@byok-sdk/keys 0.2.1 → 0.3.0

package/dist/index.js

@@ -1,9 +1,9 @@
 import { z } from 'zod';
 import { spawn } from 'child_process';
+import path, { dirname } from 'path';
 import { createHash } from 'crypto';
 import { mkdirSync, existsSync, chmodSync } from 'fs';
 import { createRequire } from 'module';
-import { dirname } from 'path';
 import { isCoreConflictError, contentHash } from '@byok-sdk/core';
 
 // src/errors.ts
@@ -588,8 +588,6 @@ var InMemorySecretStore = class _InMemorySecretStore {
     return `${this.#servicePrefix}.${assertSecretName(name)}`;
   }
 };
-
-// src/macos-keychain.ts
 var DEFAULT_KEYCHAIN_SECRET_STORAGE_PREFIX = "byok-b64-v1:";
 var SECURITY_ITEM_NOT_FOUND = 44;
 var MacOsKeychainSecretStore = class _MacOsKeychainSecretStore {
@@ -597,6 +595,7 @@ var MacOsKeychainSecretStore = class _MacOsKeychainSecretStore {
   #account;
   #allowUnprefixedRead;
   #commandRunner;
+  #keychainPath;
   #platform;
   #servicePrefix;
   #storagePrefix;
@@ -604,6 +603,7 @@ var MacOsKeychainSecretStore = class _MacOsKeychainSecretStore {
     this.#account = options.account ?? "local-device";
     this.#allowUnprefixedRead = options.allowUnprefixedRead ?? false;
     this.#commandRunner = options.commandRunner ?? runCommand;
+    this.#keychainPath = assertKeychainPath(options.keychainPath);
     this.#platform = options.platform ?? process.platform;
     this.#servicePrefix = options.servicePrefix ?? DEFAULT_SECRET_SERVICE_PREFIX;
     this.#storagePrefix = options.storagePrefix ?? DEFAULT_KEYCHAIN_SECRET_STORAGE_PREFIX;
@@ -611,9 +611,7 @@ var MacOsKeychainSecretStore = class _MacOsKeychainSecretStore {
   async available() {
     if (this.#platform !== "darwin") return false;
     const result = await this.#commandRunner("/usr/bin/security", [
-      "default-keychain",
-      "-d",
-      "user"
+      ...this.#keychainPath === void 0 ? ["default-keychain", "-d", "user"] : ["show-keychain-info", this.#keychainPath]
     ]);
     return result.exitCode === 0;
   }
@@ -625,7 +623,8 @@ var MacOsKeychainSecretStore = class _MacOsKeychainSecretStore {
       "-a",
       this.#account,
       "-s",
-      service
+      service,
+      ...this.#keychainPath === void 0 ? [] : [this.#keychainPath]
     ]);
     if (result.exitCode === SECURITY_ITEM_NOT_FOUND) return false;
     if (result.exitCode !== 0) {
@@ -645,7 +644,8 @@ var MacOsKeychainSecretStore = class _MacOsKeychainSecretStore {
       this.#account,
       "-s",
       service,
-      "-w"
+      "-w",
+      ...this.#keychainPath === void 0 ? [] : [this.#keychainPath]
     ]);
     if (result.exitCode === SECURITY_ITEM_NOT_FOUND) return void 0;
     if (result.exitCode !== 0) {
@@ -664,6 +664,7 @@ var MacOsKeychainSecretStore = class _MacOsKeychainSecretStore {
       account: this.#account,
       allowUnprefixedRead: this.#allowUnprefixedRead,
       commandRunner: this.#commandRunner,
+      keychainPath: this.#keychainPath,
       platform: this.#platform,
       servicePrefix: `${this.#servicePrefix}.scope.${assertSecretNamespace(namespace)}`,
       storagePrefix: this.#storagePrefix
@@ -687,7 +688,8 @@ var MacOsKeychainSecretStore = class _MacOsKeychainSecretStore {
       "-s",
       quoteSecurityInteractiveArgument(service),
       "-w",
-      quoteSecurityInteractiveArgument(storedSecret)
+      quoteSecurityInteractiveArgument(storedSecret),
+      ...this.#keychainPath === void 0 ? [] : [quoteSecurityInteractiveArgument(this.#keychainPath)]
     ].join(" ");
     const result = await this.#commandRunner(
       "/usr/bin/security",
@@ -746,6 +748,16 @@ function quoteSecurityInteractiveArgument(value) {
   }
   return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
 }
+function assertKeychainPath(keychainPath) {
+  if (keychainPath === void 0) return void 0;
+  if (keychainPath.length === 0 || !path.posix.isAbsolute(keychainPath) || /[\u0000\r\n]/u.test(keychainPath)) {
+    throw new ByokKeysError(
+      "KEYCHAIN_ARGUMENT_INVALID",
+      "macOS keychain path must be a non-empty absolute single-line path"
+    );
+  }
+  return keychainPath;
+}
 
 // src/windows-credential-manager.ts
 var CREDENTIAL_NOT_FOUND = 44;
@@ -1207,19 +1219,19 @@ function isSqliteAvailable() {
     return false;
   }
 }
-function openSqliteDatabase(path, options, faults) {
+function openSqliteDatabase(path2, options, faults) {
   const { DatabaseSync } = loadSqliteModule();
   const readOnly = options?.readOnly === true;
-  if (path !== ":memory:" && !readOnly) {
-    mkdirSync(dirname(path), { mode: SECURE_DIR_MODE, recursive: true });
+  if (path2 !== ":memory:" && !readOnly) {
+    mkdirSync(dirname(path2), { mode: SECURE_DIR_MODE, recursive: true });
   }
-  const database = new DatabaseSync(path, {
+  const database = new DatabaseSync(path2, {
     timeout: DEFAULT_BUSY_TIMEOUT_MS,
     ...options
   });
   try {
     faults?.onStep?.("after-open");
-    if (path !== ":memory:" && !readOnly) {
+    if (path2 !== ":memory:" && !readOnly) {
       database.exec("PRAGMA journal_mode = WAL");
       faults?.onStep?.("after-wal");
       database.exec("PRAGMA synchronous = FULL");