bleam 0.0.11 → 0.0.13

package/dist/schema-LxnzAfgw.d.ts

@@ -0,0 +1,125 @@
+//#region src/schema.d.ts
+type JSONValue = string | number | boolean | {
+  [key: string]: JSONValue;
+} | JSONValue[];
+type FieldValue = JSONValue;
+type FieldToken = 'string' | 'number' | 'boolean';
+type PrimitiveValue = string | number | boolean;
+interface SchemaIssue {
+  message: string;
+  path?: ReadonlyArray<PropertyKey | {
+    key: PropertyKey;
+  }>;
+}
+type SchemaResult<Output> = {
+  value: Output;
+  issues?: undefined;
+} | {
+  issues: ReadonlyArray<SchemaIssue>;
+};
+interface StandardSchema<Input = unknown, Output = Input> {
+  readonly '~standard': {
+    readonly version: 1;
+    readonly vendor: string;
+    readonly validate: (value: unknown) => SchemaResult<Output>;
+    readonly types?: {
+      readonly input: Input;
+      readonly output: Output;
+    };
+  };
+}
+interface FieldBase<Kind extends 'string' | 'number' | 'boolean' | 'literal' | 'object' | 'array', HasDefault$1 extends boolean> {
+  readonly kind: Kind;
+  readonly hasDefault: HasDefault$1;
+}
+interface StringField<HasDefault$1 extends boolean = boolean> extends FieldBase<'string', HasDefault$1> {
+  readonly defaultValue?: string;
+}
+interface NumberField<HasDefault$1 extends boolean = boolean> extends FieldBase<'number', HasDefault$1> {
+  readonly defaultValue?: number;
+}
+interface BooleanField<HasDefault$1 extends boolean = boolean> extends FieldBase<'boolean', HasDefault$1> {
+  readonly defaultValue?: boolean;
+}
+interface LiteralField<Value$1 extends PrimitiveValue = PrimitiveValue, HasDefault$1 extends boolean = boolean> extends FieldBase<'literal', HasDefault$1> {
+  readonly value: Value$1;
+  readonly defaultValue?: Value$1;
+}
+interface ObjectField<Shape$1 extends SchemaShape = SchemaShape, HasDefault$1 extends boolean = boolean> extends FieldBase<'object', HasDefault$1> {
+  readonly shape: Shape$1;
+  readonly defaultFactory?: () => SchemaInput<Shape$1>;
+}
+interface ArrayField<Item$1 extends FieldSchema = FieldSchema, HasDefault$1 extends boolean = boolean> extends FieldBase<'array', HasDefault$1> {
+  readonly item: Item$1;
+  readonly defaultFactory?: () => ReadonlyArray<FieldInput<Item$1>>;
+}
+type FieldSchema = StringField | NumberField | BooleanField | LiteralField | ObjectField | ArrayField;
+type SchemaShape = Readonly<Record<string, FieldSchema>>;
+type HasDefault<Field extends FieldSchema> = Field extends FieldBase<Field['kind'], infer Default> ? Default : false;
+type FieldInput<Field extends FieldSchema> = Field extends StringField ? string : Field extends NumberField ? number : Field extends BooleanField ? boolean : Field extends LiteralField<infer Value> ? Value : Field extends ObjectField<infer Shape> ? SchemaInput<Shape> : Field extends ArrayField<infer Item> ? Array<FieldInput<Item>> : never;
+type FieldOutput<Field extends FieldSchema> = Field extends StringField ? string : Field extends NumberField ? number : Field extends BooleanField ? boolean : Field extends LiteralField<infer Value> ? Value : Field extends ObjectField<infer Shape> ? SchemaOutput<Shape> : Field extends ArrayField<infer Item> ? Array<FieldOutput<Item>> : never;
+type DefaultKeys<Shape$1 extends SchemaShape> = { [Key in keyof Shape$1]-?: HasDefault<Shape$1[Key]> extends true ? Key : never }[keyof Shape$1];
+type OptionalKeys<Shape$1 extends SchemaShape> = Exclude<keyof Shape$1, DefaultKeys<Shape$1>>;
+type SchemaInput<Shape$1 extends SchemaShape> = { [Key in keyof Shape$1]?: FieldInput<Shape$1[Key]> };
+type SchemaOutput<Shape$1 extends SchemaShape> = { [Key in DefaultKeys<Shape$1>]: FieldOutput<Shape$1[Key]> } & { [Key in OptionalKeys<Shape$1>]?: FieldOutput<Shape$1[Key]> };
+type DeepPartial<Value$1> = Value$1 extends ReadonlyArray<infer Item> ? Array<DeepPartial<Item>> : Value$1 extends object ? { [Key in keyof Value$1]?: DeepPartial<Value$1[Key]> } : Value$1;
+type SchemaPatch<Shape$1 extends SchemaShape> = DeepPartial<SchemaInput<Shape$1>>;
+type NestedFieldPath<Prefix extends string, Field extends FieldSchema> = Field extends ObjectField<infer Shape> ? `${Prefix}.${FieldPath<Shape>}` : never;
+type FieldPath<Shape$1 extends SchemaShape> = { [Key in Extract<keyof Shape$1, string>]: Key | NestedFieldPath<Key, Shape$1[Key]> }[Extract<keyof Shape$1, string>];
+type ValueAtPath<Shape$1 extends SchemaShape, Path extends string> = Path extends `${infer Key}.${infer Rest}` ? Key extends keyof Shape$1 ? Shape$1[Key] extends ObjectField<infer NestedShape> ? ValueAtPath<NestedShape, Rest> | (HasDefault<Shape$1[Key]> extends true ? never : undefined) : never : never : Path extends keyof Shape$1 ? FieldOutput<Shape$1[Path]> | (HasDefault<Shape$1[Path]> extends true ? never : undefined) : never;
+type ValueAtFieldPath<Shape$1 extends SchemaShape, Path extends FieldPath<Shape$1>> = ValueAtPath<Shape$1, Path>;
+type FieldAtPath<Shape$1 extends SchemaShape, Path extends string> = Path extends `${infer Key}.${infer Rest}` ? Key extends keyof Shape$1 ? Shape$1[Key] extends ObjectField<infer NestedShape> ? FieldAtPath<NestedShape, Rest> : never : never : Path extends keyof Shape$1 ? Shape$1[Path] : never;
+type FieldAtFieldPath<Shape$1 extends SchemaShape, Path extends FieldPath<Shape$1>> = FieldAtPath<Shape$1, Path>;
+type InferInput<Value$1 extends StandardSchema> = NonNullable<Value$1['~standard']['types']>['input'];
+type InferOutput<Value$1 extends StandardSchema> = NonNullable<Value$1['~standard']['types']>['output'];
+declare class SchemaError extends Error {
+  readonly issues: ReadonlyArray<SchemaIssue>;
+  constructor(issues: ReadonlyArray<SchemaIssue>);
+}
+type SchemaJSONSchema = {
+  type: FieldToken;
+  default?: PrimitiveValue;
+} | {
+  type: FieldToken;
+  const: PrimitiveValue;
+  default?: PrimitiveValue;
+} | {
+  type: 'array';
+  items: SchemaJSONSchema;
+} | {
+  type: 'object';
+  properties: Record<string, SchemaJSONSchema>;
+  required: string[];
+  additionalProperties: false;
+};
+interface BleamSchema<Input, Output> extends StandardSchema<Input, Output> {
+  parse(value: unknown): Output;
+  safeParse(value: unknown): SchemaResult<Output>;
+  toJSONSchema(): Extract<SchemaJSONSchema, {
+    type: 'object';
+  }>;
+  transform<NextOutput>(transform: (value: Output) => NextOutput): BleamSchema<Input, NextOutput>;
+}
+type PrimitiveOptions<Value$1 extends PrimitiveValue> = {
+  default: Value$1;
+};
+type FactoryOptions<Value$1> = {
+  default: () => Value$1;
+};
+declare function string(): StringField<false>;
+declare function string(options: PrimitiveOptions<string>): StringField<true>;
+declare function number(): NumberField<false>;
+declare function number(options: PrimitiveOptions<number>): NumberField<true>;
+declare function boolean(): BooleanField<false>;
+declare function boolean(options: PrimitiveOptions<boolean>): BooleanField<true>;
+declare function literal<const Value$1 extends PrimitiveValue>(value: Value$1): LiteralField<Value$1, false>;
+declare function literal<const Value$1 extends PrimitiveValue>(value: Value$1, options: PrimitiveOptions<Value$1>): LiteralField<Value$1, true>;
+declare function object<const Shape$1 extends SchemaShape>(shape: Shape$1): ObjectField<Shape$1, false>;
+declare function object<const Shape$1 extends SchemaShape>(shape: Shape$1, options: FactoryOptions<SchemaInput<Shape$1>>): ObjectField<Shape$1, true>;
+declare function array<const Item$1 extends FieldSchema>(item: Item$1): ArrayField<Item$1, false>;
+declare function array<const Item$1 extends FieldSchema>(item: Item$1, options: FactoryOptions<ReadonlyArray<FieldInput<Item$1>>>): ArrayField<Item$1, true>;
+declare function schema<const Shape$1 extends SchemaShape>(shape: Shape$1): BleamSchema<SchemaInput<Shape$1>, SchemaOutput<Shape$1>>;
+declare function getFieldSchema<Shape$1 extends SchemaShape, Path extends FieldPath<Shape$1>>(shape: Shape$1, path: Path): FieldAtFieldPath<Shape$1, Path>;
+declare function getValueAtPath<Shape$1 extends SchemaShape, Path extends FieldPath<Shape$1>>(value: SchemaOutput<Shape$1>, path: Path): ValueAtFieldPath<Shape$1, Path>;
+//#endregion
+export { array as A, SchemaOutput as C, StandardSchema as D, SchemaShape as E, number as F, object as I, schema as L, getFieldSchema as M, getValueAtPath as N, StringField as O, literal as P, string as R, SchemaJSONSchema as S, SchemaResult as T, ObjectField as _, FieldAtFieldPath as a, SchemaInput as b, FieldPath as c, FieldValue as d, InferInput as f, NumberField as g, LiteralField as h, DeepPartial as i, boolean as j, ValueAtFieldPath as k, FieldSchema as l, JSONValue as m, BleamSchema as n, FieldInput as o, InferOutput as p, BooleanField as r, FieldOutput as s, ArrayField as t, FieldToken as u, PrimitiveValue as v, SchemaPatch as w, SchemaIssue as x, SchemaError as y };

package/dist/schema.cjs

@@ -1,4 +1,12 @@
-const require_schema = require('./schema-rQ13mrpD.cjs');
+const require_schema = require('./schema-B7SLUBLN.cjs');
 
 exports.SchemaError = require_schema.SchemaError;
-exports.schema = require_schema.schema;
+exports.array = require_schema.array;
+exports.boolean = require_schema.boolean;
+exports.getFieldSchema = require_schema.getFieldSchema;
+exports.getValueAtPath = require_schema.getValueAtPath;
+exports.literal = require_schema.literal;
+exports.number = require_schema.number;
+exports.object = require_schema.object;
+exports.schema = require_schema.schema;
+exports.string = require_schema.string;

package/dist/schema.d.cts

@@ -1,2 +1,2 @@
-import { a as FieldValue, c as SchemaError, d as SchemaJSONSchema, f as SchemaOutput, g as schema, h as StandardSchema, i as FieldToken, l as SchemaInput, m as SchemaShape, n as FieldDefault, o as InferInput, p as SchemaResult, r as FieldSchema, s as InferOutput, t as BleamSchema, u as SchemaIssue } from "./schema-oeOrd3i1.cjs";
-export { BleamSchema, FieldDefault, FieldSchema, FieldToken, FieldValue, InferInput, InferOutput, SchemaError, SchemaInput, SchemaIssue, SchemaJSONSchema, SchemaOutput, SchemaResult, SchemaShape, StandardSchema, schema };
+import { A as array, C as SchemaOutput, D as StandardSchema, E as SchemaShape, F as number, I as object, L as schema, M as getFieldSchema, N as getValueAtPath, O as StringField, P as literal, R as string, S as SchemaJSONSchema, T as SchemaResult, _ as ObjectField, a as FieldAtFieldPath, b as SchemaInput, c as FieldPath, d as FieldValue, f as InferInput, g as NumberField, h as LiteralField, i as DeepPartial, j as boolean, k as ValueAtFieldPath, l as FieldSchema, m as JSONValue, n as BleamSchema, o as FieldInput, p as InferOutput, r as BooleanField, s as FieldOutput, t as ArrayField, u as FieldToken, v as PrimitiveValue, w as SchemaPatch, x as SchemaIssue, y as SchemaError } from "./schema-BWsDPc6c.cjs";
+export { ArrayField, BleamSchema, BooleanField, DeepPartial, FieldAtFieldPath, FieldInput, FieldOutput, FieldPath, FieldSchema, FieldToken, FieldValue, InferInput, InferOutput, JSONValue, LiteralField, NumberField, ObjectField, PrimitiveValue, SchemaError, SchemaInput, SchemaIssue, SchemaJSONSchema, SchemaOutput, SchemaPatch, SchemaResult, SchemaShape, StandardSchema, StringField, ValueAtFieldPath, array, boolean, getFieldSchema, getValueAtPath, literal, number, object, schema, string };

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { a as FieldValue, c as SchemaError, d as SchemaJSONSchema, f as SchemaOutput, g as schema, h as StandardSchema, i as FieldToken, l as SchemaInput, m as SchemaShape, n as FieldDefault, o as InferInput, p as SchemaResult, r as FieldSchema, s as InferOutput, t as BleamSchema, u as SchemaIssue } from "./schema-CYh6n8GS.js";
-export { BleamSchema, FieldDefault, FieldSchema, FieldToken, FieldValue, InferInput, InferOutput, SchemaError, SchemaInput, SchemaIssue, SchemaJSONSchema, SchemaOutput, SchemaResult, SchemaShape, StandardSchema, schema };
+import { A as array, C as SchemaOutput, D as StandardSchema, E as SchemaShape, F as number, I as object, L as schema, M as getFieldSchema, N as getValueAtPath, O as StringField, P as literal, R as string, S as SchemaJSONSchema, T as SchemaResult, _ as ObjectField, a as FieldAtFieldPath, b as SchemaInput, c as FieldPath, d as FieldValue, f as InferInput, g as NumberField, h as LiteralField, i as DeepPartial, j as boolean, k as ValueAtFieldPath, l as FieldSchema, m as JSONValue, n as BleamSchema, o as FieldInput, p as InferOutput, r as BooleanField, s as FieldOutput, t as ArrayField, u as FieldToken, v as PrimitiveValue, w as SchemaPatch, x as SchemaIssue, y as SchemaError } from "./schema-LxnzAfgw.js";
+export { ArrayField, BleamSchema, BooleanField, DeepPartial, FieldAtFieldPath, FieldInput, FieldOutput, FieldPath, FieldSchema, FieldToken, FieldValue, InferInput, InferOutput, JSONValue, LiteralField, NumberField, ObjectField, PrimitiveValue, SchemaError, SchemaInput, SchemaIssue, SchemaJSONSchema, SchemaOutput, SchemaPatch, SchemaResult, SchemaShape, StandardSchema, StringField, ValueAtFieldPath, array, boolean, getFieldSchema, getValueAtPath, literal, number, object, schema, string };

package/dist/schema.js

@@ -1,3 +1,3 @@
-import { n as schema, t as SchemaError } from "./schema-Bo5Jvqus.js";
+import { a as getValueAtPath, c as object, i as getFieldSchema, l as schema, n as array, o as literal, r as boolean, s as number, t as SchemaError, u as string } from "./schema-B7ELMpuI.js";
 
-export { SchemaError, schema };
+export { SchemaError, array, boolean, getFieldSchema, getValueAtPath, literal, number, object, schema, string };

package/dist/secrets.cjs

@@ -0,0 +1,146 @@
+const require_native_runtime = require('./native-runtime-CsXnXkQn.cjs');
+const require_app_storage = require('./app-storage-D8W4n8ey.cjs');
+
+//#region src/native-secrets.ts
+var NativeSecretsError = class extends Error {
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+		this.name = "NativeSecretsError";
+	}
+};
+let securityLoaded = false;
+function ensureSecurity() {
+	if (securityLoaded) return;
+	const nativeScript = require_native_runtime.ensureNativeScript();
+	if (!nativeScript.isFrameworkLoaded("Security") && !nativeScript.loadFramework("Security")) throw new NativeSecretsError(void 0, "Keychain is unavailable");
+	securityLoaded = true;
+}
+function dictionary(capacity) {
+	return NSMutableDictionary.dictionaryWithCapacity(capacity);
+}
+function set(target, key, value) {
+	target.setObjectForKey(value, key);
+}
+function serviceName() {
+	return NSString.stringWithString(`dev.bleam.apps.${require_app_storage.currentAppStorageKey()}.secrets`);
+}
+function baseQuery(key) {
+	ensureSecurity();
+	const query = dictionary(4);
+	set(query, kSecClass, kSecClassGenericPassword);
+	set(query, kSecAttrService, serviceName());
+	set(query, kSecAttrAccount, NSString.stringWithString(key));
+	set(query, kSecUseDataProtectionKeychain, NSNumber.numberWithBool(true));
+	return query;
+}
+function statusMessage(status) {
+	const message = SecCopyErrorMessageString(status, null);
+	return message ? String(message) : `Keychain operation failed (${status})`;
+}
+function failure(status) {
+	return new NativeSecretsError(status, statusMessage(status));
+}
+function nativeSetItem(key, value) {
+	const query = baseQuery(key);
+	const encoded = NSString.stringWithString(value).dataUsingEncoding(NSUTF8StringEncoding);
+	const update = dictionary(1);
+	set(update, kSecValueData, encoded);
+	const updateStatus = SecItemUpdate(query, update);
+	if (updateStatus === errSecSuccess) return;
+	if (updateStatus !== errSecItemNotFound) throw failure(updateStatus);
+	set(query, kSecValueData, encoded);
+	set(query, kSecAttrAccessible, kSecAttrAccessibleWhenUnlockedThisDeviceOnly);
+	const addStatus = SecItemAdd(query, null);
+	if (addStatus === errSecSuccess) return;
+	if (addStatus === errSecDuplicateItem) {
+		const retryStatus = SecItemUpdate(baseQuery(key), update);
+		if (retryStatus === errSecSuccess) return;
+		throw failure(retryStatus);
+	}
+	throw failure(addStatus);
+}
+function nativeGetItem(key) {
+	const query = baseQuery(key);
+	set(query, kSecReturnData, NSNumber.numberWithBool(true));
+	set(query, kSecMatchLimit, kSecMatchLimitOne);
+	const result = new interop.Reference();
+	const status = SecItemCopyMatching(query, result);
+	if (status === errSecItemNotFound) return void 0;
+	if (status !== errSecSuccess) throw failure(status);
+	if (!result.value) throw new NativeSecretsError(errSecDecode, "Keychain returned invalid data");
+	const decoded = NSString.alloc().initWithDataEncoding(result.value, NSUTF8StringEncoding);
+	if (!decoded) throw new NativeSecretsError(errSecDecode, "Keychain returned invalid data");
+	return String(decoded);
+}
+function nativeHasItem(key) {
+	const status = SecItemCopyMatching(baseQuery(key), null);
+	if (status === errSecSuccess) return true;
+	if (status === errSecItemNotFound) return false;
+	throw failure(status);
+}
+function nativeRemoveItem(key) {
+	const status = SecItemDelete(baseQuery(key));
+	if (status === errSecSuccess || status === errSecItemNotFound) return;
+	throw failure(status);
+}
+
+//#endregion
+//#region src/secrets.ts
+var SecretsError = class extends Error {
+	constructor(code, message, status, cause) {
+		super(message);
+		this.code = code;
+		this.status = status;
+		this.cause = cause;
+		this.name = "SecretsError";
+	}
+};
+function validateKey(key) {
+	if (typeof key !== "string" || key.trim().length === 0) throw new SecretsError("invalid_key", "Secret key must not be empty");
+}
+function mapError(error) {
+	if (error instanceof SecretsError) return error;
+	if (!(error instanceof NativeSecretsError)) return new SecretsError("operation_failed", "Keychain operation failed", void 0, error);
+	return new SecretsError(error.status === void 0 || error.status === errSecNotAvailable ? "unavailable" : error.status === errSecInteractionNotAllowed ? "interaction_not_allowed" : error.status === errSecAuthFailed || error.status === errSecUserCanceled ? "authentication_failed" : error.status === errSecMissingEntitlement || error.status === errSecNoAccessForItem ? "permission_denied" : error.status === errSecDecode ? "invalid_data" : "operation_failed", error.message, error.status, error);
+}
+async function setItem(key, value) {
+	validateKey(key);
+	if (typeof value !== "string") throw new SecretsError("invalid_value", "Secret value must be a string");
+	try {
+		nativeSetItem(key, value);
+	} catch (error) {
+		throw mapError(error);
+	}
+}
+async function getItem(key) {
+	validateKey(key);
+	try {
+		return nativeGetItem(key);
+	} catch (error) {
+		throw mapError(error);
+	}
+}
+async function hasItem(key) {
+	validateKey(key);
+	try {
+		return nativeHasItem(key);
+	} catch (error) {
+		throw mapError(error);
+	}
+}
+async function removeItem(key) {
+	validateKey(key);
+	try {
+		nativeRemoveItem(key);
+	} catch (error) {
+		throw mapError(error);
+	}
+}
+
+//#endregion
+exports.SecretsError = SecretsError;
+exports.getItem = getItem;
+exports.hasItem = hasItem;
+exports.removeItem = removeItem;
+exports.setItem = setItem;

package/dist/secrets.d.cts

@@ -0,0 +1,14 @@
+//#region src/secrets.d.ts
+type SecretsErrorCode = 'invalid_key' | 'invalid_value' | 'unavailable' | 'interaction_not_allowed' | 'authentication_failed' | 'permission_denied' | 'invalid_data' | 'operation_failed';
+declare class SecretsError extends Error {
+  readonly code: SecretsErrorCode;
+  readonly status?: number | undefined;
+  readonly cause?: unknown | undefined;
+  constructor(code: SecretsErrorCode, message: string, status?: number | undefined, cause?: unknown | undefined);
+}
+declare function setItem(key: string, value: string): Promise<void>;
+declare function getItem(key: string): Promise<string | undefined>;
+declare function hasItem(key: string): Promise<boolean>;
+declare function removeItem(key: string): Promise<void>;
+//#endregion
+export { SecretsError, SecretsErrorCode, getItem, hasItem, removeItem, setItem };

package/dist/secrets.d.ts

@@ -0,0 +1,14 @@
+//#region src/secrets.d.ts
+type SecretsErrorCode = 'invalid_key' | 'invalid_value' | 'unavailable' | 'interaction_not_allowed' | 'authentication_failed' | 'permission_denied' | 'invalid_data' | 'operation_failed';
+declare class SecretsError extends Error {
+  readonly code: SecretsErrorCode;
+  readonly status?: number | undefined;
+  readonly cause?: unknown | undefined;
+  constructor(code: SecretsErrorCode, message: string, status?: number | undefined, cause?: unknown | undefined);
+}
+declare function setItem(key: string, value: string): Promise<void>;
+declare function getItem(key: string): Promise<string | undefined>;
+declare function hasItem(key: string): Promise<boolean>;
+declare function removeItem(key: string): Promise<void>;
+//#endregion
+export { SecretsError, SecretsErrorCode, getItem, hasItem, removeItem, setItem };

package/dist/secrets.js

@@ -0,0 +1,142 @@
+import { t as ensureNativeScript } from "./native-runtime-C85Nuc4F.js";
+import { t as currentAppStorageKey } from "./app-storage-Isi5Bo0R.js";
+
+//#region src/native-secrets.ts
+var NativeSecretsError = class extends Error {
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+		this.name = "NativeSecretsError";
+	}
+};
+let securityLoaded = false;
+function ensureSecurity() {
+	if (securityLoaded) return;
+	const nativeScript = ensureNativeScript();
+	if (!nativeScript.isFrameworkLoaded("Security") && !nativeScript.loadFramework("Security")) throw new NativeSecretsError(void 0, "Keychain is unavailable");
+	securityLoaded = true;
+}
+function dictionary(capacity) {
+	return NSMutableDictionary.dictionaryWithCapacity(capacity);
+}
+function set(target, key, value) {
+	target.setObjectForKey(value, key);
+}
+function serviceName() {
+	return NSString.stringWithString(`dev.bleam.apps.${currentAppStorageKey()}.secrets`);
+}
+function baseQuery(key) {
+	ensureSecurity();
+	const query = dictionary(4);
+	set(query, kSecClass, kSecClassGenericPassword);
+	set(query, kSecAttrService, serviceName());
+	set(query, kSecAttrAccount, NSString.stringWithString(key));
+	set(query, kSecUseDataProtectionKeychain, NSNumber.numberWithBool(true));
+	return query;
+}
+function statusMessage(status) {
+	const message = SecCopyErrorMessageString(status, null);
+	return message ? String(message) : `Keychain operation failed (${status})`;
+}
+function failure(status) {
+	return new NativeSecretsError(status, statusMessage(status));
+}
+function nativeSetItem(key, value) {
+	const query = baseQuery(key);
+	const encoded = NSString.stringWithString(value).dataUsingEncoding(NSUTF8StringEncoding);
+	const update = dictionary(1);
+	set(update, kSecValueData, encoded);
+	const updateStatus = SecItemUpdate(query, update);
+	if (updateStatus === errSecSuccess) return;
+	if (updateStatus !== errSecItemNotFound) throw failure(updateStatus);
+	set(query, kSecValueData, encoded);
+	set(query, kSecAttrAccessible, kSecAttrAccessibleWhenUnlockedThisDeviceOnly);
+	const addStatus = SecItemAdd(query, null);
+	if (addStatus === errSecSuccess) return;
+	if (addStatus === errSecDuplicateItem) {
+		const retryStatus = SecItemUpdate(baseQuery(key), update);
+		if (retryStatus === errSecSuccess) return;
+		throw failure(retryStatus);
+	}
+	throw failure(addStatus);
+}
+function nativeGetItem(key) {
+	const query = baseQuery(key);
+	set(query, kSecReturnData, NSNumber.numberWithBool(true));
+	set(query, kSecMatchLimit, kSecMatchLimitOne);
+	const result = new interop.Reference();
+	const status = SecItemCopyMatching(query, result);
+	if (status === errSecItemNotFound) return void 0;
+	if (status !== errSecSuccess) throw failure(status);
+	if (!result.value) throw new NativeSecretsError(errSecDecode, "Keychain returned invalid data");
+	const decoded = NSString.alloc().initWithDataEncoding(result.value, NSUTF8StringEncoding);
+	if (!decoded) throw new NativeSecretsError(errSecDecode, "Keychain returned invalid data");
+	return String(decoded);
+}
+function nativeHasItem(key) {
+	const status = SecItemCopyMatching(baseQuery(key), null);
+	if (status === errSecSuccess) return true;
+	if (status === errSecItemNotFound) return false;
+	throw failure(status);
+}
+function nativeRemoveItem(key) {
+	const status = SecItemDelete(baseQuery(key));
+	if (status === errSecSuccess || status === errSecItemNotFound) return;
+	throw failure(status);
+}
+
+//#endregion
+//#region src/secrets.ts
+var SecretsError = class extends Error {
+	constructor(code, message, status, cause) {
+		super(message);
+		this.code = code;
+		this.status = status;
+		this.cause = cause;
+		this.name = "SecretsError";
+	}
+};
+function validateKey(key) {
+	if (typeof key !== "string" || key.trim().length === 0) throw new SecretsError("invalid_key", "Secret key must not be empty");
+}
+function mapError(error) {
+	if (error instanceof SecretsError) return error;
+	if (!(error instanceof NativeSecretsError)) return new SecretsError("operation_failed", "Keychain operation failed", void 0, error);
+	return new SecretsError(error.status === void 0 || error.status === errSecNotAvailable ? "unavailable" : error.status === errSecInteractionNotAllowed ? "interaction_not_allowed" : error.status === errSecAuthFailed || error.status === errSecUserCanceled ? "authentication_failed" : error.status === errSecMissingEntitlement || error.status === errSecNoAccessForItem ? "permission_denied" : error.status === errSecDecode ? "invalid_data" : "operation_failed", error.message, error.status, error);
+}
+async function setItem(key, value) {
+	validateKey(key);
+	if (typeof value !== "string") throw new SecretsError("invalid_value", "Secret value must be a string");
+	try {
+		nativeSetItem(key, value);
+	} catch (error) {
+		throw mapError(error);
+	}
+}
+async function getItem(key) {
+	validateKey(key);
+	try {
+		return nativeGetItem(key);
+	} catch (error) {
+		throw mapError(error);
+	}
+}
+async function hasItem(key) {
+	validateKey(key);
+	try {
+		return nativeHasItem(key);
+	} catch (error) {
+		throw mapError(error);
+	}
+}
+async function removeItem(key) {
+	validateKey(key);
+	try {
+		nativeRemoveItem(key);
+	} catch (error) {
+		throw mapError(error);
+	}
+}
+
+//#endregion
+export { SecretsError, getItem, hasItem, removeItem, setItem };