@signetai/core 0.204.1 → 0.204.2

package/dist/llm-model-catalog.js

@@ -30,6 +30,20 @@ var __toESM = (mod, isNodeMode, target) => {
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/llm-model-catalog.ts

package/dist/pipeline-providers.js

@@ -30,6 +30,20 @@ var __toESM = (mod, isNodeMode, target) => {
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/llm-model-catalog.ts

package/dist/recall.js

@@ -30,6 +30,20 @@ var __toESM = (mod, isNodeMode, target) => {
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/recall.ts

package/dist/secrets-keyring.d.ts

@@ -0,0 +1,18 @@
+export type SecretKeyringState = "found" | "missing" | "locked" | "unavailable" | "permission-denied" | "corrupt" | "unsupported";
+export interface SecretKeyringResult {
+    readonly state: SecretKeyringState;
+    readonly value?: string;
+    readonly message?: string;
+}
+export interface SecretKeyringAdapter {
+    readonly platform: string;
+    readonly service: string;
+    readonly account: string;
+    get(): Promise<SecretKeyringResult>;
+    set(value: string): Promise<SecretKeyringResult>;
+    getStatus?(): SecretKeyringResult;
+}
+export declare function getSecretKeyring(workspace: string): SecretKeyringAdapter;
+export declare function setSecretKeyringForTests(adapter: SecretKeyringAdapter | null): void;
+export declare function resetSecretKeyringModuleForTests(): void;
+//# sourceMappingURL=secrets-keyring.d.ts.map

package/dist/secrets-keyring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-keyring.d.ts","sourceRoot":"","sources":["../src/secrets-keyring.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,kBAAkB,GAC3B,OAAO,GACP,SAAS,GACT,QAAQ,GACR,aAAa,GACb,mBAAmB,GACnB,SAAS,GACT,aAAa,CAAC;AAEjB,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,GAAG,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACpC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,SAAS,CAAC,IAAI,mBAAmB,CAAC;CAClC;AA4ID,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,CAExE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAInF;AAED,wBAAgB,gCAAgC,IAAI,IAAI,CAGvD"}

package/dist/secrets.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Shared secrets storage and execution primitives.
+ *
+ * This module is intentionally daemon-independent so the CLI can use the same
+ * encrypted store when no daemon is running.
+ */
+import { type SecretKeyringAdapter, type SecretKeyringResult, type SecretKeyringState } from "./secrets-keyring.js";
+export type SecretEventRecorder = (event: string, data: Record<string, unknown>) => void;
+export declare function setSecretEventRecorder(recorder: SecretEventRecorder | null): void;
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    code: number;
+    timedOut?: boolean;
+}
+export interface SecretExecOptions {
+    timeoutMs?: number;
+    maxOutputBytes?: number;
+}
+export type SecretExecJobStatus = "queued" | "running" | "completed" | "failed";
+export interface SecretExecJob {
+    id: string;
+    status: SecretExecJobStatus;
+    createdAt: string;
+    startedAt?: string;
+    completedAt?: string;
+    timeoutMs: number;
+    result?: ExecResult;
+    error?: string;
+}
+export interface SecretContextV1 {
+    readonly agentId?: string;
+}
+export interface SecretDescriptorV1 {
+    readonly name: string;
+    readonly ref: string;
+    readonly providerId: string;
+    readonly created: string;
+    readonly updated: string;
+}
+export interface ResolvedSecretV1 {
+    readonly ref: string;
+    readonly providerId: string;
+    readonly value: string;
+}
+export interface SecretProviderHealthV1 {
+    readonly status: "healthy" | "degraded" | "unhealthy";
+    readonly message?: string;
+    readonly checkedAt: string;
+}
+export interface SecretProviderV1 {
+    readonly id: string;
+    list(ctx: SecretContextV1): Promise<readonly SecretDescriptorV1[]>;
+    put(name: string, value: string, ctx: SecretContextV1): Promise<void>;
+    delete(name: string, ctx: SecretContextV1): Promise<boolean>;
+    resolve(ref: string, ctx: SecretContextV1): Promise<ResolvedSecretV1>;
+    health(ctx: SecretContextV1): Promise<SecretProviderHealthV1>;
+}
+type MachineIdResolver = () => string | undefined;
+export declare class SecretKeyringError extends Error {
+    readonly state: SecretKeyringState;
+    readonly retryable: boolean;
+    constructor(result: SecretKeyringResult);
+}
+export declare function setMachineIdResolverForTests(resolver: MachineIdResolver | null): void;
+export declare function setSecretKeyringAdapterForTests(adapter: SecretKeyringAdapter | null): void;
+type SecretStoreWriteStage = "after-write" | "before-close";
+type SecretStoreWriteHookForTests = (stage: SecretStoreWriteStage, fd?: number) => void;
+/** @internal Inject a failure or process kill while testing atomic store replacement. */
+export declare function __setSecretStoreWriteHookForTests(hook: SecretStoreWriteHookForTests | null): void;
+type SecretStoreLockHookStage = "after-acquire" | "after-stale-check";
+type SecretStoreLockHookForTests = (stage: SecretStoreLockHookStage) => void;
+/** @internal Pause an acquired lock in a child-process race regression test. */
+export declare function __setSecretStoreLockHookForTests(hook: SecretStoreLockHookForTests | null): void;
+export declare function putLocalSecret(name: string, value: string): Promise<void>;
+export declare function getLocalSecretValue(name: string): Promise<string>;
+export declare function hasLocalSecret(name: string): boolean;
+export declare function hasSecret(name: string): boolean;
+export declare function listLocalSecretNames(options?: {
+    includeInternal?: boolean;
+}): string[];
+export declare function deleteLocalSecret(name: string): Promise<boolean>;
+export type LocalSecretProviderV1 = SecretProviderV1;
+export declare const localSecretProvider: LocalSecretProviderV1;
+export declare function getLocalSecretProviderHealth(): SecretProviderHealthV1;
+/**
+ * Spawn a subprocess with one or more secrets injected as environment
+ * variables. The agent only supplies references (env var names), never
+ * the actual values.
+ *
+ * Uses direct argv execution (no shell) to eliminate glob/tilde/pipe
+ * expansion. The command string is parsed into argv tokens.
+ *
+ * @param command  Command string to execute (parsed as argv, no shell)
+ * @param secretRefs  Map of env var name → secret name, e.g. { OPENAI_API_KEY: "OPENAI_API_KEY" }
+ */
+export declare function execWithSecrets(command: string, secretRefs: Record<string, string>, options?: SecretExecOptions): Promise<ExecResult>;
+export declare function normalizeSecretExecTimeoutMs(value: unknown): number;
+export declare function parseLocalSecretName(ref: string): string;
+export {};
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAsBH,OAAO,EAGN,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;AAEzF,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAEjF;AAyCD,MAAM,WAAW,UAAU;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEhF,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,mBAAmB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAQD,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;IACnE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC9D;AAMD,KAAK,iBAAiB,GAAG,MAAM,MAAM,GAAG,SAAS,CAAC;AAqElD,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,MAAM,EAAE,mBAAmB;CAMvC;AAoED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAGrF;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAG1F;AA+MD,KAAK,qBAAqB,GAAG,aAAa,GAAG,cAAc,CAAC;AAC5D,KAAK,4BAA4B,GAAG,CAAC,KAAK,EAAE,qBAAqB,EAAE,EAAE,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AAGxF,yFAAyF;AACzF,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,4BAA4B,GAAG,IAAI,GAAG,IAAI,CAEjG;AAwCD,KAAK,wBAAwB,GAAG,eAAe,GAAG,mBAAmB,CAAC;AACtE,KAAK,2BAA2B,GAAG,CAAC,KAAK,EAAE,wBAAwB,KAAK,IAAI,CAAC;AAG7E,gFAAgF;AAChF,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,GAAG,IAAI,CAE/F;AAqND,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B/E;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWvE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED,wBAAgB,oBAAoB,CAAC,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,EAAE,CAI1F;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUtE;AAYD,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAErD,eAAO,MAAM,mBAAmB,EAAE,qBAiCjC,CAAC;AAmBF,wBAAgB,4BAA4B,IAAI,sBAAsB,CAkCrE;AAOD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACpC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAsLrB;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGnE;AAmBD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIxD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signetai/core",
-  "version": "0.204.1",
+  "version": "0.204.2",
   "license": "Apache-2.0",
   "description": "Core library for Signet - portable AI agent identity",
   "type": "module",
@@ -37,6 +37,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@napi-rs/keyring": "1.3.0",
+    "libsodium-wrappers": "^0.8.2",
     "sqlite-vec": "^0.1.7-alpha.2",
     "yaml": "^2.6.0"
   },
@@ -50,6 +52,7 @@
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.0",
+    "@types/libsodium-wrappers": "^0.8.2",
     "@types/node": "^22.0.0",
     "typescript": "^5.7.0",
     "@signet/native": "workspace:*"