@sriinnu/runic 2.0.0 → 2.11.1

package/Sources/Runic/Core/Stores/MiniMaxCookieHeaderStore.swift

@@ -1,117 +0,0 @@
-import Foundation
-import RunicCore
-import Security
-
-protocol MiniMaxCookieHeaderStoring: Sendable {
-    func loadHeader() throws -> String?
-    func storeHeader(_ header: String?) throws
-}
-
-enum MiniMaxCookieHeaderStoreError: LocalizedError {
-    case keychainStatus(OSStatus)
-    case invalidData
-
-    var errorDescription: String? {
-        switch self {
-        case let .keychainStatus(status):
-            "Keychain error: \(status)"
-        case .invalidData:
-            "Keychain returned invalid data."
-        }
-    }
-}
-
-struct KeychainMiniMaxCookieHeaderStore: MiniMaxCookieHeaderStoring {
-    private static let log = RunicLog.logger("minimax-cookie-store")
-
-    private let service = "com.sriinnu.athena.Runic"
-    private let account = "minimax-cookie-header"
-
-    func loadHeader() throws -> String? {
-        // Try standard keychain first.
-        if let header = try self.readHeader(dataProtection: false) {
-            return header
-        }
-        // Migrate from the old Data Protection keychain if present.
-        if let header = try self.readHeader(dataProtection: true) {
-            Self.log.info("Migrating MiniMax cookie header from Data Protection keychain")
-            // Store first, delete old only on success — prevents data loss.
-            if (try? self.storeHeader(header)) != nil {
-                try? self.deleteHeader(dataProtection: true)
-            }
-            return header
-        }
-        return nil
-    }
-
-    func storeHeader(_ header: String?) throws {
-        let cleaned = header?.trimmingCharacters(in: .whitespacesAndNewlines)
-        if cleaned == nil || cleaned?.isEmpty == true {
-            try? self.deleteHeader(dataProtection: false)
-            try? self.deleteHeader(dataProtection: true)
-            return
-        }
-
-        let data = cleaned!.data(using: .utf8)!
-
-        // Always delete-then-add to ensure SecAccess ACL is set.
-        // SecItemUpdate does NOT update the ACL, so existing items with
-        // missing or stale ACLs would continue to prompt for passwords.
-        try? self.deleteHeader(dataProtection: false)
-        try? self.deleteHeader(dataProtection: true)
-
-        var addQuery = self.baseQuery(dataProtection: false)
-        addQuery[kSecValueData as String] = data
-        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
-
-        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
-        guard addStatus == errSecSuccess else {
-            Self.log.error("Keychain add failed: \(addStatus)")
-            throw MiniMaxCookieHeaderStoreError.keychainStatus(addStatus)
-        }
-    }
-
-    // MARK: - Private
-
-    private func readHeader(dataProtection: Bool) throws -> String? {
-        var result: CFTypeRef?
-        var query = self.baseQuery(dataProtection: dataProtection)
-        query[kSecMatchLimit as String] = kSecMatchLimitOne
-        query[kSecReturnData as String] = true
-        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
-
-        let status = SecItemCopyMatching(query as CFDictionary, &result)
-        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
-            return nil
-        }
-        guard status == errSecSuccess else {
-            Self.log.error("Keychain read failed: \(status)")
-            throw MiniMaxCookieHeaderStoreError.keychainStatus(status)
-        }
-        guard let data = result as? Data else {
-            throw MiniMaxCookieHeaderStoreError.invalidData
-        }
-        let header = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
-        return (header?.isEmpty ?? true) ? nil : header
-    }
-
-    private func deleteHeader(dataProtection: Bool) throws {
-        let query = self.baseQuery(dataProtection: dataProtection)
-        let status = SecItemDelete(query as CFDictionary)
-        if status == errSecSuccess || status == errSecItemNotFound { return }
-        Self.log.error("Keychain delete failed: \(status)")
-        throw MiniMaxCookieHeaderStoreError.keychainStatus(status)
-    }
-
-    private func baseQuery(dataProtection: Bool) -> [String: Any] {
-        var q: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: self.service,
-            kSecAttrAccount as String: self.account,
-        ]
-        if dataProtection {
-            q[kSecUseDataProtectionKeychain as String] = true
-        }
-        return q
-    }
-}

package/Sources/Runic/Core/Stores/MiniMaxGroupIDStore.swift

@@ -1,117 +0,0 @@
-import Foundation
-import RunicCore
-import Security
-
-protocol MiniMaxGroupIDStoring: Sendable {
-    func loadGroupID() throws -> String?
-    func storeGroupID(_ groupID: String?) throws
-}
-
-enum MiniMaxGroupIDStoreError: LocalizedError {
-    case keychainStatus(OSStatus)
-    case invalidData
-
-    var errorDescription: String? {
-        switch self {
-        case let .keychainStatus(status):
-            "Keychain error: \(status)"
-        case .invalidData:
-            "Keychain returned invalid data."
-        }
-    }
-}
-
-struct KeychainMiniMaxGroupIDStore: MiniMaxGroupIDStoring {
-    private static let log = RunicLog.logger("minimax-groupid-store")
-
-    private let service = "com.sriinnu.athena.Runic"
-    private let account = "minimax-group-id"
-
-    func loadGroupID() throws -> String? {
-        // Try standard keychain first.
-        if let groupID = try self.readGroupID(dataProtection: false) {
-            return groupID
-        }
-        // Migrate from the old Data Protection keychain if present.
-        if let groupID = try self.readGroupID(dataProtection: true) {
-            Self.log.info("Migrating MiniMax group ID from Data Protection keychain")
-            // Store first, delete old only on success — prevents data loss.
-            if (try? self.storeGroupID(groupID)) != nil {
-                try? self.deleteGroupID(dataProtection: true)
-            }
-            return groupID
-        }
-        return nil
-    }
-
-    func storeGroupID(_ groupID: String?) throws {
-        let cleaned = groupID?.trimmingCharacters(in: .whitespacesAndNewlines)
-        if cleaned == nil || cleaned?.isEmpty == true {
-            try? self.deleteGroupID(dataProtection: false)
-            try? self.deleteGroupID(dataProtection: true)
-            return
-        }
-
-        let data = cleaned!.data(using: .utf8)!
-
-        // Always delete-then-add to ensure SecAccess ACL is set.
-        // SecItemUpdate does NOT update the ACL, so existing items with
-        // missing or stale ACLs would continue to prompt for passwords.
-        try? self.deleteGroupID(dataProtection: false)
-        try? self.deleteGroupID(dataProtection: true)
-
-        var addQuery = self.baseQuery(dataProtection: false)
-        addQuery[kSecValueData as String] = data
-        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
-
-        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
-        guard addStatus == errSecSuccess else {
-            Self.log.error("Keychain add failed: \(addStatus)")
-            throw MiniMaxGroupIDStoreError.keychainStatus(addStatus)
-        }
-    }
-
-    // MARK: - Private
-
-    private func readGroupID(dataProtection: Bool) throws -> String? {
-        var result: CFTypeRef?
-        var query = self.baseQuery(dataProtection: dataProtection)
-        query[kSecMatchLimit as String] = kSecMatchLimitOne
-        query[kSecReturnData as String] = true
-        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
-
-        let status = SecItemCopyMatching(query as CFDictionary, &result)
-        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
-            return nil
-        }
-        guard status == errSecSuccess else {
-            Self.log.error("Keychain read failed: \(status)")
-            throw MiniMaxGroupIDStoreError.keychainStatus(status)
-        }
-        guard let data = result as? Data else {
-            throw MiniMaxGroupIDStoreError.invalidData
-        }
-        let groupID = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
-        return (groupID?.isEmpty ?? true) ? nil : groupID
-    }
-
-    private func deleteGroupID(dataProtection: Bool) throws {
-        let query = self.baseQuery(dataProtection: dataProtection)
-        let status = SecItemDelete(query as CFDictionary)
-        if status == errSecSuccess || status == errSecItemNotFound { return }
-        Self.log.error("Keychain delete failed: \(status)")
-        throw MiniMaxGroupIDStoreError.keychainStatus(status)
-    }
-
-    private func baseQuery(dataProtection: Bool) -> [String: Any] {
-        var q: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: self.service,
-            kSecAttrAccount as String: self.account,
-        ]
-        if dataProtection {
-            q[kSecUseDataProtectionKeychain as String] = true
-        }
-        return q
-    }
-}

package/Sources/Runic/Core/Stores/MiniMaxTokenStore.swift

@@ -1,117 +0,0 @@
-import Foundation
-import RunicCore
-import Security
-
-protocol MiniMaxTokenStoring: Sendable {
-    func loadToken() throws -> String?
-    func storeToken(_ token: String?) throws
-}
-
-enum MiniMaxTokenStoreError: LocalizedError {
-    case keychainStatus(OSStatus)
-    case invalidData
-
-    var errorDescription: String? {
-        switch self {
-        case let .keychainStatus(status):
-            "Keychain error: \(status)"
-        case .invalidData:
-            "Keychain returned invalid data."
-        }
-    }
-}
-
-struct KeychainMiniMaxTokenStore: MiniMaxTokenStoring {
-    private static let log = RunicLog.logger("minimax-token-store")
-
-    private let service = "com.sriinnu.athena.Runic"
-    private let account = "minimax-api-token"
-
-    func loadToken() throws -> String? {
-        // Try standard keychain first.
-        if let token = try self.readToken(dataProtection: false) {
-            return token
-        }
-        // Migrate from the old Data Protection keychain if present.
-        if let token = try self.readToken(dataProtection: true) {
-            Self.log.info("Migrating MiniMax token from Data Protection keychain")
-            // Store first, delete old only on success — prevents data loss.
-            if (try? self.storeToken(token)) != nil {
-                try? self.deleteToken(dataProtection: true)
-            }
-            return token
-        }
-        return nil
-    }
-
-    func storeToken(_ token: String?) throws {
-        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
-        if cleaned == nil || cleaned?.isEmpty == true {
-            try? self.deleteToken(dataProtection: false)
-            try? self.deleteToken(dataProtection: true)
-            return
-        }
-
-        let data = cleaned!.data(using: .utf8)!
-
-        // Always delete-then-add to ensure SecAccess ACL is set.
-        // SecItemUpdate does NOT update the ACL, so existing items with
-        // missing or stale ACLs would continue to prompt for passwords.
-        try? self.deleteToken(dataProtection: false)
-        try? self.deleteToken(dataProtection: true)
-
-        var addQuery = self.baseQuery(dataProtection: false)
-        addQuery[kSecValueData as String] = data
-        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
-
-        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
-        guard addStatus == errSecSuccess else {
-            Self.log.error("Keychain add failed: \(addStatus)")
-            throw MiniMaxTokenStoreError.keychainStatus(addStatus)
-        }
-    }
-
-    // MARK: - Private
-
-    private func readToken(dataProtection: Bool) throws -> String? {
-        var result: CFTypeRef?
-        var query = self.baseQuery(dataProtection: dataProtection)
-        query[kSecMatchLimit as String] = kSecMatchLimitOne
-        query[kSecReturnData as String] = true
-        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
-
-        let status = SecItemCopyMatching(query as CFDictionary, &result)
-        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
-            return nil
-        }
-        guard status == errSecSuccess else {
-            Self.log.error("Keychain read failed: \(status)")
-            throw MiniMaxTokenStoreError.keychainStatus(status)
-        }
-        guard let data = result as? Data else {
-            throw MiniMaxTokenStoreError.invalidData
-        }
-        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
-        return (token?.isEmpty ?? true) ? nil : token
-    }
-
-    private func deleteToken(dataProtection: Bool) throws {
-        let query = self.baseQuery(dataProtection: dataProtection)
-        let status = SecItemDelete(query as CFDictionary)
-        if status == errSecSuccess || status == errSecItemNotFound { return }
-        Self.log.error("Keychain delete failed: \(status)")
-        throw MiniMaxTokenStoreError.keychainStatus(status)
-    }
-
-    private func baseQuery(dataProtection: Bool) -> [String: Any] {
-        var q: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: self.service,
-            kSecAttrAccount as String: self.account,
-        ]
-        if dataProtection {
-            q[kSecUseDataProtectionKeychain as String] = true
-        }
-        return q
-    }
-}

package/Sources/Runic/Core/Stores/MistralTokenStore.swift

@@ -1,117 +0,0 @@
-import Foundation
-import RunicCore
-import Security
-
-protocol MistralTokenStoring: Sendable {
-    func loadToken() throws -> String?
-    func storeToken(_ token: String?) throws
-}
-
-enum MistralTokenStoreError: LocalizedError {
-    case keychainStatus(OSStatus)
-    case invalidData
-
-    var errorDescription: String? {
-        switch self {
-        case let .keychainStatus(status):
-            "Keychain error: \(status)"
-        case .invalidData:
-            "Keychain returned invalid data."
-        }
-    }
-}
-
-struct KeychainMistralTokenStore: MistralTokenStoring {
-    private static let log = RunicLog.logger("mistral-token-store")
-
-    private let service = "com.sriinnu.athena.Runic"
-    private let account = "mistral-api-token"
-
-    func loadToken() throws -> String? {
-        // Try standard keychain first.
-        if let token = try self.readToken(dataProtection: false) {
-            return token
-        }
-        // Migrate from the old Data Protection keychain if present.
-        if let token = try self.readToken(dataProtection: true) {
-            Self.log.info("Migrating Mistral token from Data Protection keychain")
-            // Store first, delete old only on success — prevents data loss.
-            if (try? self.storeToken(token)) != nil {
-                try? self.deleteToken(dataProtection: true)
-            }
-            return token
-        }
-        return nil
-    }
-
-    func storeToken(_ token: String?) throws {
-        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
-        if cleaned == nil || cleaned?.isEmpty == true {
-            try? self.deleteToken(dataProtection: false)
-            try? self.deleteToken(dataProtection: true)
-            return
-        }
-
-        let data = cleaned!.data(using: .utf8)!
-
-        // Always delete-then-add to ensure SecAccess ACL is set.
-        // SecItemUpdate does NOT update the ACL, so existing items with
-        // missing or stale ACLs would continue to prompt for passwords.
-        try? self.deleteToken(dataProtection: false)
-        try? self.deleteToken(dataProtection: true)
-
-        var addQuery = self.baseQuery(dataProtection: false)
-        addQuery[kSecValueData as String] = data
-        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
-
-        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
-        guard addStatus == errSecSuccess else {
-            Self.log.error("Keychain add failed: \(addStatus)")
-            throw MistralTokenStoreError.keychainStatus(addStatus)
-        }
-    }
-
-    // MARK: - Private
-
-    private func readToken(dataProtection: Bool) throws -> String? {
-        var result: CFTypeRef?
-        var query = self.baseQuery(dataProtection: dataProtection)
-        query[kSecMatchLimit as String] = kSecMatchLimitOne
-        query[kSecReturnData as String] = true
-        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
-
-        let status = SecItemCopyMatching(query as CFDictionary, &result)
-        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
-            return nil
-        }
-        guard status == errSecSuccess else {
-            Self.log.error("Keychain read failed: \(status)")
-            throw MistralTokenStoreError.keychainStatus(status)
-        }
-        guard let data = result as? Data else {
-            throw MistralTokenStoreError.invalidData
-        }
-        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
-        return (token?.isEmpty ?? true) ? nil : token
-    }
-
-    private func deleteToken(dataProtection: Bool) throws {
-        let query = self.baseQuery(dataProtection: dataProtection)
-        let status = SecItemDelete(query as CFDictionary)
-        if status == errSecSuccess || status == errSecItemNotFound { return }
-        Self.log.error("Keychain delete failed: \(status)")
-        throw MistralTokenStoreError.keychainStatus(status)
-    }
-
-    private func baseQuery(dataProtection: Bool) -> [String: Any] {
-        var q: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: self.service,
-            kSecAttrAccount as String: self.account,
-        ]
-        if dataProtection {
-            q[kSecUseDataProtectionKeychain as String] = true
-        }
-        return q
-    }
-}

package/Sources/Runic/Core/Stores/OpenRouterTokenStore.swift

@@ -1,117 +0,0 @@
-import Foundation
-import RunicCore
-import Security
-
-protocol OpenRouterTokenStoring: Sendable {
-    func loadToken() throws -> String?
-    func storeToken(_ token: String?) throws
-}
-
-enum OpenRouterTokenStoreError: LocalizedError {
-    case keychainStatus(OSStatus)
-    case invalidData
-
-    var errorDescription: String? {
-        switch self {
-        case let .keychainStatus(status):
-            "Keychain error: \(status)"
-        case .invalidData:
-            "Keychain returned invalid data."
-        }
-    }
-}
-
-struct KeychainOpenRouterTokenStore: OpenRouterTokenStoring {
-    private static let log = RunicLog.logger("openrouter-token-store")
-
-    private let service = "com.sriinnu.athena.Runic"
-    private let account = "openrouter-api-token"
-
-    func loadToken() throws -> String? {
-        // Try standard keychain first.
-        if let token = try self.readToken(dataProtection: false) {
-            return token
-        }
-        // Migrate from the old Data Protection keychain if present.
-        if let token = try self.readToken(dataProtection: true) {
-            Self.log.info("Migrating OpenRouter token from Data Protection keychain")
-            // Store first, delete old only on success — prevents data loss.
-            if (try? self.storeToken(token)) != nil {
-                try? self.deleteToken(dataProtection: true)
-            }
-            return token
-        }
-        return nil
-    }
-
-    func storeToken(_ token: String?) throws {
-        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
-        if cleaned == nil || cleaned?.isEmpty == true {
-            try? self.deleteToken(dataProtection: false)
-            try? self.deleteToken(dataProtection: true)
-            return
-        }
-
-        let data = cleaned!.data(using: .utf8)!
-
-        // Always delete-then-add to ensure SecAccess ACL is set.
-        // SecItemUpdate does NOT update the ACL, so existing items with
-        // missing or stale ACLs would continue to prompt for passwords.
-        try? self.deleteToken(dataProtection: false)
-        try? self.deleteToken(dataProtection: true)
-
-        var addQuery = self.baseQuery(dataProtection: false)
-        addQuery[kSecValueData as String] = data
-        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
-
-        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
-        guard addStatus == errSecSuccess else {
-            Self.log.error("Keychain add failed: \(addStatus)")
-            throw OpenRouterTokenStoreError.keychainStatus(addStatus)
-        }
-    }
-
-    // MARK: - Private
-
-    private func readToken(dataProtection: Bool) throws -> String? {
-        var result: CFTypeRef?
-        var query = self.baseQuery(dataProtection: dataProtection)
-        query[kSecMatchLimit as String] = kSecMatchLimitOne
-        query[kSecReturnData as String] = true
-        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
-
-        let status = SecItemCopyMatching(query as CFDictionary, &result)
-        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
-            return nil
-        }
-        guard status == errSecSuccess else {
-            Self.log.error("Keychain read failed: \(status)")
-            throw OpenRouterTokenStoreError.keychainStatus(status)
-        }
-        guard let data = result as? Data else {
-            throw OpenRouterTokenStoreError.invalidData
-        }
-        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
-        return (token?.isEmpty ?? true) ? nil : token
-    }
-
-    private func deleteToken(dataProtection: Bool) throws {
-        let query = self.baseQuery(dataProtection: dataProtection)
-        let status = SecItemDelete(query as CFDictionary)
-        if status == errSecSuccess || status == errSecItemNotFound { return }
-        Self.log.error("Keychain delete failed: \(status)")
-        throw OpenRouterTokenStoreError.keychainStatus(status)
-    }
-
-    private func baseQuery(dataProtection: Bool) -> [String: Any] {
-        var q: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: self.service,
-            kSecAttrAccount as String: self.account,
-        ]
-        if dataProtection {
-            q[kSecUseDataProtectionKeychain as String] = true
-        }
-        return q
-    }
-}