@socketsecurity/lib 6.0.3 → 6.0.5

package/dist/secrets/linux.js

@@ -1,151 +1,149 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var linux_exports = {};
-__export(linux_exports, {
-  deleteLinux: () => deleteLinux,
-  deleteLinuxSync: () => deleteLinuxSync,
-  isLinuxBackendAvailable: () => isLinuxBackendAvailable,
-  readLinux: () => readLinux,
-  readLinuxSync: () => readLinuxSync,
-  writeLinux: () => writeLinux,
-  writeLinuxSync: () => writeLinuxSync
-});
-module.exports = __toCommonJS(linux_exports);
-var import_node_child_process = require("node:child_process");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let node_child_process = require("node:child_process");
+
+//#region src/secrets/linux.ts
+/**
+* @file Linux Secret Service backend via `secret-tool`. `secret-tool` is the
+*   user-facing CLI for libsecret, which talks to any running Secret Service
+*   provider (gnome-keyring, kwallet5, KeePassXC's Secret Service integration,
+*   etc.). Most desktop Linux installs have one; headless / containerized hosts
+*   do not. Storage shape: each item has a `service=<svc> user=<account>`
+*   attribute pair plus the password body. Reads + writes use those two
+*   attributes as the lookup key. The label (`--label`) is what shows up in the
+*   user's keyring UI; we set it to the same string passed in by the caller. No
+*   backing-file fallback. If `secret-tool` isn't on PATH or no Secret Service
+*   provider is running, reads return `undefined` and writes throw with an
+*   actionable hint — callers fall back to env variables for that session.
+*/
 const SECRET_TOOL_BIN = "secret-tool";
 async function deleteLinux(service, account) {
-  return new Promise((resolve) => {
-    const child = (0, import_node_child_process.spawn)(
-      SECRET_TOOL_BIN,
-      ["clear", "service", service, "user", account],
-      { stdio: "ignore" }
-    );
-    child.on("error", () => resolve("absent"));
-    child.on("close", (status) => resolve(status === 0 ? "removed" : "absent"));
-  });
+	return new Promise((resolve) => {
+		const child = (0, node_child_process.spawn)(SECRET_TOOL_BIN, [
+			"clear",
+			"service",
+			service,
+			"user",
+			account
+		], { stdio: "ignore" });
+		child.on("error", () => resolve("absent"));
+		child.on("close", (status) => resolve(status === 0 ? "removed" : "absent"));
+	});
 }
 function deleteLinuxSync(service, account) {
-  const r = (0, import_node_child_process.spawnSync)(
-    SECRET_TOOL_BIN,
-    ["clear", "service", service, "user", account],
-    { stdio: "ignore" }
-  );
-  return r.status === 0 ? "removed" : "absent";
+	return (0, node_child_process.spawnSync)(SECRET_TOOL_BIN, [
+		"clear",
+		"service",
+		service,
+		"user",
+		account
+	], { stdio: "ignore" }).status === 0 ? "removed" : "absent";
 }
 function isLinuxBackendAvailable() {
-  const r = (0, import_node_child_process.spawnSync)(SECRET_TOOL_BIN, ["--version"], { stdio: "ignore" });
-  return r.status === 0;
+	return (0, node_child_process.spawnSync)(SECRET_TOOL_BIN, ["--version"], { stdio: "ignore" }).status === 0;
 }
 async function readLinux(service, account) {
-  return new Promise((resolve) => {
-    const child = (0, import_node_child_process.spawn)(
-      SECRET_TOOL_BIN,
-      ["lookup", "service", service, "user", account],
-      { stdio: ["ignore", "pipe", "pipe"] }
-    );
-    let stdout = "";
-    child.stdout.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk;
-    });
-    child.on("error", () => resolve(void 0));
-    child.on("close", (status) => {
-      if (status !== 0) {
-        resolve(void 0);
-        return;
-      }
-      const out = stdout.trim();
-      resolve(out || void 0);
-    });
-  });
+	return new Promise((resolve) => {
+		const child = (0, node_child_process.spawn)(SECRET_TOOL_BIN, [
+			"lookup",
+			"service",
+			service,
+			"user",
+			account
+		], { stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		] });
+		let stdout = "";
+		child.stdout.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk;
+		});
+		child.on("error", () => resolve(void 0));
+		child.on("close", (status) => {
+			if (status !== 0) {
+				resolve(void 0);
+				return;
+			}
+			resolve(stdout.trim() || void 0);
+		});
+	});
 }
 function readLinuxSync(service, account) {
-  const r = (0, import_node_child_process.spawnSync)(
-    SECRET_TOOL_BIN,
-    ["lookup", "service", service, "user", account],
-    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
-  );
-  if (r.status !== 0) {
-    return void 0;
-  }
-  const out = r.stdout.trim();
-  return out || void 0;
+	const r = (0, node_child_process.spawnSync)(SECRET_TOOL_BIN, [
+		"lookup",
+		"service",
+		service,
+		"user",
+		account
+	], {
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	if (r.status !== 0) return;
+	return r.stdout.trim() || void 0;
 }
 async function writeLinux(service, account, value, label) {
-  return new Promise((resolve, reject) => {
-    const child = (0, import_node_child_process.spawn)(
-      SECRET_TOOL_BIN,
-      ["store", `--label=${label}`, "service", service, "user", account],
-      { stdio: ["pipe", "pipe", "pipe"] }
-    );
-    let stderr = "";
-    child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk;
-    });
-    child.on(
-      "error",
-      (err) => reject(
-        new Error(
-          `secret-tool store failed: ${err.message}. Install libsecret-tools (apt install libsecret-tools / dnf install libsecret) or ensure a Secret Service provider (gnome-keyring, kwallet) is running.`
-        )
-      )
-    );
-    child.on("close", (status) => {
-      if (status === 0) {
-        resolve();
-        return;
-      }
-      reject(
-        new Error(
-          `secret-tool store failed (status=${status}, user=${account}): ${stderr.trim()}. Install libsecret-tools (apt install libsecret-tools / dnf install libsecret) or ensure a Secret Service provider (gnome-keyring, kwallet) is running.`
-        )
-      );
-    });
-    child.stdin.end(value);
-  });
+	return new Promise((resolve, reject) => {
+		const child = (0, node_child_process.spawn)(SECRET_TOOL_BIN, [
+			"store",
+			`--label=${label}`,
+			"service",
+			service,
+			"user",
+			account
+		], { stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		] });
+		let stderr = "";
+		child.stderr.setEncoding("utf8");
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk;
+		});
+		child.on("error", (err) => reject(/* @__PURE__ */ new Error(`secret-tool store failed: ${err.message}. Install libsecret-tools (apt install libsecret-tools / dnf install libsecret) or ensure a Secret Service provider (gnome-keyring, kwallet) is running.`)));
+		child.on("close", (status) => {
+			if (status === 0) {
+				resolve();
+				return;
+			}
+			reject(/* @__PURE__ */ new Error(`secret-tool store failed (status=${status}, user=${account}): ${stderr.trim()}. Install libsecret-tools (apt install libsecret-tools / dnf install libsecret) or ensure a Secret Service provider (gnome-keyring, kwallet) is running.`));
+		});
+		child.stdin.end(value);
+	});
 }
 function writeLinuxSync(service, account, value, label) {
-  const r = (0, import_node_child_process.spawnSync)(
-    SECRET_TOOL_BIN,
-    ["store", `--label=${label}`, "service", service, "user", account],
-    {
-      encoding: "utf8",
-      input: value,
-      stdio: ["pipe", "pipe", "pipe"]
-    }
-  );
-  if (r.status !== 0) {
-    throw new Error(
-      `secret-tool store failed (status=${r.status}, user=${account}): ${r.stderr.trim()}. Install libsecret-tools (apt install libsecret-tools / dnf install libsecret) or ensure a Secret Service provider (gnome-keyring, kwallet) is running.`
-    );
-  }
+	const r = (0, node_child_process.spawnSync)(SECRET_TOOL_BIN, [
+		"store",
+		`--label=${label}`,
+		"service",
+		service,
+		"user",
+		account
+	], {
+		encoding: "utf8",
+		input: value,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		]
+	});
+	if (r.status !== 0) throw new Error(`secret-tool store failed (status=${r.status}, user=${account}): ${r.stderr.trim()}. Install libsecret-tools (apt install libsecret-tools / dnf install libsecret) or ensure a Secret Service provider (gnome-keyring, kwallet) is running.`);
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  deleteLinux,
-  deleteLinuxSync,
-  isLinuxBackendAvailable,
-  readLinux,
-  readLinuxSync,
-  writeLinux,
-  writeLinuxSync
-});
+
+//#endregion
+exports.deleteLinux = deleteLinux;
+exports.deleteLinuxSync = deleteLinuxSync;
+exports.isLinuxBackendAvailable = isLinuxBackendAvailable;
+exports.readLinux = readLinux;
+exports.readLinuxSync = readLinuxSync;
+exports.writeLinux = writeLinux;
+exports.writeLinuxSync = writeLinuxSync;

package/dist/secrets/macos.js

@@ -1,165 +1,169 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var macos_exports = {};
-__export(macos_exports, {
-  deleteMacOS: () => deleteMacOS,
-  deleteMacOSSync: () => deleteMacOSSync,
-  isMacOSBackendAvailable: () => isMacOSBackendAvailable,
-  readMacOS: () => readMacOS,
-  readMacOSSync: () => readMacOSSync,
-  runAsync: () => runAsync,
-  writeMacOS: () => writeMacOS,
-  writeMacOSSync: () => writeMacOSSync
-});
-module.exports = __toCommonJS(macos_exports);
-var import_node_child_process = require("node:child_process");
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let node_child_process = require("node:child_process");
+
+//#region src/secrets/macos.ts
+/**
+* @file MacOS Keychain backend via `security(1)`. The native `security` CLI
+*   ships with macOS — no install step. We use generic-password items, which
+*   are the simplest credential shape Keychain supports (service + account →
+*   password string). Process model: each call spawns `security`. Read returns
+*   the password on stdout; write uses `-w <value>` (we accept that the value
+*   briefly appears in argv — `security` is local-only and runs in the user's
+*   session, so the leakage surface is `ps(1)` for one other process on the
+*   same user). Delete is best-effort. ACL: writes use `-A -T ''` so any
+*   application on the user's account can read the entry without an extra
+*   Keychain prompt. The first write still prompts once (creating / updating
+*   the entry requires the user to authorize that one action), but every later
+*   read is silent — sfw, socket-cli, MCP servers, and the bash shell itself
+*   all read the same value with no UI. The trust model: the user explicitly
+*   authorized the install flow that wrote this; the value is theirs to use
+*   across their tooling, not a credential earmarked for a single binary path.
+*   Revocable in Keychain Access.app if the user changes their mind. This
+*   restores the original wheelhouse `token-storage.mts` behavior dropped in
+*   v6's first cut.
+*/
 const SECURITY_BIN = "security";
 async function deleteMacOS(service, account) {
-  const r = await runAsync(
-    ["delete-generic-password", "-s", service, "-a", account],
-    { stdio: "ignore" }
-  );
-  return r.status === 0 ? "removed" : "absent";
+	return (await runAsync([
+		"delete-generic-password",
+		"-s",
+		service,
+		"-a",
+		account
+	], { stdio: "ignore" })).status === 0 ? "removed" : "absent";
 }
 function deleteMacOSSync(service, account) {
-  const r = (0, import_node_child_process.spawnSync)(
-    SECURITY_BIN,
-    ["delete-generic-password", "-s", service, "-a", account],
-    { stdio: "ignore" }
-  );
-  return r.status === 0 ? "removed" : "absent";
+	return (0, node_child_process.spawnSync)(SECURITY_BIN, [
+		"delete-generic-password",
+		"-s",
+		service,
+		"-a",
+		account
+	], { stdio: "ignore" }).status === 0 ? "removed" : "absent";
 }
 function isMacOSBackendAvailable() {
-  return true;
+	return true;
 }
 async function readMacOS(service, account) {
-  const r = await runAsync([
-    "find-generic-password",
-    "-s",
-    service,
-    "-a",
-    account,
-    "-w"
-  ]);
-  if (r.status !== 0) {
-    return void 0;
-  }
-  const out = r.stdout.trim();
-  return out || void 0;
+	const r = await runAsync([
+		"find-generic-password",
+		"-s",
+		service,
+		"-a",
+		account,
+		"-w"
+	]);
+	if (r.status !== 0) return;
+	return r.stdout.trim() || void 0;
 }
 function readMacOSSync(service, account) {
-  const r = (0, import_node_child_process.spawnSync)(
-    SECURITY_BIN,
-    ["find-generic-password", "-s", service, "-a", account, "-w"],
-    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
-  );
-  if (r.status !== 0) {
-    return void 0;
-  }
-  const out = r.stdout.trim();
-  return out || void 0;
+	const r = (0, node_child_process.spawnSync)(SECURITY_BIN, [
+		"find-generic-password",
+		"-s",
+		service,
+		"-a",
+		account,
+		"-w"
+	], {
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	if (r.status !== 0) return;
+	return r.stdout.trim() || void 0;
 }
 function runAsync(args, opts = {}) {
-  return new Promise((resolve) => {
-    const child = (0, import_node_child_process.spawn)(SECURITY_BIN, args, {
-      stdio: opts.stdio ?? ["ignore", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    if (child.stdout) {
-      child.stdout.setEncoding("utf8");
-      child.stdout.on("data", (chunk) => {
-        stdout += chunk;
-      });
-    }
-    if (child.stderr) {
-      child.stderr.setEncoding("utf8");
-      child.stderr.on("data", (chunk) => {
-        stderr += chunk;
-      });
-    }
-    child.on("error", () => resolve({ status: -1, stdout, stderr }));
-    child.on("close", (status) => resolve({ status, stdout, stderr }));
-  });
+	return new Promise((resolve) => {
+		const child = (0, node_child_process.spawn)(SECURITY_BIN, args, { stdio: opts.stdio ?? [
+			"ignore",
+			"pipe",
+			"pipe"
+		] });
+		let stdout = "";
+		let stderr = "";
+		if (child.stdout) {
+			child.stdout.setEncoding("utf8");
+			child.stdout.on("data", (chunk) => {
+				stdout += chunk;
+			});
+		}
+		if (child.stderr) {
+			child.stderr.setEncoding("utf8");
+			child.stderr.on("data", (chunk) => {
+				stderr += chunk;
+			});
+		}
+		child.on("error", () => resolve({
+			status: -1,
+			stdout,
+			stderr
+		}));
+		child.on("close", (status) => resolve({
+			status,
+			stdout,
+			stderr
+		}));
+	});
 }
 async function writeMacOS(service, account, value, label) {
-  const r = await runAsync([
-    "add-generic-password",
-    "-U",
-    "-A",
-    "-T",
-    "",
-    "-s",
-    service,
-    "-a",
-    account,
-    "-w",
-    value,
-    "-D",
-    label,
-    "-l",
-    label
-  ]);
-  if (r.status !== 0) {
-    throw new Error(
-      `security(1) add-generic-password failed (status=${r.status}, account=${account}): ${r.stderr.trim()}`
-    );
-  }
+	const r = await runAsync([
+		"add-generic-password",
+		"-U",
+		"-A",
+		"-T",
+		"",
+		"-s",
+		service,
+		"-a",
+		account,
+		"-w",
+		value,
+		"-D",
+		label,
+		"-l",
+		label
+	]);
+	if (r.status !== 0) throw new Error(`security(1) add-generic-password failed (status=${r.status}, account=${account}): ${r.stderr.trim()}`);
 }
 function writeMacOSSync(service, account, value, label) {
-  const r = (0, import_node_child_process.spawnSync)(
-    SECURITY_BIN,
-    [
-      "add-generic-password",
-      "-U",
-      "-A",
-      "-T",
-      "",
-      "-s",
-      service,
-      "-a",
-      account,
-      "-w",
-      value,
-      "-D",
-      label,
-      "-l",
-      label
-    ],
-    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
-  );
-  if (r.status !== 0) {
-    throw new Error(
-      `security(1) add-generic-password failed (status=${r.status}, account=${account}): ${r.stderr.trim()}`
-    );
-  }
+	const r = (0, node_child_process.spawnSync)(SECURITY_BIN, [
+		"add-generic-password",
+		"-U",
+		"-A",
+		"-T",
+		"",
+		"-s",
+		service,
+		"-a",
+		account,
+		"-w",
+		value,
+		"-D",
+		label,
+		"-l",
+		label
+	], {
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	if (r.status !== 0) throw new Error(`security(1) add-generic-password failed (status=${r.status}, account=${account}): ${r.stderr.trim()}`);
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  deleteMacOS,
-  deleteMacOSSync,
-  isMacOSBackendAvailable,
-  readMacOS,
-  readMacOSSync,
-  runAsync,
-  writeMacOS,
-  writeMacOSSync
-});
+
+//#endregion
+exports.deleteMacOS = deleteMacOS;
+exports.deleteMacOSSync = deleteMacOSSync;
+exports.isMacOSBackendAvailable = isMacOSBackendAvailable;
+exports.readMacOS = readMacOS;
+exports.readMacOSSync = readMacOSSync;
+exports.runAsync = runAsync;
+exports.writeMacOS = writeMacOS;
+exports.writeMacOSSync = writeMacOSSync;