forkit-connect 0.1.0

package/dist/v1/credential-store.js

@@ -0,0 +1,797 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectCredentialStore = exports.WindowsDpapiCredentialBackend = exports.ConnectCredentialStoreError = void 0;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+class ConnectCredentialStoreError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ConnectCredentialStoreError';
+    }
+}
+exports.ConnectCredentialStoreError = ConnectCredentialStoreError;
+const SERVICE_BASE_NAME = 'ForkitConnect';
+const LEGACY_SERVICE_NAME = SERVICE_BASE_NAME;
+function nowIso() {
+    return new Date().toISOString();
+}
+function sanitizeSecret(value) {
+    const normalized = String(value || '').trim();
+    return normalized || null;
+}
+function buildCredentialRef(value) {
+    return (0, node_crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex').slice(0, 24);
+}
+function buildScopedServiceName(stateDir) {
+    const namespace = (0, node_crypto_1.createHash)('sha256')
+        .update(node_path_1.default.resolve(stateDir), 'utf8')
+        .digest('hex')
+        .slice(0, 16);
+    return `${SERVICE_BASE_NAME}.v1.${namespace}`;
+}
+function buildEmptyCredentialFileShape() {
+    return {
+        sessionRef: null,
+        runtimeSignalApiKeys: {},
+    };
+}
+function normalizedDetail(value) {
+    return String(value || '').trim();
+}
+function errnoCode(error) {
+    if (!error) {
+        return null;
+    }
+    const candidate = error;
+    return typeof candidate.code === 'string' ? candidate.code : null;
+}
+function linuxHeadlessCredentialGuidance() {
+    return 'Headless Linux can still authenticate by exporting FORKIT_CONNECT_SESSION_REF, but that path does not persist credentials locally.';
+}
+function windowsHeadlessCredentialGuidance() {
+    return 'Headless Windows can still authenticate by exporting FORKIT_CONNECT_SESSION_REF, but that path does not persist credentials locally.';
+}
+function linuxSecretServiceUnavailableDetail(reason) {
+    return `${reason} Install libsecret's secret-tool and run Forkit Connect inside a user session with DBUS_SESSION_BUS_ADDRESS set. ${linuxHeadlessCredentialGuidance()}`;
+}
+function windowsDpapiUnavailableDetail(reason) {
+    return `${reason} Windows secure credential storage requires powershell.exe and the signed-in user DPAPI profile. ${windowsHeadlessCredentialGuidance()}`;
+}
+function isCredentialNotFound(stderr, status) {
+    const normalized = stderr.toLowerCase();
+    return status === 44
+        || normalized.includes('could not be found')
+        || normalized.includes('the specified item could not be found');
+}
+function isLinuxSecretItemNotFound(stderr, status) {
+    const normalized = normalizedDetail(stderr).toLowerCase();
+    return (status === 1 && !normalized)
+        || normalized.includes('no such secret item')
+        || normalized.includes('not found');
+}
+function isWindowsCredentialNotFound(stderr, status) {
+    const normalized = normalizedDetail(stderr).toLowerCase();
+    return status === 44
+        || normalized.includes('cannot find path')
+        || normalized.includes('could not be found')
+        || normalized.includes('not found');
+}
+const WINDOWS_DPAPI_SCRIPTS = {
+    status: [
+        "$ErrorActionPreference = 'Stop'",
+        '[void][System.Security.Cryptography.DataProtectionScope]::CurrentUser',
+        "[Console]::Out.Write('windows-dpapi-ready')",
+    ].join('; '),
+    read: [
+        "$ErrorActionPreference = 'Stop'",
+        '$path = $env:FORKIT_CONNECT_WINDOWS_CREDENTIAL_PATH',
+        'if (-not (Test-Path -LiteralPath $path)) { exit 44 }',
+        '$raw = [System.IO.File]::ReadAllText($path, [System.Text.Encoding]::UTF8)',
+        '$trimmed = $raw.Trim()',
+        'if (-not $trimmed) { exit 44 }',
+        '$protected = [Convert]::FromBase64String($trimmed)',
+        '$entropy = [System.Text.Encoding]::UTF8.GetBytes($env:FORKIT_CONNECT_WINDOWS_CREDENTIAL_ENTROPY)',
+        '$plain = [System.Security.Cryptography.ProtectedData]::Unprotect($protected, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)',
+        '[Console]::Out.Write([System.Text.Encoding]::UTF8.GetString($plain))',
+    ].join('; '),
+    write: [
+        "$ErrorActionPreference = 'Stop'",
+        '$path = $env:FORKIT_CONNECT_WINDOWS_CREDENTIAL_PATH',
+        '$directory = Split-Path -Parent $path',
+        'if ($directory) { [System.IO.Directory]::CreateDirectory($directory) | Out-Null }',
+        '$inputText = [Console]::In.ReadToEnd()',
+        '$plainBytes = [System.Text.Encoding]::UTF8.GetBytes($inputText)',
+        '$entropy = [System.Text.Encoding]::UTF8.GetBytes($env:FORKIT_CONNECT_WINDOWS_CREDENTIAL_ENTROPY)',
+        '$protected = [System.Security.Cryptography.ProtectedData]::Protect($plainBytes, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)',
+        '$encoded = [Convert]::ToBase64String($protected)',
+        '[System.IO.File]::WriteAllText($path, $encoded, [System.Text.Encoding]::UTF8)',
+    ].join('; '),
+    delete: [
+        "$ErrorActionPreference = 'Stop'",
+        '$path = $env:FORKIT_CONNECT_WINDOWS_CREDENTIAL_PATH',
+        'if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Force }',
+    ].join('; '),
+};
+function normalizeWindowsDpapiCommandResult(result) {
+    return {
+        status: result.status ?? null,
+        stdout: String(result.stdout || ''),
+        stderr: String(result.stderr || ''),
+        error: result.error ?? null,
+    };
+}
+function runWindowsDpapiPowerShell(operation, options) {
+    const result = (0, node_child_process_1.spawnSync)('powershell.exe', [
+        '-NoProfile',
+        '-NonInteractive',
+        '-Command',
+        WINDOWS_DPAPI_SCRIPTS[operation],
+    ], {
+        encoding: 'utf8',
+        input: options.input,
+        env: {
+            ...process.env,
+            FORKIT_CONNECT_WINDOWS_CREDENTIAL_PATH: options.credentialPath,
+            FORKIT_CONNECT_WINDOWS_CREDENTIAL_ENTROPY: options.entropy,
+        },
+    });
+    return normalizeWindowsDpapiCommandResult(result);
+}
+class UnsupportedSecureCredentialBackend {
+    detail;
+    backend = 'unsupported';
+    constructor(detail) {
+        this.detail = detail;
+    }
+    read() {
+        return null;
+    }
+    write() {
+        throw new ConnectCredentialStoreError('secure_storage_unavailable', this.detail);
+    }
+    delete() {
+        throw new ConnectCredentialStoreError('secure_storage_unavailable', this.detail);
+    }
+    getStatus() {
+        return {
+            backend: this.backend,
+            available: false,
+            detail: this.detail,
+        };
+    }
+}
+class MacOsKeychainBackend {
+    serviceName;
+    backend = 'macos-keychain';
+    constructor(serviceName) {
+        this.serviceName = serviceName;
+    }
+    read(account) {
+        const result = (0, node_child_process_1.spawnSync)('security', [
+            'find-generic-password',
+            '-s',
+            this.serviceName,
+            '-a',
+            account,
+            '-w',
+        ], {
+            encoding: 'utf8',
+        });
+        if (result.error) {
+            throw new ConnectCredentialStoreError('secure_storage_read_failed', `Forkit Connect could not read secure credentials from macOS Keychain: ${result.error.message}`);
+        }
+        if (result.status === 0) {
+            return String(result.stdout || '').trim() || null;
+        }
+        if (isCredentialNotFound(String(result.stderr || ''), result.status)) {
+            return null;
+        }
+        throw new ConnectCredentialStoreError('secure_storage_read_failed', `Forkit Connect could not read secure credentials from macOS Keychain (${String(result.stderr || '').trim() || `status ${result.status}`}).`);
+    }
+    write(account, value) {
+        const result = (0, node_child_process_1.spawnSync)('security', [
+            'add-generic-password',
+            '-U',
+            '-s',
+            this.serviceName,
+            '-a',
+            account,
+            '-w',
+            value,
+        ], {
+            encoding: 'utf8',
+        });
+        if (result.error) {
+            throw new ConnectCredentialStoreError('secure_storage_write_failed', `Forkit Connect could not write secure credentials to macOS Keychain: ${result.error.message}`);
+        }
+        if (result.status === 0) {
+            return;
+        }
+        throw new ConnectCredentialStoreError('secure_storage_write_failed', `Forkit Connect could not write secure credentials to macOS Keychain (${String(result.stderr || '').trim() || `status ${result.status}`}).`);
+    }
+    delete(account) {
+        const result = (0, node_child_process_1.spawnSync)('security', [
+            'delete-generic-password',
+            '-s',
+            this.serviceName,
+            '-a',
+            account,
+        ], {
+            encoding: 'utf8',
+        });
+        if (result.error) {
+            throw new ConnectCredentialStoreError('secure_storage_delete_failed', `Forkit Connect could not remove secure credentials from macOS Keychain: ${result.error.message}`);
+        }
+        if (result.status === 0 || isCredentialNotFound(String(result.stderr || ''), result.status)) {
+            return;
+        }
+        throw new ConnectCredentialStoreError('secure_storage_delete_failed', `Forkit Connect could not remove secure credentials from macOS Keychain (${String(result.stderr || '').trim() || `status ${result.status}`}).`);
+    }
+    getStatus() {
+        const result = (0, node_child_process_1.spawnSync)('security', ['list-keychains'], {
+            encoding: 'utf8',
+        });
+        if (result.error) {
+            return {
+                backend: this.backend,
+                available: false,
+                detail: `macOS Keychain command failed: ${result.error.message}`,
+            };
+        }
+        if (result.status === 0) {
+            return {
+                backend: this.backend,
+                available: true,
+                detail: `macOS Keychain available for ${this.serviceName}.`,
+            };
+        }
+        return {
+            backend: this.backend,
+            available: false,
+            detail: `macOS Keychain unavailable (${String(result.stderr || '').trim() || `status ${result.status}`}).`,
+        };
+    }
+}
+class LinuxSecretServiceBackend {
+    serviceName;
+    backend = 'linux-secret-service';
+    constructor(serviceName) {
+        this.serviceName = serviceName;
+    }
+    baseArgs(account) {
+        return ['service', this.serviceName, 'account', account];
+    }
+    read(account) {
+        const result = (0, node_child_process_1.spawnSync)('secret-tool', [
+            'lookup',
+            ...this.baseArgs(account),
+        ], {
+            encoding: 'utf8',
+        });
+        if (result.error) {
+            const detail = errnoCode(result.error) === 'ENOENT'
+                ? linuxSecretServiceUnavailableDetail('Linux Secret Service CLI secret-tool is unavailable.')
+                : `Forkit Connect could not read secure credentials from Linux Secret Service: ${result.error.message}`;
+            throw new ConnectCredentialStoreError('secure_storage_read_failed', detail);
+        }
+        if (result.status === 0) {
+            return normalizedDetail(result.stdout) || null;
+        }
+        if (isLinuxSecretItemNotFound(String(result.stderr || ''), result.status)) {
+            return null;
+        }
+        throw new ConnectCredentialStoreError('secure_storage_read_failed', `Forkit Connect could not read secure credentials from Linux Secret Service (${normalizedDetail(result.stderr) || `status ${result.status}`}).`);
+    }
+    write(account, value) {
+        const result = (0, node_child_process_1.spawnSync)('secret-tool', [
+            'store',
+            '--label',
+            `Forkit Connect ${account}`,
+            ...this.baseArgs(account),
+        ], {
+            encoding: 'utf8',
+            input: `${value}\n`,
+        });
+        if (result.error) {
+            const detail = errnoCode(result.error) === 'ENOENT'
+                ? linuxSecretServiceUnavailableDetail('Linux Secret Service CLI secret-tool is unavailable.')
+                : `Forkit Connect could not write secure credentials to Linux Secret Service: ${result.error.message}`;
+            throw new ConnectCredentialStoreError('secure_storage_write_failed', detail);
+        }
+        if (result.status === 0) {
+            return;
+        }
+        throw new ConnectCredentialStoreError('secure_storage_write_failed', `Forkit Connect could not write secure credentials to Linux Secret Service (${normalizedDetail(result.stderr) || `status ${result.status}`}).`);
+    }
+    delete(account) {
+        const result = (0, node_child_process_1.spawnSync)('secret-tool', [
+            'clear',
+            ...this.baseArgs(account),
+        ], {
+            encoding: 'utf8',
+        });
+        if (result.error) {
+            const detail = errnoCode(result.error) === 'ENOENT'
+                ? linuxSecretServiceUnavailableDetail('Linux Secret Service CLI secret-tool is unavailable.')
+                : `Forkit Connect could not remove secure credentials from Linux Secret Service: ${result.error.message}`;
+            throw new ConnectCredentialStoreError('secure_storage_delete_failed', detail);
+        }
+        if (result.status === 0 || isLinuxSecretItemNotFound(String(result.stderr || ''), result.status)) {
+            return;
+        }
+        throw new ConnectCredentialStoreError('secure_storage_delete_failed', `Forkit Connect could not remove secure credentials from Linux Secret Service (${normalizedDetail(result.stderr) || `status ${result.status}`}).`);
+    }
+    getStatus() {
+        if (!normalizedDetail(process.env.DBUS_SESSION_BUS_ADDRESS)) {
+            return {
+                backend: this.backend,
+                available: false,
+                detail: linuxSecretServiceUnavailableDetail('Linux Secret Service session bus is unavailable.'),
+            };
+        }
+        const result = (0, node_child_process_1.spawnSync)('secret-tool', ['search', 'service', this.serviceName], {
+            encoding: 'utf8',
+        });
+        if (result.error) {
+            return {
+                backend: this.backend,
+                available: false,
+                detail: errnoCode(result.error) === 'ENOENT'
+                    ? linuxSecretServiceUnavailableDetail('Linux Secret Service CLI secret-tool is unavailable.')
+                    : `Linux Secret Service command failed: ${result.error.message}`,
+            };
+        }
+        const stderr = normalizedDetail(result.stderr);
+        if (result.status === 0 || (result.status === 1 && !stderr)) {
+            return {
+                backend: this.backend,
+                available: true,
+                detail: `Linux Secret Service available for ${this.serviceName}.`,
+            };
+        }
+        return {
+            backend: this.backend,
+            available: false,
+            detail: linuxSecretServiceUnavailableDetail(`Linux Secret Service unavailable (${stderr || `status ${result.status}`}).`),
+        };
+    }
+}
+class WindowsDpapiCredentialBackend {
+    serviceName;
+    stateDir;
+    runner;
+    backend = 'windows-dpapi';
+    constructor(serviceName, stateDir, runner = runWindowsDpapiPowerShell) {
+        this.serviceName = serviceName;
+        this.stateDir = stateDir;
+        this.runner = runner;
+    }
+    credentialPath(account) {
+        const accountHash = (0, node_crypto_1.createHash)('sha256')
+            .update(`${this.serviceName}|${account}`, 'utf8')
+            .digest('hex');
+        return node_path_1.default.join(this.stateDir, 'secure-credentials-win32', `${accountHash}.dpapi`);
+    }
+    entropy(account) {
+        return `${this.serviceName}|${account}`;
+    }
+    read(account) {
+        const result = this.runner('read', {
+            credentialPath: this.credentialPath(account),
+            entropy: this.entropy(account),
+        });
+        if (result.error) {
+            const detail = errnoCode(result.error) === 'ENOENT'
+                ? windowsDpapiUnavailableDetail('Windows PowerShell is unavailable for DPAPI secure storage.')
+                : `Forkit Connect could not read secure credentials from Windows DPAPI: ${result.error.message}`;
+            throw new ConnectCredentialStoreError('secure_storage_read_failed', detail);
+        }
+        if (result.status === 0) {
+            return normalizedDetail(result.stdout) || null;
+        }
+        if (isWindowsCredentialNotFound(result.stderr, result.status)) {
+            return null;
+        }
+        throw new ConnectCredentialStoreError('secure_storage_read_failed', `Forkit Connect could not read secure credentials from Windows DPAPI (${normalizedDetail(result.stderr) || `status ${result.status}`}).`);
+    }
+    write(account, value) {
+        const result = this.runner('write', {
+            credentialPath: this.credentialPath(account),
+            entropy: this.entropy(account),
+            input: value,
+        });
+        if (result.error) {
+            const detail = errnoCode(result.error) === 'ENOENT'
+                ? windowsDpapiUnavailableDetail('Windows PowerShell is unavailable for DPAPI secure storage.')
+                : `Forkit Connect could not write secure credentials to Windows DPAPI: ${result.error.message}`;
+            throw new ConnectCredentialStoreError('secure_storage_write_failed', detail);
+        }
+        if (result.status === 0) {
+            return;
+        }
+        throw new ConnectCredentialStoreError('secure_storage_write_failed', `Forkit Connect could not write secure credentials to Windows DPAPI (${normalizedDetail(result.stderr) || `status ${result.status}`}).`);
+    }
+    delete(account) {
+        const result = this.runner('delete', {
+            credentialPath: this.credentialPath(account),
+            entropy: this.entropy(account),
+        });
+        if (result.error) {
+            const detail = errnoCode(result.error) === 'ENOENT'
+                ? windowsDpapiUnavailableDetail('Windows PowerShell is unavailable for DPAPI secure storage.')
+                : `Forkit Connect could not remove secure credentials from Windows DPAPI: ${result.error.message}`;
+            throw new ConnectCredentialStoreError('secure_storage_delete_failed', detail);
+        }
+        if (result.status === 0 || isWindowsCredentialNotFound(result.stderr, result.status)) {
+            return;
+        }
+        throw new ConnectCredentialStoreError('secure_storage_delete_failed', `Forkit Connect could not remove secure credentials from Windows DPAPI (${normalizedDetail(result.stderr) || `status ${result.status}`}).`);
+    }
+    getStatus() {
+        const result = this.runner('status', {
+            credentialPath: node_path_1.default.join(this.stateDir, 'secure-credentials-win32', '.probe'),
+            entropy: this.serviceName,
+        });
+        if (result.error) {
+            return {
+                backend: this.backend,
+                available: false,
+                detail: errnoCode(result.error) === 'ENOENT'
+                    ? windowsDpapiUnavailableDetail('Windows PowerShell is unavailable for DPAPI secure storage.')
+                    : `Windows DPAPI command failed: ${result.error.message}`,
+            };
+        }
+        if (result.status === 0) {
+            return {
+                backend: this.backend,
+                available: true,
+                detail: `Windows DPAPI secure storage available for ${this.serviceName}.`,
+            };
+        }
+        return {
+            backend: this.backend,
+            available: false,
+            detail: windowsDpapiUnavailableDetail(`Windows DPAPI unavailable (${normalizedDetail(result.stderr) || `status ${result.status}`}).`),
+        };
+    }
+}
+exports.WindowsDpapiCredentialBackend = WindowsDpapiCredentialBackend;
+function createDefaultSecureCredentialBackend(stateDir) {
+    if (process.platform === 'darwin') {
+        return new MacOsKeychainBackend(buildScopedServiceName(stateDir));
+    }
+    if (process.platform === 'linux') {
+        return new LinuxSecretServiceBackend(buildScopedServiceName(stateDir));
+    }
+    if (process.platform === 'win32') {
+        return new WindowsDpapiCredentialBackend(buildScopedServiceName(stateDir), stateDir);
+    }
+    return new UnsupportedSecureCredentialBackend('Forkit Connect V1 secure credential storage is currently supported on macOS, Linux Secret Service, and Windows DPAPI.');
+}
+function createLegacySecureCredentialBackend() {
+    if (process.platform === 'darwin') {
+        return new MacOsKeychainBackend(LEGACY_SERVICE_NAME);
+    }
+    return null;
+}
+class ConnectCredentialStore {
+    stateDir;
+    sessionAccount = 'connect-session-ref';
+    credentialFile;
+    backend;
+    legacyBackend;
+    allowPlaintextFallback;
+    cache = new Map();
+    lastBackendError = null;
+    constructor(stateDir, backend, legacyBackend) {
+        this.stateDir = stateDir;
+        this.credentialFile = node_path_1.default.join(stateDir, 'credentials.v1.json');
+        this.backend = backend ?? createDefaultSecureCredentialBackend(stateDir);
+        this.legacyBackend = legacyBackend === undefined ? createLegacySecureCredentialBackend() : legacyBackend;
+        this.allowPlaintextFallback = process.env.FORKIT_CONNECT_ALLOW_PLAINTEXT_FALLBACK !== '0';
+    }
+    getCredentialFilePath() {
+        return this.credentialFile;
+    }
+    getStatus() {
+        const backendStatus = this.backend.getStatus();
+        const legacyPlaintextFilePresent = node_fs_1.default.existsSync(this.credentialFile);
+        const fallbackActive = this.allowPlaintextFallback && legacyPlaintextFilePresent;
+        const detail = fallbackActive
+            ? `${this.lastBackendError?.message ?? backendStatus.detail} Connect is using local plaintext credential fallback at ${this.credentialFile}.`
+            : this.lastBackendError?.message ?? backendStatus.detail;
+        return {
+            backend: backendStatus.backend,
+            available: fallbackActive || (backendStatus.available && !this.lastBackendError),
+            detail,
+            legacyPlaintextFilePresent,
+        };
+    }
+    migrateLegacyPlaintextFile() {
+        if (!node_fs_1.default.existsSync(this.credentialFile)) {
+            return;
+        }
+        const legacy = this.readLegacyFile();
+        const sessionRef = sanitizeSecret(legacy.sessionRef?.value);
+        const runtimeSignalEntries = Object.entries(legacy.runtimeSignalApiKeys ?? {});
+        let usedFallbackDuringMigration = false;
+        this.lastBackendError = null;
+        try {
+            if (sessionRef) {
+                this.writeAccount(this.sessionAccount, sessionRef);
+                if (this.allowPlaintextFallback && this.lastBackendError) {
+                    usedFallbackDuringMigration = true;
+                }
+            }
+            for (const [gaid, record] of runtimeSignalEntries) {
+                const normalizedKey = sanitizeSecret(record?.value);
+                if (!normalizedKey)
+                    continue;
+                const normalizedGaid = sanitizeSecret(gaid);
+                if (!normalizedGaid)
+                    continue;
+                this.writeAccount(this.runtimeSignalAccount(normalizedGaid), normalizedKey);
+                if (this.allowPlaintextFallback && this.lastBackendError) {
+                    usedFallbackDuringMigration = true;
+                }
+            }
+        }
+        catch (error) {
+            if (error instanceof ConnectCredentialStoreError) {
+                this.lastBackendError = new ConnectCredentialStoreError(error.code === 'secure_storage_write_failed' ? 'legacy_plaintext_migration_failed' : error.code, `Forkit Connect could not migrate existing plaintext credentials into secure storage. ${error.message}`);
+                return;
+            }
+            throw error;
+        }
+        if (usedFallbackDuringMigration) {
+            return;
+        }
+        node_fs_1.default.rmSync(this.credentialFile, { force: true });
+    }
+    getSessionRef() {
+        return this.readAccount(this.sessionAccount);
+    }
+    setSessionRef(sessionRef) {
+        const value = sanitizeSecret(sessionRef);
+        if (!value) {
+            return this.clearSessionRef();
+        }
+        const updatedAt = nowIso();
+        const credentialRef = buildCredentialRef(value);
+        this.writeAccount(this.sessionAccount, value);
+        return { credentialRef, updatedAt };
+    }
+    clearSessionRef() {
+        const updatedAt = nowIso();
+        this.deleteAccount(this.sessionAccount);
+        return { credentialRef: null, updatedAt };
+    }
+    getRuntimeSignalApiKey(gaid) {
+        const normalizedGaid = sanitizeSecret(gaid);
+        if (!normalizedGaid)
+            return null;
+        return this.readAccount(this.runtimeSignalAccount(normalizedGaid));
+    }
+    setRuntimeSignalApiKey(gaid, apiKey) {
+        const normalizedGaid = sanitizeSecret(gaid);
+        const normalizedKey = sanitizeSecret(apiKey);
+        if (!normalizedGaid || !normalizedKey) {
+            return this.clearRuntimeSignalApiKey(gaid);
+        }
+        const updatedAt = nowIso();
+        const credentialRef = buildCredentialRef(normalizedKey);
+        this.writeAccount(this.runtimeSignalAccount(normalizedGaid), normalizedKey);
+        return { credentialRef, updatedAt };
+    }
+    clearRuntimeSignalApiKey(gaid) {
+        const normalizedGaid = sanitizeSecret(gaid);
+        const updatedAt = nowIso();
+        if (!normalizedGaid) {
+            return { credentialRef: null, updatedAt };
+        }
+        this.deleteAccount(this.runtimeSignalAccount(normalizedGaid));
+        return { credentialRef: null, updatedAt };
+    }
+    runtimeSignalAccount(gaid) {
+        return `runtimeSignal:${gaid}`;
+    }
+    readAccount(account) {
+        try {
+            const current = this.backend.read(account);
+            if (current) {
+                this.cache.set(account, current);
+                this.lastBackendError = null;
+                return current;
+            }
+        }
+        catch (error) {
+            if (error instanceof ConnectCredentialStoreError) {
+                this.lastBackendError = error;
+            }
+            else {
+                this.lastBackendError = new ConnectCredentialStoreError('secure_storage_read_failed', error instanceof Error
+                    ? error.message
+                    : 'Forkit Connect could not read secure credentials.');
+            }
+        }
+        const legacy = this.readLegacyAccount(account);
+        if (legacy) {
+            try {
+                this.writeAccount(account, legacy);
+            }
+            catch {
+                this.cache.set(account, legacy);
+            }
+            return legacy;
+        }
+        this.cache.delete(account);
+        return null;
+    }
+    writeAccount(account, value) {
+        try {
+            this.backend.write(account, value);
+        }
+        catch (error) {
+            if (error instanceof ConnectCredentialStoreError) {
+                this.lastBackendError = error;
+                if (this.allowPlaintextFallback && (error.code === 'secure_storage_unavailable' || error.code === 'secure_storage_write_failed')) {
+                    this.writeLegacyAccount(account, value);
+                    this.cache.set(account, value);
+                    return;
+                }
+                throw error;
+            }
+            const wrapped = new ConnectCredentialStoreError('secure_storage_write_failed', error instanceof Error
+                ? error.message
+                : 'Forkit Connect could not write secure credentials.');
+            this.lastBackendError = wrapped;
+            if (this.allowPlaintextFallback) {
+                this.writeLegacyAccount(account, value);
+                this.cache.set(account, value);
+                return;
+            }
+            throw wrapped;
+        }
+        this.lastBackendError = null;
+        this.cache.set(account, value);
+        this.deleteLegacyAccount(account);
+    }
+    deleteAccount(account) {
+        try {
+            this.backend.delete(account);
+        }
+        catch (error) {
+            if (error instanceof ConnectCredentialStoreError) {
+                this.lastBackendError = error;
+                if (this.allowPlaintextFallback && (error.code === 'secure_storage_unavailable' || error.code === 'secure_storage_delete_failed')) {
+                    this.deleteLegacyAccount(account);
+                    this.cache.set(account, null);
+                    return;
+                }
+                throw error;
+            }
+            const wrapped = new ConnectCredentialStoreError('secure_storage_delete_failed', error instanceof Error
+                ? error.message
+                : 'Forkit Connect could not remove secure credentials.');
+            this.lastBackendError = wrapped;
+            if (this.allowPlaintextFallback) {
+                this.deleteLegacyAccount(account);
+                this.cache.set(account, null);
+                return;
+            }
+            throw wrapped;
+        }
+        this.lastBackendError = null;
+        this.cache.set(account, null);
+        this.deleteLegacyAccount(account);
+    }
+    writeLegacyAccount(account, value) {
+        const updatedAt = nowIso();
+        const credentialRef = buildCredentialRef(value);
+        const legacy = this.readLegacyFile();
+        if (account === this.sessionAccount) {
+            legacy.sessionRef = {
+                value,
+                ref: credentialRef,
+                updatedAt,
+            };
+            this.writeLegacyFile(legacy);
+            return;
+        }
+        if (account.startsWith('runtimeSignal:')) {
+            const gaid = sanitizeSecret(account.slice('runtimeSignal:'.length));
+            if (!gaid)
+                return;
+            legacy.runtimeSignalApiKeys = legacy.runtimeSignalApiKeys ?? {};
+            legacy.runtimeSignalApiKeys[gaid] = {
+                value,
+                ref: credentialRef,
+                updatedAt,
+            };
+            this.writeLegacyFile(legacy);
+        }
+    }
+    readLegacyAccount(account) {
+        if (account === this.sessionAccount) {
+            return sanitizeSecret(this.readLegacyFile().sessionRef?.value);
+        }
+        if (account.startsWith('runtimeSignal:')) {
+            const gaid = sanitizeSecret(account.slice('runtimeSignal:'.length));
+            if (!gaid)
+                return null;
+            return sanitizeSecret(this.readLegacyFile().runtimeSignalApiKeys?.[gaid]?.value);
+        }
+        if (!this.legacyBackend)
+            return null;
+        try {
+            return this.legacyBackend.read(account);
+        }
+        catch {
+            return null;
+        }
+    }
+    deleteLegacyAccount(account) {
+        const legacy = this.readLegacyFile();
+        let updatedLegacyFile = false;
+        if (account === this.sessionAccount && legacy.sessionRef) {
+            legacy.sessionRef = null;
+            updatedLegacyFile = true;
+        }
+        if (account.startsWith('runtimeSignal:')) {
+            const gaid = sanitizeSecret(account.slice('runtimeSignal:'.length));
+            if (gaid && legacy.runtimeSignalApiKeys?.[gaid]) {
+                delete legacy.runtimeSignalApiKeys[gaid];
+                updatedLegacyFile = true;
+            }
+        }
+        if (updatedLegacyFile) {
+            this.writeLegacyFile(legacy);
+        }
+        if (!this.legacyBackend)
+            return;
+        try {
+            this.legacyBackend.delete(account);
+        }
+        catch {
+            return;
+        }
+    }
+    readLegacyFile() {
+        if (!node_fs_1.default.existsSync(this.credentialFile)) {
+            return buildEmptyCredentialFileShape();
+        }
+        try {
+            const raw = node_fs_1.default.readFileSync(this.credentialFile, 'utf8');
+            const parsed = JSON.parse(raw);
+            return {
+                sessionRef: parsed.sessionRef ?? null,
+                runtimeSignalApiKeys: parsed.runtimeSignalApiKeys ?? {},
+            };
+        }
+        catch {
+            return buildEmptyCredentialFileShape();
+        }
+    }
+    writeLegacyFile(shape) {
+        const normalized = {
+            sessionRef: shape.sessionRef ?? null,
+            runtimeSignalApiKeys: shape.runtimeSignalApiKeys ?? {},
+        };
+        const hasSessionRef = Boolean(normalized.sessionRef?.value);
+        const hasRuntimeSignalKeys = Object.keys(normalized.runtimeSignalApiKeys || {}).length > 0;
+        if (!hasSessionRef && !hasRuntimeSignalKeys) {
+            node_fs_1.default.rmSync(this.credentialFile, { force: true });
+            return;
+        }
+        node_fs_1.default.writeFileSync(this.credentialFile, JSON.stringify(normalized, null, 2));
+    }
+}
+exports.ConnectCredentialStore = ConnectCredentialStore;
+//# sourceMappingURL=credential-store.js.map