@rafads/plugin-keychain

@rafads/plugin-keychain

OS-keychain-backed secret store for the executor. Reads and writes secrets to:

• macOS / iOS — Keychain
• Linux — Secret Service (GNOME Keyring, KWallet)
• Windows — Credential Manager

Secrets are encrypted at rest by the operating system and never touch your project's filesystem.

Install

bun add @rafads/sdk @rafads/plugin-keychain
# or
npm install @rafads/sdk @rafads/plugin-keychain

Usage

import { createExecutor } from "@rafads/sdk";
import { keychainPlugin } from "@rafads/plugin-keychain";

const executor = await createExecutor({
  onElicitation: "accept-all",
  plugins: [keychainPlugin()] as const,
});

// Check whether the current OS has a supported keychain
if (executor.keychain.isSupported) {
  await executor.secrets.set({
    id: "github-token",
    name: "GitHub Token",
    value: "ghp_...",
    scope: executor.scopes[0]!.id,
  });

  const value = await executor.secrets.get("github-token");
}

Secrets written through this plugin are available to every other plugin that resolves secrets by ID — so you can store a token once and use it across @rafads/plugin-openapi, @rafads/plugin-graphql, etc. via { secretId, prefix } headers.

Using with Effect

If you're building on @rafads/sdk/core (the raw Effect entry), import this plugin from its /core subpath instead — it returns the Effect-shaped plugin with Effect.Effect<...>-returning methods rather than promisified wrappers:

import { keychainPlugin } from "@rafads/plugin-keychain/core";

Status

Pre-1.0. APIs may still change between beta releases. Part of the executor monorepo.

License

MIT