@socketsecurity/lib 6.0.8 → 6.0.9

package/dist/secrets/broker.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @file Proteus broker client. Asks the running proteus credential daemon for a
+ *   secret over its local Unix socket (Windows named pipe later), so a
+ *   biometric-gated read happens inside the daemon and the value is vended to
+ *   this process in memory rather than sitting in an env var. This is the layer
+ *   `ai/credentials.mts` documents as slotting between the env check and the
+ *   keychain read in `secrets/find.ts` `resolve()`.
+ *   The broker is OPTIONAL and self-gating: when the daemon isn't running (no
+ *   socket file), `requestFromBroker` returns `undefined` immediately and the
+ *   caller falls through to the keychain. It never throws — a broker miss is a
+ *   fall-through, not an error. The daemon binary itself is built by socket-btm
+ *   (`packages/proteus-builder`); download-and-start is a later layer, so today
+ *   this only talks to an already-running daemon.
+ */
+export interface BrokerRequestOptions {
+    /**
+     * The keychain service scope (e.g. `socketsecurity`).
+     */
+    readonly service: string;
+    /**
+     * The account within the service (e.g. `ANTHROPIC_API_KEY`).
+     */
+    readonly account: string;
+}
+export interface BrokerResponse {
+    readonly ok?: boolean | undefined;
+    readonly value?: string | undefined;
+}
+/**
+ * Ask the proteus daemon for a credential. Returns the value on success, or
+ * `undefined` when the daemon isn't running, doesn't hold it, or the biometric
+ * prompt was declined. Never throws: a miss falls through to the next resolver
+ * layer (the keychain).
+ */
+export declare function requestFromBroker({ account, service, }: BrokerRequestOptions): Promise<string | undefined>;

package/dist/secrets/broker.js

@@ -0,0 +1,72 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../_virtual/_rolldown/runtime.js');
+const require_paths_socket = require('../paths/socket.js');
+let node_fs = require("node:fs");
+let node_net = require("node:net");
+node_net = require_runtime.__toESM(node_net);
+
+//#region src/secrets/broker.ts
+/**
+* @file Proteus broker client. Asks the running proteus credential daemon for a
+*   secret over its local Unix socket (Windows named pipe later), so a
+*   biometric-gated read happens inside the daemon and the value is vended to
+*   this process in memory rather than sitting in an env var. This is the layer
+*   `ai/credentials.mts` documents as slotting between the env check and the
+*   keychain read in `secrets/find.ts` `resolve()`.
+*   The broker is OPTIONAL and self-gating: when the daemon isn't running (no
+*   socket file), `requestFromBroker` returns `undefined` immediately and the
+*   caller falls through to the keychain. It never throws — a broker miss is a
+*   fall-through, not an error. The daemon binary itself is built by socket-btm
+*   (`packages/proteus-builder`); download-and-start is a later layer, so today
+*   this only talks to an already-running daemon.
+*/
+const PROTEUS_SOCKET_NAME = "proteus";
+const BROKER_TIMEOUT_MS = 1e3;
+/**
+* Ask the proteus daemon for a credential. Returns the value on success, or
+* `undefined` when the daemon isn't running, doesn't hold it, or the biometric
+* prompt was declined. Never throws: a miss falls through to the next resolver
+* layer (the keychain).
+*/
+async function requestFromBroker({ account, service }) {
+	const socketPath = require_paths_socket.getRuntimeSocketPath(PROTEUS_SOCKET_NAME);
+	if (!(0, node_fs.existsSync)(socketPath)) return;
+	return await new Promise((resolvePromise) => {
+		const conn = node_net.default.connect(socketPath);
+		let buffer = "";
+		let settled = false;
+		function settle(value) {
+			if (settled) return;
+			settled = true;
+			conn.destroy();
+			resolvePromise(value);
+		}
+		conn.setTimeout(BROKER_TIMEOUT_MS);
+		conn.on("timeout", () => settle(void 0));
+		conn.on("error", () => settle(void 0));
+		conn.on("connect", () => {
+			const payload = JSON.stringify({
+				account,
+				op: "get",
+				service
+			});
+			conn.write(`${payload}\n`);
+		});
+		conn.on("data", (chunk) => {
+			buffer += String(chunk);
+			const newlineAt = buffer.indexOf("\n");
+			if (newlineAt === -1) return;
+			try {
+				const parsed = JSON.parse(buffer.slice(0, newlineAt));
+				settle(parsed.ok && typeof parsed.value === "string" ? parsed.value : void 0);
+			} catch {
+				settle(void 0);
+			}
+		});
+	});
+}
+
+//#endregion
+exports.requestFromBroker = requestFromBroker;

package/dist/secrets/find.d.ts

@@ -51,10 +51,11 @@ export interface ResolveResult {
     value: string;
     /**
      * Where the value came from: 'env' — `process.env[<account>]` had a non-empty
-     * value. 'keychain' — env-var was empty/missing; the value was read from the
-     * OS credential store under the matching account.
+     * value. 'broker' — the proteus daemon vended it after a biometric unlock.
+     * 'keychain' — env-var was empty and no broker was running; the value was
+     * read from the OS credential store under the matching account.
      */
-    source: 'env' | 'keychain';
+    source: 'broker' | 'env' | 'keychain';
     /**
      * Which account in `accounts` was the actual hit.
      */
@@ -74,6 +75,7 @@ export declare function readEnv(name: string): string | undefined;
 export declare function resolve(options: ResolveOptions): Promise<ResolveResult | undefined>;
 /**
  * Sync variant for non-async callers (hook initializers, schema validators that
- * run before any `await` machinery exists).
+ * run before any `await` machinery exists). Has no proteus broker tier — the
+ * broker socket round-trip is async — so this path is env → keychain only.
  */
 export declare function resolveSync(options: ResolveOptions): ResolveResult | undefined;

package/dist/secrets/find.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_secrets_broker = require('./broker.js');
 const require_secrets_keychain = require('./keychain.js');
 
 //#region src/secrets/find.ts
@@ -57,6 +58,18 @@ async function resolve(options) {
 		};
 	}
 	if (allowEnvOnly) return;
+	for (let i = 0, { length } = accounts; i < length; i += 1) {
+		const account = accounts[i];
+		const fromBroker = await require_secrets_broker.requestFromBroker({
+			account,
+			service
+		});
+		if (fromBroker) return {
+			value: fromBroker,
+			source: "broker",
+			account
+		};
+	}
 	for (let i = 0, { length } = accounts; i < length; i += 1) {
 		const account = accounts[i];
 		const fromKeychain = await require_secrets_keychain.readSecret({
@@ -72,7 +85,8 @@ async function resolve(options) {
 }
 /**
 * Sync variant for non-async callers (hook initializers, schema validators that
-* run before any `await` machinery exists).
+* run before any `await` machinery exists). Has no proteus broker tier — the
+* broker socket round-trip is async — so this path is env → keychain only.
 */
 function resolveSync(options) {
 	const { accounts, allowEnvOnly, service } = {

package/dist/secrets/rc.js

@@ -3,8 +3,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_primordials_object = require('../primordials/object.js');
-const require_env_home = require('../env/home.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_env_home = require('../env/home.js');
 const require_primordials_regexp = require('../primordials/regexp.js');
 let node_fs = require("node:fs");
 let node_process = require("node:process");

package/dist/smol/detect.js

@@ -43,7 +43,7 @@ function getSmolUtil() {
 	if (!smolUtilProbed) {
 		smolUtilProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (require_node_module.isNodeBuiltin("node:smol-util")) smolUtilCache = require("node:smol-util");
+		if (require_node_module.isNodeBuiltin("node:smol-util")) smolUtilCache = require_node_module.requireBuiltin("node:smol-util");
 	}
 	return smolUtilCache;
 }

package/dist/smol/http.js

@@ -28,7 +28,7 @@ function getSmolHttp() {
 	if (!smolHttpProbed) {
 		smolHttpProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (require_node_module.isNodeBuiltin("node:smol-http")) smolHttpBinding = require("node:smol-http");
+		if (require_node_module.isNodeBuiltin("node:smol-http")) smolHttpBinding = require_node_module.requireBuiltin("node:smol-http");
 	}
 	return smolHttpBinding;
 }

package/dist/smol/https.js

@@ -26,7 +26,7 @@ function getSmolHttps() {
 	if (!smolHttpsProbed) {
 		smolHttpsProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (require_node_module.isNodeBuiltin("node:smol-https")) smolHttps = require("node:smol-https");
+		if (require_node_module.isNodeBuiltin("node:smol-https")) smolHttps = require_node_module.requireBuiltin("node:smol-https");
 	}
 	return smolHttps;
 }

package/dist/smol/manifest.js

@@ -28,7 +28,7 @@ function getSmolManifest() {
 	if (!smolManifestProbed) {
 		smolManifestProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (require_node_module.isNodeBuiltin("node:smol-manifest")) cachedSmolManifest = require("node:smol-manifest");
+		if (require_node_module.isNodeBuiltin("node:smol-manifest")) cachedSmolManifest = require_node_module.requireBuiltin("node:smol-manifest");
 	}
 	return cachedSmolManifest;
 }

package/dist/smol/path.js

@@ -28,7 +28,7 @@ function getSmolPath() {
 	if (!smolPathProbed) {
 		smolPathProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (require_node_module.isNodeBuiltin("node:smol-path")) smolPathCache = require("node:smol-path");
+		if (require_node_module.isNodeBuiltin("node:smol-path")) smolPathCache = require_node_module.requireBuiltin("node:smol-path");
 	}
 	return smolPathCache;
 }

package/dist/smol/primordial.js

@@ -30,7 +30,7 @@ function getSmolPrimordial() {
 	if (!smolPrimordialProbed) {
 		smolPrimordialProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (require_node_module.isNodeBuiltin("node:smol-primordial")) smolPrimordial = require("node:smol-primordial");
+		if (require_node_module.isNodeBuiltin("node:smol-primordial")) smolPrimordial = require_node_module.requireBuiltin("node:smol-primordial");
 	}
 	return smolPrimordial;
 }

package/dist/smol/purl.js

@@ -29,7 +29,7 @@ function getSmolPurl() {
 	if (!smolPurlProbed) {
 		smolPurlProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (require_node_module.isNodeBuiltin("node:smol-purl")) smolPurl = require("node:smol-purl");
+		if (require_node_module.isNodeBuiltin("node:smol-purl")) smolPurl = require_node_module.requireBuiltin("node:smol-purl");
 	}
 	return smolPurl;
 }

package/dist/smol/versions.js

@@ -26,7 +26,7 @@ function getSmolVersions() {
 	if (!smolVersionsProbed) {
 		smolVersionsProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (require_node_module.isNodeBuiltin("node:smol-versions")) smolVersions = require("node:smol-versions");
+		if (require_node_module.isNodeBuiltin("node:smol-versions")) smolVersions = require_node_module.requireBuiltin("node:smol-versions");
 	}
 	return smolVersions;
 }

package/dist/smol/vfs.js

@@ -41,7 +41,7 @@ function getSmolVfs() {
 	if (!smolVfsProbed) {
 		smolVfsProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (require_node_module.isNodeBuiltin("node:smol-vfs")) cachedSmolVfs = require("node:smol-vfs").getSmolVfs();
+		if (require_node_module.isNodeBuiltin("node:smol-vfs")) cachedSmolVfs = require_node_module.requireBuiltin("node:smol-vfs").getSmolVfs();
 	}
 	return cachedSmolVfs;
 }

package/dist/sorts/_internal.d.ts

@@ -4,6 +4,5 @@
  *   locale / natural / semver comparison entrypoints.
  */
 import type * as fastSortType from '../external/fast-sort';
-import type * as semverType from '../external/semver';
+export { getSemver } from '../versions/_internal';
 export declare function getFastSort(): typeof fastSortType;
-export declare function getSemver(): typeof semverType;

package/dist/sorts/_internal.js

@@ -1,19 +1,15 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_versions__internal = require('../versions/_internal.js');
 
 //#region src/sorts/_internal.ts
 let fastSort;
-let semver;
 function getFastSort() {
 	if (fastSort === void 0) fastSort = /*@__PURE__*/ require("../external/fast-sort.js");
 	return fastSort;
 }
-function getSemver() {
-	if (semver === void 0) semver = /*@__PURE__*/ require("../external/semver.js");
-	return semver;
-}
 
 //#endregion
 exports.getFastSort = getFastSort;
-exports.getSemver = getSemver;
+exports.getSemver = require_versions__internal.getSemver;

package/dist/sorts/semver.js

@@ -1,7 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_sorts__internal = require('./_internal.js');
+const require_versions__internal = require('../versions/_internal.js');
 
 //#region src/sorts/semver.ts
 /**
@@ -20,7 +20,7 @@ const require_sorts__internal = require('./_internal.js');
 */
 function compareSemver(a, b) {
 	/* c8 ignore start */
-	const semver = require_sorts__internal.getSemver();
+	const semver = require_versions__internal.getSemver();
 	const validA = semver.valid(a);
 	/* c8 ignore stop */
 	const validB = semver.valid(b);

package/dist/spinner/create-spinner-class.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_math = require('../primordials/math.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_primordials_math = require('../primordials/math.js');
 const require_primordials_array = require('../primordials/array.js');
 const require_process_abort = require('../process/abort.js');
 const require_logger_symbols = require('../logger/symbols.js');

package/dist/stdio/progress.js

@@ -2,9 +2,9 @@
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('../_virtual/_rolldown/runtime.js');
-const require_primordials_math = require('../primordials/math.js');
 const require_primordials_object = require('../primordials/object.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_primordials_math = require('../primordials/math.js');
 const require_primordials_date = require('../primordials/date.js');
 const require_ansi_strip = require('../ansi/strip.js');
 const require_strings_format = require('../strings/format.js');

package/dist/stdio/prompts.d.ts

@@ -6,7 +6,6 @@ import checkboxRaw from '../external/@inquirer/checkbox';
 import confirmRaw from '../external/@inquirer/confirm';
 import inputRaw from '../external/@inquirer/input';
 import passwordRaw from '../external/@inquirer/password';
-import type { ColorValue } from '../colors/types';
 import type { Remap } from '../objects/types';
 import type { SpinnerInstance } from '../spinner/types';
 import type { ThemeName } from '../themes/themes';
@@ -94,13 +93,6 @@ export declare class SeparatorType {
     constructor(separator?: string);
 }
 export type Separator = SeparatorType;
-/**
- * Apply a color to text using yoctocolors. Handles both named colors and RGB
- * tuples.
- *
- * @private
- */
-export declare function applyColor(text: string, color: ColorValue): string;
 /**
  * Convert Socket theme to @inquirer theme format. Maps our theme colors to
  * inquirer's style functions. Handles theme names, Theme objects, and passes

package/dist/stdio/prompts.js

@@ -5,10 +5,9 @@ const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_process_abort = require('../process/abort.js');
 const require_themes_themes = require('../themes/themes.js');
 const require_themes_context = require('../themes/context.js');
+const require_logger_colors = require('../logger/colors.js');
 const require_themes_resolve = require('../themes/resolve.js');
 const require_spinner_default = require('../spinner/default.js');
-let src_external_yoctocolors_cjs = require("../external/yoctocolors-cjs");
-src_external_yoctocolors_cjs = require_runtime.__toESM(src_external_yoctocolors_cjs);
 let src_external__inquirer_checkbox = require("../external/@inquirer/checkbox");
 src_external__inquirer_checkbox = require_runtime.__toESM(src_external__inquirer_checkbox);
 let src_external__inquirer_confirm = require("../external/@inquirer/confirm");
@@ -34,17 +33,6 @@ const selectModule = src_external__inquirer_select;
 const selectRaw = selectModule.default;
 const ActualSeparator = selectModule.Separator;
 /**
-* Apply a color to text using yoctocolors. Handles both named colors and RGB
-* tuples.
-*
-* @private
-*/
-function applyColor(text, color) {
-	if (typeof color === "string") return src_external_yoctocolors_cjs.default[color](text);
-	const { 0: r, 1: g, 2: b } = color;
-	return `\u001B[38;2;${r};${g};${b}m${text}\u001B[39m`;
-}
-/**
 * Convert Socket theme to @inquirer theme format. Maps our theme colors to
 * inquirer's style functions. Handles theme names, Theme objects, and passes
 * through @inquirer themes.
@@ -75,18 +63,18 @@ function createInquirerTheme(theme) {
 		const primaryColor = socketTheme.colors.primary;
 		return {
 			style: {
-				message: (text) => applyColor(text, promptColor),
-				answer: (text) => applyColor(text, primaryColor),
-				help: (text) => applyColor(text, textDimColor),
-				description: (text) => applyColor(text, textDimColor),
-				disabled: (text) => applyColor(text, textDimColor),
-				error: (text) => applyColor(text, errorColor),
-				highlight: (text) => applyColor(text, primaryColor)
+				message: (text) => require_logger_colors.applyColor(text, promptColor),
+				answer: (text) => require_logger_colors.applyColor(text, primaryColor),
+				help: (text) => require_logger_colors.applyColor(text, textDimColor),
+				description: (text) => require_logger_colors.applyColor(text, textDimColor),
+				disabled: (text) => require_logger_colors.applyColor(text, textDimColor),
+				error: (text) => require_logger_colors.applyColor(text, errorColor),
+				highlight: (text) => require_logger_colors.applyColor(text, primaryColor)
 			},
 			icon: {
-				checked: applyColor("✓", successColor),
+				checked: require_logger_colors.applyColor("✓", successColor),
 				unchecked: " ",
-				cursor: applyColor("❯", primaryColor)
+				cursor: require_logger_colors.applyColor("❯", primaryColor)
 			}
 		};
 	}
@@ -246,7 +234,6 @@ const select = wrapPrompt(selectRaw);
 
 //#endregion
 exports.Separator = ActualSeparator;
-exports.applyColor = applyColor;
 exports.checkbox = checkbox;
 exports.confirm = confirm;
 exports.createInquirerTheme = createInquirerTheme;

package/dist/strings/format.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_math = require('../primordials/math.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_primordials_math = require('../primordials/math.js');
 const require_ansi_strip = require('../ansi/strip.js');
 
 //#region src/strings/format.ts

package/dist/strings/search.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_math = require('../primordials/math.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_primordials_math = require('../primordials/math.js');
 
 //#region src/strings/search.ts
 /**

package/dist/themes/context.d.ts

@@ -4,7 +4,7 @@
  */
 import type { Theme } from './types';
 import type { ThemeName } from './themes';
-import type * as AsyncHooks from 'node:async_hooks';
+import { getNodeAsyncHooks } from '../node/async-hooks';
 /**
  * Theme change event listener signature.
  */
@@ -16,11 +16,13 @@ export type ThemeChangeListener = (theme: Theme) => void;
  */
 export declare function emitThemeChange(theme: Theme): void;
 /**
- * Lazily load the async_hooks module to avoid Webpack errors.
+ * Lazily load the async_hooks module. Aliases the canonical `node/async-hooks`
+ * accessor (single owner of the bundler-safe require); kept as an export so
+ * this module's surface is unchanged.
  *
  * @private
  */
-export declare function getAsyncHooks(): typeof AsyncHooks;
+export declare const getAsyncHooks: typeof getNodeAsyncHooks;
 /**
  * Get the active theme from context.
  *

package/dist/themes/context.js

@@ -1,11 +1,11 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_node_async_hooks = require('../node/async-hooks.js');
 const require_primordials_map_set = require('../primordials/map-set.js');
 const require_themes_themes = require('./themes.js');
 
 //#region src/themes/context.ts
-let asyncHooks;
 /**
 * Emit theme change event to listeners.
 *
@@ -15,14 +15,13 @@ function emitThemeChange(theme) {
 	for (const listener of listeners) listener(theme);
 }
 /**
-* Lazily load the async_hooks module to avoid Webpack errors.
+* Lazily load the async_hooks module. Aliases the canonical `node/async-hooks`
+* accessor (single owner of the bundler-safe require); kept as an export so
+* this module's surface is unchanged.
 *
 * @private
 */
-function getAsyncHooks() {
-	if (asyncHooks === void 0) asyncHooks = /*@__PURE__*/ require("node:async_hooks");
-	return asyncHooks;
-}
+const getAsyncHooks = require_node_async_hooks.getNodeAsyncHooks;
 /**
 * AsyncLocalStorage for theme context isolation.
 */