"use strict";
/* Socket Lib - Built with rolldown */
Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
const require_primordials_error = require('../primordials/error.js');
const require_primordials_promise = require('../primordials/promise.js');
let node_child_process = require("node:child_process");

//#region src/secrets/macos.ts
/**
* @file MacOS Keychain backend via `security(1)`. The native `security` CLI
*   ships with macOS — no install step. We use generic-password items, which
*   are the simplest credential shape Keychain supports (service + account →
*   password string). Process model: each call spawns `security`. Read returns
*   the password on stdout; write uses `-w <value>` (we accept that the value
*   briefly appears in argv — `security` is local-only and runs in the user's
*   session, so the leakage surface is `ps(1)` for one other process on the
*   same user). Delete is best-effort. ACL: writes use `-A -T ''` so any
*   application on the user's account can read the entry without an extra
*   Keychain prompt. The first write still prompts once (creating / updating
*   the entry requires the user to authorize that one action), but every later
*   read is silent — sfw, socket-cli, MCP servers, and the bash shell itself
*   all read the same value with no UI. The trust model: the user explicitly
*   authorized the install flow that wrote this; the value is theirs to use
*   across their tooling, not a credential earmarked for a single binary path.
*   Revocable in Keychain Access.app if the user changes their mind. This
*   restores the original wheelhouse `token-storage.mts` behavior dropped in
*   v6's first cut.
*/
const SECURITY_BIN = "security";
async function deleteMacOS(service, account) {
	return (await runAsync([
		"delete-generic-password",
		"-s",
		service,
		"-a",
		account
	], { stdio: "ignore" })).status === 0 ? "removed" : "absent";
}
function deleteMacOSSync(service, account) {
	return (0, node_child_process.spawnSync)(SECURITY_BIN, [
		"delete-generic-password",
		"-s",
		service,
		"-a",
		account
	], { stdio: "ignore" }).status === 0 ? "removed" : "absent";
}
function isMacOSBackendAvailable() {
	return true;
}
async function readMacOS(service, account) {
	const r = await runAsync([
		"find-generic-password",
		"-s",
		service,
		"-a",
		account,
		"-w"
	]);
	if (r.status !== 0) return;
	return r.stdout.trim() || void 0;
}
function readMacOSSync(service, account) {
	const r = (0, node_child_process.spawnSync)(SECURITY_BIN, [
		"find-generic-password",
		"-s",
		service,
		"-a",
		account,
		"-w"
	], {
		encoding: "utf8",
		stdio: [
			"ignore",
			"pipe",
			"pipe"
		]
	});
	if (r.status !== 0) return;
	return r.stdout.trim() || void 0;
}
function runAsync(args, opts = {}) {
	return new require_primordials_promise.PromiseCtor((resolve) => {
		const child = (0, node_child_process.spawn)(SECURITY_BIN, args, { stdio: opts.stdio ?? [
			"ignore",
			"pipe",
			"pipe"
		] });
		let stdout = "";
		let stderr = "";
		if (child.stdout) {
			child.stdout.setEncoding("utf8");
			child.stdout.on("data", (chunk) => {
				stdout += chunk;
			});
		}
		if (child.stderr) {
			child.stderr.setEncoding("utf8");
			child.stderr.on("data", (chunk) => {
				stderr += chunk;
			});
		}
		child.on("error", () => resolve({
			status: -1,
			stdout,
			stderr
		}));
		child.on("close", (status) => resolve({
			status,
			stdout,
			stderr
		}));
	});
}
async function writeMacOS(service, account, value, label) {
	const r = await runAsync([
		"add-generic-password",
		"-U",
		"-A",
		"-T",
		"",
		"-s",
		service,
		"-a",
		account,
		"-w",
		value,
		"-D",
		label,
		"-l",
		label
	]);
	if (r.status !== 0) throw new require_primordials_error.ErrorCtor(`security(1) add-generic-password failed (status=${r.status}, account=${account}): ${r.stderr.trim()}`);
}
function writeMacOSSync(service, account, value, label) {
	const r = (0, node_child_process.spawnSync)(SECURITY_BIN, [
		"add-generic-password",
		"-U",
		"-A",
		"-T",
		"",
		"-s",
		service,
		"-a",
		account,
		"-w",
		value,
		"-D",
		label,
		"-l",
		label
	], {
		encoding: "utf8",
		stdio: [
			"ignore",
			"pipe",
			"pipe"
		]
	});
	if (r.status !== 0) throw new require_primordials_error.ErrorCtor(`security(1) add-generic-password failed (status=${r.status}, account=${account}): ${r.stderr.trim()}`);
}

//#endregion
exports.deleteMacOS = deleteMacOS;
exports.deleteMacOSSync = deleteMacOSSync;
exports.isMacOSBackendAvailable = isMacOSBackendAvailable;
exports.readMacOS = readMacOS;
exports.readMacOSSync = readMacOSSync;
exports.runAsync = runAsync;
exports.writeMacOS = writeMacOS;
exports.writeMacOSSync = writeMacOSSync;