@sriinnu/runic 2.0.0 → 2.11.1

package/Sources/Runic/Core/Stores/AuggieTokenStore.swift

@@ -1,117 +0,0 @@
-import Foundation
-import RunicCore
-import Security
-
-protocol AuggieTokenStoring: Sendable {
-    func loadToken() throws -> String?
-    func storeToken(_ token: String?) throws
-}
-
-enum AuggieTokenStoreError: LocalizedError {
-    case keychainStatus(OSStatus)
-    case invalidData
-
-    var errorDescription: String? {
-        switch self {
-        case let .keychainStatus(status):
-            "Keychain error: \(status)"
-        case .invalidData:
-            "Keychain returned invalid data."
-        }
-    }
-}
-
-struct KeychainAuggieTokenStore: AuggieTokenStoring {
-    private static let log = RunicLog.logger("auggie-token-store")
-
-    private let service = "com.sriinnu.athena.Runic"
-    private let account = "auggie-api-token"
-
-    func loadToken() throws -> String? {
-        // Try standard keychain first.
-        if let token = try self.readToken(dataProtection: false) {
-            return token
-        }
-        // Migrate from the old Data Protection keychain if present.
-        if let token = try self.readToken(dataProtection: true) {
-            Self.log.info("Migrating Auggie token from Data Protection keychain")
-            // Store first, delete old only on success — prevents data loss.
-            if (try? self.storeToken(token)) != nil {
-                try? self.deleteToken(dataProtection: true)
-            }
-            return token
-        }
-        return nil
-    }
-
-    func storeToken(_ token: String?) throws {
-        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
-        if cleaned == nil || cleaned?.isEmpty == true {
-            try? self.deleteToken(dataProtection: false)
-            try? self.deleteToken(dataProtection: true)
-            return
-        }
-
-        let data = cleaned!.data(using: .utf8)!
-
-        // Always delete-then-add to ensure SecAccess ACL is set.
-        // SecItemUpdate does NOT update the ACL, so existing items with
-        // missing or stale ACLs would continue to prompt for passwords.
-        try? self.deleteToken(dataProtection: false)
-        try? self.deleteToken(dataProtection: true)
-
-        var addQuery = self.baseQuery(dataProtection: false)
-        addQuery[kSecValueData as String] = data
-        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
-
-        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
-        guard addStatus == errSecSuccess else {
-            Self.log.error("Keychain add failed: \(addStatus)")
-            throw AuggieTokenStoreError.keychainStatus(addStatus)
-        }
-    }
-
-    // MARK: - Private
-
-    private func readToken(dataProtection: Bool) throws -> String? {
-        var result: CFTypeRef?
-        var query = self.baseQuery(dataProtection: dataProtection)
-        query[kSecMatchLimit as String] = kSecMatchLimitOne
-        query[kSecReturnData as String] = true
-        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
-
-        let status = SecItemCopyMatching(query as CFDictionary, &result)
-        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
-            return nil
-        }
-        guard status == errSecSuccess else {
-            Self.log.error("Keychain read failed: \(status)")
-            throw AuggieTokenStoreError.keychainStatus(status)
-        }
-        guard let data = result as? Data else {
-            throw AuggieTokenStoreError.invalidData
-        }
-        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
-        return (token?.isEmpty ?? true) ? nil : token
-    }
-
-    private func deleteToken(dataProtection: Bool) throws {
-        let query = self.baseQuery(dataProtection: dataProtection)
-        let status = SecItemDelete(query as CFDictionary)
-        if status == errSecSuccess || status == errSecItemNotFound { return }
-        Self.log.error("Keychain delete failed: \(status)")
-        throw AuggieTokenStoreError.keychainStatus(status)
-    }
-
-    private func baseQuery(dataProtection: Bool) -> [String: Any] {
-        var q: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: self.service,
-            kSecAttrAccount as String: self.account,
-        ]
-        if dataProtection {
-            q[kSecUseDataProtectionKeychain as String] = true
-        }
-        return q
-    }
-}

package/Sources/Runic/Core/Stores/AzureOpenAITokenStore.swift

@@ -1,117 +0,0 @@
-import Foundation
-import RunicCore
-import Security
-
-protocol AzureOpenAITokenStoring: Sendable {
-    func loadToken() throws -> String?
-    func storeToken(_ token: String?) throws
-}
-
-enum AzureOpenAITokenStoreError: LocalizedError {
-    case keychainStatus(OSStatus)
-    case invalidData
-
-    var errorDescription: String? {
-        switch self {
-        case let .keychainStatus(status):
-            "Keychain error: \(status)"
-        case .invalidData:
-            "Keychain returned invalid data."
-        }
-    }
-}
-
-struct KeychainAzureOpenAITokenStore: AzureOpenAITokenStoring {
-    private static let log = RunicLog.logger("azure-openai-token-store")
-
-    private let service = "com.sriinnu.athena.Runic"
-    private let account = "azure-openai-api-token"
-
-    func loadToken() throws -> String? {
-        // Try standard keychain first.
-        if let token = try self.readToken(dataProtection: false) {
-            return token
-        }
-        // Migrate from the old Data Protection keychain if present.
-        if let token = try self.readToken(dataProtection: true) {
-            Self.log.info("Migrating Azure OpenAI token from Data Protection keychain")
-            // Store first, delete old only on success — prevents data loss.
-            if (try? self.storeToken(token)) != nil {
-                try? self.deleteToken(dataProtection: true)
-            }
-            return token
-        }
-        return nil
-    }
-
-    func storeToken(_ token: String?) throws {
-        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
-        if cleaned == nil || cleaned?.isEmpty == true {
-            try? self.deleteToken(dataProtection: false)
-            try? self.deleteToken(dataProtection: true)
-            return
-        }
-
-        let data = cleaned!.data(using: .utf8)!
-
-        // Always delete-then-add to ensure SecAccess ACL is set.
-        // SecItemUpdate does NOT update the ACL, so existing items with
-        // missing or stale ACLs would continue to prompt for passwords.
-        try? self.deleteToken(dataProtection: false)
-        try? self.deleteToken(dataProtection: true)
-
-        var addQuery = self.baseQuery(dataProtection: false)
-        addQuery[kSecValueData as String] = data
-        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
-
-        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
-        guard addStatus == errSecSuccess else {
-            Self.log.error("Keychain add failed: \(addStatus)")
-            throw AzureOpenAITokenStoreError.keychainStatus(addStatus)
-        }
-    }
-
-    // MARK: - Private
-
-    private func readToken(dataProtection: Bool) throws -> String? {
-        var result: CFTypeRef?
-        var query = self.baseQuery(dataProtection: dataProtection)
-        query[kSecMatchLimit as String] = kSecMatchLimitOne
-        query[kSecReturnData as String] = true
-        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
-
-        let status = SecItemCopyMatching(query as CFDictionary, &result)
-        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
-            return nil
-        }
-        guard status == errSecSuccess else {
-            Self.log.error("Keychain read failed: \(status)")
-            throw AzureOpenAITokenStoreError.keychainStatus(status)
-        }
-        guard let data = result as? Data else {
-            throw AzureOpenAITokenStoreError.invalidData
-        }
-        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
-        return (token?.isEmpty ?? true) ? nil : token
-    }
-
-    private func deleteToken(dataProtection: Bool) throws {
-        let query = self.baseQuery(dataProtection: dataProtection)
-        let status = SecItemDelete(query as CFDictionary)
-        if status == errSecSuccess || status == errSecItemNotFound { return }
-        Self.log.error("Keychain delete failed: \(status)")
-        throw AzureOpenAITokenStoreError.keychainStatus(status)
-    }
-
-    private func baseQuery(dataProtection: Bool) -> [String: Any] {
-        var q: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: self.service,
-            kSecAttrAccount as String: self.account,
-        ]
-        if dataProtection {
-            q[kSecUseDataProtectionKeychain as String] = true
-        }
-        return q
-    }
-}

package/Sources/Runic/Core/Stores/CerebrasTokenStore.swift

@@ -1,117 +0,0 @@
-import Foundation
-import RunicCore
-import Security
-
-protocol CerebrasTokenStoring: Sendable {
-    func loadToken() throws -> String?
-    func storeToken(_ token: String?) throws
-}
-
-enum CerebrasTokenStoreError: LocalizedError {
-    case keychainStatus(OSStatus)
-    case invalidData
-
-    var errorDescription: String? {
-        switch self {
-        case let .keychainStatus(status):
-            "Keychain error: \(status)"
-        case .invalidData:
-            "Keychain returned invalid data."
-        }
-    }
-}
-
-struct KeychainCerebrasTokenStore: CerebrasTokenStoring {
-    private static let log = RunicLog.logger("cerebras-token-store")
-
-    private let service = "com.sriinnu.athena.Runic"
-    private let account = "cerebras-api-token"
-
-    func loadToken() throws -> String? {
-        // Try standard keychain first.
-        if let token = try self.readToken(dataProtection: false) {
-            return token
-        }
-        // Migrate from the old Data Protection keychain if present.
-        if let token = try self.readToken(dataProtection: true) {
-            Self.log.info("Migrating Cerebras token from Data Protection keychain")
-            // Store first, delete old only on success — prevents data loss.
-            if (try? self.storeToken(token)) != nil {
-                try? self.deleteToken(dataProtection: true)
-            }
-            return token
-        }
-        return nil
-    }
-
-    func storeToken(_ token: String?) throws {
-        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
-        if cleaned == nil || cleaned?.isEmpty == true {
-            try? self.deleteToken(dataProtection: false)
-            try? self.deleteToken(dataProtection: true)
-            return
-        }
-
-        let data = cleaned!.data(using: .utf8)!
-
-        // Always delete-then-add to ensure SecAccess ACL is set.
-        // SecItemUpdate does NOT update the ACL, so existing items with
-        // missing or stale ACLs would continue to prompt for passwords.
-        try? self.deleteToken(dataProtection: false)
-        try? self.deleteToken(dataProtection: true)
-
-        var addQuery = self.baseQuery(dataProtection: false)
-        addQuery[kSecValueData as String] = data
-        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
-
-        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
-        guard addStatus == errSecSuccess else {
-            Self.log.error("Keychain add failed: \(addStatus)")
-            throw CerebrasTokenStoreError.keychainStatus(addStatus)
-        }
-    }
-
-    // MARK: - Private
-
-    private func readToken(dataProtection: Bool) throws -> String? {
-        var result: CFTypeRef?
-        var query = self.baseQuery(dataProtection: dataProtection)
-        query[kSecMatchLimit as String] = kSecMatchLimitOne
-        query[kSecReturnData as String] = true
-        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
-
-        let status = SecItemCopyMatching(query as CFDictionary, &result)
-        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
-            return nil
-        }
-        guard status == errSecSuccess else {
-            Self.log.error("Keychain read failed: \(status)")
-            throw CerebrasTokenStoreError.keychainStatus(status)
-        }
-        guard let data = result as? Data else {
-            throw CerebrasTokenStoreError.invalidData
-        }
-        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
-        return (token?.isEmpty ?? true) ? nil : token
-    }
-
-    private func deleteToken(dataProtection: Bool) throws {
-        let query = self.baseQuery(dataProtection: dataProtection)
-        let status = SecItemDelete(query as CFDictionary)
-        if status == errSecSuccess || status == errSecItemNotFound { return }
-        Self.log.error("Keychain delete failed: \(status)")
-        throw CerebrasTokenStoreError.keychainStatus(status)
-    }
-
-    private func baseQuery(dataProtection: Bool) -> [String: Any] {
-        var q: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: self.service,
-            kSecAttrAccount as String: self.account,
-        ]
-        if dataProtection {
-            q[kSecUseDataProtectionKeychain as String] = true
-        }
-        return q
-    }
-}

package/Sources/Runic/Core/Stores/CohereTokenStore.swift

@@ -1,117 +0,0 @@
-import Foundation
-import RunicCore
-import Security
-
-protocol CohereTokenStoring: Sendable {
-    func loadToken() throws -> String?
-    func storeToken(_ token: String?) throws
-}
-
-enum CohereTokenStoreError: LocalizedError {
-    case keychainStatus(OSStatus)
-    case invalidData
-
-    var errorDescription: String? {
-        switch self {
-        case let .keychainStatus(status):
-            "Keychain error: \(status)"
-        case .invalidData:
-            "Keychain returned invalid data."
-        }
-    }
-}
-
-struct KeychainCohereTokenStore: CohereTokenStoring {
-    private static let log = RunicLog.logger("cohere-token-store")
-
-    private let service = "com.sriinnu.athena.Runic"
-    private let account = "cohere-api-token"
-
-    func loadToken() throws -> String? {
-        // Try standard keychain first.
-        if let token = try self.readToken(dataProtection: false) {
-            return token
-        }
-        // Migrate from the old Data Protection keychain if present.
-        if let token = try self.readToken(dataProtection: true) {
-            Self.log.info("Migrating Cohere token from Data Protection keychain")
-            // Store first, delete old only on success — prevents data loss.
-            if (try? self.storeToken(token)) != nil {
-                try? self.deleteToken(dataProtection: true)
-            }
-            return token
-        }
-        return nil
-    }
-
-    func storeToken(_ token: String?) throws {
-        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
-        if cleaned == nil || cleaned?.isEmpty == true {
-            try? self.deleteToken(dataProtection: false)
-            try? self.deleteToken(dataProtection: true)
-            return
-        }
-
-        let data = cleaned!.data(using: .utf8)!
-
-        // Always delete-then-add to ensure SecAccess ACL is set.
-        // SecItemUpdate does NOT update the ACL, so existing items with
-        // missing or stale ACLs would continue to prompt for passwords.
-        try? self.deleteToken(dataProtection: false)
-        try? self.deleteToken(dataProtection: true)
-
-        var addQuery = self.baseQuery(dataProtection: false)
-        addQuery[kSecValueData as String] = data
-        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
-
-        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
-        guard addStatus == errSecSuccess else {
-            Self.log.error("Keychain add failed: \(addStatus)")
-            throw CohereTokenStoreError.keychainStatus(addStatus)
-        }
-    }
-
-    // MARK: - Private
-
-    private func readToken(dataProtection: Bool) throws -> String? {
-        var result: CFTypeRef?
-        var query = self.baseQuery(dataProtection: dataProtection)
-        query[kSecMatchLimit as String] = kSecMatchLimitOne
-        query[kSecReturnData as String] = true
-        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
-
-        let status = SecItemCopyMatching(query as CFDictionary, &result)
-        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
-            return nil
-        }
-        guard status == errSecSuccess else {
-            Self.log.error("Keychain read failed: \(status)")
-            throw CohereTokenStoreError.keychainStatus(status)
-        }
-        guard let data = result as? Data else {
-            throw CohereTokenStoreError.invalidData
-        }
-        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
-        return (token?.isEmpty ?? true) ? nil : token
-    }
-
-    private func deleteToken(dataProtection: Bool) throws {
-        let query = self.baseQuery(dataProtection: dataProtection)
-        let status = SecItemDelete(query as CFDictionary)
-        if status == errSecSuccess || status == errSecItemNotFound { return }
-        Self.log.error("Keychain delete failed: \(status)")
-        throw CohereTokenStoreError.keychainStatus(status)
-    }
-
-    private func baseQuery(dataProtection: Bool) -> [String: Any] {
-        var q: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: self.service,
-            kSecAttrAccount as String: self.account,
-        ]
-        if dataProtection {
-            q[kSecUseDataProtectionKeychain as String] = true
-        }
-        return q
-    }
-}

package/Sources/Runic/Core/Stores/CopilotTokenStore.swift

@@ -1,117 +0,0 @@
-import Foundation
-import RunicCore
-import Security
-
-protocol CopilotTokenStoring: Sendable {
-    func loadToken() throws -> String?
-    func storeToken(_ token: String?) throws
-}
-
-enum CopilotTokenStoreError: LocalizedError {
-    case keychainStatus(OSStatus)
-    case invalidData
-
-    var errorDescription: String? {
-        switch self {
-        case let .keychainStatus(status):
-            "Keychain error: \(status)"
-        case .invalidData:
-            "Keychain returned invalid data."
-        }
-    }
-}
-
-struct KeychainCopilotTokenStore: CopilotTokenStoring {
-    private static let log = RunicLog.logger("copilot-token-store")
-
-    private let service = "com.sriinnu.athena.Runic"
-    private let account = "copilot-api-token"
-
-    func loadToken() throws -> String? {
-        // Try standard keychain first.
-        if let token = try self.readToken(dataProtection: false) {
-            return token
-        }
-        // Migrate from the old Data Protection keychain if present.
-        if let token = try self.readToken(dataProtection: true) {
-            Self.log.info("Migrating Copilot token from Data Protection keychain")
-            // Store first, delete old only on success — prevents data loss.
-            if (try? self.storeToken(token)) != nil {
-                try? self.deleteToken(dataProtection: true)
-            }
-            return token
-        }
-        return nil
-    }
-
-    func storeToken(_ token: String?) throws {
-        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
-        if cleaned == nil || cleaned?.isEmpty == true {
-            try? self.deleteToken(dataProtection: false)
-            try? self.deleteToken(dataProtection: true)
-            return
-        }
-
-        let data = cleaned!.data(using: .utf8)!
-
-        // Always delete-then-add to ensure SecAccess ACL is set.
-        // SecItemUpdate does NOT update the ACL, so existing items with
-        // missing or stale ACLs would continue to prompt for passwords.
-        try? self.deleteToken(dataProtection: false)
-        try? self.deleteToken(dataProtection: true)
-
-        var addQuery = self.baseQuery(dataProtection: false)
-        addQuery[kSecValueData as String] = data
-        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
-
-        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
-        guard addStatus == errSecSuccess else {
-            Self.log.error("Keychain add failed: \(addStatus)")
-            throw CopilotTokenStoreError.keychainStatus(addStatus)
-        }
-    }
-
-    // MARK: - Private
-
-    private func readToken(dataProtection: Bool) throws -> String? {
-        var result: CFTypeRef?
-        var query = self.baseQuery(dataProtection: dataProtection)
-        query[kSecMatchLimit as String] = kSecMatchLimitOne
-        query[kSecReturnData as String] = true
-        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
-
-        let status = SecItemCopyMatching(query as CFDictionary, &result)
-        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
-            return nil
-        }
-        guard status == errSecSuccess else {
-            Self.log.error("Keychain read failed: \(status)")
-            throw CopilotTokenStoreError.keychainStatus(status)
-        }
-        guard let data = result as? Data else {
-            throw CopilotTokenStoreError.invalidData
-        }
-        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
-        return (token?.isEmpty ?? true) ? nil : token
-    }
-
-    private func deleteToken(dataProtection: Bool) throws {
-        let query = self.baseQuery(dataProtection: dataProtection)
-        let status = SecItemDelete(query as CFDictionary)
-        if status == errSecSuccess || status == errSecItemNotFound { return }
-        Self.log.error("Keychain delete failed: \(status)")
-        throw CopilotTokenStoreError.keychainStatus(status)
-    }
-
-    private func baseQuery(dataProtection: Bool) -> [String: Any] {
-        var q: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: self.service,
-            kSecAttrAccount as String: self.account,
-        ]
-        if dataProtection {
-            q[kSecUseDataProtectionKeychain as String] = true
-        }
-        return q
-    }
-}