macos-keychain

@noy-db/at-macos-keychain · pnpm add @noy-db/at-macos-keychain Desktop-app sealing — the key lives in the OS Keychain, gated by "I'm logged into my Mac."

What it does

atMacosKeychain({ service, account }) binds the sealing key to the user's macOS login Keychain via the native @napi-rs/keyring addon. The first call for a given (service, account) generates a fresh 32-byte AES-256 key and stores it in the Keychain; later calls (same process, or any future process running as that OS user) retrieve the same key and unseal transparently — no secret prompt ever appears. Its pid is macos-keychain:<service>/<account> (e.g. macos-keychain:com.acme.app/alice@acme.example).

The Keychain entry is the security boundary — any process running as the same OS user can read it. Users can add Touch ID gating to the entry themselves via Keychain Access; the package does not gate it programmatically. It exposes only seal/unseal (self-targeted) — not the RecipientSealer contract — and throws at construction on any non-macOS platform.

Usage

import { atMacosKeychain } from '@noy-db/at-macos-keychain'

const sealingKey = atMacosKeychain({
  service: 'com.acme.app',       // your bundle id / app namespace
  account: 'alice@acme.example', // per-user keychain item
})
sealingKey.id // → 'macos-keychain:com.acme.app/alice@acme.example'

See also

• at-* family
• sealing provider id — the pid stability rule
• env — the server/container alternative (no Keychain in a container)