frely-cli 0.4.1 → 0.5.0

package/dist/credential-command.js

@@ -0,0 +1,42 @@
+import { spawn } from "node:child_process";
+/** Secrets travel through pipes, never command arguments, a shell, or error messages. */
+export const runCredentialCommand = (file, args, input) => new Promise((resolve, reject) => {
+    const child = spawn(file, args, { shell: false, windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
+    const stdout = [];
+    const stderr = [];
+    let bytes = 0;
+    let settled = false;
+    const finish = (error, result) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(timer);
+        if (error)
+            reject(error);
+        else
+            resolve(result);
+    };
+    const timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        finish(new Error("Credential service timed out. Unlock the OS credential store or configure FRELY_CREDENTIAL_STORE=encrypted-file with FRELY_CREDENTIAL_KEY."));
+    }, 15_000);
+    const collect = (stream, chunk) => {
+        bytes += chunk.length;
+        if (bytes > 2 * 1024 * 1024) {
+            child.kill("SIGKILL");
+            finish(new Error("Credential service response exceeded the size limit."));
+            return;
+        }
+        if (stream === "stdout")
+            stdout.push(chunk);
+        else
+            stderr.push(chunk);
+    };
+    child.stdout.on("data", (chunk) => collect("stdout", chunk));
+    child.stderr.on("data", (chunk) => collect("stderr", chunk));
+    child.once("error", () => finish(new Error("OS credential tool is unavailable. Linux requires secret-tool and an unlocked Secret Service; headless hosts can use FRELY_CREDENTIAL_STORE=encrypted-file with FRELY_CREDENTIAL_KEY.")));
+    child.stdin.on("error", () => { });
+    child.once("close", (code) => finish(undefined, { code, stdout: Buffer.concat(stdout).toString("utf8"), stderr: Buffer.concat(stderr).toString("utf8") }));
+    child.stdin.end(input ?? "");
+});
+//# sourceMappingURL=credential-command.js.map

package/dist/credential-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-command.js","sourceRoot":"","sources":["../src/credential-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C,yFAAyF;AACzF,MAAM,CAAC,MAAM,oBAAoB,GAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC5G,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACtG,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,MAAsB,EAAQ,EAAE;QAC7D,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,KAAK;YAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;YACpB,OAAO,CAAC,MAAO,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,CAAC,IAAI,KAAK,CAAC,4IAA4I,CAAC,CAAC,CAAC;IAClK,CAAC,EAAE,MAAM,CAAC,CAAC;IACX,MAAM,OAAO,GAAG,CAAC,MAA2B,EAAE,KAAa,EAAQ,EAAE;QACnE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YACvC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uLAAuL,CAAC,CAAC,CAAC,CAAC;IACtO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAqE,CAAC,CAAC,CAAC;IACrG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3J,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC"}

package/dist/credential-file.d.ts

@@ -0,0 +1,6 @@
+import type { CredentialStore } from "./credential-store.js";
+/** The encryption key is injected by the operator; this module never writes it to disk. */
+export declare function createEncryptedCredentialStore(root: string, keyHex: string): CredentialStore;
+export declare function ensureCredentialDirectory(path: string, create: boolean): Promise<boolean>;
+export declare function readPrivateFile(path: string): Promise<string | null>;
+export declare function writePrivateFile(path: string, content: string): Promise<void>;

package/dist/credential-file.js

@@ -0,0 +1,212 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readdir, rename, rmdir, unlink } from "node:fs/promises";
+import { dirname, join } from "node:path";
+const HEADER = "vault.json";
+const CHECK = "frely credential vault v1";
+const MAX_FILE_SIZE = 2 * 1024 * 1024;
+const invalid = () => new Error("Encrypted credential authentication failed. Check FRELY_CREDENTIAL_KEY and vault integrity. Existing credentials were not replaced.");
+/** The encryption key is injected by the operator; this module never writes it to disk. */
+export function createEncryptedCredentialStore(root, keyHex) {
+    if (!/^[a-fA-F0-9]{64}$/u.test(keyHex))
+        throw new Error("FRELY_CREDENTIAL_KEY must be a 32-byte random key encoded as 64 hexadecimal characters. Provision it through a secret manager; do not store it next to the vault.");
+    const key = Buffer.from(keyHex, "hex");
+    const context = (service, account) => JSON.stringify(["frely.credentials.v1", service, account]);
+    const entryPath = (service, account) => join(root, `${createHash("sha256").update(context(service, account)).digest("hex")}.json`);
+    const headerContext = context("vault", "key-check");
+    function encrypt(value, aad) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", key, iv);
+        cipher.setAAD(Buffer.from(aad));
+        const data = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+        return JSON.stringify({ version: 1, algorithm: "aes-256-gcm", iv: iv.toString("base64"), tag: cipher.getAuthTag().toString("base64"), data: data.toString("base64") }) + "\n";
+    }
+    function decrypt(raw, aad) {
+        try {
+            const value = JSON.parse(raw);
+            if (value.version !== 1 || value.algorithm !== "aes-256-gcm")
+                throw invalid();
+            const decode = (input) => {
+                if (typeof input !== "string")
+                    throw invalid();
+                const result = Buffer.from(input, "base64");
+                if (result.toString("base64") !== input)
+                    throw invalid();
+                return result;
+            };
+            const iv = decode(value.iv), tag = decode(value.tag), data = decode(value.data);
+            if (iv.length !== 12 || tag.length !== 16)
+                throw invalid();
+            const cipher = createDecipheriv("aes-256-gcm", key, iv);
+            cipher.setAAD(Buffer.from(aad));
+            cipher.setAuthTag(tag);
+            return Buffer.concat([cipher.update(data), cipher.final()]).toString("utf8");
+        }
+        catch {
+            throw invalid();
+        }
+    }
+    async function checkHeader(create) {
+        if (!await ensureCredentialDirectory(root, create))
+            return false;
+        const path = join(root, HEADER);
+        const check = async () => {
+            const raw = await readPrivateFile(path);
+            if (raw === null)
+                return false;
+            if (decrypt(raw, headerContext) !== CHECK)
+                throw invalid();
+            return true;
+        };
+        if (await check())
+            return true;
+        if (!create) {
+            if ((await readdir(root)).some((name) => name.endsWith(".json")))
+                throw invalid();
+            return false;
+        }
+        // Serialize first-key initialization across processes. A stale lock fails closed.
+        const lock = join(root, ".init.lock");
+        let locked = false;
+        for (let attempt = 0; attempt < 100; attempt++) {
+            try {
+                await mkdir(lock, { mode: 0o700 });
+                locked = true;
+                break;
+            }
+            catch (error) {
+                if (!directoryLockBusy(error))
+                    throw error;
+                await new Promise((resolve) => setTimeout(resolve, 50));
+            }
+        }
+        if (!locked)
+            throw new Error("Credential vault initialization is locked. Check for another Frely process or a stale .init.lock directory before retrying.");
+        try {
+            if (!await check()) {
+                if ((await readdir(root)).some((name) => name.endsWith(".json")))
+                    throw invalid();
+                await writePrivateFile(path, encrypt(CHECK, headerContext));
+            }
+        }
+        finally {
+            await rmdir(lock);
+        }
+        return true;
+    }
+    return {
+        async getPassword(service, account) {
+            if (!await checkHeader(false))
+                return null;
+            const raw = await readPrivateFile(entryPath(service, account));
+            return raw === null ? null : decrypt(raw, context(service, account));
+        },
+        async setPassword(service, account, password) {
+            await checkHeader(true);
+            const path = entryPath(service, account);
+            const previous = await readPrivateFile(path);
+            if (previous !== null)
+                decrypt(previous, context(service, account));
+            await writePrivateFile(path, encrypt(password, context(service, account)));
+        },
+        async deletePassword(service, account) {
+            if (!await checkHeader(false))
+                return false;
+            const path = entryPath(service, account);
+            const raw = await readPrivateFile(path);
+            if (raw === null)
+                return false;
+            decrypt(raw, context(service, account));
+            try {
+                await unlink(path);
+                return true;
+            }
+            catch (error) {
+                if (hasCode(error, "ENOENT"))
+                    return false;
+                throw error;
+            }
+        },
+    };
+}
+export async function ensureCredentialDirectory(path, create) {
+    let info;
+    try {
+        info = await lstat(path);
+    }
+    catch (error) {
+        if (!hasCode(error, "ENOENT"))
+            throw error;
+        if (!create)
+            return false;
+        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+        const parent = await lstat(dirname(path));
+        assertPrivate(parent, true);
+        await mkdir(path, { mode: 0o700 }).catch((error) => { if (!hasCode(error, "EEXIST"))
+            throw error; });
+        info = await lstat(path);
+    }
+    assertPrivate(await lstat(dirname(path)), true);
+    assertPrivate(info, true);
+    return true;
+}
+function assertPrivate(info, directory) {
+    if (info.isSymbolicLink() || (directory ? !info.isDirectory() : !info.isFile()) || (!directory && info.nlink !== 1))
+        throw new Error("Credential vault paths must be regular owner-controlled files and directories, not links.");
+    if (process.platform !== "win32" && ((info.mode & 0o077) !== 0 || (process.getuid && info.uid !== process.getuid())))
+        throw new Error("Credential vault permissions are unsafe. Use owner-only directories (0700) and files (0600).");
+}
+export async function readPrivateFile(path) {
+    let before;
+    try {
+        before = await lstat(path);
+    }
+    catch (error) {
+        if (hasCode(error, "ENOENT"))
+            return null;
+        throw error;
+    }
+    assertPrivate(before, false);
+    const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const info = await file.stat();
+        assertPrivate(info, false);
+        if (info.ino !== before.ino || info.dev !== before.dev || info.size > MAX_FILE_SIZE)
+            throw new Error("Credential vault file changed or exceeded the size limit.");
+        const raw = await file.readFile("utf8");
+        if (Buffer.byteLength(raw) > MAX_FILE_SIZE)
+            throw new Error("Credential vault file exceeded the size limit.");
+        return raw;
+    }
+    finally {
+        await file.close();
+    }
+}
+export async function writePrivateFile(path, content) {
+    if (Buffer.byteLength(content) > MAX_FILE_SIZE)
+        throw new Error("Credential exceeded the size limit.");
+    const temporary = join(dirname(path), `.${randomUUID()}.tmp`);
+    const file = await open(temporary, "wx", 0o600);
+    try {
+        await file.writeFile(content, "utf8");
+        await file.sync();
+        await file.close();
+        await rename(temporary, path);
+    }
+    finally {
+        await file.close().catch(() => undefined);
+        await unlink(temporary).catch((error) => { if (!hasCode(error, "ENOENT"))
+            throw error; });
+    }
+}
+function hasCode(error, code) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+function directoryLockBusy(error) {
+    if (hasCode(error, "EEXIST"))
+        return true;
+    // Windows can report transient sharing/access errors while another caller owns
+    // or removes the directory lock. Retry within the bounded lock window only.
+    return process.platform === "win32" && ["EPERM", "EBUSY", "ENOTEMPTY"].some((code) => hasCode(error, code));
+}
+//# sourceMappingURL=credential-file.js.map

package/dist/credential-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-file.js","sourceRoot":"","sources":["../src/credential-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEtF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,MAAM,MAAM,GAAG,YAAY,CAAC;AAC5B,MAAM,KAAK,GAAG,2BAA2B,CAAC;AAC1C,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACtC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,qIAAqI,CAAC,CAAC;AAEvK,2FAA2F;AAC3F,MAAM,UAAU,8BAA8B,CAAC,IAAY,EAAE,MAAc;IACzE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mKAAmK,CAAC,CAAC;IAC7N,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,sBAAsB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACjH,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnJ,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAEpD,SAAS,OAAO,CAAC,KAAa,EAAE,GAAW;QACzC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;IAChL,CAAC;IACD,SAAS,OAAO,CAAC,GAAW,EAAE,GAAW;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YACzD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa;gBAAE,MAAM,OAAO,EAAE,CAAC;YAC9E,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE;gBACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,MAAM,OAAO,EAAE,CAAC;gBAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK;oBAAE,MAAM,OAAO,EAAE,CAAC;gBACzD,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;YACF,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChF,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,OAAO,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,OAAO,EAAE,CAAC;QAAC,CAAC;IAC9B,CAAC;IACD,KAAK,UAAU,WAAW,CAAC,MAAe;QACxC,IAAI,CAAC,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,IAAsB,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC/B,IAAI,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,KAAK;gBAAE,MAAM,OAAO,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,IAAI,MAAM,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,kFAAkF;QAClF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACtC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,MAAM;YAAC,CAAC;YACjE,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC3C,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6HAA6H,CAAC,CAAC;QAC5J,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACnB,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAAE,MAAM,OAAO,EAAE,CAAC;gBAClF,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;gBAAS,CAAC;YAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO;YAChC,IAAI,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/D,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ;YAC1C,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACpE,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO;YACnC,IAAI,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC/B,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;YACxC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAY,EAAE,MAAe;IAC3E,IAAI,IAAW,CAAC;IAChB,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACjC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9G,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,aAAa,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAChD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AACD,SAAS,aAAa,CAAC,IAAW,EAAE,SAAkB;IACpD,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAClO,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;AACxO,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,IAAI,MAAa,CAAC;IAClB,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACnC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IACzE,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,GAAG,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAClK,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC9G,OAAO,GAAG,CAAC;IACb,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACnC,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAe;IAClE,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACvG,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AACD,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAC/F,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,+EAA+E;IAC/E,4EAA4E;IAC5E,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAC9G,CAAC"}

package/dist/credential-native.d.ts

@@ -0,0 +1,3 @@
+import type { CredentialStore } from "./credential-store.js";
+import { type CredentialCommand } from "./credential-command.js";
+export declare function createNativeCredentialStore(platform?: NodeJS.Platform, run?: CredentialCommand): CredentialStore;

package/dist/credential-native.js

@@ -0,0 +1,196 @@
+import { win32 } from "node:path";
+import { runCredentialCommand } from "./credential-command.js";
+const unavailable = () => new Error("OS credential store access failed. Unlock the store and run `frely doctor`; headless hosts can configure FRELY_CREDENTIAL_STORE=encrypted-file with FRELY_CREDENTIAL_KEY. No plaintext fallback was used.");
+const stripNewline = (value) => value.replace(/\r?\n$/u, "");
+export function createNativeCredentialStore(platform = process.platform, run = runCredentialCommand) {
+    if (platform === "darwin") {
+        const read = async (service, account) => {
+            const result = await run("/usr/bin/security", ["find-generic-password", "-s", service, "-a", account, "-g"]);
+            if (result.code === 44)
+                return null; // errSecItemNotFound; other failures must not become missing credentials.
+            if (result.code !== 0)
+                throw unavailable();
+            const output = stripNewline(result.stderr);
+            if (!output.startsWith("password: "))
+                throw unavailable();
+            const value = output.slice("password: ".length);
+            const hex = /^0x([a-fA-F0-9]+)(?:\s.*)?$/su.exec(value)?.[1];
+            if (hex && hex.length % 2 === 0)
+                return Buffer.from(hex, "hex").toString("utf8");
+            if (value.startsWith('"') && value.endsWith('"'))
+                return value.slice(1, -1);
+            if (value === "")
+                return "";
+            throw unavailable();
+        };
+        return {
+            getPassword: read,
+            async setPassword(service, account, password) {
+                // security's interactive parser is not a shell. Restrict its identifiers and send
+                // password bytes as hex over stdin; -A and shell/argv secrets are prohibited.
+                if ([service, account].some((value) => /[\x00-\x20\x7f"'\\]/u.test(value)))
+                    throw new Error("Invalid macOS credential identifier.");
+                const line = `add-generic-password -U -s "${service}" -a "${account}" -X ${Buffer.from(password, "utf8").toString("hex")}\n`;
+                if (Buffer.byteLength(line, "utf8") >= 4096)
+                    throw new Error("macOS credential command exceeds its input limit.");
+                const result = await run("/usr/bin/security", ["-i"], line);
+                // Interactive security can exit 0 after a command error; require readback.
+                if (result.code !== 0 || await read(service, account) !== password)
+                    throw unavailable();
+            },
+            async deletePassword(service, account) {
+                const result = await run("/usr/bin/security", ["delete-generic-password", "-s", service, "-a", account]);
+                if (result.code === 44)
+                    return false;
+                if (result.code !== 0)
+                    throw unavailable();
+                return true;
+            },
+        };
+    }
+    if (platform === "linux") {
+        const missing = (result) => result.code === 1 && result.stdout.length === 0 && result.stderr.trim().length === 0;
+        const attributes = (service, account) => ["service", service, "account", account];
+        const read = async (service, account) => {
+            const result = await run("secret-tool", ["lookup", ...attributes(service, account)]);
+            if (missing(result))
+                return null;
+            if (result.code !== 0)
+                throw unavailable();
+            // secret-tool writes the stored value verbatim when stdout is a pipe.
+            // Removing a trailing newline would corrupt legitimate multiline secrets.
+            return result.stdout;
+        };
+        return {
+            getPassword: read,
+            async setPassword(service, account, password) {
+                const result = await run("secret-tool", ["store", "--label=Frely CLI", ...attributes(service, account)], password);
+                if (result.code !== 0 || await read(service, account) !== password)
+                    throw unavailable();
+            },
+            async deletePassword(service, account) {
+                if (await read(service, account) === null)
+                    return false;
+                const result = await run("secret-tool", ["clear", ...attributes(service, account)]);
+                if (result.code !== 0)
+                    throw unavailable();
+                return true;
+            },
+        };
+    }
+    if (platform === "win32") {
+        const execute = async (operation, service, account, password) => {
+            const file = win32.join(process.env.SystemRoot || "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+            const result = await run(file, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", WINDOWS_SCRIPT], JSON.stringify({ operation, target: `${service}/${account}`, account, ...(password !== undefined ? { data: Buffer.from(password, "utf8").toString("base64") } : {}) }));
+            if (result.code !== 0)
+                throw unavailable();
+            try {
+                const value = JSON.parse(result.stdout.trim());
+                if (value.ok !== true)
+                    throw unavailable();
+                if (operation === "get") {
+                    if (value.data === null)
+                        return null;
+                    if (typeof value.data !== "string")
+                        throw unavailable();
+                    return Buffer.from(value.data, "base64").toString("utf8");
+                }
+                return value.deleted ?? true;
+            }
+            catch {
+                throw unavailable();
+            }
+        };
+        return {
+            async getPassword(service, account) { return await execute("get", service, account); },
+            async setPassword(service, account, password) {
+                if (Buffer.byteLength(password, "utf8") > 2560)
+                    throw new Error("Windows Credential Manager limits a credential to 2560 bytes. Use FRELY_CREDENTIAL_STORE=encrypted-file with an injected FRELY_CREDENTIAL_KEY for larger credentials.");
+                await execute("set", service, account, password);
+            },
+            async deletePassword(service, account) { return await execute("delete", service, account); },
+        };
+    }
+    throw new Error("Unsupported OS credential store. Configure FRELY_CREDENTIAL_STORE=encrypted-file with FRELY_CREDENTIAL_KEY.");
+}
+// Static source only. Request values enter through stdin JSON, not PowerShell source.
+// CredentialBlob is UTF-8 and TargetName is service/account, matching legacy keytar.
+const WINDOWS_SCRIPT = String.raw `
+$ErrorActionPreference = 'Stop'
+[Console]::InputEncoding = New-Object System.Text.UTF8Encoding($false)
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+try {
+Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+public static class FrelyCredentials {
+  [StructLayout(LayoutKind.Sequential)]
+  struct Credential {
+    public uint Flags, Type;
+    public IntPtr TargetName, Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public uint CredentialBlobSize;
+    public IntPtr CredentialBlob;
+    public uint Persist, AttributeCount;
+    public IntPtr Attributes, TargetAlias, UserName;
+  }
+  [DllImport("advapi32.dll", EntryPoint="CredReadW", CharSet=CharSet.Unicode, SetLastError=true)]
+  static extern bool Read(string target, uint type, uint flags, out IntPtr credential);
+  [DllImport("advapi32.dll", EntryPoint="CredWriteW", CharSet=CharSet.Unicode, SetLastError=true)]
+  static extern bool Write(ref Credential credential, uint flags);
+  [DllImport("advapi32.dll", EntryPoint="CredDeleteW", CharSet=CharSet.Unicode, SetLastError=true)]
+  static extern bool Delete(string target, uint type, uint flags);
+  [DllImport("advapi32.dll")] static extern void CredFree(IntPtr credential);
+  public static string Get(string target) {
+    IntPtr ptr;
+    if (!Read(target, 1, 0, out ptr)) {
+      int error = Marshal.GetLastWin32Error();
+      if (error == 1168) return null;
+      throw new Win32Exception(error);
+    }
+    try {
+      Credential value = (Credential)Marshal.PtrToStructure(ptr, typeof(Credential));
+      byte[] data = new byte[value.CredentialBlobSize];
+      if (data.Length > 0) Marshal.Copy(value.CredentialBlob, data, 0, data.Length);
+      return Convert.ToBase64String(data);
+    } finally { CredFree(ptr); }
+  }
+  public static void Set(string target, string account, string encoded) {
+    byte[] data = Convert.FromBase64String(encoded);
+    Credential value = new Credential();
+    value.Type = 1; value.Persist = 2;
+    try {
+      value.TargetName = Marshal.StringToCoTaskMemUni(target);
+      value.UserName = Marshal.StringToCoTaskMemUni(account);
+      value.CredentialBlobSize = (uint)data.Length;
+      value.CredentialBlob = Marshal.AllocCoTaskMem(data.Length);
+      if (data.Length > 0) Marshal.Copy(data, 0, value.CredentialBlob, data.Length);
+      if (!Write(ref value, 0)) throw new Win32Exception(Marshal.GetLastWin32Error());
+    } finally {
+      if (value.CredentialBlob != IntPtr.Zero) {
+        for (int i = 0; i < data.Length; i++) Marshal.WriteByte(value.CredentialBlob, i, 0);
+        Marshal.FreeCoTaskMem(value.CredentialBlob);
+      }
+      Marshal.FreeCoTaskMem(value.TargetName); Marshal.FreeCoTaskMem(value.UserName);
+      Array.Clear(data, 0, data.Length);
+    }
+  }
+  public static bool Remove(string target) {
+    if (Delete(target, 1, 0)) return true;
+    int error = Marshal.GetLastWin32Error();
+    if (error == 1168) return false;
+    throw new Win32Exception(error);
+  }
+}
+'@
+$request = [Console]::In.ReadToEnd() | ConvertFrom-Json
+switch ($request.operation) {
+  'get' { $data = [FrelyCredentials]::Get($request.target); [Console]::Out.Write((@{ok=$true;data=$data} | ConvertTo-Json -Compress)) }
+  'set' { [FrelyCredentials]::Set($request.target,$request.account,$request.data); [Console]::Out.Write('{"ok":true}') }
+  'delete' { $deleted = [FrelyCredentials]::Remove($request.target); [Console]::Out.Write((@{ok=$true;deleted=$deleted} | ConvertTo-Json -Compress)) }
+  default { exit 1 }
+}
+} catch { [Console]::Error.Write('Windows credential operation failed.'); exit 1 }
+`;
+//# sourceMappingURL=credential-native.js.map

package/dist/credential-native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-native.js","sourceRoot":"","sources":["../src/credential-native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,oBAAoB,EAA8C,MAAM,yBAAyB,CAAC;AAE3G,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,2MAA2M,CAAC,CAAC;AACjP,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAE7E,MAAM,UAAU,2BAA2B,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAyB,oBAAoB;IACpH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,KAAK,EAAE,OAAe,EAAE,OAAe,EAA0B,EAAE;YAC9E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,mBAAmB,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7G,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC,CAAC,0EAA0E;YAC/G,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,WAAW,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;gBAAE,MAAM,WAAW,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjF,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5E,IAAI,KAAK,KAAK,EAAE;gBAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,WAAW,EAAE,CAAC;QACtB,CAAC,CAAC;QACF,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ;gBAC1C,kFAAkF;gBAClF,8EAA8E;gBAC9E,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBACpI,MAAM,IAAI,GAAG,+BAA+B,OAAO,SAAS,OAAO,QAAQ,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC7H,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBAClH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC5D,2EAA2E;gBAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,QAAQ;oBAAE,MAAM,WAAW,EAAE,CAAC;YAC1F,CAAC;YACD,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO;gBACnC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,mBAAmB,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;gBACzG,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;oBAAE,OAAO,KAAK,CAAC;gBACrC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;oBAAE,MAAM,WAAW,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,MAAqB,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;QACzI,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAClG,MAAM,IAAI,GAAG,KAAK,EAAE,OAAe,EAAE,OAAe,EAA0B,EAAE;YAC9E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;YACrF,IAAI,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,WAAW,EAAE,CAAC;YAC3C,sEAAsE;YACtE,0EAA0E;YAC1E,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC;QACF,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ;gBAC1C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACnH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,QAAQ;oBAAE,MAAM,WAAW,EAAE,CAAC;YAC1F,CAAC;YACD,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO;gBACnC,IAAI,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI;oBAAE,OAAO,KAAK,CAAC;gBACxD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;gBACpF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;oBAAE,MAAM,WAAW,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,EAAE,SAAiB,EAAE,OAAe,EAAE,OAAe,EAAE,QAAiB,EAAoC,EAAE;YACjI,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC5H,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACjR,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,WAAW,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAA8D,CAAC;gBAC5G,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;oBAAE,MAAM,WAAW,EAAE,CAAC;gBAC3C,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;oBACxB,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;wBAAE,OAAO,IAAI,CAAC;oBACrC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,WAAW,EAAE,CAAC;oBACxD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAO,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,WAAW,EAAE,CAAC;YAAC,CAAC;QAClC,CAAC,CAAC;QACF,OAAO;YACL,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,IAAI,OAAO,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAkB,CAAC,CAAC,CAAC;YACvG,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ;gBAC1C,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,uKAAuK,CAAC,CAAC;gBACzO,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnD,CAAC;YACD,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,IAAI,OAAO,MAAM,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAY,CAAC,CAAC,CAAC;SACxG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6GAA6G,CAAC,CAAC;AACjI,CAAC;AAED,sFAAsF;AACtF,qFAAqF;AACrF,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6EhC,CAAC"}

package/dist/credential-store.d.ts

@@ -1,10 +1,17 @@
+import type { CredentialCommand } from "./credential-command.js";
 export interface CredentialStore {
     getPassword(service: string, account: string): Promise<string | null>;
     setPassword(service: string, account: string, password: string): Promise<void>;
     deletePassword(service: string, account: string): Promise<boolean>;
 }
-/**
- * Production credential storage backed by the operating system's secure store.
- * Tests replace the methods on this narrow adapter with an in-memory store.
- */
+interface StoreOptions {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    run?: CredentialCommand;
+}
+export declare function credentialStoreBackend(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string;
+/** Backend selection and OS access happen at credential use, not module import. */
+export declare function createCredentialStore(options?: StoreOptions): CredentialStore;
+/** Tests replace this narrow adapter without contacting the user's credential store. */
 export declare const credentialStore: CredentialStore;
+export {};

package/dist/credential-store.js

@@ -1,11 +1,49 @@
-import keytar from "keytar";
-/**
- * Production credential storage backed by the operating system's secure store.
- * Tests replace the methods on this narrow adapter with an in-memory store.
- */
-export const credentialStore = {
-    getPassword: (service, account) => keytar.getPassword(service, account),
-    setPassword: (service, account, password) => keytar.setPassword(service, account, password),
-    deletePassword: (service, account) => keytar.deletePassword(service, account),
-};
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { createNativeCredentialStore } from "./credential-native.js";
+import { createEncryptedCredentialStore } from "./credential-file.js";
+import { createSystemCredentialStore } from "./credential-system.js";
+export function credentialStoreBackend(env = process.env, platform = process.platform) {
+    const mode = env.FRELY_CREDENTIAL_STORE ?? "auto";
+    if (!["auto", "system", "encrypted-file"].includes(mode))
+        throw new Error("FRELY_CREDENTIAL_STORE must be auto, system, or encrypted-file. Plaintext storage is not supported.");
+    if (mode === "encrypted-file" || (mode === "auto" && env.FRELY_CREDENTIAL_KEY !== undefined))
+        return "encrypted-file";
+    if (platform === "darwin")
+        return "macOS Keychain";
+    if (platform === "win32")
+        return "Windows Credential Manager";
+    if (platform === "linux")
+        return "Linux Secret Service";
+    throw new Error("Unsupported OS credential store. Configure encrypted-file storage with an injected FRELY_CREDENTIAL_KEY.");
+}
+/** Backend selection and OS access happen at credential use, not module import. */
+export function createCredentialStore(options = {}) {
+    const select = () => {
+        const env = options.env ?? process.env;
+        const platform = options.platform ?? process.platform;
+        if (credentialStoreBackend(env, platform) === "encrypted-file") {
+            const root = resolve(join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "frely", "credentials-v1"));
+            return createEncryptedCredentialStore(root, env.FRELY_CREDENTIAL_KEY ?? "");
+        }
+        const root = resolve(join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "frely", "system-credentials-v1"));
+        return createSystemCredentialStore(root, createNativeCredentialStore(platform, options.run));
+    };
+    const validate = (service, account) => {
+        if (!service || !account || /[\x00-\x1f\x7f]/u.test(service + account))
+            throw new Error("Credential service and account must be non-empty and contain no control characters.");
+    };
+    return {
+        async getPassword(service, account) { validate(service, account); return select().getPassword(service, account); },
+        async setPassword(service, account, password) {
+            validate(service, account);
+            if (!password || Buffer.byteLength(password, "utf8") > 1024 * 1024)
+                throw new Error("Credential must contain between 1 byte and 1 MiB.");
+            await select().setPassword(service, account, password);
+        },
+        async deletePassword(service, account) { validate(service, account); return select().deletePassword(service, account); },
+    };
+}
+/** Tests replace this narrow adapter without contacting the user's credential store. */
+export const credentialStore = createCredentialStore();
 //# sourceMappingURL=credential-store.js.map

package/dist/credential-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAQ5B;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;IACvE,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC;IAC3F,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;CAC9E,CAAC"}
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAcrE,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACvH,MAAM,IAAI,GAAG,GAAG,CAAC,sBAAsB,IAAI,MAAM,CAAC;IAClD,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;IACjL,IAAI,IAAI,KAAK,gBAAgB,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACtH,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IACnD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,4BAA4B,CAAC;IAC9D,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,sBAAsB,CAAC;IACxD,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAC;AAC9H,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,UAAwB,EAAE;IAC9D,MAAM,MAAM,GAAG,GAAoB,EAAE;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACtD,IAAI,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;YACzG,OAAO,8BAA8B,CAAC,IAAI,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAChH,OAAO,2BAA2B,CAAC,IAAI,EAAE,2BAA2B,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/F,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,OAAe,EAAQ,EAAE;QAC1D,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACjL,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAClH,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ;YAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3B,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACzI,MAAM,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;KACzH,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,eAAe,GAAoB,qBAAqB,EAAE,CAAC"}

package/dist/credential-system.d.ts

@@ -0,0 +1,3 @@
+import type { CredentialStore } from "./credential-store.js";
+/** The OS stores a 32-byte master key; authenticated files hold variable-size credentials. */
+export declare function createSystemCredentialStore(root: string, native: CredentialStore): CredentialStore;