@xrkseek/harness 0.4.0-rc.4 → 0.4.1

package/node_modules/@xrkseek/runtime-invariants/dist/index.js

@@ -0,0 +1,163 @@
+/**
+ * Cordis-free registry for package-owned runtime invariant contributions.
+ * Face / Host compositions mount this; Cordis overlays keep using
+ * `@xrkseek/xrk-invariants` under stubs.
+ *
+ * @module @xrkseek/runtime-invariants
+ */
+/** Thrown when a package-owned runtime invariant is violated. */
+export class InvariantError extends Error {
+    code = "INVARIANT";
+    packageName;
+    constructor(packageName, message) {
+        super(`invariant violated by "${packageName}": ${message}`);
+        this.name = "InvariantError";
+        this.packageName = packageName;
+    }
+}
+/** Compile and validate one package-filter list. */
+function compilePatterns(field, values) {
+    const seen = new Set();
+    return values.map((value) => {
+        if (value.length === 0 || value.trim() !== value) {
+            throw new Error(`invariants: ${field} entries must be non-blank and have no surrounding whitespace`);
+        }
+        if (seen.has(value)) {
+            throw new Error(`invariants: ${field} contains duplicate regex ${JSON.stringify(value)}`);
+        }
+        seen.add(value);
+        try {
+            return new RegExp(value);
+        }
+        catch (cause) {
+            throw new Error(`invariants: ${field} contains invalid regex ${JSON.stringify(value)}`, { cause });
+        }
+    });
+}
+/** Env truthy for Host optional fail-fast (`XRK_INVARIANTS_FAIL_FAST`). */
+export function resolveInvariantsFailFast(env = process.env) {
+    const raw = env.XRK_INVARIANTS_FAIL_FAST?.trim().toLowerCase();
+    return raw === "1" || raw === "true" || raw === "yes" || raw === "on";
+}
+/** Package-owned invariant registry with global and regex-based selection. */
+export class InvariantRegistry {
+    enabled;
+    packageAllowlist;
+    packageBlocklist;
+    registrations = new Set();
+    appendListeners = new Set();
+    disposed = false;
+    constructor(config = {}) {
+        this.enabled = config.enabled ?? true;
+        this.packageAllowlist = compilePatterns("packageAllowlist", config.packageAllowlist ?? []);
+        this.packageBlocklist = compilePatterns("packageBlocklist", config.packageBlocklist ?? []);
+    }
+    selected(packageName) {
+        if (!this.enabled)
+            return false;
+        if (this.packageAllowlist.length > 0 &&
+            !this.packageAllowlist.some((pattern) => pattern.test(packageName))) {
+            return false;
+        }
+        return !this.packageBlocklist.some((pattern) => pattern.test(packageName));
+    }
+    /**
+     * Register one package's invariant installer.
+     * The package name is reserved even when filters disable its checks.
+     */
+    register(packageName, installer) {
+        if (this.disposed) {
+            throw new Error("invariants: registry is disposed");
+        }
+        if (packageName.length === 0 ||
+            packageName.trim() !== packageName ||
+            /\s/.test(packageName)) {
+            throw new Error("invariants: packageName must be non-blank and contain no whitespace");
+        }
+        if (this.registrations.has(packageName)) {
+            throw new Error(`invariants: package "${packageName}" is already registered`);
+        }
+        this.registrations.add(packageName);
+        const fail = (message) => {
+            throw new InvariantError(packageName, message);
+        };
+        const localDisposers = [];
+        const api = {
+            onAppend: (listener) => {
+                this.appendListeners.add(listener);
+                const dispose = () => {
+                    this.appendListeners.delete(listener);
+                };
+                localDisposers.push(dispose);
+                return dispose;
+            },
+        };
+        if (this.selected(packageName)) {
+            try {
+                const result = installer(api, fail);
+                if (result !== undefined) {
+                    throw new Error(`invariants: package "${packageName}" installer must be synchronous (got a Promise)`);
+                }
+            }
+            catch (error) {
+                for (const d of localDisposers)
+                    d();
+                this.registrations.delete(packageName);
+                throw error;
+            }
+        }
+        return () => {
+            for (const d of localDisposers)
+                d();
+            this.registrations.delete(packageName);
+        };
+    }
+    /** Whether a package name is currently reserved. */
+    has(packageName) {
+        return this.registrations.has(packageName);
+    }
+    /** Fan-out one append observation to active companion listeners. */
+    notifyAppend(obs) {
+        if (this.disposed || !this.enabled)
+            return;
+        for (const listener of this.appendListeners) {
+            listener(obs);
+        }
+    }
+    dispose() {
+        this.appendListeners.clear();
+        this.registrations.clear();
+        this.disposed = true;
+    }
+}
+export function createInvariantRegistry(config = {}) {
+    return new InvariantRegistry(config);
+}
+/**
+ * Wrap a SessionStore so every append notifies the registry **before** commit
+ * (fail-fast: violation prevents the underlying append).
+ */
+export function wrapSessionStore(store, registry) {
+    const wrapped = Object.create(store);
+    wrapped.append = ((id, event) => {
+        const prefix = store.get(id).events;
+        registry.notifyAppend({ sessionId: id, event, prefix });
+        return store.append(id, event);
+    });
+    return wrapped;
+}
+/**
+ * Replay an existing log through the registry (Host boot self-check).
+ * Does not mutate the store.
+ */
+export function replaySessionLog(registry, sessionId, events) {
+    for (let i = 0; i < events.length; i += 1) {
+        const event = events[i];
+        registry.notifyAppend({
+            sessionId,
+            event,
+            prefix: events.slice(0, i),
+        });
+    }
+}
+//# sourceMappingURL=index.js.map

package/node_modules/@xrkseek/runtime-invariants/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2CH,iEAAiE;AACjE,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,GAAG,WAAoB,CAAC;IAC5B,WAAW,CAAS;IAE7B,YAAY,WAAmB,EAAE,OAAe;QAC9C,KAAK,CAAC,0BAA0B,WAAW,MAAM,OAAO,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAED,oDAAoD;AACpD,SAAS,eAAe,CACtB,KAA8C,EAC9C,MAAyB;IAEzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,eAAe,KAAK,+DAA+D,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,eAAe,KAAK,6BAA6B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,eAAe,KAAK,2BAA2B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EACtE,EAAE,KAAK,EAAE,CACV,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,IAAI,CAAC;AACxE,CAAC;AAED,8EAA8E;AAC9E,MAAM,OAAO,iBAAiB;IACX,OAAO,CAAU;IACjB,gBAAgB,CAAoB;IACpC,gBAAgB,CAAoB;IACpC,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,eAAe,GAAG,IAAI,GAAG,EAEvC,CAAC;IACI,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAAY,SAAkC,EAAE;QAC9C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;QACtC,IAAI,CAAC,gBAAgB,GAAG,eAAe,CACrC,kBAAkB,EAClB,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAC9B,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,eAAe,CACrC,kBAAkB,EAClB,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAC9B,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,WAAmB;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAChC,IACE,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAChC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EACnE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,WAAmB,EAAE,SAA6B;QACzD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IACE,WAAW,CAAC,MAAM,KAAK,CAAC;YACxB,WAAW,CAAC,IAAI,EAAE,KAAK,WAAW;YAClC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EACtB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,wBAAwB,WAAW,yBAAyB,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEpC,MAAM,IAAI,GAAqB,CAAC,OAAO,EAAS,EAAE;YAChD,MAAM,IAAI,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC,CAAC;QAEF,MAAM,cAAc,GAAsB,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAwB;YAC/B,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE;gBACrB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnC,MAAM,OAAO,GAAG,GAAS,EAAE;oBACzB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACxC,CAAC,CAAC;gBACF,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC7B,OAAO,OAAO,CAAC;YACjB,CAAC;SACF,CAAC;QAEF,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,IAAI,KAAK,CACb,wBAAwB,WAAW,iDAAiD,CACrF,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,MAAM,CAAC,IAAI,cAAc;oBAAE,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACvC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,GAAG,EAAE;YACV,KAAK,MAAM,CAAC,IAAI,cAAc;gBAAE,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,GAAG,CAAC,WAAmB;QACrB,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED,oEAAoE;IACpE,YAAY,CAAC,GAA6B;QACxC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC3C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5C,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,SAAkC,EAAE;IAEpC,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAgBD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAQ,EACR,QAA2B;IAE3B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAM,CAAC;IAC1C,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAU,EAAE,KAAmB,EAAgB,EAAE;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC,CAAgB,CAAC;IAClB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA2B,EAC3B,SAAiB,EACjB,MAA+B;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACzB,QAAQ,CAAC,YAAY,CAAC;YACpB,SAAS;YACT,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/node_modules/@xrkseek/runtime-invariants/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "@xrkseek/runtime-invariants",
+  "version": "0.1.0",
+  "description": "Package-owned runtime invariant registry for Face/Host compositions (Cordis-free)",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "dependencies": {
+    "@xrkseek/protocol": "workspace:*"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/xrkseek/XRK-harness.git",
+    "directory": "packages/runtime-diagnostics/invariants"
+  },
+  "private": true
+}

package/node_modules/@xrkseek/secrets/README.md

@@ -0,0 +1,28 @@
+# @xrkseek/secrets
+
+Secret store Providers + unified log redaction (Codex-style keyring-store + sanitizer).
+
+## Definition / Provider
+
+| Layer | Role |
+|-------|------|
+| **Definition** | `SecretStore` (`load` / `save` / `delete` by service+account) |
+| **Provider** | `createMemorySecretStore` · `createOsKeyringStore` (dynamic `keytar` probe; missing → `available: false`) |
+| **Resolve** | `resolveSecretStore(env)` via `XRK_SECRETS_BACKEND` |
+
+| `XRK_SECRETS_BACKEND` | Behavior |
+|------------------------|----------|
+| unset / `file` | No overlay — Face keeps `~/.xrk/.credentials.yaml` |
+| `memory` | In-process store (CI) |
+| `keyring` | OS keyring via optional `keytar` (`pnpm add keytar`); if missing → `available: false` (honest) |
+
+Face may dual-write slots with `syncSlotToSecretStore` / hydrate with `loadSlotFromSecretStore`.
+
+## Redaction
+
+`redactSecrets(text)` — best-effort strip of `sk-…`, Bearer tokens, AWS AKIA, `api_key=` assignments.  
+`wrapLoggerForSecrets(logger)` — wrap CLI / Host sinks.
+
+Not the settings schema `role('secret')` walker (`@xrkseek/xrk-settings`).
+
+See [docs/configuration.md](../../../docs/configuration.md) · [docs/seams.md](../../../docs/seams.md).

package/node_modules/@xrkseek/secrets/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { REDACTED_SECRET, redactSecrets, wrapLoggerForSecrets, type RedactingLogger, } from "./redact.js";
+export { SecretStoreError, XRK_KEYRING_SERVICE, type SecretStore, type SecretStoreKind, } from "./types.js";
+export { createMemorySecretStore } from "./memory.js";
+export { createOsKeyringStore } from "./keyring.js";
+export { resolveSecretStore, type SecretsBackendKind, } from "./resolve.js";
+import { type SecretStore } from "./types.js";
+/** Persist one Face slot into the keyring when available. Never logs the value. */
+export declare function syncSlotToSecretStore(store: SecretStore | undefined, slotId: string, value: string | null): Promise<void>;
+/** Load one Face slot from the keyring when the vault has no value. */
+export declare function loadSlotFromSecretStore(store: SecretStore | undefined, slotId: string): Promise<string | undefined>;
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@xrkseek/secrets/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,KAAK,kBAAkB,GACxB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAEpB,mFAAmF;AACnF,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,WAAW,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,uEAAuE;AACvE,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,WAAW,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAG7B"}

package/node_modules/@xrkseek/secrets/dist/index.js

@@ -0,0 +1,23 @@
+export { REDACTED_SECRET, redactSecrets, wrapLoggerForSecrets, } from "./redact.js";
+export { SecretStoreError, XRK_KEYRING_SERVICE, } from "./types.js";
+export { createMemorySecretStore } from "./memory.js";
+export { createOsKeyringStore } from "./keyring.js";
+export { resolveSecretStore, } from "./resolve.js";
+import { XRK_KEYRING_SERVICE, } from "./types.js";
+/** Persist one Face slot into the keyring when available. Never logs the value. */
+export async function syncSlotToSecretStore(store, slotId, value) {
+    if (!store?.available)
+        return;
+    if (value === null || value === "") {
+        await store.delete(XRK_KEYRING_SERVICE, slotId);
+        return;
+    }
+    await store.save(XRK_KEYRING_SERVICE, slotId, value);
+}
+/** Load one Face slot from the keyring when the vault has no value. */
+export async function loadSlotFromSecretStore(store, slotId) {
+    if (!store?.available)
+        return undefined;
+    return store.load(XRK_KEYRING_SERVICE, slotId);
+}
+//# sourceMappingURL=index.js.map

package/node_modules/@xrkseek/secrets/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,aAAa,EACb,oBAAoB,GAErB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,kBAAkB,GAEnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,GAEpB,MAAM,YAAY,CAAC;AAEpB,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA8B,EAC9B,MAAc,EACd,KAAoB;IAEpB,IAAI,CAAC,KAAK,EAAE,SAAS;QAAE,OAAO;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACnC,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAA8B,EAC9B,MAAc;IAEd,IAAI,CAAC,KAAK,EAAE,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC"}

package/node_modules/@xrkseek/secrets/dist/keyring.d.ts

@@ -0,0 +1,10 @@
+/**
+ * OS keyring Provider (Codex DefaultKeyringStore shape).
+ * Uses optional `keytar` when installed; otherwise available=false (honest).
+ */
+import { type SecretStore } from "./types.js";
+/**
+ * Build an OS keyring-backed store. Probes `keytar` once; does not throw on miss.
+ */
+export declare function createOsKeyringStore(): Promise<SecretStore>;
+//# sourceMappingURL=keyring.d.ts.map

package/node_modules/@xrkseek/secrets/dist/keyring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.d.ts","sourceRoot":"","sources":["../src/keyring.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAqCpB;;GAEG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,WAAW,CAAC,CAwDjE"}

package/node_modules/@xrkseek/secrets/dist/keyring.js

@@ -0,0 +1,77 @@
+/**
+ * OS keyring Provider (Codex DefaultKeyringStore shape).
+ * Uses optional `keytar` when installed; otherwise available=false (honest).
+ */
+import { SecretStoreError, } from "./types.js";
+async function tryImportKeytar() {
+    try {
+        // Optional native module — install separately (`pnpm add keytar`) when enabling keyring.
+        const mod = (await import("keytar"));
+        if (typeof mod.getPassword === "function") {
+            return mod;
+        }
+        if (mod.default && typeof mod.default.getPassword === "function") {
+            return mod.default;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const UNAVAILABLE = "OS keyring unavailable (optional package `keytar` not installed or failed to load). " +
+    "Face keeps using ~/.xrk/.credentials.yaml. Install keytar and set XRK_SECRETS_BACKEND=keyring to enable.";
+/**
+ * Build an OS keyring-backed store. Probes `keytar` once; does not throw on miss.
+ */
+export async function createOsKeyringStore() {
+    const keytar = await tryImportKeytar();
+    if (!keytar) {
+        return {
+            providerName: "os-keyring",
+            kind: "unavailable",
+            available: false,
+            unavailableMessage: UNAVAILABLE,
+            async load() {
+                throw new SecretStoreError(UNAVAILABLE, "SECRET_UNAVAILABLE");
+            },
+            async save() {
+                throw new SecretStoreError(UNAVAILABLE, "SECRET_UNAVAILABLE");
+            },
+            async delete() {
+                throw new SecretStoreError(UNAVAILABLE, "SECRET_UNAVAILABLE");
+            },
+        };
+    }
+    return {
+        providerName: "os-keyring",
+        kind: "os-keyring",
+        available: true,
+        async load(service, account) {
+            try {
+                const v = await keytar.getPassword(service, account);
+                return v && v.length > 0 ? v : undefined;
+            }
+            catch (err) {
+                throw new SecretStoreError(err instanceof Error ? err.message : String(err), "SECRET_BACKEND");
+            }
+        },
+        async save(service, account, value) {
+            try {
+                await keytar.setPassword(service, account, value);
+            }
+            catch (err) {
+                throw new SecretStoreError(err instanceof Error ? err.message : String(err), "SECRET_BACKEND");
+            }
+        },
+        async delete(service, account) {
+            try {
+                return await keytar.deletePassword(service, account);
+            }
+            catch (err) {
+                throw new SecretStoreError(err instanceof Error ? err.message : String(err), "SECRET_BACKEND");
+            }
+        },
+    };
+}
+//# sourceMappingURL=keyring.js.map

package/node_modules/@xrkseek/secrets/dist/keyring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.js","sourceRoot":"","sources":["../src/keyring.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,gBAAgB,GAEjB,MAAM,YAAY,CAAC;AAYpB,KAAK,UAAU,eAAe;IAC5B,IAAI,CAAC;QACL,yFAAyF;QACzF,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAKhC,CAAC;QACF,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YAC1C,OAAO,GAAgB,CAAC;QAC1B,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACjE,OAAO,GAAG,CAAC,OAAO,CAAC;QACrB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GACf,sFAAsF;IACtF,0GAA0G,CAAC;AAE7G;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,YAAY,EAAE,YAAY;YAC1B,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,KAAK;YAChB,kBAAkB,EAAE,WAAW;YAC/B,KAAK,CAAC,IAAI;gBACR,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;YAChE,CAAC;YACD,KAAK,CAAC,IAAI;gBACR,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;YAChE,CAAC;YACD,KAAK,CAAC,MAAM;gBACV,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;YAChE,CAAC;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY,EAAE,YAAY;QAC1B,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,IAAI;QACf,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO;YACzB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,gBAAgB,CACxB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAChD,gBAAgB,CACjB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,gBAAgB,CACxB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAChD,gBAAgB,CACjB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO;YAC3B,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,gBAAgB,CACxB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAChD,gBAAgB,CACjB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/node_modules/@xrkseek/secrets/dist/memory.d.ts

@@ -0,0 +1,4 @@
+import type { SecretStore } from "./types.js";
+/** In-memory SecretStore for tests / CI (`XRK_SECRETS_BACKEND=memory`). */
+export declare function createMemorySecretStore(): SecretStore;
+//# sourceMappingURL=memory.d.ts.map

package/node_modules/@xrkseek/secrets/dist/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,2EAA2E;AAC3E,wBAAgB,uBAAuB,IAAI,WAAW,CAkBrD"}

package/node_modules/@xrkseek/secrets/dist/memory.js

@@ -0,0 +1,21 @@
+/** In-memory SecretStore for tests / CI (`XRK_SECRETS_BACKEND=memory`). */
+export function createMemorySecretStore() {
+    const map = new Map();
+    const keyOf = (service, account) => `${service}\0${account}`;
+    return {
+        providerName: "memory",
+        kind: "memory",
+        available: true,
+        async load(service, account) {
+            const v = map.get(keyOf(service, account));
+            return v !== undefined && v.length > 0 ? v : undefined;
+        },
+        async save(service, account, value) {
+            map.set(keyOf(service, account), value);
+        },
+        async delete(service, account) {
+            return map.delete(keyOf(service, account));
+        },
+    };
+}
+//# sourceMappingURL=memory.js.map

package/node_modules/@xrkseek/secrets/dist/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":"AAEA,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,EAAE,CAAC,GAAG,OAAO,KAAK,OAAO,EAAE,CAAC;IAC7E,OAAO;QACL,YAAY,EAAE,QAAQ;QACtB,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,IAAI;QACf,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO;YACzB,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK;YAChC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO;YAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/node_modules/@xrkseek/secrets/dist/redact.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Best-effort secret redaction for logs and durable text (Codex-style sanitizer).
+ * Not a wire `role('secret')` walker — see `@xrkseek/xrk-settings` for that.
+ */
+/** Placeholder used in redacted output. */
+export declare const REDACTED_SECRET = "[REDACTED_SECRET]";
+/**
+ * Remove well-known secret shapes from a string (best-effort).
+ * Safe to call on every log line; does not throw.
+ */
+export declare function redactSecrets(input: string): string;
+/** Minimal logger surface shared by CLI / Host sinks. */
+export interface RedactingLogger {
+    error(msg: string): void;
+    warn(msg: string): void;
+    info(msg: string): void;
+    debug(msg: string): void;
+}
+/**
+ * Wrap a logger so every message is passed through {@link redactSecrets}.
+ */
+export declare function wrapLoggerForSecrets<T extends RedactingLogger>(inner: T): T;
+//# sourceMappingURL=redact.d.ts.map

package/node_modules/@xrkseek/secrets/dist/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,2CAA2C;AAC3C,eAAO,MAAM,eAAe,sBAAsB,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAW3E"}

package/node_modules/@xrkseek/secrets/dist/redact.js

@@ -0,0 +1,38 @@
+/**
+ * Best-effort secret redaction for logs and durable text (Codex-style sanitizer).
+ * Not a wire `role('secret')` walker — see `@xrkseek/xrk-settings` for that.
+ */
+const OPENAI_KEY = /\bsk-[A-Za-z0-9_-]{8,}\b/g;
+const AWS_ACCESS = /\bAKIA[0-9A-Z]{16}\b/g;
+const BEARER = /\bBearer[ \t]+[A-Za-z0-9._~+/-]{16,}=*/gi;
+const ASSIGNMENT = /\b(api[_-]?key|token|secret|password)\b(\s*[:=]\s*)(["']?)[^\s"']{8,}/gi;
+/** Placeholder used in redacted output. */
+export const REDACTED_SECRET = "[REDACTED_SECRET]";
+/**
+ * Remove well-known secret shapes from a string (best-effort).
+ * Safe to call on every log line; does not throw.
+ */
+export function redactSecrets(input) {
+    let out = input;
+    out = out.replace(BEARER, `Bearer ${REDACTED_SECRET}`);
+    out = out.replace(OPENAI_KEY, REDACTED_SECRET);
+    out = out.replace(AWS_ACCESS, REDACTED_SECRET);
+    out = out.replace(ASSIGNMENT, `$1$2$3${REDACTED_SECRET}`);
+    return out;
+}
+/**
+ * Wrap a logger so every message is passed through {@link redactSecrets}.
+ */
+export function wrapLoggerForSecrets(inner) {
+    const wrap = (fn) => (msg) => {
+        fn(redactSecrets(msg));
+    };
+    return {
+        ...inner,
+        error: wrap(inner.error.bind(inner)),
+        warn: wrap(inner.warn.bind(inner)),
+        info: wrap(inner.info.bind(inner)),
+        debug: wrap(inner.debug.bind(inner)),
+    };
+}
+//# sourceMappingURL=redact.js.map

package/node_modules/@xrkseek/secrets/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAC/C,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAC3C,MAAM,MAAM,GAAG,0CAA0C,CAAC;AAC1D,MAAM,UAAU,GACd,yEAAyE,CAAC;AAE5E,2CAA2C;AAC3C,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAEnD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,eAAe,EAAE,CAAC,CAAC;IACvD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC/C,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC/C,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAA4B,KAAQ;IACtE,MAAM,IAAI,GAAG,CAAC,EAAyB,EAAE,EAAE,CAAC,CAAC,GAAW,EAAE,EAAE;QAC1D,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,OAAO;QACL,GAAG,KAAK;QACR,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;KACrC,CAAC;AACJ,CAAC"}

package/node_modules/@xrkseek/secrets/dist/resolve.d.ts

@@ -0,0 +1,10 @@
+import type { SecretStore } from "./types.js";
+export type SecretsBackendKind = "file" | "keyring" | "memory";
+/**
+ * Resolve the optional SecretStore overlay.
+ * - `file` / unset → undefined (Face `.credentials.yaml` only)
+ * - `memory` → in-process store (CI)
+ * - `keyring` → OS keyring via optional `keytar` (may be unavailable)
+ */
+export declare function resolveSecretStore(env?: NodeJS.ProcessEnv): Promise<SecretStore | undefined>;
+//# sourceMappingURL=resolve.d.ts.map

package/node_modules/@xrkseek/secrets/dist/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/D;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAclC"}

package/node_modules/@xrkseek/secrets/dist/resolve.js

@@ -0,0 +1,24 @@
+import { createMemorySecretStore } from "./memory.js";
+import { createOsKeyringStore } from "./keyring.js";
+/**
+ * Resolve the optional SecretStore overlay.
+ * - `file` / unset → undefined (Face `.credentials.yaml` only)
+ * - `memory` → in-process store (CI)
+ * - `keyring` → OS keyring via optional `keytar` (may be unavailable)
+ */
+export async function resolveSecretStore(env = process.env) {
+    const raw = String(env.XRK_SECRETS_BACKEND ?? "")
+        .trim()
+        .toLowerCase();
+    if (!raw || raw === "file" || raw === "0" || raw === "off") {
+        return undefined;
+    }
+    if (raw === "memory") {
+        return createMemorySecretStore();
+    }
+    if (raw === "keyring" || raw === "os" || raw === "1") {
+        return createOsKeyringStore();
+    }
+    return undefined;
+}
+//# sourceMappingURL=resolve.js.map

package/node_modules/@xrkseek/secrets/dist/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAKpD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;SAC9C,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAC3D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QACrD,OAAO,oBAAoB,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/node_modules/@xrkseek/secrets/dist/types.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Secret store Definition (Codex keyring-store shape).
+ * Face credentials stay the product SoT; this is an optional durable Provider.
+ */
+export type SecretStoreKind = "memory" | "os-keyring" | "unavailable";
+export declare class SecretStoreError extends Error {
+    readonly code: "SECRET_UNAVAILABLE" | "SECRET_BACKEND";
+    constructor(message: string, code?: "SECRET_UNAVAILABLE" | "SECRET_BACKEND");
+}
+/**
+ * Pluggable secret backend: load / save / delete by (service, account).
+ * Implementations must never log the secret value.
+ */
+export interface SecretStore {
+    readonly providerName: string;
+    readonly kind: SecretStoreKind;
+    /** False when the OS keyring module is missing or the backend refused probe. */
+    readonly available: boolean;
+    /** Human reason when `available` is false. */
+    readonly unavailableMessage?: string;
+    load(service: string, account: string): Promise<string | undefined>;
+    save(service: string, account: string, value: string): Promise<void>;
+    delete(service: string, account: string): Promise<boolean>;
+}
+/** Default keyring service id for XRK Host credentials. */
+export declare const XRK_KEYRING_SERVICE = "xrk-harness";
+//# sourceMappingURL=types.d.ts.map

package/node_modules/@xrkseek/secrets/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC;AAEtE,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CAAC;gBAGrD,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,oBAAoB,GAAG,gBAAmC;CAMnE;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8CAA8C;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5D;AAED,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,gBAAgB,CAAC"}

package/node_modules/@xrkseek/secrets/dist/types.js

@@ -0,0 +1,15 @@
+/**
+ * Secret store Definition (Codex keyring-store shape).
+ * Face credentials stay the product SoT; this is an optional durable Provider.
+ */
+export class SecretStoreError extends Error {
+    code;
+    constructor(message, code = "SECRET_BACKEND") {
+        super(message);
+        this.name = "SecretStoreError";
+        this.code = code;
+    }
+}
+/** Default keyring service id for XRK Host credentials. */
+export const XRK_KEYRING_SERVICE = "xrk-harness";
+//# sourceMappingURL=types.js.map

package/node_modules/@xrkseek/secrets/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAA0C;IAEvD,YACE,OAAe,EACf,OAAgD,gBAAgB;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAkBD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC"}

package/node_modules/@xrkseek/secrets/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@xrkseek/secrets",
+  "description": "Secret store Providers (memory · OS keyring) + unified redactSecrets for logs",
+  "version": "0.1.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./redact": {
+      "types": "./dist/redact.d.ts",
+      "import": "./dist/redact.js",
+      "default": "./dist/redact.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/xrkseek/XRK-harness.git",
+    "directory": "packages/util/secrets"
+  },
+  "private": true
+}

package/node_modules/@xrkseek/server-config/dist/index.d.ts

@@ -57,6 +57,12 @@ export interface HostRuntimeConfig {
      * (Desktop pipe transport). Env: `XRK_LISTEN=0`. Default `true`.
      */
     readonly listen?: boolean;
+    /**
+     * When `true`, wrap SessionStore with package-owned runtime invariants and
+     * fail-fast on relational log violations. Env: `XRK_INVARIANTS_FAIL_FAST=1`.
+     * Default off (observability opt-in; does not change product defaults).
+     */
+    readonly invariantsFailFast?: boolean;
 }
 export interface HostConfig {
     readonly credentials: HostCredentials;

package/node_modules/@xrkseek/server-config/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE1E,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AAC3C,YAAY,EAAE,YAAY,EAAE,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,WAAW,EACX,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,iFAS1B,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,mBAAmB,CAEzE;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C,2FAA2F;IAC3F,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAChD;AAQD,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,KAAK,GAAE,eAAoB,GAAG,UAAU,CAiHtE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,aAAa,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,YAAY,EAAE,CAAC;CACvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE1E,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AAC3C,YAAY,EAAE,YAAY,EAAE,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,WAAW,EACX,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,iFAS1B,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,mBAAmB,CAEzE;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C,2FAA2F;IAC3F,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAChD;AAQD,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,KAAK,GAAE,eAAoB,GAAG,UAAU,CA2HtE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,aAAa,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,YAAY,EAAE,CAAC;CACvD"}