@socketsecurity/lib 6.0.3 → 6.0.5

package/dist/secrets/find.js

@@ -1,84 +1,103 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var find_exports = {};
-__export(find_exports, {
-  readEnv: () => readEnv,
-  resolve: () => resolve,
-  resolveSync: () => resolveSync
-});
-module.exports = __toCommonJS(find_exports);
-var import_keychain = require("./keychain");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_secrets_keychain = require('./keychain.js');
+
+//#region src/secrets/find.ts
+/**
+* @file Resolve a secret from the canonical fleet precedence order: process env
+*   → OS keychain. Returns the value + the source it came from so the caller
+*   can log which slot won. Why a helper instead of inlining: every consumer of
+*   the fleet's Socket API token does the same dance — check
+*   `process.env.SOCKET_API_TOKEN`, fall back to a legacy env-var alias, fall
+*   back to `readSecret({...})` from the keychain. Tools drift on the exact
+*   order and on which aliases they consider. This helper centralizes the
+*   precedence so a token check in socket-cli, socket-mcp, depot, and ad-hoc
+*   scripts all behave the same way. Not included: `.env` file parsing. Hosts
+*   that want `.env` support should pre-populate `process.env` from `.env`
+*   themselves (e.g. with `dotenv.config()` at process start). Folding `.env`
+*   reads into this helper would couple the secrets API to a config-file parser
+*   that's better lived at the application boundary. Prompt minimization: every
+*   keychain read short-circuits through the process-scoped cache in
+*   `./_internal.ts`. So calling `resolve` multiple times in one process spawns
+*   at most one `security` (macOS) / `secret-tool` (Linux) / `powershell`
+*   (Windows) per `{service, account}` pair. Combined with macOS's `-A -T ''`
+*   ACL (set by `writeSecret`), this means: at most one Keychain auth prompt
+*   across a process's entire lifetime — and zero prompts when the env-var path
+*   covers the read.
+*/
+/**
+* Pull a non-empty string from `process.env[name]`. Returns `undefined` for
+* missing or empty values so the caller can fall through to the next source
+* without distinguishing the two cases.
+*/
 function readEnv(name) {
-  const value = process.env[name];
-  if (typeof value !== "string") {
-    return void 0;
-  }
-  const trimmed = value.trim();
-  return trimmed ? trimmed : void 0;
+	const value = process.env[name];
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed ? trimmed : void 0;
 }
+/**
+* Resolve a secret following the canonical env → keychain order. Returns
+* `undefined` when neither source has the value — the caller's signal to prompt
+* the user or surface a setup hint.
+*/
 async function resolve(opts) {
-  const { accounts, allowEnvOnly, service } = opts;
-  for (let i = 0, { length } = accounts; i < length; i += 1) {
-    const account = accounts[i];
-    const fromEnv = readEnv(account);
-    if (fromEnv) {
-      return { value: fromEnv, source: "env", account };
-    }
-  }
-  if (allowEnvOnly) {
-    return void 0;
-  }
-  for (let i = 0, { length } = accounts; i < length; i += 1) {
-    const account = accounts[i];
-    const fromKeychain = await (0, import_keychain.readSecret)({ service, account });
-    if (fromKeychain) {
-      return { value: fromKeychain, source: "keychain", account };
-    }
-  }
-  return void 0;
+	const { accounts, allowEnvOnly, service } = opts;
+	for (let i = 0, { length } = accounts; i < length; i += 1) {
+		const account = accounts[i];
+		const fromEnv = readEnv(account);
+		if (fromEnv) return {
+			value: fromEnv,
+			source: "env",
+			account
+		};
+	}
+	if (allowEnvOnly) return;
+	for (let i = 0, { length } = accounts; i < length; i += 1) {
+		const account = accounts[i];
+		const fromKeychain = await require_secrets_keychain.readSecret({
+			service,
+			account
+		});
+		if (fromKeychain) return {
+			value: fromKeychain,
+			source: "keychain",
+			account
+		};
+	}
 }
+/**
+* Sync variant for non-async callers (hook initializers, schema validators that
+* run before any `await` machinery exists).
+*/
 function resolveSync(opts) {
-  const { accounts, allowEnvOnly, service } = opts;
-  for (let i = 0, { length } = accounts; i < length; i += 1) {
-    const account = accounts[i];
-    const fromEnv = readEnv(account);
-    if (fromEnv) {
-      return { value: fromEnv, source: "env", account };
-    }
-  }
-  if (allowEnvOnly) {
-    return void 0;
-  }
-  for (let i = 0, { length } = accounts; i < length; i += 1) {
-    const account = accounts[i];
-    const fromKeychain = (0, import_keychain.readSecretSync)({ service, account });
-    if (fromKeychain) {
-      return { value: fromKeychain, source: "keychain", account };
-    }
-  }
-  return void 0;
+	const { accounts, allowEnvOnly, service } = opts;
+	for (let i = 0, { length } = accounts; i < length; i += 1) {
+		const account = accounts[i];
+		const fromEnv = readEnv(account);
+		if (fromEnv) return {
+			value: fromEnv,
+			source: "env",
+			account
+		};
+	}
+	if (allowEnvOnly) return;
+	for (let i = 0, { length } = accounts; i < length; i += 1) {
+		const account = accounts[i];
+		const fromKeychain = require_secrets_keychain.readSecretSync({
+			service,
+			account
+		});
+		if (fromKeychain) return {
+			value: fromKeychain,
+			source: "keychain",
+			account
+		};
+	}
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  readEnv,
-  resolve,
-  resolveSync
-});
+
+//#endregion
+exports.readEnv = readEnv;
+exports.resolve = resolve;
+exports.resolveSync = resolveSync;