@aifabrix/builder 2.45.5 → 2.46.0

package/lib/commands/repair.js

@@ -12,207 +12,13 @@
 
 'use strict';
 
-const path = require('path');
 const fs = require('fs');
-const chalk = require('chalk');
 const { detectAppType } = require('../utils/paths');
-const { resolveApplicationConfigPath, resolveRbacPath } = require('../utils/app-config-resolver');
-const { loadConfigFile, writeConfigFile, isYamlPath } = require('../utils/config-format');
-const logger = require('../utils/logger');
-const { repairEnvTemplate, normalizeSystemFileAuthAndConfig } = require('./repair-env-template');
-const { repairDatasourceFile } = require('./repair-datasource');
-const { mergeRbacFromDatasources, extractRbacFromSystem, migrateSystemRbacIntoRbacFile } = require('./repair-rbac');
+const { resolveApplicationConfigPath } = require('../utils/app-config-resolver');
+const { loadConfigFile, isYamlPath } = require('../utils/config-format');
 const { discoverIntegrationFiles, buildEffectiveDatasourceFiles } = require('./repair-internal');
-const { normalizeDatasourceKeysAndFilenames } = require('./repair-datasource-keys');
-const { backupIntegrationFile } = require('../utils/integration-file-backup');
-const { maybeSyncOpenApiFilesForMcp } = require('./repair-openapi-sync');
-const {
-  alignAppKeyWithSystem,
-  alignDatasourceSystemKeys,
-  alignSystemFileDataSources,
-  ensureExternalIntegrationBlock,
-  removeAuthVarsFromConfiguration,
-  resolveSystemContext
-} = require('./repair-system-alignment');
-const { persistChangesAndRegenerate, regenerateReadmeIfRequested } = require('./repair-persist');
-
-/** Allowed authentication methods for repair --auth (matches external-system schema) */
-const ALLOWED_AUTH = ['oauth2', 'aad', 'apikey', 'basic', 'queryParam', 'oidc', 'hmac', 'none'];
-
-function createRbacFromSystemIfNeeded(opts) {
-  const { appPath, systemFilePath, systemParsed, dryRun, changes, format, backupCtx } = opts;
-  if (resolveRbacPath(appPath)) return false;
-  const rbacFromSystem = extractRbacFromSystem(systemParsed);
-  if (!rbacFromSystem) return false;
-  if (!dryRun) {
-    const rbacFormat = format === 'json' ? 'json' : 'yaml';
-    const defaultRbacPath = path.join(appPath, rbacFormat === 'json' ? 'rbac.json' : 'rbac.yaml');
-    writeConfigFile(defaultRbacPath, rbacFromSystem, rbacFormat);
-    delete systemParsed.roles;
-    delete systemParsed.permissions;
-    backupIntegrationFile(systemFilePath, backupCtx);
-    writeConfigFile(systemFilePath, systemParsed);
-  }
-  changes.push('Created rbac.yaml from system roles/permissions');
-  changes.push('Removed roles/permissions from system file (now in rbac file)');
-  return true;
-}
-
-/**
- * Runs datasource repair for each file (v2.4 root dimensions, metadataSchema; optional expose/sync/test).
- * @param {string} appPath - Application path
- * @param {string[]} datasourceFiles - Datasource file names
- * @param {Object} options - { expose?: boolean, sync?: boolean, test?: boolean }
- * @param {boolean} dryRun - If true, do not write
- * @param {string[]} changes - Array to append change descriptions to
- * @returns {boolean} True if any datasource was updated
- */
-function runDatasourceRepairs(appPath, datasourceFiles, options, dryRun, changes) {
-  if (!datasourceFiles || datasourceFiles.length === 0) return false;
-  let updated = false;
-  for (const fileName of datasourceFiles) {
-    const filePath = path.join(appPath, fileName);
-    if (!fs.existsSync(filePath)) continue;
-    try {
-      const parsed = loadConfigFile(filePath);
-      const { updated: fileUpdated, changes: fileChanges } = repairDatasourceFile(parsed, {
-        expose: options.expose,
-        sync: options.sync,
-        test: options.test
-      });
-      if (fileUpdated) {
-        updated = true;
-        fileChanges.forEach(c => changes.push(`${fileName}: ${c}`));
-        if (!dryRun) {
-          backupIntegrationFile(filePath, options.backupCtx);
-          writeConfigFile(filePath, parsed);
-        }
-      }
-    } catch (err) {
-      logger.log(chalk.yellow(`⚠ Could not repair datasource ${fileName}: ${err.message}`));
-    }
-  }
-  return updated;
-}
-
-function maybeRepairRbac(appPath, systemFilePath, systemParsed, datasourceFiles, options) {
-  if (!options.rbac) return { rbacMigratedFromSystem: false, rbacMergeUpdated: false };
-  const { dryRun, changes, backupCtx, rbacFmt } = options;
-  const rbacMigratedFromSystem = migrateSystemRbacIntoRbacFile(appPath, systemFilePath, systemParsed, { dryRun, changes, backupCtx });
-  const rbacMergeUpdated = mergeRbacFromDatasources(appPath, systemParsed, datasourceFiles, extractRbacFromSystem, {
-    format: rbacFmt,
-    dryRun,
-    changes,
-    backupCtx
-  });
-  return { rbacMigratedFromSystem, rbacMergeUpdated };
-}
+const { runRepairExternalIntegration } = require('./repair-external-run');
 
-/**
- * Apply --auth: replace system file authentication with canonical block for the given method.
- * Preserves existing authentication.variables (e.g. baseUrl, tokenUrl) from the current system file.
- * @param {Object} ctx - Context with systemParsed, systemKey, auth, dryRun, changes
- * @returns {boolean} True if auth was replaced
- */
-function applyAuthMethod(ctx) {
-  if (!ctx.auth || typeof ctx.auth !== 'string') return false;
-  const method = ctx.auth.trim().toLowerCase();
-  if (!ALLOWED_AUTH.includes(method)) {
-    throw new Error(
-      `Invalid --auth "${ctx.auth}". Allowed methods: ${ALLOWED_AUTH.join(', ')}`
-    );
-  }
-  const existingAuth = ctx.systemParsed.authentication || ctx.systemParsed.auth || {};
-  const { buildAuthenticationFromMethod } = require('../external-system/generator');
-  const newAuth = buildAuthenticationFromMethod(ctx.systemKey, method);
-  const existingVars =
-    existingAuth.variables && typeof existingAuth.variables === 'object'
-      ? existingAuth.variables
-      : {};
-  // When switching auth method, keep only connectivity fields from the wizard draft.
-  // Do not let OAuth-era variables (tokenUrl, scope, headerName, …) override the new method.
-  const mergedVariables = { ...newAuth.variables };
-  for (const key of ['baseUrl', 'testEndpoint']) {
-    if (existingVars[key] !== undefined && existingVars[key] !== null) {
-      mergedVariables[key] = existingVars[key];
-    }
-  }
-  ctx.systemParsed.authentication = {
-    ...newAuth,
-    variables: mergedVariables
-  };
-  if (existingAuth.displayName !== undefined) {
-    ctx.systemParsed.authentication.displayName = existingAuth.displayName;
-  }
-  ctx.changes.push(`Set authentication method to ${method}`);
-  return true;
-}
-
-/**
- * Runs all repair steps (integration block, system dataSources, auth/config, app key, datasource keys, rbac, env.template).
- * @param {Object} ctx - Context with appPath, configPath, variables, systemFilePath, systemParsed, systemKey, systemFiles, datasourceFiles, dryRun, changes, auth?, backupCtx?
- * @returns {{ updated: boolean, appKeyFixed: boolean, datasourceKeysFixed: boolean, rbacFileCreated: boolean, envTemplateRepaired: boolean }}
- */
-function runRepairSteps(ctx) {
-  const bc = ctx.backupCtx;
-  let updated = ensureExternalIntegrationBlock(
-    ctx.variables, ctx.systemFiles, ctx.datasourceFiles, ctx.changes
-  );
-  const authReplaced = applyAuthMethod(ctx);
-  updated = updated || authReplaced;
-  const systemAuthConfigNormalized = normalizeSystemFileAuthAndConfig(
-    ctx.systemParsed, ctx.systemKey, ctx.changes
-  );
-  const systemDataSourcesAligned = alignSystemFileDataSources(
-    ctx.appPath, ctx.systemParsed, ctx.datasourceFiles, ctx.systemKey, ctx.dryRun, ctx.changes
-  );
-  const authVarsRemoved = removeAuthVarsFromConfiguration(
-    ctx.systemParsed, ctx.systemKey, ctx.dryRun, ctx.changes
-  );
-  const systemFileUpdated =
-    authReplaced || systemAuthConfigNormalized || systemDataSourcesAligned || authVarsRemoved;
-  if (systemFileUpdated && !ctx.dryRun) {
-    backupIntegrationFile(ctx.systemFilePath, bc);
-    writeConfigFile(ctx.systemFilePath, ctx.systemParsed);
-  }
-  updated = updated || systemFileUpdated;
-  const appKeyFixed = alignAppKeyWithSystem(
-    ctx.variables, ctx.systemKey, ctx.systemParsed, ctx.changes
-  );
-  const datasourceKeysFixed = alignDatasourceSystemKeys(
-    ctx.appPath, ctx.datasourceFiles, ctx.systemKey, ctx.dryRun, ctx.changes, bc
-  );
-  const rbacFileCreated = createRbacFromSystemIfNeeded({
-    appPath: ctx.appPath,
-    systemFilePath: ctx.systemFilePath,
-    systemParsed: ctx.systemParsed,
-    dryRun: ctx.dryRun,
-    changes: ctx.changes,
-    format: ctx.format,
-    backupCtx: bc
-  });
-  const envTemplateRepaired = repairEnvTemplate(
-    ctx.appPath, ctx.systemParsed, ctx.systemKey, ctx.dryRun, ctx.changes, bc
-  );
-  updated = updated || appKeyFixed || datasourceKeysFixed || rbacFileCreated || envTemplateRepaired;
-  return {
-    updated,
-    appKeyFixed,
-    datasourceKeysFixed,
-    rbacFileCreated,
-    envTemplateRepaired
-  };
-}
-
-/**
- * Repairs external integration config: syncs files, aligns keys, creates rbac, regenerates manifest
- * @async
- * @param {string} appName - Application/integration name
- * @param {Object} [options] - Options
- * @param {boolean} [options.dryRun] - If true, only report changes; do not write
- * @param {boolean} [options.doc] - If true, regenerate README.md from deployment manifest
- * @returns {Promise<{ updated: boolean, changes: string[], systemFiles: string[], datasourceFiles: string[], appKeyFixed?: boolean, datasourceKeysFixed?: boolean, rbacFileCreated?: boolean, envTemplateRepaired?: boolean, manifestRegenerated?: boolean, readmeRegenerated?: boolean }>}
- */
 /**
  * Loads application config and discovers integration files; validates at least one system file exists.
  * @param {string} appPath - Application path
@@ -226,43 +32,13 @@ function loadConfigAndDiscover(appPath, configPath) {
     originalYamlContent = fs.readFileSync(configPath, 'utf8');
   }
   const { systemFiles, datasourceFiles: discoveredDatasourceFiles } = discoverIntegrationFiles(appPath);
-  if (systemFiles.length === 0) {
+  if (!systemFiles || systemFiles.length === 0) {
     throw new Error(`No system file found in ${appPath}. Expected *-system.yaml or *-system.json`);
   }
   const datasourceFiles = buildEffectiveDatasourceFiles(appPath, discoveredDatasourceFiles, variables.externalIntegration?.dataSources);
   return { variables, originalYamlContent, systemFiles, datasourceFiles };
 }
 
-/**
- * Builds the repair result object from steps and flags.
- * @param {Object} steps - Result of runRepairSteps
- * @param {boolean} anyUpdated - Whether any repair made changes
- * @param {boolean} manifestRegenerated - Whether manifest was regenerated
- * @param {boolean} readmeRegenerated - Whether README was regenerated
- * @param {{ changes: string[], systemFiles: string[], datasourceFiles: string[] }} ctx - changes and file lists
- * @returns {Object} Combined result object
- */
-function buildRepairResult(steps, anyUpdated, manifestRegenerated, readmeRegenerated, ctx) {
-  return Object.assign(
-    {
-      updated: anyUpdated,
-      actionsPerformed: ctx.actionsPerformed === true,
-      changes: ctx.changes,
-      systemFiles: ctx.systemFiles,
-      datasourceFiles: ctx.datasourceFiles,
-      backupPaths: ctx.backupPaths || []
-    },
-    {
-      appKeyFixed: steps.appKeyFixed,
-      datasourceKeysFixed: steps.datasourceKeysFixed,
-      rbacFileCreated: steps.rbacFileCreated,
-      envTemplateRepaired: steps.envTemplateRepaired,
-      manifestRegenerated,
-      readmeRegenerated
-    }
-  );
-}
-
 /**
  * Validates repair inputs and resolves app path and config path.
  * @param {string} appName - Application name
@@ -291,83 +67,40 @@ function createRepairBackupContext(options, dryRun) {
   const noBackup = options.noBackup === true || options.backup === false;
   const backupPaths = [];
   const backedUpFiles = new Set();
-  const backupCtx = { dryRun, noBackup, backupPaths, backedUpFiles };
+  const backupCtx = {
+    dryRun,
+    noBackup,
+    backupPaths,
+    backedUpFiles,
+    changedFiles: [],
+    wouldChangeFiles: []
+  };
   return { backupPaths, backupCtx };
 }
 
-async function maybeRunOpenApiSyncForMcp({ options, dryRun, appPath, systemKey, datasourceFiles, changes }) {
-  if (!options.api) return false;
-  try {
-    const openapiLines = await maybeSyncOpenApiFilesForMcp({
-      enabled: true,
-      dryRun,
-      appPath,
-      systemKey,
-      datasourceFiles
-    });
-    openapiLines.forEach((l) => changes.push(l));
-    return openapiLines.length > 0;
-  } catch (err) {
-    changes.push(`OpenAPI upload for MCP failed: ${err.message}`);
-    return false;
-  }
-}
-
+/**
+ * Repairs external integration config: syncs files, aligns keys, creates rbac, regenerates manifest
+ * @async
+ * @param {string} appName - Application/integration name
+ * @param {Object} [options] - Options
+ * @param {boolean} [options.dryRun] - If true, only report changes; do not write
+ * @param {boolean} [options.doc] - If true, regenerate README.md from deployment manifest
+ * @returns {Promise<Object>}
+ */
 async function repairExternalIntegration(appName, options = {}) {
   const { appPath, configPath, dryRun, authOption } = await validateAndResolveRepairPaths(appName, options);
   const { backupPaths, backupCtx } = createRepairBackupContext(options, dryRun);
-  const { variables, originalYamlContent, systemFiles, datasourceFiles: initialDatasourceFiles } = loadConfigAndDiscover(appPath, configPath);
-  const changes = [];
-  const { systemFilePath, systemParsed, systemKey } = resolveSystemContext(appPath, systemFiles);
-  const rbacFmt = options.format === 'json' ? 'json' : 'yaml';
-  const { updated: keysNormalized, datasourceFiles } = normalizeDatasourceKeysAndFilenames(appPath, initialDatasourceFiles, systemKey, { variables, dryRun, changes, backupCtx });
-  const steps = runRepairSteps({
+  const loaded = loadConfigAndDiscover(appPath, configPath);
+  return runRepairExternalIntegration({
+    appName,
+    options,
     appPath,
     configPath,
-    variables,
-    systemFilePath,
-    systemParsed,
-    systemKey,
-    systemFiles,
-    datasourceFiles,
-    dryRun,
-    changes,
-    auth: authOption,
-    format: rbacFmt,
-    backupCtx
-  });
-  const datasourceRepairUpdated = runDatasourceRepairs(appPath, datasourceFiles, {
-    expose: Boolean(options.expose),
-    sync: Boolean(options.sync),
-    test: Boolean(options.test),
-    backupCtx
-  }, dryRun, changes);
-  const openapiActionsPerformed = await maybeRunOpenApiSyncForMcp({
-    options,
     dryRun,
-    appPath,
-    systemKey,
-    datasourceFiles,
-    changes
-  });
-  const { rbacMigratedFromSystem, rbacMergeUpdated } = maybeRepairRbac(
-    appPath,
-    systemFilePath,
-    systemParsed,
-    datasourceFiles,
-    { rbac: Boolean(options.rbac), rbacFmt, dryRun, changes, backupCtx }
-  );
-  const anyLocalUpdated = keysNormalized || steps.updated || datasourceRepairUpdated || rbacMigratedFromSystem || rbacMergeUpdated;
-  const manifestRegenerated = (anyLocalUpdated && !dryRun) ? await persistChangesAndRegenerate(
-    { configPath, variables, appName, appPath, changes, originalYamlContent, backupCtx }
-  ) : false;
-  const readmeRegenerated = await regenerateReadmeIfRequested(appName, appPath, { ...options, backupCtx }, changes);
-  return buildRepairResult(steps, anyLocalUpdated, manifestRegenerated, readmeRegenerated, {
-    actionsPerformed: openapiActionsPerformed,
-    changes,
-    systemFiles,
-    datasourceFiles,
-    backupPaths
+    authOption,
+    backupPaths,
+    backupCtx,
+    ...loaded
   });
 }
 

package/lib/commands/secrets-get.js

@@ -0,0 +1,184 @@
+/**
+ * @fileoverview aifabrix secret get – read one secret (local user file or shared-only)
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+const path = require('path');
+const { getAifabrixSecretsPath } = require('../core/config');
+const { decryptSecretsObject } = require('../core/secrets-load');
+const { loadPrimaryUserSecrets } = require('../utils/secrets-utils');
+const { loadConfiguredSharedSecretsStore } = require('../utils/remote-secrets-loader');
+const remoteDevAuth = require('../utils/remote-dev-auth');
+const devApi = require('../api/dev.api');
+const logger = require('../utils/logger');
+
+const REMOTE_NOT_CONFIGURED_MSG =
+  'Remote server is not configured. Set remote-server and run "aifabrix dev init" first.';
+
+/**
+ * Human-readable label for which store(s) were queried (paths included for file stores).
+ * @param {{ shared?: boolean }} options
+ * @returns {Promise<string>}
+ */
+async function resolveSecretsScopeLabel(options) {
+  const useSharedOnly = Boolean(options.shared || options['shared']);
+  const generalSecretsPath = await getAifabrixSecretsPath();
+
+  if (useSharedOnly) {
+    if (!generalSecretsPath) {
+      return 'shared secrets (aifabrix-secrets not configured; run aifabrix secret set-secrets-file <path>)';
+    }
+    const target = await remoteDevAuth.resolveSharedSecretsEndpoint(generalSecretsPath);
+    if (remoteDevAuth.isRemoteSecretsUrl(target)) {
+      const host = remoteDevAuth.getSharedSecretsRemoteHostname(target) || target;
+      return `shared secrets API (${host})`;
+    }
+    const resolved = path.isAbsolute(target) ? target : path.resolve(process.cwd(), target);
+    return `shared secrets file ${resolved}`;
+  }
+
+  const pathsUtil = require('../utils/paths');
+  const userPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+  return `local secrets file ${userPath}`;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+function isSecretPresent(value) {
+  if (value === undefined || value === null) {
+    return false;
+  }
+  return String(value).trim() !== '';
+}
+
+/**
+ * @param {Array<{ name?: string, key?: string, value?: unknown }>} items
+ * @returns {Record<string, string>}
+ */
+function remoteSecretItemsToMap(items) {
+  const raw = {};
+  for (const item of items) {
+    const name = item?.name || item?.key;
+    if (typeof name === 'string' && item.value !== undefined) {
+      raw[name] = String(item.value);
+    }
+  }
+  return raw;
+}
+
+/**
+ * @param {string} target
+ * @returns {Promise<Record<string, string>>}
+ */
+async function loadRemoteSharedSecretsDecrypted(target) {
+  const auth = await remoteDevAuth.getRemoteDevAuth();
+  if (!auth) {
+    throw new Error(REMOTE_NOT_CONFIGURED_MSG);
+  }
+  const items = await devApi.listSecrets(
+    auth.serverUrl,
+    auth.clientCertPem,
+    auth.serverCaPem || undefined,
+    target
+  );
+  const label = remoteDevAuth.getSharedSecretsRemoteHostname(target) || 'shared secrets API';
+  return decryptSecretsObject(remoteSecretItemsToMap(items), { defaultSourceLabel: label });
+}
+
+/**
+ * Load shared secrets (file or remote), decrypted.
+ * @returns {Promise<Record<string, string>>}
+ */
+async function loadSharedSecretsDecrypted() {
+  const generalSecretsPath = await getAifabrixSecretsPath();
+  if (!generalSecretsPath) {
+    throw new Error('Shared secrets not configured. Set aifabrix-secrets in config.yaml.');
+  }
+
+  const target = await remoteDevAuth.resolveSharedSecretsEndpoint(generalSecretsPath);
+  if (remoteDevAuth.isRemoteSecretsUrl(target)) {
+    return loadRemoteSharedSecretsDecrypted(target);
+  }
+
+  const raw = await loadConfiguredSharedSecretsStore();
+  if (!raw || typeof raw !== 'object') {
+    return {};
+  }
+  const resolvedPath = path.isAbsolute(target) ? target : path.resolve(process.cwd(), target);
+  return decryptSecretsObject(raw, { defaultSourceLabel: resolvedPath });
+}
+
+/**
+ * Load and decrypt the primary user secrets file only (not aifabrix-secrets / shared).
+ * @returns {Promise<Record<string, string>>}
+ */
+async function loadLocalUserSecretsDecrypted() {
+  const pathsUtil = require('../utils/paths');
+  const userPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+  const raw = loadPrimaryUserSecrets();
+  return decryptSecretsObject(raw || {}, { defaultSourceLabel: userPath });
+}
+
+/**
+ * Load secrets for lookup: local user file (default) or shared store only (--shared).
+ * @param {{ shared?: boolean }} options
+ * @returns {Promise<Record<string, string>>}
+ */
+async function loadSecretsForGet(options) {
+  if (options.shared || options['shared']) {
+    return loadSharedSecretsDecrypted();
+  }
+  return loadLocalUserSecretsDecrypted();
+}
+
+/**
+ * Handle secret get command.
+ * @param {string} key - Secret key (no kv:// prefix)
+ * @param {Object} options
+ * @param {boolean} [options.shared] - Shared store only (aifabrix-secrets); default is local user file only
+ * @param {boolean} [options.exists] - Exit 0 when present; no stdout (script-friendly)
+ * @param {boolean} [options.json] - JSON { key, exists, value }
+ * @returns {Promise<{ key: string, exists: boolean, value?: string }>}
+ */
+async function handleSecretsGet(key, options = {}) {
+  if (!key || typeof key !== 'string') {
+    throw new Error('Secret key is required and must be a string');
+  }
+  if (key.startsWith('kv://')) {
+    throw new Error(
+      'Secret key must not start with kv://. Use the key path without the prefix (e.g. hubspot-demo/token).'
+    );
+  }
+
+  const secrets = await loadSecretsForGet(options);
+  const value = secrets[key];
+  const present = isSecretPresent(value);
+
+  if (!present) {
+    const scope = await resolveSecretsScopeLabel(options);
+    throw new Error(`Secret '${key}' is missing or empty in ${scope}.`);
+  }
+
+  if (options.exists || options['exists']) {
+    return { key, exists: true };
+  }
+
+  if (options.json || options['json']) {
+    logger.log(JSON.stringify({ key, exists: true, value: String(value) }));
+    return { key, exists: true, value: String(value) };
+  }
+
+  logger.log(String(value));
+  return { key, exists: true, value: String(value) };
+}
+
+module.exports = {
+  handleSecretsGet,
+  isSecretPresent,
+  loadSecretsForGet,
+  loadLocalUserSecretsDecrypted,
+  resolveSecretsScopeLabel
+};

package/lib/commands/secrets-remove-all.js

@@ -56,6 +56,8 @@ function listKeysFromYamlFile(filePath) {
  * @param {string} filePath - Absolute path
  */
 function writeEmptySecretsFile(filePath) {
+  const { assertWritableSecretsPathForTests } = require('../utils/aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(filePath);
   const yamlContent = yaml.dump({}, { indent: 2, lineWidth: -1, noRefs: true, sortKeys: false });
   fs.writeFileSync(filePath, yamlContent, { mode: 0o600 });
 }
@@ -217,4 +219,4 @@ async function handleSecretsRemoveAll(options) {
   await removeAllSharedSecrets(generalSecretsPath, options);
 }
 
-module.exports = { handleSecretsRemoveAll };
+module.exports = { handleSecretsRemoveAll, writeEmptySecretsFile };