@socketsecurity/lib 6.0.3 → 6.0.5

package/dist/schema/parse.js

@@ -1,39 +1,38 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var parse_exports = {};
-__export(parse_exports, {
-  parseSchema: () => parseSchema
-});
-module.exports = __toCommonJS(parse_exports);
-var import_validate = require("./validate");
-var import_error = require("../primordials/error");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_error = require('../primordials/error.js');
+const require_schema_validate = require('./validate.js');
+
+//#region src/schema/parse.ts
+/**
+* @file Throwing twin of `validateSchema`. Use `parseSchema(schema, data)` for
+*   fail-fast trust boundaries (app startup, config files, internal
+*   assertions). Use the non-throwing `validateSchema` for recoverable input
+*   (form fields, API request bodies, anywhere errors need to surface to a
+*   user).
+*
+* @example
+*   ;```ts
+*   import { z } from 'zod'
+*   import { parseSchema } from '@socketsecurity/lib/schema/parse'
+*
+*   const Config = z.object({ host: z.string(), port: z.number() })
+*   const config = parseSchema(Config, json) // throws on invalid
+*   ```
+*/
+/**
+* Parse `data` against `schema` and return the validated value.
+*
+* @throws {Error} When validation fails. The message lists all issues as `path:
+*   message, path: message, ...`. Use `validateSchema` if you need structured
+*   access to the error list.
+*/
 function parseSchema(schema, data) {
-  const result = (0, import_validate.validateSchema)(schema, data);
-  if (result.ok) {
-    return result.value;
-  }
-  const summary = result.errors.map((e) => `${e.path.join(".") || "(root)"}: ${e.message}`).join(", ");
-  throw new import_error.ErrorCtor(`Validation failed: ${summary}`);
+	const result = require_schema_validate.validateSchema(schema, data);
+	if (result.ok) return result.value;
+	throw new require_primordials_error.ErrorCtor(`Validation failed: ${result.errors.map((e) => `${e.path.join(".") || "(root)"}: ${e.message}`).join(", ")}`);
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  parseSchema
-});
+
+//#endregion
+exports.parseSchema = parseSchema;

package/dist/schema/types.js

@@ -1,18 +1,2 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var types_exports = {};
-module.exports = __toCommonJS(types_exports);
+/* Socket Lib - Built with rolldown */

package/dist/schema/validate.js

@@ -1,108 +1,127 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var validate_exports = {};
-__export(validate_exports, {
-  isTypeBoxSchema: () => isTypeBoxSchema,
-  normalizeTypeBoxErrors: () => normalizeTypeBoxErrors,
-  normalizeZodError: () => normalizeZodError,
-  validateSchema: () => validateSchema
-});
-module.exports = __toCommonJS(validate_exports);
-var import_array = require("../primordials/array");
-var import_error = require("../primordials/error");
-var import_number = require("../primordials/number");
-var import_object = require("../primordials/object");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_error = require('../primordials/error.js');
+const require_primordials_number = require('../primordials/number.js');
+const require_primordials_array = require('../primordials/array.js');
+const require_primordials_object = require('../primordials/object.js');
+
+//#region src/schema/validate.ts
+/**
+* @file Universal schema validator — non-throwing. Accepts any Zod-shaped
+*   schema (`.safeParse`-exposing) and returns a tagged result `{ ok: true,
+*   value } | { ok: false, errors }` with normalized `{ path, message }`
+*   issues. No runtime dependency on `zod` — detection is purely structural.
+*
+* @example
+*   ;```ts
+*   import { z } from 'zod'
+*   import { validateSchema } from '@socketsecurity/lib/schema/validate'
+*
+*   const User = z.object({ name: z.string() })
+*   const r = validateSchema(User, data)
+*   if (r.ok)
+*     r.value.name // string
+*   else r.errors // ValidationIssue[]
+*   ```
+*
+* @internal
+* socket-lib additionally recognizes TypeBox schemas for its own internal
+* use (e.g. `src/ipc.ts`'s stub-file validation). That path is not a
+* supported consumer API.
+*/
+/**
+* Detect a TypeBox schema structurally: object with a symbol key whose
+* description is `'TypeBox.Kind'`, holding a string value.
+*
+* @internal
+*/
 function isTypeBoxSchema(schema) {
-  if (schema === null || typeof schema !== "object") {
-    return false;
-  }
-  for (const sym of (0, import_object.ObjectGetOwnPropertySymbols)(schema)) {
-    if (sym.description === "TypeBox.Kind") {
-      return typeof schema[sym] === "string";
-    }
-  }
-  return false;
+	if (schema === null || typeof schema !== "object") return false;
+	for (const sym of require_primordials_object.ObjectGetOwnPropertySymbols(schema)) if (sym.description === "TypeBox.Kind") return typeof schema[sym] === "string";
+	return false;
 }
+/**
+* Normalize a TypeBox `ValueError` iterator into plain issues. TypeBox paths
+* are JSON Pointers (`/user/0/name`); convert to arrays.
+*
+* @internal
+*/
 function normalizeTypeBoxErrors(errors) {
-  const out = [];
-  for (const err of errors) {
-    const segs = err.path.split("/").filter(Boolean);
-    out.push({
-      path: segs.map((s) => {
-        const n = Number(s);
-        return (0, import_number.NumberIsInteger)(n) && String(n) === s ? n : s;
-      }),
-      message: err.message
-    });
-  }
-  return out;
+	const out = [];
+	for (const err of errors) {
+		const segs = err.path.split("/").filter(Boolean);
+		out.push({
+			path: segs.map((s) => {
+				const n = Number(s);
+				return require_primordials_number.NumberIsInteger(n) && String(n) === s ? n : s;
+			}),
+			message: err.message
+		});
+	}
+	return out;
 }
+/**
+* Normalize a Zod error object (v3 or v4) into plain issues. Both versions
+* expose `.issues: Array<{ path, message }>`.
+*
+* @internal
+*/
 function normalizeZodError(err) {
-  if (err === null || typeof err !== "object") {
-    return [{ path: [], message: String(err) }];
-  }
-  const issues = err.issues;
-  if (!(0, import_array.ArrayIsArray)(issues)) {
-    return [{ path: [], message: "Unknown validation error" }];
-  }
-  return issues.map((issue) => {
-    const i = issue;
-    return {
-      path: (0, import_array.ArrayIsArray)(i.path) ? i.path : [],
-      message: typeof i.message === "string" ? i.message : "Invalid value"
-    };
-  });
+	if (err === null || typeof err !== "object") return [{
+		path: [],
+		message: String(err)
+	}];
+	const issues = err.issues;
+	if (!require_primordials_array.ArrayIsArray(issues)) return [{
+		path: [],
+		message: "Unknown validation error"
+	}];
+	return issues.map((issue) => {
+		const i = issue;
+		return {
+			path: require_primordials_array.ArrayIsArray(i.path) ? i.path : [],
+			message: typeof i.message === "string" ? i.message : "Invalid value"
+		};
+	});
 }
+/**
+* Validate `data` against a Zod-style `schema`. Non-throwing.
+*
+* The return type narrows `value` to `Infer<S>`, so callers get `z.infer<typeof
+* S>` with no casts. Errors are normalized to `{ path, message }` regardless of
+* the underlying validator.
+*
+* @throws {TypeError} When `schema` is not a recognized validator kind.
+*/
 function validateSchema(schema, data) {
-  if (isTypeBoxSchema(schema)) {
-    const { Value } = require("../external/@sinclair/typebox/value");
-    if (Value.Check(schema, data)) {
-      return { ok: true, value: data };
-    }
-    return {
-      ok: false,
-      errors: normalizeTypeBoxErrors(Value.Errors(schema, data))
-    };
-  }
-  if (schema !== null && typeof schema === "object" && typeof schema.safeParse === "function") {
-    const result = schema.safeParse(data);
-    if (result.success === true) {
-      return {
-        ok: true,
-        value: result.data
-      };
-    }
-    return {
-      ok: false,
-      errors: normalizeZodError(result.error)
-    };
-  }
-  throw new import_error.TypeErrorCtor(
-    "validateSchema: unsupported schema kind. Expected a Zod schema or an object with a safeParse method."
-  );
+	if (isTypeBoxSchema(schema)) {
+		const { Value } = require("../external/@sinclair/typebox/value");
+		if (Value.Check(schema, data)) return {
+			ok: true,
+			value: data
+		};
+		return {
+			ok: false,
+			errors: normalizeTypeBoxErrors(Value.Errors(schema, data))
+		};
+	}
+	if (schema !== null && typeof schema === "object" && typeof schema.safeParse === "function") {
+		const result = schema.safeParse(data);
+		if (result.success === true) return {
+			ok: true,
+			value: result.data
+		};
+		return {
+			ok: false,
+			errors: normalizeZodError(result.error)
+		};
+	}
+	throw new require_primordials_error.TypeErrorCtor("validateSchema: unsupported schema kind. Expected a Zod schema or an object with a safeParse method.");
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  isTypeBoxSchema,
-  normalizeTypeBoxErrors,
-  normalizeZodError,
-  validateSchema
-});
+
+//#endregion
+exports.isTypeBoxSchema = isTypeBoxSchema;
+exports.normalizeTypeBoxErrors = normalizeTypeBoxErrors;
+exports.normalizeZodError = normalizeZodError;
+exports.validateSchema = validateSchema;

package/dist/sea/detect.js

@@ -1,58 +1,63 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var detect_exports = {};
-__export(detect_exports, {
-  getSeaBinaryPath: () => getSeaBinaryPath,
-  isSeaBinary: () => isSeaBinary
-});
-module.exports = __toCommonJS(detect_exports);
-var import_node_process = __toESM(require("node:process"));
-var import_normalize = require("../paths/normalize");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_paths_normalize = require('../paths/normalize.js');
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/sea/detect.ts
+/**
+* @file SEA (Single Executable Application) binary detection + path accessor.
+*   Two responsibilities (mirror of `src/smol/detect.ts` shape):
+*
+*   1. `isSeaBinary()` — memoized boolean detector for whether the current process
+*      is running as a Node.js Single Executable Application. Probes via Node
+*      24+'s `node:sea.isSea()` native API; falls back to `false` on older
+*      runtimes.
+*   2. `getSeaBinaryPath()` — returns the path of the SEA binary
+*      (`process.argv[0]` normalized) when running as SEA, otherwise
+*      `undefined`. Defensive across runtimes: returns `false` / `undefined`
+*      cleanly on stock Node < 24, browsers, Deno, Bun.
+*/
+/**
+* Cached SEA detection result.
+*/
 let _isSea;
+/**
+* Get the current SEA binary path. Only valid when running as a SEA binary.
+*
+* @example
+*   ```typescript
+*   const binPath = getSeaBinaryPath()
+*   if (binPath) {
+*   console.log(`Running as SEA binary: ${binPath}`)
+*   }
+*   ```
+*/
 function getSeaBinaryPath() {
-  return isSeaBinary() && import_node_process.default.argv[0] ? (0, import_normalize.normalizePath)(import_node_process.default.argv[0]) : void 0;
+	return isSeaBinary() && node_process.default.argv[0] ? /* @__PURE__ */ require_paths_normalize.normalizePath(node_process.default.argv[0]) : void 0;
 }
+/**
+* Detect if the current process is running as a SEA binary. Uses Node.js 24+
+* native API with caching for performance.
+*
+* @example
+*   ;```typescript
+*   if (isSeaBinary()) {
+*     console.log('Running as a Single Executable Application')
+*   }
+*   ```
+*/
 function isSeaBinary() {
-  if (_isSea === void 0) {
-    try {
-      const seaModule = require("node:sea");
-      _isSea = seaModule.isSea();
-    } catch {
-      _isSea = false;
-    }
-  }
-  return _isSea ?? false;
+	if (_isSea === void 0) try {
+		_isSea = require("node:sea").isSea();
+	} catch {
+		_isSea = false;
+	}
+	return _isSea ?? false;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  getSeaBinaryPath,
-  isSeaBinary
-});
+
+//#endregion
+exports.getSeaBinaryPath = getSeaBinaryPath;
+exports.isSeaBinary = isSeaBinary;

package/dist/secrets/_internal.js

@@ -1,84 +1,103 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var internal_exports = {};
-__export(internal_exports, {
-  cacheKey: () => cacheKey,
-  dedupeRead: () => dedupeRead,
-  getCached: () => getCached,
-  has: () => has,
-  invalidate: () => invalidate,
-  invalidateAll: () => invalidateAll,
-  setCached: () => setCached
-});
-module.exports = __toCommonJS(internal_exports);
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/secrets/_internal.ts
+/**
+* @file Private internals for `secrets/` — process-scoped read cache for the
+*   keychain backend. Underscore-prefixed and skipped by the export generator
+*   (`dist/**\/_*` ignore pattern in
+*   `scripts/fix/generate-package-exports.mts`) so this module is NOT part of
+*   the public API surface. Imported by `./keychain.ts`. Every `readSecret`
+*   call shells out to the OS credential CLI (`security`, `secret-tool`,
+*   PowerShell). On macOS, the first read of a given entry by a new binary path
+*   triggers a Keychain auth prompt unless the entry was written with `-A -T
+*   ''` (which we now do — see `./macos.ts`). Even so, every read is a process
+*   spawn, which costs a few ms per call. For tools that read the same secret
+*   multiple times within one process (CLI commands handling multiple
+*   subcommands, MCP request handlers serving sibling endpoints), a
+*   process-scoped cache eliminates the redundant work. Lifetime: a single Node
+*   process. The cache lives in module-level state; importing this module from
+*   a child process gets a fresh cache. No persistence to disk — for that, see
+*   `./rc.ts` which materializes a one-time `export` block into the shell rc.
+*   Invalidation: callers MUST invalidate the cache when they write/delete the
+*   same `{service, account}` pair. The public keychain.ts wraps writeSecret /
+*   deleteSecret so cache eviction happens automatically. Concurrency:
+*   in-flight reads of the same key share a single Promise so two `await
+*   readSecret(...)` calls don't spawn two `security` processes for the same
+*   entry. Once the Promise resolves, the value is cached. If the read returns
+*   undefined (entry missing), `undefined` is cached too — callers that want a
+*   re-check after creating the entry must call `invalidate`.
+*/
 const valueCache = /* @__PURE__ */ new Map();
 const inflight = /* @__PURE__ */ new Map();
 function cacheKey(service, account) {
-  return `${service} ${account}`;
+	return `${service} ${account}`;
 }
+/**
+* Coordinate concurrent reads of the same key. The first caller registers a
+* Promise; subsequent callers receive the same Promise instead of spawning
+* another OS call. On settle, the Promise's inflight slot is dropped and the
+* value is cached.
+*/
 async function dedupeRead(service, account, reader) {
-  const key = cacheKey(service, account);
-  if (valueCache.has(key)) {
-    return valueCache.get(key);
-  }
-  const existing = inflight.get(key);
-  if (existing) {
-    return existing;
-  }
-  const promise = (async () => {
-    try {
-      const value = await reader();
-      valueCache.set(key, value);
-      return value;
-    } finally {
-      inflight.delete(key);
-    }
-  })();
-  inflight.set(key, promise);
-  return promise;
+	const key = cacheKey(service, account);
+	if (valueCache.has(key)) return valueCache.get(key);
+	const existing = inflight.get(key);
+	if (existing) return existing;
+	const promise = (async () => {
+		try {
+			const value = await reader();
+			valueCache.set(key, value);
+			return value;
+		} finally {
+			inflight.delete(key);
+		}
+	})();
+	inflight.set(key, promise);
+	return promise;
 }
+/**
+* Look up a cached value. Returns `undefined` for both "cached as absent" and
+* "not yet cached" — callers that need to distinguish those cases should use
+* `has` first.
+*/
 function getCached(service, account) {
-  return valueCache.get(cacheKey(service, account));
+	return valueCache.get(cacheKey(service, account));
 }
 function has(service, account) {
-  return valueCache.has(cacheKey(service, account));
+	return valueCache.has(cacheKey(service, account));
 }
+/**
+* Drop a cached value. Called by `writeSecret` / `deleteSecret` after the
+* underlying OS state changes so a subsequent `readSecret` reflects the new
+* reality. Also called by `invalidateAll()` for service-wide refreshes.
+*/
 function invalidate(service, account) {
-  valueCache.delete(cacheKey(service, account));
-  inflight.delete(cacheKey(service, account));
+	valueCache.delete(cacheKey(service, account));
+	inflight.delete(cacheKey(service, account));
 }
+/**
+* Wipe the entire cache. Tests use this between cases; consumers generally
+* don't need it (process exit drops the cache anyway).
+*/
 function invalidateAll() {
-  valueCache.clear();
-  inflight.clear();
+	valueCache.clear();
+	inflight.clear();
 }
+/**
+* Store a value (or `undefined` to record an absent entry) so later reads of
+* the same key short-circuit the OS call.
+*/
 function setCached(service, account, value) {
-  valueCache.set(cacheKey(service, account), value);
+	valueCache.set(cacheKey(service, account), value);
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  cacheKey,
-  dedupeRead,
-  getCached,
-  has,
-  invalidate,
-  invalidateAll,
-  setCached
-});
+
+//#endregion
+exports.cacheKey = cacheKey;
+exports.dedupeRead = dedupeRead;
+exports.getCached = getCached;
+exports.has = has;
+exports.invalidate = invalidate;
+exports.invalidateAll = invalidateAll;
+exports.setCached = setCached;