@ -0,0 +1,52 @@
+import * as readline from 'node:readline';
+import { Writable } from 'node:stream';
+import { notATtyError, promptCancelledError } from './errors.js';
+/**
+ * Securely prompt for a secret value: no terminal echo, and the value never
+ * appears on the command line or in shell history (it's only ever read as
+ * stdin during this interactive prompt).
+ *
+ * Requires a real TTY on stdin by default (checked via `isTTY`) - a non-TTY
+ * context (piped/redirected input) is refused rather than silently read some
+ * other way, since that would be an unaudited path that could bypass the
+ * "never printed/logged" guarantee this function exists to provide. Tests
+ * inject streams explicitly instead of relying on isTTY.
+ */
+export function promptSecret(message, streams) {
+    const input = streams?.input ?? process.stdin;
+    const output = streams?.output ?? process.stdout;
+    if (!streams && !process.stdin.isTTY) {
+        return Promise.reject(notATtyError());
+    }
+    return new Promise((resolve, reject) => {
+        // Mute the output stream's echo of typed characters while still allowing
+        // the prompt message itself to be written.
+        let muted = false;
+        const mutableOutput = new Writable({
+            write(chunk, _enc, callback) {
+                if (!muted)
+                    output.write(chunk);
+                callback();
+            },
+        });
+        const rl = readline.createInterface({
+            input,
+            output: mutableOutput,
+            terminal: true,
+        });
+        output.write(message);
+        muted = true;
+        rl.question('', (answer) => {
+            muted = false;
+            rl.close();
+            output.write('\n');
+            if (answer.length === 0) {
+                reject(promptCancelledError());
+            }
+            else {
+                resolve(answer);
+            }
+        });
+    });
+}
+//# sourceMappingURL=prompt.js.map

package/dist/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAOjE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,OAAuB;IACnE,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAEjD,IAAI,CAAC,OAAO,IAAI,CAAE,OAAO,CAAC,KAAa,CAAC,KAAK,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,yEAAyE;QACzE,2CAA2C;QAC3C,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,MAAM,aAAa,GAAG,IAAI,QAAQ,CAAC;YACjC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ;gBACzB,IAAI,CAAC,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAChC,QAAQ,EAAE,CAAC;YACb,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK;YACL,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtB,KAAK,GAAG,IAAI,CAAC;QAEb,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;YACzB,KAAK,GAAG,KAAK,CAAC;YACd,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/secret-ref.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The single code path allowed to construct a keychain account reference.
+ * Composite (server_id:secret_id) because the same secret id (e.g. "GITHUB_TOKEN")
+ * could otherwise collide across two unrelated servers that happen to name their
+ * secret the same thing. Store, retrieve, and delete must all go through this -
+ * never construct the string inline elsewhere, or store-time and lookup-time
+ * keys can silently drift apart.
+ */
+export declare function secretRef(server_id: string, secret_id: string): string;
+export declare const KEYCHAIN_SERVICE_NAME = "scopewatch";
+//# sourceMappingURL=secret-ref.d.ts.map

package/dist/secret-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-ref.d.ts","sourceRoot":"","sources":["../src/secret-ref.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED,eAAO,MAAM,qBAAqB,eAAe,CAAC"}

package/dist/secret-ref.js

@@ -0,0 +1,13 @@
+/**
+ * The single code path allowed to construct a keychain account reference.
+ * Composite (server_id:secret_id) because the same secret id (e.g. "GITHUB_TOKEN")
+ * could otherwise collide across two unrelated servers that happen to name their
+ * secret the same thing. Store, retrieve, and delete must all go through this -
+ * never construct the string inline elsewhere, or store-time and lookup-time
+ * keys can silently drift apart.
+ */
+export function secretRef(server_id, secret_id) {
+    return `${server_id}:${secret_id}`;
+}
+export const KEYCHAIN_SERVICE_NAME = 'scopewatch';
+//# sourceMappingURL=secret-ref.js.map

package/dist/secret-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-ref.js","sourceRoot":"","sources":["../src/secret-ref.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,SAAiB;IAC5D,OAAO,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC"}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@scopewatch/secrets",
+  "version": "0.0.1",
+  "description": "OS keychain abstraction, secure secret prompt, and redaction-first logging",
+  "license": "MIT",
+  "author": "Sathvik Putta <puttasathvik16@gmail.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PuttaSathvik16/scopewatch.git",
+    "directory": "packages/secrets"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "node --import tsx --test 'test/**/*.test.ts'",
+    "clean": "rm -rf dist"
+  },
+  "devDependencies": {
+    "@scopewatch/state": "0.0.1",
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0",
+    "tsx": "^4.19.0"
+  }
+}