@socketsecurity/lib 5.28.0 → 6.0.0

package/dist/secrets/rc.d.ts

@@ -0,0 +1,139 @@
+/**
+ * @file Write a managed `export VAR='<value>'` block to the user's shell rc
+ *   ("run commands") file. macOS only for now. `rc` is the historical Unix
+ *   suffix for shell-startup files (`.bashrc`, `.zshrc`, `.cshrc`) — short for
+ *   "run commands", a convention from MIT's CTSS (1965) carried through Multics
+ *   into Unix. This module writes a managed block into that file so the value
+ *   is exported into every subsequent shell session. Use case: `readSecret()`
+ *   from `./keychain` round-trips through the OS credential store on every
+ *   call. On macOS each call triggers a Keychain auth prompt unless the
+ *   keychain item's ACL allows the calling process. That's the right shape for
+ *   tools that read the secret once per process — but if you wire
+ *   `readSecret()` into a shell rc file directly, the user gets an auth prompt
+ *   on every new shell. Claude Code's Bash tool spawns a fresh shell per
+ *   command, which means continuous prompt flood. Solution: write the literal
+ *   value into ~/.zshenv (or equivalent) **once**, at install time, so every
+ *   subsequent shell session picks up the env var without re-reading the
+ *   keychain. The keychain is still the canonical store; this helper is just a
+ *   cached materialization that lives in the rc file. API: write({ service,
+ *   exports, notes?, legacySentinels? }) → { rcPath, outcome: 'inserted' |
+ *   'updated' | 'unchanged' } | undefined clear(service, legacySentinels?) →
+ *   boolean (true when a block was found and removed) Block layout (idempotent
+ *   — re-running with the same exports returns `outcome: 'unchanged'`):
+ *
+ *   # BEGIN <service> env (managed)
+ *
+ *   # Token persisted by <installer>.
+ *
+ *   # Rotate via: <rotate-command>
+ *
+ *   export VAR_1='<value>' export VAR_2='<value>'
+ *
+ *   # END <service> env (managed)
+ *
+ *   Target file by shell: zsh → ~/.zshenv (sourced by every zsh, including
+ *   non-interactive) bash → ~/.bashrc (or ~/.bash_profile fallback) For zsh we
+ *   deliberately pick .zshenv (not .zshrc) because tools that spawn
+ *   non-interactive shells (Claude Code, IDE plugins, CI runners) skip .zshrc
+ *   and would miss the export.
+ */
+export declare function buildBlock(opts: WriteOptions): {
+    begin: string;
+    end: string;
+    body: string;
+    full: string;
+};
+/**
+ * Remove the managed block from the user's shell rc file. Used by an uninstall
+ * / clear flow. Returns `true` when a block was found and removed, `false` when
+ * no block was present.
+ */
+export declare function clear(service: string, legacySentinels?: readonly string[]): boolean;
+export declare function escapeRegExp(s: string): string;
+export interface WriteOptions {
+    /**
+     * Logical service name. Used to compose the BEGIN/END sentinels (`# BEGIN
+     * <service> env (managed)`) so multiple tools can manage independent blocks
+     * in the same rc file without stepping on each other.
+     */
+    service: string;
+    /**
+     * Map of env-var name → literal value to export. Each entry becomes a single
+     * POSIX `export NAME='value'` line.
+     */
+    exports: Record<string, string>;
+    /**
+     * Optional doc-comment lines added at the top of the managed block (e.g.
+     * "Rotate via: my-installer --rotate"). Each entry is prefixed with `# `
+     * automatically.
+     */
+    notes?: readonly string[];
+    /**
+     * Legacy sentinel BEGIN strings to sweep before writing the new block. Used
+     * during a rename/migration so an older managed block is removed rather than
+     * ignored. Each entry should be the literal BEGIN line; the function
+     * tolerates any line endings up to the matching END (same prefix with `END`
+     * replacing `BEGIN`).
+     */
+    legacySentinels?: readonly string[];
+    /**
+     * Override the auto-detected shell. By default the helper reads `$SHELL` and
+     * targets the matching rc file:
+     *
+     * - Zsh → `~/.zshenv`
+     * - Bash → `~/.bashrc` (or `~/.bash_profile` if `~/.bashrc` is absent)
+     * - Fish → `~/.config/fish/config.fish`
+     *
+     * Useful when an installer is running under a different shell than the user
+     * normally uses (e.g. invoked from a sudo /bin/sh but the user is a zsh
+     * user).
+     */
+    shell?: 'zsh' | 'bash' | 'fish' | undefined;
+    /**
+     * Override the auto-picked rc path entirely. Use this when the user has a
+     * non-standard layout (chezmoi, dotfile managers, a separate
+     * `~/.zshenv.local` they source from `~/.zshenv`, etc.). The file is created
+     * if missing.
+     */
+    rcPath?: string | undefined;
+}
+export type WriteResult = {
+    rcPath: string;
+    outcome: 'inserted' | 'updated' | 'unchanged';
+} | {
+    rcPath: undefined;
+    outcome: 'skipped';
+    reason: 'unsupported-platform' | 'unknown-shell';
+};
+export declare function pickRcFile(shellOverride?: 'zsh' | 'bash' | 'fish'): string | undefined;
+export declare function shellSingleQuote(value: string): string;
+/**
+ * Insert or update the managed env-var block in the user's shell run-commands
+ * file (`~/.zshenv` for zsh, `~/.bashrc` / `~/.bash_profile` for bash,
+ * `~/.config/fish/config.fish` for fish). macOS only — Linux + Windows return
+ * `{outcome: 'skipped', reason: 'unsupported-platform'}` so callers can fall
+ * back to a copy- pasteable instruction without special-casing an `undefined`
+ * return.
+ *
+ * The block is matched by BEGIN/END sentinels, so it coexists with other
+ * managed blocks (homebrew, nvm, etc.). Idempotent: re-running with the same
+ * exports produces `outcome: 'unchanged'` and doesn't touch the file.
+ *
+ * `legacySentinels` lets a consumer migrate the block from an older BEGIN
+ * string. Each legacy block (matched by `BEGIN <legacy>` → `END <legacy>`) is
+ * stripped before the new block is written.
+ *
+ * `shell` and `rcPath` override the auto-detected target — useful for chezmoi /
+ * dotfile-manager users or installers running under a non-default shell.
+ */
+export declare function write(opts: WriteOptions): WriteResult;
+/**
+ * Internal: write an rc file with 0o600 (owner-only). The rc file embeds a
+ * literal SOCKET_API_KEY value so the shell rc can `export` it on session start
+ * without re-prompting the keychain. The file must NEVER be readable by other
+ * local users — `writeFileSync` with no `mode:` lands at `0o644` on first
+ * create (default umask 022), exposing the token on multi-user macOS / Linux
+ * machines. We unconditionally chmod after write so existing files with looser
+ * permissions also get tightened.
+ */
+export declare function writeRcFile(rcPath: string, contents: string): void;

package/dist/secrets/rc.js

@@ -0,0 +1,196 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var rc_exports = {};
+__export(rc_exports, {
+  buildBlock: () => buildBlock,
+  clear: () => clear,
+  escapeRegExp: () => escapeRegExp,
+  pickRcFile: () => pickRcFile,
+  shellSingleQuote: () => shellSingleQuote,
+  write: () => write,
+  writeRcFile: () => writeRcFile
+});
+module.exports = __toCommonJS(rc_exports);
+var import_node_fs = require("node:fs");
+var import_node_os = require("node:os");
+var import_node_path = __toESM(require("node:path"));
+var import_node_process = __toESM(require("node:process"));
+var import_home = require("../env/home");
+function buildBlock(opts) {
+  const begin = `# BEGIN ${opts.service} env (managed)`;
+  const end = `# END ${opts.service} env (managed)`;
+  const noteLines = (opts.notes ?? []).map((line) => `# ${line}`);
+  const exportLines = Object.entries(opts.exports).map(
+    ([name, value]) => `export ${name}=${shellSingleQuote(value)}`
+  );
+  const body = [...noteLines, ...exportLines].join("\n");
+  return {
+    begin,
+    end,
+    body,
+    full: `${begin}
+${body}
+${end}`
+  };
+}
+function clear(service, legacySentinels = []) {
+  if ((0, import_node_os.platform)() !== "darwin") {
+    return false;
+  }
+  const rcPath = pickRcFile();
+  if (!rcPath || !(0, import_node_fs.existsSync)(rcPath)) {
+    return false;
+  }
+  let existing = (0, import_node_fs.readFileSync)(rcPath, "utf8");
+  let removedAny = false;
+  const sentinelsToStrip = [
+    `# BEGIN ${service} env (managed)`,
+    ...legacySentinels
+  ];
+  for (const begin of sentinelsToStrip) {
+    const end = begin.replace(/\bBEGIN\b/, "END");
+    const endStripped = end.replace(/\s*\(managed\)\s*$/, "");
+    const endAlt = end === endStripped ? escapeRegExp(end) : `(?:${escapeRegExp(end)}|${escapeRegExp(endStripped)})`;
+    const re = new RegExp(
+      `
+*${escapeRegExp(begin)}[\\s\\S]*?${endAlt}
+?`,
+      "g"
+    );
+    const next = existing.replace(re, "\n");
+    if (next !== existing) {
+      removedAny = true;
+      existing = next;
+    }
+  }
+  if (removedAny) {
+    writeRcFile(rcPath, existing.replace(/\n{3,}/g, "\n\n"));
+  }
+  return removedAny;
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function pickRcFile(shellOverride) {
+  const home = (0, import_home.getHome)();
+  if (!home) {
+    return void 0;
+  }
+  const shellPath = import_node_process.default.env["SHELL"] ?? "";
+  const shell = shellOverride ?? (shellPath.endsWith("zsh") ? "zsh" : shellPath.endsWith("bash") ? "bash" : shellPath.endsWith("fish") ? "fish" : void 0);
+  if (shell === "zsh") {
+    return import_node_path.default.join(home, ".zshenv");
+  }
+  if (shell === "bash") {
+    const bashrc = import_node_path.default.join(home, ".bashrc");
+    if ((0, import_node_fs.existsSync)(bashrc)) {
+      return bashrc;
+    }
+    const bashProfile = import_node_path.default.join(home, ".bash_profile");
+    if ((0, import_node_fs.existsSync)(bashProfile)) {
+      return bashProfile;
+    }
+    return bashrc;
+  }
+  if (shell === "fish") {
+    return import_node_path.default.join(home, ".config", "fish", "config.fish");
+  }
+  return void 0;
+}
+function shellSingleQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function write(opts) {
+  if ((0, import_node_os.platform)() !== "darwin") {
+    return {
+      rcPath: void 0,
+      outcome: "skipped",
+      reason: "unsupported-platform"
+    };
+  }
+  const rcPath = opts.rcPath ?? pickRcFile(opts.shell);
+  if (!rcPath) {
+    return { rcPath: void 0, outcome: "skipped", reason: "unknown-shell" };
+  }
+  const { begin, end, full: desiredBlock } = buildBlock(opts);
+  let onDisk = "";
+  if ((0, import_node_fs.existsSync)(rcPath)) {
+    onDisk = (0, import_node_fs.readFileSync)(rcPath, "utf8");
+  }
+  let working = onDisk;
+  for (const legacyBegin of opts.legacySentinels ?? []) {
+    const legacyEnd = legacyBegin.replace(/\bBEGIN\b/, "END");
+    const legacyEndStripped = legacyEnd.replace(/\s*\(managed\)\s*$/, "");
+    const endAlt = legacyEnd === legacyEndStripped ? escapeRegExp(legacyEnd) : `(?:${escapeRegExp(legacyEnd)}|${escapeRegExp(legacyEndStripped)})`;
+    const legacyRe = new RegExp(
+      `
+*${escapeRegExp(legacyBegin)}[\\s\\S]*?${endAlt}
+?`,
+      "g"
+    );
+    working = working.replace(legacyRe, "\n");
+  }
+  const blockRe = new RegExp(
+    `${escapeRegExp(begin)}[\\s\\S]*?${escapeRegExp(end)}`
+  );
+  const match = blockRe.exec(working);
+  if (match) {
+    if (match[0] === desiredBlock && working === onDisk) {
+      return { rcPath, outcome: "unchanged" };
+    }
+    const rewritten = working.slice(0, match.index) + desiredBlock + working.slice(match.index + match[0].length);
+    writeRcFile(rcPath, rewritten.replace(/\n{3,}/g, "\n\n"));
+    return { rcPath, outcome: "updated" };
+  }
+  const needsLeadingNewline = working.length > 0 && !working.endsWith("\n\n");
+  const prefix = needsLeadingNewline ? working.endsWith("\n") ? "\n" : "\n\n" : "";
+  const next = `${working}${prefix}${desiredBlock}
+`.replace(/\n{3,}/g, "\n\n");
+  writeRcFile(rcPath, next);
+  return { rcPath, outcome: "inserted" };
+}
+function writeRcFile(rcPath, contents) {
+  (0, import_node_fs.writeFileSync)(rcPath, contents, { mode: 384 });
+  try {
+    (0, import_node_fs.chmodSync)(rcPath, 384);
+  } catch {
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  buildBlock,
+  clear,
+  escapeRegExp,
+  pickRcFile,
+  shellSingleQuote,
+  write,
+  writeRcFile
+});

package/dist/secrets/socket-api-token.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @file Convenience helper for reading the Socket API token from the canonical
+ *   env → keychain precedence order. Centralizes two constants every fleet
+ *   consumer would otherwise hard-code: the keychain service name
+ *   (`socket-cli`) and the env-var + account fallback list (`SOCKET_API_TOKEN`
+ *   canonical, `SOCKET_API_KEY` legacy alias). Consumers like firewall and
+ *   wheelhouse hooks call `readSocketApiToken()` instead of redoing the
+ *   `resolve({ service, accounts })` boilerplate.
+ */
+export interface ReadSocketApiTokenOptions {
+    /**
+     * When `true`, skip the keychain fallback entirely. The resolver checks
+     * `process.env.SOCKET_API_TOKEN` then `process.env.SOCKET_API_KEY` and
+     * returns `undefined` immediately if neither is set. Use this in headless
+     * contexts (CI, bootstrap hooks) where a Keychain auth prompt is
+     * unacceptable.
+     *
+     * @default false
+     */
+    allowEnvOnly?: boolean | undefined;
+}
+export declare function readSocketApiToken(options?: ReadSocketApiTokenOptions | undefined): Promise<string | undefined>;
+export declare function readSocketApiTokenSync(options?: ReadSocketApiTokenOptions | undefined): string | undefined;

package/dist/secrets/socket-api-token.js

@@ -0,0 +1,50 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var socket_api_token_exports = {};
+__export(socket_api_token_exports, {
+  readSocketApiToken: () => readSocketApiToken,
+  readSocketApiTokenSync: () => readSocketApiTokenSync
+});
+module.exports = __toCommonJS(socket_api_token_exports);
+var import_find = require("./find");
+const SOCKET_CLI_SERVICE = "socket-cli";
+const TOKEN_ACCOUNTS = ["SOCKET_API_TOKEN", "SOCKET_API_KEY"];
+async function readSocketApiToken(options) {
+  const result = await (0, import_find.resolve)({
+    service: SOCKET_CLI_SERVICE,
+    accounts: TOKEN_ACCOUNTS,
+    allowEnvOnly: options?.allowEnvOnly
+  });
+  return result?.value;
+}
+function readSocketApiTokenSync(options) {
+  const result = (0, import_find.resolveSync)({
+    service: SOCKET_CLI_SERVICE,
+    accounts: TOKEN_ACCOUNTS,
+    allowEnvOnly: options?.allowEnvOnly
+  });
+  return result?.value;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  readSocketApiToken,
+  readSocketApiTokenSync
+});

package/dist/secrets/types.d.ts

@@ -0,0 +1,69 @@
+/**
+ * @file Public type surface for `secrets/*`. Secrets in the fleet are stored
+ *   under the OS's native credential store keyed by `{ service, account }`:
+ *
+ *   - macOS: Keychain generic-password items (service = `-s`, account = `-a`
+ *     flags on `security(1)`)
+ *   - Linux: libsecret Secret Service items (service + user attributes via
+ *     `secret-tool`)
+ *   - Windows: Credential Manager StoredCredential targets ("service:account"
+ *     composed as the target name) Consumers pick their own service name
+ *     (`socket-cli`, `socket-mcp`, `depot`, etc.) and account name (typically
+ *     the env-var the value eventually lands in, e.g. `SOCKET_API_TOKEN`).
+ */
+/**
+ * Coordinate for a secret in the OS credential store.
+ *
+ * @property service - Logical service identifier (e.g. `'socket-cli'`,
+ *   `'socket-mcp'`). Per-consumer; pick a stable name and use it everywhere
+ *   your tool reads/writes its secrets.
+ * @property account - Per-secret name within a service. Typically the canonical
+ *   env-var the value will be exported under (e.g. `'SOCKET_API_TOKEN'`), since
+ *   that's the name a future reader will reach for when grepping the keychain.
+ */
+export interface SecretSlot {
+    service: string;
+    account: string;
+}
+/**
+ * Result of a write attempt. The `account` is echoed back so a batch caller
+ * (writeSecretToSlots) can correlate per-slot outcomes without reconstructing
+ * the input order.
+ *
+ * `outcome: 'unchanged'` is returned when the stored value already matches the
+ * requested value — the helper short-circuits without issuing an OS write.
+ * Callers logging "rotated N tokens" should filter for `outcome === 'written'`
+ * to avoid lying about no-ops.
+ */
+export interface SecretWriteResult {
+    account: string;
+    outcome: 'written' | 'unchanged';
+}
+/**
+ * Result of a delete attempt. Idempotent: `outcome: 'removed'` when an entry
+ * existed and was deleted, `outcome: 'absent'` when no entry was present (still
+ * a success — caller wanted the slot empty).
+ */
+export interface SecretDeleteResult {
+    account: string;
+    outcome: 'removed' | 'absent';
+}
+/**
+ * Diagnostic from `checkBackendAvailable`. Used by installers / onboarding
+ * flows to tell the operator upfront whether the OS has the credential tooling
+ * needed (e.g. `libsecret-tools` on Linux, the CredentialManager PowerShell
+ * module on Windows).
+ */
+export interface BackendAvailability {
+    available: boolean;
+    /**
+     * Human-facing tool name for log messages.
+     */
+    toolName: string;
+    /**
+     * `apt install libsecret-tools` / similar. `undefined` when the backend is
+     * always available (macOS `security(1)` ships with the OS) or when no install
+     * path is sensible (unsupported platform).
+     */
+    installHint: string | undefined;
+}

package/dist/secrets/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);

package/dist/secrets/windows.d.ts

@@ -0,0 +1,50 @@
+/**
+ * @file Windows backend via PowerShell CredentialManager module, with a
+ *   DPAPI-encrypted file fallback. Two paths, tried in order:
+ *
+ *   1. CredentialManager PowerShell module (`New-StoredCredential` /
+ *      `Get-StoredCredential` / `Remove-StoredCredential`). The cleanest path —
+ *      stored credentials live in the Windows Credential Manager, the same
+ *      place `cmdkey` writes to. Requires the module to be installed
+ *      (`Install-Module CredentialManager -Scope CurrentUser`).
+ *   2. DPAPI-encrypted file under `%APPDATA%\<service>\<account>.enc`. Used when
+ *      the CredentialManager module isn't available.
+ *      `System.Security.Cryptography.ProtectedData` encrypts under the
+ *      current-user machine key — readable only by this user on this machine,
+ *      never plaintext. The target name composed for CredentialManager is
+ *      `service:account` (matching `cmdkey /generic:<target>` convention).
+ */
+export declare function buildTarget(service: string, account: string): string;
+export declare function deleteWindows(service: string, account: string): Promise<'removed' | 'absent'>;
+export declare function deleteWindowsSync(service: string, account: string): 'removed' | 'absent';
+export declare function getDpapiFilePath(service: string, account: string): string;
+export declare function isWindowsBackendAvailable(): boolean;
+export declare function quotePs(value: string): string;
+export declare function readDpapi(filePath: string): Promise<string | undefined>;
+export declare function readDpapiSync(filePath: string): string | undefined;
+export declare function readWindows(service: string, account: string): Promise<string | undefined>;
+export declare function readWindowsSync(service: string, account: string): string | undefined;
+export declare function runPsAsync(script: string, input?: string): Promise<{
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}>;
+export declare function runPsSync(script: string, input?: string): {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * Reject identifier components (service / account names) that contain path
+ * separators, `..` segments, or NUL bytes. These would escape the intended
+ * `%APPDATA%\<service>\<account>.enc` layout and let a caller read or overwrite
+ * arbitrary files under the user's profile.
+ *
+ * Throws on bad input rather than sanitizing — callers should pass logical
+ * identifiers (e.g. `socket-cli`, `SOCKET_API_KEY`), not paths.
+ */
+export declare function validateKeychainComponent(value: string, name: string): void;
+export declare function writeDpapi(filePath: string, value: string): Promise<void>;
+export declare function writeDpapiSync(filePath: string, value: string): void;
+export declare function writeWindows(service: string, account: string, value: string, _label: string): Promise<void>;
+export declare function writeWindowsSync(service: string, account: string, value: string, _label: string): void;