import { Effect } from "effect"; import { StorageError, type SecretProvider } from "@executor-js/sdk/core"; import type { KeychainError } from "./errors";import { getPassword, setPassword, deletePassword } from "./keyring"; // ---------------------------------------------------------------------------// SecretProvider adapter — bridges keyring into SDK resolution chain//// The underlying `@napi-rs/keyring` sync API encodes "no entry" as an// ordinary return value (`getPassword()` → `null`, `deletePassword()` →// `false`), and only throws on real failures (keychain locked, permission// denied, platform init failure, etc.). `keyring.ts` wraps those thrown// failures as `KeychainError`. We translate `KeychainError` →// `StorageError` so the HTTP edge can capture it to telemetry and surface// an opaque `InternalError({ traceId })` — previously `orElseSucceed`// silently converted every failure into "nothing found", which made it// impossible to debug why secrets weren't resolving.// --------------------------------------------------------------------------- const toStorageError = (cause: KeychainError) => {  const { cause: underlyingCause } = cause;  // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: typed KeychainError message becomes StorageError message  return new StorageError({ message: cause.message, cause: underlyingCause ?? cause });}; export const scopedKeychainServiceName = (baseServiceName: string, scope: string): string =>  `${baseServiceName}/${scope}`; export const makeKeychainProvider = (baseServiceName: string): SecretProvider => ({  key: "keychain",  writable: true,  get: (secretId, scope) =>    getPassword(scopedKeychainServiceName(baseServiceName, scope), secretId).pipe(      Effect.mapError(toStorageError),    ),  set: (secretId, value, scope) =>    setPassword(scopedKeychainServiceName(baseServiceName, scope), secretId, value).pipe(      Effect.mapError(toStorageError),    ),  delete: (secretId, scope) =>    deletePassword(scopedKeychainServiceName(baseServiceName, scope), secretId).pipe(      Effect.mapError(toStorageError),    ),  // Keychain doesn't support enumerating — you need to know the account name  list: undefined,});