toolcraft-openapi 0.0.160 → 0.0.161

package/dist/auth/bearer-token-auth.js

@@ -1,6 +1,6 @@
 import { defineCommand, defineGroup, S, UserError } from "toolcraft";
 import { isCancel, password } from "toolcraft-design";
-import { createSecretStore } from "auth-store";
+import { createSecretStore } from "toolcraft/auth-store";
 import { requestJson } from "../http.js";
 const DEFAULT_COMMAND_PREFIX = "auth";
 const loginParams = S.Object({

package/dist/composition.json

@@ -6,11 +6,6 @@
       "version": "0.0.1",
       "license": "MIT"
     },
-    {
-      "name": "auth-store",
-      "version": "0.0.1",
-      "license": "MIT"
-    },
     {
       "name": "fast-string-truncated-width",
       "version": "3.0.3",
@@ -38,12 +33,12 @@
     },
     {
       "name": "toolcraft-openapi",
-      "version": "0.0.160",
+      "version": "0.0.161",
       "license": "MIT"
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.160",
+      "version": "0.0.161",
       "license": "MIT"
     },
     {

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.160",
+  "version": "0.0.161",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-openapi",
-  "version": "0.0.160",
+  "version": "0.0.161",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -19,8 +19,8 @@
     "build": "rm -rf dist && tsc",
     "test": "cd ../.. && vitest run packages/toolcraft-openapi/src",
     "test:unit": "cd ../.. && vitest run packages/toolcraft-openapi/src",
-    "prepack": "node ../../scripts/set-bin-executable.mjs && node ../../scripts/manage-bundled-workspace-deps.mjs prepare . toolcraft-schema toolcraft-design @poe-code/frontmatter auth-store fast-string-width fast-wrap-ansi sisteransi yaml",
-    "postpack": "node ../../scripts/manage-bundled-workspace-deps.mjs cleanup . toolcraft-schema toolcraft-design @poe-code/frontmatter auth-store fast-string-width fast-wrap-ansi sisteransi yaml"
+    "prepack": "node ../../scripts/set-bin-executable.mjs && node ../../scripts/manage-bundled-workspace-deps.mjs prepare . toolcraft-schema toolcraft-design @poe-code/frontmatter fast-string-width fast-wrap-ansi sisteransi yaml",
+    "postpack": "node ../../scripts/manage-bundled-workspace-deps.mjs cleanup . toolcraft-schema toolcraft-design @poe-code/frontmatter fast-string-width fast-wrap-ansi sisteransi yaml"
   },
   "files": [
     "LICENSE",
@@ -30,7 +30,7 @@
     "toolcraft-openapi-generate": "dist/bin/generate.js"
   },
   "dependencies": {
-    "toolcraft": "0.0.160",
+    "toolcraft": "0.0.161",
     "fast-string-width": "^3.0.2",
     "fast-wrap-ansi": "^0.2.0",
     "sisteransi": "^1.0.5",
@@ -45,8 +45,7 @@
     "directory": "packages/toolcraft-openapi"
   },
   "optionalDependencies": {
-    "auth-store": "*",
-    "toolcraft-schema": "0.0.160",
+    "toolcraft-schema": "0.0.161",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*"
   },
@@ -54,7 +53,6 @@
     "toolcraft-schema",
     "toolcraft-design",
     "@poe-code/frontmatter",
-    "auth-store",
     "fast-string-width",
     "fast-wrap-ansi",
     "sisteransi",

package/node_modules/auth-store/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Poe Platform
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/node_modules/auth-store/README.md

@@ -1,62 +0,0 @@
-# auth-store
-
-Generic encrypted secret storage with platform-aware backends.
-
-## Usage
-
-```ts
-import { createSecretStore } from "auth-store";
-
-const { store, backend } = createSecretStore({
-  backendEnvVar: "MY_AUTH_BACKEND",
-  fileStore: {
-    salt: "my-app:encrypted-store:v1",
-    defaultDirectory: ".my-app",
-    defaultFileName: "credentials.enc"
-  },
-  keychainStore: {
-    service: "my-app",
-    account: "api-key"
-  }
-});
-
-await store.set("secret-value");
-const value = await store.get(); // "secret-value"
-await store.delete();
-```
-
-## Backends
-
-| `backendEnvVar` value | Platform | Backend        |
-| --------------------- | -------- | -------------- |
-| _(unset)_             | any      | Encrypted file |
-| `file`                | any      | Encrypted file |
-| `keychain`            | macOS    | macOS Keychain |
-| `keychain`            | other    | Error          |
-
-### Encrypted file
-
-- AES-256-GCM with machine-derived key (hostname + username via scrypt)
-- Configurable salt, directory, and file name
-- File permissions: `0600`
-- Random IV per write
-
-### macOS Keychain
-
-- Uses the `security` CLI (`add-generic-password`, `find-generic-password`, `delete-generic-password`)
-- Configurable service and account names
-
-## Configuration Options
-
-`createSecretStore()` accepts:
-
-- `backendEnvVar`: optional env var name that selects `file` or `keychain`.
-- `fileStore.salt`: application-specific encryption salt.
-- `fileStore.defaultDirectory`: default credential directory.
-- `fileStore.defaultFileName`: encrypted file name.
-- `keychainStore.service`: macOS Keychain service name.
-- `keychainStore.account`: macOS Keychain account name.
-
-## Environment Variables
-
-This package reads only the caller-selected `backendEnvVar`. It does not define a fixed public env var.

package/node_modules/auth-store/dist/create-secret-store.d.ts

@@ -1,2 +0,0 @@
-import type { CreateSecretStoreInput, CreateSecretStoreResult } from "./types.js";
-export declare function createSecretStore(input: CreateSecretStoreInput): CreateSecretStoreResult;

package/node_modules/auth-store/dist/create-secret-store.js

@@ -1,44 +0,0 @@
-import { EncryptedFileStore } from "./encrypted-file-store.js";
-import { KeychainStore } from "./keychain-store.js";
-const DEFAULT_BACKEND_ENV_VAR = "AUTH_BACKEND";
-const MACOS_PLATFORM = "darwin";
-const storeFactories = {
-    file: (input) => {
-        if (!input.fileStore) {
-            throw new Error("fileStore configuration is required for file backend");
-        }
-        return new EncryptedFileStore(input.fileStore);
-    },
-    keychain: (input) => {
-        if (!input.keychainStore) {
-            throw new Error("keychainStore configuration is required for keychain backend");
-        }
-        return new KeychainStore(input.keychainStore);
-    }
-};
-export function createSecretStore(input) {
-    const backend = resolveBackend(input);
-    const platform = input.platform ?? process.platform;
-    if (backend === "keychain" && platform !== MACOS_PLATFORM) {
-        throw new Error(`Keychain backend is only supported on macOS. Current platform: ${platform}`);
-    }
-    const store = storeFactories[backend](input);
-    return { backend, store };
-}
-function resolveBackend(input) {
-    const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
-    const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
-    const backend = configuredBackend?.trim();
-    if (backend === "keychain") {
-        return "keychain";
-    }
-    if (backend === undefined || backend === "file") {
-        return "file";
-    }
-    throw new Error(`Unsupported auth store backend: ${backend}`);
-}
-function getOwnEnvValue(env, key) {
-    return env !== undefined && Object.prototype.hasOwnProperty.call(env, key)
-        ? env[key]
-        : undefined;
-}

package/node_modules/auth-store/dist/encrypted-file-store.d.ts

@@ -1,47 +0,0 @@
-import type { SecretStore } from "./types.js";
-export interface MachineIdentity {
-    hostname: string;
-    username: string;
-}
-export interface EncryptedFileStoreFileSystem {
-    readFile(path: string, encoding: BufferEncoding): Promise<string>;
-    writeFile(path: string, data: string | NodeJS.ArrayBufferView, options?: {
-        encoding?: BufferEncoding;
-        flag?: string;
-        mode?: number;
-    }): Promise<void>;
-    mkdir(path: string, options?: {
-        recursive?: boolean;
-    }): Promise<void | string | undefined>;
-    rename(oldPath: string, newPath: string): Promise<void>;
-    lstat(path: string): Promise<{
-        isSymbolicLink(): boolean;
-    }>;
-    unlink(path: string): Promise<void>;
-    chmod(path: string, mode: number): Promise<void>;
-}
-export interface EncryptedFileStoreInput {
-    fs?: EncryptedFileStoreFileSystem;
-    filePath?: string;
-    salt: string;
-    defaultDirectory?: string;
-    defaultFileName?: string;
-    getMachineIdentity?: () => MachineIdentity | Promise<MachineIdentity>;
-    getHomeDirectory?: () => string;
-    getRandomBytes?: (size: number) => Buffer;
-}
-export declare class EncryptedFileStore implements SecretStore {
-    private readonly fs;
-    private readonly filePath;
-    private readonly symbolicLinkCheckStartPath;
-    private readonly salt;
-    private readonly getMachineIdentity;
-    private readonly getRandomBytes;
-    private keyPromise;
-    constructor(input: EncryptedFileStoreInput);
-    get(): Promise<string | null>;
-    set(value: string): Promise<void>;
-    delete(): Promise<void>;
-    private assertCredentialPathHasNoSymbolicLinks;
-    private getEncryptionKey;
-}

package/node_modules/auth-store/dist/encrypted-file-store.js

@@ -1,303 +0,0 @@
-import { createCipheriv, createDecipheriv, randomBytes, randomUUID, scrypt } from "node:crypto";
-import { promises as fs } from "node:fs";
-import { homedir, hostname, userInfo } from "node:os";
-import path from "node:path";
-import { hasOwnErrorCode } from "./error-codes.js";
-const derivedKeyCache = new Map();
-const ENCRYPTION_ALGORITHM = "aes-256-gcm";
-const ENCRYPTION_VERSION = 1;
-const ENCRYPTION_KEY_BYTES = 32;
-const ENCRYPTION_IV_BYTES = 12;
-const ENCRYPTION_AUTH_TAG_BYTES = 16;
-const ENCRYPTION_FILE_MODE = 0o600;
-export class EncryptedFileStore {
-    fs;
-    filePath;
-    symbolicLinkCheckStartPath;
-    salt;
-    getMachineIdentity;
-    getRandomBytes;
-    keyPromise = null;
-    constructor(input) {
-        this.fs = input.fs ?? fs;
-        this.salt = input.salt;
-        if (input.filePath === undefined) {
-            const homeDirectory = (input.getHomeDirectory ?? homedir)();
-            const defaultDirectory = input.defaultDirectory ?? ".auth-store";
-            const defaultFileName = input.defaultFileName ?? "credentials.enc";
-            assertSafeDefaultDirectory(defaultDirectory);
-            assertSafeDefaultFileName(defaultFileName);
-            this.filePath = path.join(homeDirectory, defaultDirectory, defaultFileName);
-            this.symbolicLinkCheckStartPath = resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory);
-        }
-        else {
-            this.filePath = input.filePath;
-            this.symbolicLinkCheckStartPath = null;
-        }
-        this.getMachineIdentity = input.getMachineIdentity ?? defaultMachineIdentity;
-        this.getRandomBytes = input.getRandomBytes ?? randomBytes;
-    }
-    async get() {
-        await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
-        let rawDocument;
-        try {
-            rawDocument = await this.fs.readFile(this.filePath, "utf8");
-        }
-        catch (error) {
-            if (isNotFoundError(error)) {
-                return null;
-            }
-            throw error;
-        }
-        const document = parseEncryptedDocument(rawDocument);
-        if (!document) {
-            return null;
-        }
-        const key = await this.getEncryptionKey();
-        try {
-            const iv = Buffer.from(document.iv, "base64");
-            const authTag = Buffer.from(document.authTag, "base64");
-            const ciphertext = Buffer.from(document.ciphertext, "base64");
-            if (iv.byteLength !== ENCRYPTION_IV_BYTES ||
-                authTag.byteLength !== ENCRYPTION_AUTH_TAG_BYTES) {
-                return null;
-            }
-            const decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key, iv);
-            decipher.setAuthTag(authTag);
-            const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-            return plaintext.toString("utf8");
-        }
-        catch {
-            return null;
-        }
-    }
-    async set(value) {
-        await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
-        const key = await this.getEncryptionKey();
-        const iv = this.getRandomBytes(ENCRYPTION_IV_BYTES);
-        const cipher = createCipheriv(ENCRYPTION_ALGORITHM, key, iv);
-        const ciphertext = Buffer.concat([
-            cipher.update(value, "utf8"),
-            cipher.final()
-        ]);
-        const authTag = cipher.getAuthTag();
-        const document = {
-            version: ENCRYPTION_VERSION,
-            iv: iv.toString("base64"),
-            authTag: authTag.toString("base64"),
-            ciphertext: ciphertext.toString("base64")
-        };
-        await this.fs.mkdir(path.dirname(this.filePath), { recursive: true });
-        await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
-        const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
-        let temporaryCreated = false;
-        try {
-            await this.assertCredentialPathHasNoSymbolicLinks(temporaryPath);
-            await this.fs.writeFile(temporaryPath, JSON.stringify(document), {
-                encoding: "utf8",
-                flag: "wx",
-                mode: ENCRYPTION_FILE_MODE
-            });
-            temporaryCreated = true;
-            await this.fs.chmod(temporaryPath, ENCRYPTION_FILE_MODE);
-            await this.fs.rename(temporaryPath, this.filePath);
-        }
-        catch (error) {
-            if (temporaryCreated || !isAlreadyExistsError(error)) {
-                await removeIfPresent(this.fs, temporaryPath).catch(() => undefined);
-            }
-            throw error;
-        }
-    }
-    async delete() {
-        await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
-        try {
-            await this.fs.unlink(this.filePath);
-        }
-        catch (error) {
-            if (!isNotFoundError(error)) {
-                throw error;
-            }
-        }
-    }
-    async assertCredentialPathHasNoSymbolicLinks(targetPath) {
-        const resolvedPath = path.resolve(targetPath);
-        const protectedPaths = getProtectedCredentialPaths(resolvedPath, this.symbolicLinkCheckStartPath);
-        for (const currentPath of protectedPaths) {
-            try {
-                const stats = await this.fs.lstat(currentPath);
-                if (stats.isSymbolicLink()) {
-                    throw new Error(`Refusing to use encrypted credential path through symbolic link: ${currentPath}`);
-                }
-            }
-            catch (error) {
-                if (isNotFoundError(error)) {
-                    return;
-                }
-                throw error;
-            }
-        }
-    }
-    getEncryptionKey() {
-        if (!this.keyPromise) {
-            const retryableKeyPromise = deriveEncryptionKey(this.getMachineIdentity, this.salt).catch((error) => {
-                if (this.keyPromise === retryableKeyPromise) {
-                    this.keyPromise = null;
-                }
-                throw error;
-            });
-            this.keyPromise = retryableKeyPromise;
-        }
-        return this.keyPromise;
-    }
-}
-function resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory) {
-    const [firstSegment] = defaultDirectory.split(/[\\/]+/).filter(Boolean);
-    return path.resolve(homeDirectory, firstSegment ?? ".");
-}
-function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
-    if (symbolicLinkCheckStartPath === null) {
-        return getExplicitProtectedCredentialPaths(resolvedPath);
-    }
-    const resolvedStartPath = path.resolve(symbolicLinkCheckStartPath);
-    if (!isPathInsideOrEqual(resolvedPath, resolvedStartPath)) {
-        return [path.dirname(resolvedPath), resolvedPath];
-    }
-    const protectedPaths = [resolvedStartPath];
-    let currentPath = resolvedStartPath;
-    for (const segment of path.relative(resolvedStartPath, resolvedPath).split(path.sep).filter(Boolean)) {
-        currentPath = path.join(currentPath, segment);
-        protectedPaths.push(currentPath);
-    }
-    return protectedPaths;
-}
-function assertSafeDefaultDirectory(defaultDirectory) {
-    if (path.isAbsolute(defaultDirectory) || path.win32.isAbsolute(defaultDirectory)) {
-        throw new Error("defaultDirectory must be a relative path inside the home directory");
-    }
-    for (const segment of splitPathSegments(defaultDirectory)) {
-        if (segment === "..") {
-            throw new Error("defaultDirectory must be a relative path inside the home directory");
-        }
-    }
-}
-function assertSafeDefaultFileName(defaultFileName) {
-    if (defaultFileName.trim().length === 0 ||
-        defaultFileName === "." ||
-        defaultFileName === ".." ||
-        splitPathSegments(defaultFileName).length !== 1) {
-        throw new Error("defaultFileName must be a file name without path separators");
-    }
-}
-function splitPathSegments(value) {
-    return value
-        .split("/")
-        .flatMap((segment) => segment.split("\\"))
-        .filter((segment) => segment.length > 0);
-}
-function getExplicitProtectedCredentialPaths(resolvedPath) {
-    const parsed = path.parse(resolvedPath);
-    const segments = resolvedPath
-        .slice(parsed.root.length)
-        .split(path.sep)
-        .filter((segment) => segment.length > 0);
-    if (segments.length <= 1) {
-        return [resolvedPath];
-    }
-    const protectedPaths = [];
-    let currentPath = parsed.root;
-    for (const [index, segment] of segments.entries()) {
-        currentPath = path.join(currentPath, segment);
-        if (index === 0) {
-            continue;
-        }
-        protectedPaths.push(currentPath);
-    }
-    return protectedPaths;
-}
-function isPathInsideOrEqual(childPath, parentPath) {
-    const relativePath = path.relative(parentPath, childPath);
-    return relativePath === "" || (!relativePath.startsWith("..") && !path.isAbsolute(relativePath));
-}
-async function removeIfPresent(fileSystem, filePath) {
-    try {
-        await fileSystem.unlink(filePath);
-    }
-    catch (error) {
-        if (!isNotFoundError(error)) {
-            throw error;
-        }
-    }
-}
-function defaultMachineIdentity() {
-    return {
-        hostname: hostname(),
-        username: userInfo().username
-    };
-}
-async function deriveEncryptionKey(getMachineIdentity, salt) {
-    const machineIdentity = await getMachineIdentity();
-    const secret = `${machineIdentity.hostname}:${machineIdentity.username}`;
-    const cacheKey = JSON.stringify([machineIdentity.hostname, machineIdentity.username, salt]);
-    const cached = derivedKeyCache.get(cacheKey);
-    if (cached) {
-        return cached;
-    }
-    const keyPromise = new Promise((resolve, reject) => {
-        scrypt(secret, salt, ENCRYPTION_KEY_BYTES, (error, derivedKey) => {
-            if (error) {
-                reject(error);
-                return;
-            }
-            resolve(Buffer.from(derivedKey));
-        });
-    });
-    derivedKeyCache.set(cacheKey, keyPromise);
-    return keyPromise.catch((error) => {
-        if (derivedKeyCache.get(cacheKey) === keyPromise) {
-            derivedKeyCache.delete(cacheKey);
-        }
-        throw error;
-    });
-}
-function parseEncryptedDocument(raw) {
-    try {
-        const parsed = JSON.parse(raw);
-        if (!isRecord(parsed)) {
-            return null;
-        }
-        const version = getOwnEntry(parsed, "version");
-        const iv = getOwnEntry(parsed, "iv");
-        const authTag = getOwnEntry(parsed, "authTag");
-        const ciphertext = getOwnEntry(parsed, "ciphertext");
-        if (version !== ENCRYPTION_VERSION) {
-            return null;
-        }
-        if (typeof iv !== "string" ||
-            typeof authTag !== "string" ||
-            typeof ciphertext !== "string") {
-            return null;
-        }
-        return {
-            version,
-            iv,
-            authTag,
-            ciphertext
-        };
-    }
-    catch {
-        return null;
-    }
-}
-function isRecord(value) {
-    return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function getOwnEntry(record, key) {
-    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
-}
-function isNotFoundError(error) {
-    return hasOwnErrorCode(error, "ENOENT");
-}
-function isAlreadyExistsError(error) {
-    return hasOwnErrorCode(error, "EEXIST");
-}

package/node_modules/auth-store/dist/error-codes.d.ts

@@ -1 +0,0 @@
-export declare function hasOwnErrorCode(error: unknown, code: string): boolean;

package/node_modules/auth-store/dist/error-codes.js

@@ -1,5 +0,0 @@
-export function hasOwnErrorCode(error, code) {
-    return (error instanceof Error &&
-        Object.prototype.hasOwnProperty.call(error, "code") &&
-        error.code === code);
-}

package/node_modules/auth-store/dist/index.d.ts

@@ -1,7 +0,0 @@
-export { createSecretStore } from "./create-secret-store.js";
-export { EncryptedFileStore } from "./encrypted-file-store.js";
-export { KeychainStore } from "./keychain-store.js";
-export { key, MigratingSecretStore } from "./provider-store.js";
-export type { SecretStore, StoreBackend, CreateSecretStoreInput, CreateSecretStoreResult } from "./types.js";
-export type { MachineIdentity, EncryptedFileStoreInput, EncryptedFileStoreFileSystem } from "./encrypted-file-store.js";
-export type { KeychainStoreInput, KeychainCommandRunner, KeychainCommandResult, KeychainCommandOptions } from "./keychain-store.js";

package/node_modules/auth-store/dist/index.js

@@ -1,4 +0,0 @@
-export { createSecretStore } from "./create-secret-store.js";
-export { EncryptedFileStore } from "./encrypted-file-store.js";
-export { KeychainStore } from "./keychain-store.js";
-export { key, MigratingSecretStore } from "./provider-store.js";

package/node_modules/auth-store/dist/keychain-store.d.ts

@@ -1,25 +0,0 @@
-import type { SecretStore } from "./types.js";
-export interface KeychainCommandResult {
-    stdout: string;
-    stderr: string;
-    exitCode: number;
-}
-export interface KeychainCommandOptions {
-    stdin?: string;
-}
-export type KeychainCommandRunner = (command: string, args: string[], options?: KeychainCommandOptions) => Promise<KeychainCommandResult>;
-export interface KeychainStoreInput {
-    runCommand?: KeychainCommandRunner;
-    service: string;
-    account: string;
-}
-export declare class KeychainStore implements SecretStore {
-    private readonly runCommand;
-    private readonly service;
-    private readonly account;
-    constructor(input: KeychainStoreInput);
-    get(): Promise<string | null>;
-    set(value: string): Promise<void>;
-    delete(): Promise<void>;
-    private executeSecurityCommand;
-}

package/node_modules/auth-store/dist/keychain-store.js

@@ -1,154 +0,0 @@
-import { spawn } from "node:child_process";
-const SECURITY_CLI = "security";
-const KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE = 44;
-export class KeychainStore {
-    runCommand;
-    service;
-    account;
-    constructor(input) {
-        this.runCommand = input.runCommand ?? runSecurityCommand;
-        this.service = input.service.trim();
-        this.account = input.account.trim();
-        if (this.service.length === 0) {
-            throw new Error("Keychain service must not be empty");
-        }
-        if (this.account.length === 0) {
-            throw new Error("Keychain account must not be empty");
-        }
-    }
-    async get() {
-        const result = await this.executeSecurityCommand(["find-generic-password", "-s", this.service, "-a", this.account, "-w"], "read secret from macOS Keychain");
-        if (getCommandExitCode(result) === 0) {
-            return stripTrailingLineBreak(getCommandOutput(result, "stdout"));
-        }
-        if (isKeychainEntryNotFound(result)) {
-            return null;
-        }
-        throw createSecurityCliFailure("read secret from macOS Keychain", result);
-    }
-    async set(value) {
-        if (value.includes("\n") || value.includes("\r")) {
-            throw new Error("Keychain secrets cannot contain line breaks");
-        }
-        const result = await this.executeSecurityCommand([
-            "add-generic-password",
-            "-s",
-            this.service,
-            "-a",
-            this.account,
-            "-U",
-            "-w",
-            value
-        ], "store secret in macOS Keychain");
-        if (getCommandExitCode(result) !== 0) {
-            throw createSecurityCliFailure("store secret in macOS Keychain", result);
-        }
-    }
-    async delete() {
-        const result = await this.executeSecurityCommand(["delete-generic-password", "-s", this.service, "-a", this.account], "delete secret from macOS Keychain");
-        if (getCommandExitCode(result) === 0 || isKeychainEntryNotFound(result)) {
-            return;
-        }
-        throw createSecurityCliFailure("delete secret from macOS Keychain", result);
-    }
-    async executeSecurityCommand(args, operation, options) {
-        try {
-            if (options === undefined) {
-                return await this.runCommand(SECURITY_CLI, args);
-            }
-            return await this.runCommand(SECURITY_CLI, args, options);
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            throw new Error(`Failed to ${operation}: ${message}`);
-        }
-    }
-}
-function runSecurityCommand(command, args, options) {
-    return new Promise((resolve) => {
-        const child = spawn(command, args, {
-            stdio: [options?.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"]
-        });
-        let stdout = "";
-        let stderr = "";
-        let stdinErrorMessage;
-        const appendStderr = (message) => {
-            stderr = stderr.length === 0
-                ? message
-                : `${stderr}${stderr.endsWith("\n") ? "" : "\n"}${message}`;
-        };
-        const appendStdinError = () => {
-            if (stdinErrorMessage === undefined) {
-                return;
-            }
-            appendStderr(stdinErrorMessage);
-            stdinErrorMessage = undefined;
-        };
-        child.stdout?.setEncoding("utf8");
-        child.stdout?.on("data", (chunk) => {
-            stdout += chunk.toString();
-        });
-        child.stderr?.setEncoding("utf8");
-        child.stderr?.on("data", (chunk) => {
-            stderr += chunk.toString();
-        });
-        if (options?.stdin !== undefined) {
-            child.stdin?.once("error", (error) => {
-                stdinErrorMessage = error instanceof Error ? error.message : String(error);
-            });
-            child.stdin?.end(options.stdin);
-        }
-        child.on("error", (error) => {
-            const message = error instanceof Error ? error.message : String(error ?? "Unknown error");
-            appendStdinError();
-            appendStderr(message);
-            resolve({
-                stdout,
-                stderr,
-                exitCode: 127
-            });
-        });
-        child.on("close", (code) => {
-            appendStdinError();
-            resolve({
-                stdout,
-                stderr,
-                exitCode: code ?? 1
-            });
-        });
-    });
-}
-function stripTrailingLineBreak(value) {
-    if (value.endsWith("\r\n")) {
-        return value.slice(0, -2);
-    }
-    if (value.endsWith("\n") || value.endsWith("\r")) {
-        return value.slice(0, -1);
-    }
-    return value;
-}
-function isKeychainEntryNotFound(result) {
-    return getCommandExitCode(result) === KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE;
-}
-function createSecurityCliFailure(operation, result) {
-    const exitCode = getCommandExitCode(result);
-    const details = getCommandOutput(result, "stderr").trim()
-        || getCommandOutput(result, "stdout").trim();
-    if (details) {
-        return new Error(`Failed to ${operation}: security exited with code ${exitCode}: ${details}`);
-    }
-    return new Error(`Failed to ${operation}: security exited with code ${exitCode}`);
-}
-function getCommandExitCode(result) {
-    const value = getOwnEntry(result, "exitCode");
-    return typeof value === "number" && Number.isInteger(value) ? value : 1;
-}
-function getCommandOutput(result, key) {
-    const value = getOwnEntry(result, key);
-    return typeof value === "string" ? value : "";
-}
-function getOwnEntry(record, key) {
-    return Object.prototype.hasOwnProperty.call(record, key)
-        ? record[key]
-        : undefined;
-}

package/node_modules/auth-store/dist/provider-store.d.ts

@@ -1,14 +0,0 @@
-import type { SecretStore } from "./types.js";
-export declare function key(providerId: string): string;
-export declare class MigratingSecretStore implements SecretStore {
-    private readonly store;
-    private readonly legacyStore;
-    private pendingMutation;
-    constructor(store: SecretStore, legacyStore?: SecretStore | null);
-    get(options?: {
-        readOnly?: boolean;
-    }): Promise<string | null>;
-    set(value: string): Promise<void>;
-    delete(): Promise<void>;
-    private mutate;
-}

package/node_modules/auth-store/dist/provider-store.js

@@ -1,78 +0,0 @@
-export function key(providerId) {
-    return `provider:${providerId}`;
-}
-export class MigratingSecretStore {
-    store;
-    legacyStore;
-    pendingMutation = Promise.resolve();
-    constructor(store, legacyStore = null) {
-        this.store = store;
-        this.legacyStore = legacyStore;
-    }
-    async get(options = {}) {
-        const value = await this.store.get();
-        if (value !== null || !this.legacyStore) {
-            return value;
-        }
-        const legacyValue = await this.legacyStore.get();
-        if (legacyValue !== null && !options.readOnly) {
-            await this.mutate(async () => {
-                if (await this.store.get() === null) {
-                    try {
-                        await this.store.set(legacyValue);
-                    }
-                    catch {
-                        return;
-                    }
-                }
-            });
-        }
-        return legacyValue;
-    }
-    async set(value) {
-        await this.mutate(async () => {
-            const previousValue = await this.store.get();
-            const previousLegacyValue = await this.legacyStore?.get() ?? null;
-            await this.store.set(value);
-            try {
-                await this.legacyStore?.set(value);
-            }
-            catch (error) {
-                await restore(this.store, previousValue);
-                if (this.legacyStore) {
-                    await restore(this.legacyStore, previousLegacyValue);
-                }
-                throw error;
-            }
-        });
-    }
-    async delete() {
-        await this.mutate(async () => {
-            const previousValue = await this.store.get();
-            const previousLegacyValue = await this.legacyStore?.get() ?? null;
-            await this.store.delete();
-            try {
-                await this.legacyStore?.delete();
-            }
-            catch (error) {
-                await restore(this.store, previousValue);
-                if (this.legacyStore) {
-                    await restore(this.legacyStore, previousLegacyValue);
-                }
-                throw error;
-            }
-        });
-    }
-    async mutate(action) {
-        const operation = this.pendingMutation.then(action, action);
-        this.pendingMutation = operation.catch(() => undefined);
-        await operation;
-    }
-}
-async function restore(store, value) {
-    if (value === null) {
-        await store.delete();
-        return;
-    }
-    await store.set(value);
-}

package/node_modules/auth-store/dist/types.d.ts

@@ -1,22 +0,0 @@
-import type { EncryptedFileStoreInput } from "./encrypted-file-store.js";
-import type { KeychainStoreInput } from "./keychain-store.js";
-export interface SecretStore {
-    get(options?: {
-        readOnly?: boolean;
-    }): Promise<string | null>;
-    set(value: string): Promise<void>;
-    delete(): Promise<void>;
-}
-export type StoreBackend = "file" | "keychain";
-export interface CreateSecretStoreInput {
-    backend?: StoreBackend;
-    env?: NodeJS.ProcessEnv;
-    platform?: NodeJS.Platform;
-    backendEnvVar?: string;
-    fileStore?: EncryptedFileStoreInput;
-    keychainStore?: KeychainStoreInput;
-}
-export interface CreateSecretStoreResult {
-    store: SecretStore;
-    backend: StoreBackend;
-}

package/node_modules/auth-store/dist/types.js

@@ -1 +0,0 @@
-export {};

package/node_modules/auth-store/package.json

@@ -1,25 +0,0 @@
-{
-  "private": true,
-  "license": "MIT",
-  "type": "module",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    }
-  },
-  "scripts": {
-    "build": "node ../../scripts/guard-package-dist.mjs && tsc"
-  },
-  "files": [
-    "dist",
-    "LICENSE"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/poe-platform/poe-code.git",
-    "directory": "packages/auth-store"
-  }
-}