import { Effect } from "effect"; import { StorageError, type SecretProvider } from "@executor/sdk"; import { getPassword, setPassword, deletePassword } from "./keyring"; // ---------------------------------------------------------------------------// SecretProvider adapter — bridges keyring into SDK resolution chain//// The underlying `@napi-rs/keyring` sync API encodes "no entry" as an// ordinary return value (`getPassword()` → `null`, `deletePassword()` →// `false`), and only throws on real failures (keychain locked, permission// denied, platform init failure, etc.). `keyring.ts` wraps those thrown// failures as `KeychainError`. We translate `KeychainError` →// `StorageError` so the HTTP edge can capture it to telemetry and surface// an opaque `InternalError({ traceId })` — previously `orElseSucceed`// silently converted every failure into "nothing found", which made it// impossible to debug why secrets weren't resolving.// --------------------------------------------------------------------------- const toStorageError = (cause: { readonly message: string; readonly cause?: unknown }) =>  new StorageError({ message: cause.message, cause: cause.cause ?? cause }); // Scope arg is ignored — keychain partitions by `serviceName`, which the// host fixes per executor at construction time. A future refactor could// fold `scope` into the service name, but today a keychain provider// instance is already one-scope.export const makeKeychainProvider = (serviceName: string): SecretProvider => ({  key: "keychain",  writable: true,  get: (secretId, _scope) =>    getPassword(serviceName, secretId).pipe(Effect.mapError(toStorageError)),  set: (secretId, value, _scope) =>    setPassword(serviceName, secretId, value).pipe(Effect.mapError(toStorageError)),  delete: (secretId, _scope) =>    deletePassword(serviceName, secretId).pipe(Effect.mapError(toStorageError)),  // Keychain doesn't support enumerating — you need to know the account name  list: undefined,});