ai-cred 1.0.0

package/dist/cli/commands/add.d.ts

@@ -0,0 +1,8 @@
+/**
+ * CLI subcommand: ai-cred add <service>
+ *
+ * Stores a new credential in the macOS Keychain.
+ * Prompts interactively for secret fields not provided via flags.
+ */
+import { Command } from 'commander';
+export declare function makeAddCommand(): Command;

package/dist/cli/commands/add.js

@@ -0,0 +1,145 @@
+/**
+ * CLI subcommand: ai-cred add <service>
+ *
+ * Stores a new credential in the macOS Keychain.
+ * Prompts interactively for secret fields not provided via flags.
+ */
+import { Command } from 'commander';
+import { KeychainAdapter, KeychainError } from '../../core/keychain-adapter.js';
+import { CredentialSchema, EnvironmentSchema } from '../../types/credential.js';
+import { ServiceNameSchema } from '../../utils/validation.js';
+import { promptSecret } from '../utils/prompt.js';
+import { auditLog } from '../../core/audit-logger.js';
+async function withAdapter() {
+    const adapter = new KeychainAdapter();
+    await adapter.initialize();
+    return adapter;
+}
+export function makeAddCommand() {
+    return new Command('add')
+        .description('Store a new credential')
+        .argument('<service>', 'Service name')
+        .requiredOption('-t, --type <type>', 'Credential type (ssh|jenkins|portainer|aws|api-key)')
+        .option('-e, --env <environment>', 'Environment', 'global')
+        .option('--notes <text>', 'Optional notes')
+        // SSH options
+        .option('--host <host>', 'SSH host')
+        .option('--port <port>', 'SSH port')
+        .option('--username <user>', 'Username')
+        .option('--password <pass>', 'Password')
+        .option('--key-path <path>', 'SSH key path')
+        // Jenkins/Portainer options
+        .option('--url <url>', 'Service URL')
+        .option('--api-token <token>', 'API token')
+        // AWS options
+        .option('--access-key-id <id>', 'AWS access key ID')
+        .option('--secret-access-key <key>', 'AWS secret access key')
+        .option('--region <region>', 'AWS region')
+        .option('--profile <name>', 'AWS profile name')
+        // API key options
+        .option('--key <key>', 'API key value')
+        .action(async (service, opts) => {
+        // Validate service name
+        const svcResult = ServiceNameSchema.safeParse(service);
+        if (!svcResult.success) {
+            process.stderr.write(`Error: ${svcResult.error.issues[0]?.message ?? 'Invalid service name'}\n`);
+            process.exit(1);
+        }
+        // Validate environment
+        const envResult = EnvironmentSchema.safeParse(opts.env);
+        if (!envResult.success) {
+            process.stderr.write(`Error: ${envResult.error.issues[0]?.message ?? 'Invalid environment'}\n`);
+            process.exit(1);
+        }
+        const env = envResult.data;
+        // Build credential object based on type
+        const credential = await buildCredential(opts);
+        if (!credential)
+            return; // buildCredential handles errors
+        // Validate through Zod schema
+        const credResult = CredentialSchema.safeParse(credential);
+        if (!credResult.success) {
+            const issues = credResult.error.issues.map((i) => i.message).join(', ');
+            process.stderr.write(`Validation error: ${issues}\n`);
+            process.exit(1);
+        }
+        try {
+            const adapter = await withAdapter();
+            await adapter.store(env, service, credResult.data);
+            await auditLog({ operation: 'store', service, environment: env });
+            console.log(`Stored credential '${service}' in ${env}`);
+        }
+        catch (err) {
+            if (err instanceof KeychainError) {
+                process.stderr.write(`Error: ${err.message}\n`);
+            }
+            else {
+                process.stderr.write(`Error: Failed to store credential\n`);
+            }
+            process.exit(1);
+        }
+    });
+}
+async function buildCredential(opts) {
+    const type = opts.type;
+    const notes = opts.notes;
+    switch (type) {
+        case 'ssh': {
+            const password = opts.password ?? (await promptSecret('Password (or press Enter to skip): ') || undefined);
+            const cred = {
+                type: 'ssh',
+                host: opts.host ?? '',
+                port: opts.port ? parseInt(opts.port, 10) : 22,
+                username: opts.username ?? '',
+                ...(password && { password }),
+                ...(opts.keyPath && { keyPath: opts.keyPath }),
+                ...(notes && { notes }),
+            };
+            return cred;
+        }
+        case 'jenkins': {
+            const apiToken = opts.apiToken ?? await promptSecret('API Token: ');
+            return {
+                type: 'jenkins',
+                url: opts.url ?? '',
+                username: opts.username ?? '',
+                apiToken,
+                ...(notes && { notes }),
+            };
+        }
+        case 'portainer': {
+            const apiToken = opts.apiToken ?? await promptSecret('API Token: ');
+            return {
+                type: 'portainer',
+                url: opts.url ?? '',
+                apiToken,
+                ...(notes && { notes }),
+            };
+        }
+        case 'aws': {
+            const secretAccessKey = opts.secretAccessKey ?? await promptSecret('Secret Access Key: ');
+            return {
+                type: 'aws',
+                accessKeyId: opts.accessKeyId ?? '',
+                secretAccessKey,
+                region: opts.region ?? '',
+                ...(opts.profile && { profile: opts.profile }),
+                ...(notes && { notes }),
+            };
+        }
+        case 'api-key': {
+            const key = opts.key ?? await promptSecret('API Key: ');
+            return {
+                type: 'api-key',
+                key,
+                ...(opts.url && { url: opts.url }),
+                ...(notes && { notes }),
+            };
+        }
+        default:
+            process.stderr.write(`Error: Unknown credential type '${type}'. Must be ssh|jenkins|portainer|aws|api-key.\n`);
+            process.exit(1);
+            return null;
+    }
+}
+//# sourceMappingURL=add.js.map

package/dist/cli/commands/add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../../src/cli/commands/add.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAEtD,KAAK,UAAU,WAAW;IACxB,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC;SACtB,WAAW,CAAC,wBAAwB,CAAC;SACrC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;SACrC,cAAc,CAAC,mBAAmB,EAAE,qDAAqD,CAAC;SAC1F,MAAM,CAAC,yBAAyB,EAAE,aAAa,EAAE,QAAQ,CAAC;SAC1D,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;QAC3C,cAAc;SACb,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,MAAM,CAAC,mBAAmB,EAAE,UAAU,CAAC;SACvC,MAAM,CAAC,mBAAmB,EAAE,UAAU,CAAC;SACvC,MAAM,CAAC,mBAAmB,EAAE,cAAc,CAAC;QAC5C,4BAA4B;SAC3B,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC;SACpC,MAAM,CAAC,qBAAqB,EAAE,WAAW,CAAC;QAC3C,cAAc;SACb,MAAM,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;SACnD,MAAM,CAAC,2BAA2B,EAAE,uBAAuB,CAAC;SAC5D,MAAM,CAAC,mBAAmB,EAAE,YAAY,CAAC;SACzC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QAC/C,kBAAkB;SACjB,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC;SACtC,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAAwC,EAAE,EAAE;QAC1E,wBAAwB;QACxB,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,sBAAsB,IAAI,CAAC,CAAC;YACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,uBAAuB;QACvB,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,qBAAqB,IAAI,CAAC,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC;QAE3B,wCAAwC;QACxC,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,iCAAiC;QAE1D,8BAA8B;QAC9B,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,MAAM,IAAI,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;YACpC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,QAAQ,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,sBAAsB,OAAO,QAAQ,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAwC;IAExC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAEzB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,YAAY,CAAC,qCAAqC,CAAC,IAAI,SAAS,CAAC,CAAC;YAC3G,MAAM,IAAI,GAA4B;gBACpC,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;gBACrB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;gBAC7B,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;aACxB,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC;YACpE,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;gBAC7B,QAAQ;gBACR,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;aACxB,CAAC;QACJ,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC;YACpE,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;gBACnB,QAAQ;gBACR,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;aACxB,CAAC;QACJ,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC1F,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;gBACnC,eAAe;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;gBACzB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;aACxB,CAAC;QACJ,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;YACxD,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,GAAG;gBACH,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClC,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;aACxB,CAAC;QACJ,CAAC;QACD;YACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,iDAAiD,CAAC,CAAC;YAC/G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/cli/commands/get.d.ts

@@ -0,0 +1,7 @@
+/**
+ * CLI subcommand: ai-cred get <service>
+ *
+ * Retrieves and prints a credential as JSON.
+ */
+import { Command } from 'commander';
+export declare function makeGetCommand(): Command;

package/dist/cli/commands/get.js

@@ -0,0 +1,53 @@
+/**
+ * CLI subcommand: ai-cred get <service>
+ *
+ * Retrieves and prints a credential as JSON.
+ */
+import { Command } from 'commander';
+import { KeychainAdapter, KeychainError } from '../../core/keychain-adapter.js';
+import { EnvironmentSchema } from '../../types/credential.js';
+import { ServiceNameSchema } from '../../utils/validation.js';
+import { auditLog } from '../../core/audit-logger.js';
+async function withAdapter() {
+    const adapter = new KeychainAdapter();
+    await adapter.initialize();
+    return adapter;
+}
+export function makeGetCommand() {
+    return new Command('get')
+        .description('Retrieve a credential')
+        .argument('<service>', 'Service name')
+        .option('-e, --env <environment>', 'Environment', 'global')
+        .action(async (service, opts) => {
+        const svcResult = ServiceNameSchema.safeParse(service);
+        if (!svcResult.success) {
+            process.stderr.write(`Error: ${svcResult.error.issues[0]?.message ?? 'Invalid service name'}\n`);
+            process.exit(1);
+        }
+        const envResult = EnvironmentSchema.safeParse(opts.env);
+        if (!envResult.success) {
+            process.stderr.write(`Error: ${envResult.error.issues[0]?.message ?? 'Invalid environment'}\n`);
+            process.exit(1);
+        }
+        const env = envResult.data;
+        try {
+            const adapter = await withAdapter();
+            const credential = await adapter.get(env, service);
+            await auditLog({ operation: 'get', service, environment: env });
+            console.log(JSON.stringify(credential, null, 2));
+        }
+        catch (err) {
+            if (err instanceof KeychainError && err.exitCode === 44) {
+                process.stderr.write(`No credential found for '${service}' in ${env}\n`);
+            }
+            else if (err instanceof KeychainError) {
+                process.stderr.write(`Error: ${err.message}\n`);
+            }
+            else {
+                process.stderr.write(`Error: Failed to retrieve credential\n`);
+            }
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=get.js.map

package/dist/cli/commands/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../src/cli/commands/get.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAEtD,KAAK,UAAU,WAAW;IACxB,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC;SACtB,WAAW,CAAC,uBAAuB,CAAC;SACpC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;SACrC,MAAM,CAAC,yBAAyB,EAAE,aAAa,EAAE,QAAQ,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAAqB,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,sBAAsB,IAAI,CAAC,CAAC;YACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,qBAAqB,IAAI,CAAC,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC;QAE3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;YACpC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,OAAO,QAAQ,GAAG,IAAI,CAAC,CAAC;YAC3E,CAAC;iBAAM,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/list.d.ts

@@ -0,0 +1,7 @@
+/**
+ * CLI subcommand: ai-cred list
+ *
+ * Lists all credentials with masked secret preview in a formatted table.
+ */
+import { Command } from 'commander';
+export declare function makeListCommand(): Command;

package/dist/cli/commands/list.js

@@ -0,0 +1,118 @@
+/**
+ * CLI subcommand: ai-cred list
+ *
+ * Lists all credentials with masked secret preview in a formatted table.
+ */
+import { Command } from 'commander';
+import { KeychainAdapter, KeychainError } from '../../core/keychain-adapter.js';
+import { EnvironmentSchema } from '../../types/credential.js';
+import { maskSecret, getPrimarySecret } from '../utils/display.js';
+async function withAdapter() {
+    const adapter = new KeychainAdapter();
+    await adapter.initialize();
+    return adapter;
+}
+export function makeListCommand() {
+    return new Command('list')
+        .description('List all credentials')
+        .option('-e, --env <environment>', 'Filter by environment')
+        .action(async (opts) => {
+        // Validate environment filter if provided
+        let envFilter;
+        if (opts.env) {
+            const envResult = EnvironmentSchema.safeParse(opts.env);
+            if (!envResult.success) {
+                process.stderr.write(`Error: ${envResult.error.issues[0]?.message ?? 'Invalid environment'}\n`);
+                process.exit(1);
+            }
+            envFilter = envResult.data;
+        }
+        try {
+            const adapter = await withAdapter();
+            let items = await adapter.list();
+            if (envFilter) {
+                items = items.filter((item) => item.environment === envFilter);
+            }
+            if (items.length === 0) {
+                console.log('No credentials found.');
+                return;
+            }
+            // Fetch full credentials for masked secret preview (N+1 acceptable for <100 items)
+            const rows = [];
+            for (const item of items) {
+                try {
+                    const credential = await adapter.get(item.environment, item.service);
+                    const primarySecret = getPrimarySecret(credential);
+                    const masked = maskSecret(primarySecret);
+                    const notes = ('notes' in credential && typeof credential.notes === 'string')
+                        ? (credential.notes.length > 30 ? credential.notes.slice(0, 27) + '...' : credential.notes)
+                        : '';
+                    rows.push({
+                        service: item.service,
+                        environment: item.environment,
+                        type: item.type,
+                        secret: masked,
+                        notes,
+                    });
+                }
+                catch {
+                    // If we can't fetch a credential, show what we have
+                    rows.push({
+                        service: item.service,
+                        environment: item.environment,
+                        type: item.type,
+                        secret: '(error)',
+                        notes: '',
+                    });
+                }
+            }
+            // Calculate column widths
+            const headers = { service: 'Service', environment: 'Environment', type: 'Type', secret: 'Secret', notes: 'Notes' };
+            const colWidths = {
+                service: Math.max(headers.service.length, ...rows.map((r) => r.service.length)),
+                environment: Math.max(headers.environment.length, ...rows.map((r) => r.environment.length)),
+                type: Math.max(headers.type.length, ...rows.map((r) => r.type.length)),
+                secret: Math.max(headers.secret.length, ...rows.map((r) => r.secret.length)),
+                notes: Math.max(headers.notes.length, ...rows.map((r) => r.notes.length)),
+            };
+            // Print header
+            const headerLine = [
+                headers.service.padEnd(colWidths.service),
+                headers.environment.padEnd(colWidths.environment),
+                headers.type.padEnd(colWidths.type),
+                headers.secret.padEnd(colWidths.secret),
+                headers.notes.padEnd(colWidths.notes),
+            ].join('  ');
+            console.log(headerLine);
+            const separator = [
+                '-'.repeat(colWidths.service),
+                '-'.repeat(colWidths.environment),
+                '-'.repeat(colWidths.type),
+                '-'.repeat(colWidths.secret),
+                '-'.repeat(colWidths.notes),
+            ].join('  ');
+            console.log(separator);
+            // Print rows
+            for (const row of rows) {
+                const line = [
+                    row.service.padEnd(colWidths.service),
+                    row.environment.padEnd(colWidths.environment),
+                    row.type.padEnd(colWidths.type),
+                    row.secret.padEnd(colWidths.secret),
+                    row.notes.padEnd(colWidths.notes),
+                ].join('  ');
+                console.log(line);
+            }
+        }
+        catch (err) {
+            if (err instanceof KeychainError) {
+                process.stderr.write(`Error: ${err.message}\n`);
+            }
+            else {
+                process.stderr.write(`Error: Failed to list credentials\n`);
+            }
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=list.js.map

package/dist/cli/commands/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../src/cli/commands/list.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEnE,KAAK,UAAU,WAAW;IACxB,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,IAAsB,EAAE,EAAE;QACvC,0CAA0C;QAC1C,IAAI,SAAkC,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,qBAAqB,IAAI,CAAC,CAAC;gBAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;YACpC,IAAI,KAAK,GAAyB,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAEvD,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC;YACjE,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;gBACrC,OAAO;YACT,CAAC;YAED,mFAAmF;YACnF,MAAM,IAAI,GAA4F,EAAE,CAAC;YAEzG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;oBACrE,MAAM,aAAa,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;oBACnD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;oBACzC,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,CAAC;wBAC3E,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;wBAC3F,CAAC,CAAC,EAAE,CAAC;oBACP,IAAI,CAAC,IAAI,CAAC;wBACR,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,MAAM,EAAE,MAAM;wBACd,KAAK;qBACN,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,oDAAoD;oBACpD,IAAI,CAAC,IAAI,CAAC;wBACR,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,MAAM,EAAE,SAAS;wBACjB,KAAK,EAAE,EAAE;qBACV,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,0BAA0B;YAC1B,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACnH,MAAM,SAAS,GAAG;gBAChB,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC/E,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBAC3F,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACtE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC5E,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aAC1E,CAAC;YAEF,eAAe;YACf,MAAM,UAAU,GAAG;gBACjB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;gBACzC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;gBACnC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;gBACvC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;aACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAExB,MAAM,SAAS,GAAG;gBAChB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC;gBACjC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;aAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAEvB,aAAa;YACb,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG;oBACX,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;oBACrC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC;oBAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;oBAC/B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;oBACnC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;iBAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/remove.d.ts

@@ -0,0 +1,7 @@
+/**
+ * CLI subcommand: ai-cred remove <service>
+ *
+ * Deletes a credential from the macOS Keychain.
+ */
+import { Command } from 'commander';
+export declare function makeRemoveCommand(): Command;

package/dist/cli/commands/remove.js

@@ -0,0 +1,53 @@
+/**
+ * CLI subcommand: ai-cred remove <service>
+ *
+ * Deletes a credential from the macOS Keychain.
+ */
+import { Command } from 'commander';
+import { KeychainAdapter, KeychainError } from '../../core/keychain-adapter.js';
+import { EnvironmentSchema } from '../../types/credential.js';
+import { ServiceNameSchema } from '../../utils/validation.js';
+import { auditLog } from '../../core/audit-logger.js';
+async function withAdapter() {
+    const adapter = new KeychainAdapter();
+    await adapter.initialize();
+    return adapter;
+}
+export function makeRemoveCommand() {
+    return new Command('remove')
+        .description('Delete a credential')
+        .argument('<service>', 'Service name')
+        .option('-e, --env <environment>', 'Environment', 'global')
+        .action(async (service, opts) => {
+        const svcResult = ServiceNameSchema.safeParse(service);
+        if (!svcResult.success) {
+            process.stderr.write(`Error: ${svcResult.error.issues[0]?.message ?? 'Invalid service name'}\n`);
+            process.exit(1);
+        }
+        const envResult = EnvironmentSchema.safeParse(opts.env);
+        if (!envResult.success) {
+            process.stderr.write(`Error: ${envResult.error.issues[0]?.message ?? 'Invalid environment'}\n`);
+            process.exit(1);
+        }
+        const env = envResult.data;
+        try {
+            const adapter = await withAdapter();
+            await adapter.delete(env, service);
+            await auditLog({ operation: 'delete', service, environment: env });
+            console.log(`Removed credential '${service}' from ${env}`);
+        }
+        catch (err) {
+            if (err instanceof KeychainError && err.exitCode === 44) {
+                process.stderr.write(`No credential found for '${service}' in ${env}\n`);
+            }
+            else if (err instanceof KeychainError) {
+                process.stderr.write(`Error: ${err.message}\n`);
+            }
+            else {
+                process.stderr.write(`Error: Failed to remove credential\n`);
+            }
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=remove.js.map

package/dist/cli/commands/remove.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.js","sourceRoot":"","sources":["../../../src/cli/commands/remove.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAEtD,KAAK,UAAU,WAAW;IACxB,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;SACzB,WAAW,CAAC,qBAAqB,CAAC;SAClC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;SACrC,MAAM,CAAC,yBAAyB,EAAE,aAAa,EAAE,QAAQ,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAAqB,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,sBAAsB,IAAI,CAAC,CAAC;YACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,qBAAqB,IAAI,CAAC,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC;QAE3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;YACpC,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACnC,MAAM,QAAQ,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,UAAU,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,OAAO,QAAQ,GAAG,IAAI,CAAC,CAAC;YAC3E,CAAC;iBAAM,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/update.d.ts

@@ -0,0 +1,8 @@
+/**
+ * CLI subcommand: ai-cred update <service>
+ *
+ * Replaces a credential via upsert (-U flag on add-generic-password).
+ * Full replacement: all fields must be provided.
+ */
+import { Command } from 'commander';
+export declare function makeUpdateCommand(): Command;

package/dist/cli/commands/update.js

@@ -0,0 +1,140 @@
+/**
+ * CLI subcommand: ai-cred update <service>
+ *
+ * Replaces a credential via upsert (-U flag on add-generic-password).
+ * Full replacement: all fields must be provided.
+ */
+import { Command } from 'commander';
+import { KeychainAdapter, KeychainError } from '../../core/keychain-adapter.js';
+import { CredentialSchema, EnvironmentSchema } from '../../types/credential.js';
+import { ServiceNameSchema } from '../../utils/validation.js';
+import { promptSecret } from '../utils/prompt.js';
+import { auditLog } from '../../core/audit-logger.js';
+async function withAdapter() {
+    const adapter = new KeychainAdapter();
+    await adapter.initialize();
+    return adapter;
+}
+export function makeUpdateCommand() {
+    return new Command('update')
+        .description('Update (replace) a credential')
+        .argument('<service>', 'Service name')
+        .requiredOption('-t, --type <type>', 'Credential type (ssh|jenkins|portainer|aws|api-key)')
+        .option('-e, --env <environment>', 'Environment', 'global')
+        .option('--notes <text>', 'Optional notes')
+        // SSH options
+        .option('--host <host>', 'SSH host')
+        .option('--port <port>', 'SSH port')
+        .option('--username <user>', 'Username')
+        .option('--password <pass>', 'Password')
+        .option('--key-path <path>', 'SSH key path')
+        // Jenkins/Portainer options
+        .option('--url <url>', 'Service URL')
+        .option('--api-token <token>', 'API token')
+        // AWS options
+        .option('--access-key-id <id>', 'AWS access key ID')
+        .option('--secret-access-key <key>', 'AWS secret access key')
+        .option('--region <region>', 'AWS region')
+        .option('--profile <name>', 'AWS profile name')
+        // API key options
+        .option('--key <key>', 'API key value')
+        .action(async (service, opts) => {
+        const svcResult = ServiceNameSchema.safeParse(service);
+        if (!svcResult.success) {
+            process.stderr.write(`Error: ${svcResult.error.issues[0]?.message ?? 'Invalid service name'}\n`);
+            process.exit(1);
+        }
+        const envResult = EnvironmentSchema.safeParse(opts.env);
+        if (!envResult.success) {
+            process.stderr.write(`Error: ${envResult.error.issues[0]?.message ?? 'Invalid environment'}\n`);
+            process.exit(1);
+        }
+        const env = envResult.data;
+        const credential = await buildCredential(opts);
+        if (!credential)
+            return;
+        const credResult = CredentialSchema.safeParse(credential);
+        if (!credResult.success) {
+            const issues = credResult.error.issues.map((i) => i.message).join(', ');
+            process.stderr.write(`Validation error: ${issues}\n`);
+            process.exit(1);
+        }
+        try {
+            const adapter = await withAdapter();
+            await adapter.store(env, service, credResult.data);
+            await auditLog({ operation: 'update', service, environment: env });
+            console.log(`Updated credential '${service}' in ${env}`);
+        }
+        catch (err) {
+            if (err instanceof KeychainError) {
+                process.stderr.write(`Error: ${err.message}\n`);
+            }
+            else {
+                process.stderr.write(`Error: Failed to update credential\n`);
+            }
+            process.exit(1);
+        }
+    });
+}
+async function buildCredential(opts) {
+    const type = opts.type;
+    const notes = opts.notes;
+    switch (type) {
+        case 'ssh': {
+            const password = opts.password ?? (await promptSecret('Password (or press Enter to skip): ') || undefined);
+            return {
+                type: 'ssh',
+                host: opts.host ?? '',
+                port: opts.port ? parseInt(opts.port, 10) : 22,
+                username: opts.username ?? '',
+                ...(password && { password }),
+                ...(opts.keyPath && { keyPath: opts.keyPath }),
+                ...(notes && { notes }),
+            };
+        }
+        case 'jenkins': {
+            const apiToken = opts.apiToken ?? await promptSecret('API Token: ');
+            return {
+                type: 'jenkins',
+                url: opts.url ?? '',
+                username: opts.username ?? '',
+                apiToken,
+                ...(notes && { notes }),
+            };
+        }
+        case 'portainer': {
+            const apiToken = opts.apiToken ?? await promptSecret('API Token: ');
+            return {
+                type: 'portainer',
+                url: opts.url ?? '',
+                apiToken,
+                ...(notes && { notes }),
+            };
+        }
+        case 'aws': {
+            const secretAccessKey = opts.secretAccessKey ?? await promptSecret('Secret Access Key: ');
+            return {
+                type: 'aws',
+                accessKeyId: opts.accessKeyId ?? '',
+                secretAccessKey,
+                region: opts.region ?? '',
+                ...(opts.profile && { profile: opts.profile }),
+                ...(notes && { notes }),
+            };
+        }
+        case 'api-key': {
+            const key = opts.key ?? await promptSecret('API Key: ');
+            return {
+                type: 'api-key',
+                key,
+                ...(opts.url && { url: opts.url }),
+                ...(notes && { notes }),
+            };
+        }
+        default:
+            process.stderr.write(`Error: Unknown credential type '${type}'. Must be ssh|jenkins|portainer|aws|api-key.\n`);
+            process.exit(1);
+            return null;
+    }
+}
+//# sourceMappingURL=update.js.map

package/dist/cli/commands/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../src/cli/commands/update.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAEtD,KAAK,UAAU,WAAW;IACxB,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;SACzB,WAAW,CAAC,+BAA+B,CAAC;SAC5C,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;SACrC,cAAc,CAAC,mBAAmB,EAAE,qDAAqD,CAAC;SAC1F,MAAM,CAAC,yBAAyB,EAAE,aAAa,EAAE,QAAQ,CAAC;SAC1D,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;QAC3C,cAAc;SACb,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,MAAM,CAAC,mBAAmB,EAAE,UAAU,CAAC;SACvC,MAAM,CAAC,mBAAmB,EAAE,UAAU,CAAC;SACvC,MAAM,CAAC,mBAAmB,EAAE,cAAc,CAAC;QAC5C,4BAA4B;SAC3B,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC;SACpC,MAAM,CAAC,qBAAqB,EAAE,WAAW,CAAC;QAC3C,cAAc;SACb,MAAM,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;SACnD,MAAM,CAAC,2BAA2B,EAAE,uBAAuB,CAAC;SAC5D,MAAM,CAAC,mBAAmB,EAAE,YAAY,CAAC;SACzC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QAC/C,kBAAkB;SACjB,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC;SACtC,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAAwC,EAAE,EAAE;QAC1E,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,sBAAsB,IAAI,CAAC,CAAC;YACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,qBAAqB,IAAI,CAAC,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC;QAE3B,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,MAAM,IAAI,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;YACpC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,QAAQ,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,QAAQ,GAAG,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAwC;IAExC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAEzB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,YAAY,CAAC,qCAAqC,CAAC,IAAI,SAAS,CAAC,CAAC;YAC3G,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;gBACrB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;gBAC7B,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;aACxB,CAAC;QACJ,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC;YACpE,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;gBAC7B,QAAQ;gBACR,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;aACxB,CAAC;QACJ,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC;YACpE,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;gBACnB,QAAQ;gBACR,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;aACxB,CAAC;QACJ,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC1F,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;gBACnC,eAAe;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;gBACzB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;aACxB,CAAC;QACJ,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;YACxD,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,GAAG;gBACH,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClC,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;aACxB,CAAC;QACJ,CAAC;QACD;YACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,iDAAiD,CAAC,CAAC;YAC/G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * ai-cred CLI entry point.
+ *
+ * Provides terminal-based credential management backed by the macOS Keychain.
+ * Development usage: npx tsx src/cli/index.ts <command>
+ */
+export {};

package/dist/cli/index.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+/**
+ * ai-cred CLI entry point.
+ *
+ * Provides terminal-based credential management backed by the macOS Keychain.
+ * Development usage: npx tsx src/cli/index.ts <command>
+ */
+import { Command } from 'commander';
+import { makeAddCommand } from './commands/add.js';
+import { makeGetCommand } from './commands/get.js';
+import { makeListCommand } from './commands/list.js';
+import { makeRemoveCommand } from './commands/remove.js';
+import { makeUpdateCommand } from './commands/update.js';
+const program = new Command();
+program
+    .name('ai-cred')
+    .description('Manage credentials stored in macOS Keychain')
+    .version('1.0.0');
+program.addCommand(makeAddCommand());
+program.addCommand(makeGetCommand());
+program.addCommand(makeListCommand());
+program.addCommand(makeRemoveCommand());
+program.addCommand(makeUpdateCommand());
+program.parse();
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,6CAA6C,CAAC;KAC1D,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;AACtC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;AACxC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAExC,OAAO,CAAC,KAAK,EAAE,CAAC"}