@envseal/core 0.1.0

package/dist/sinks/doppler.js

@@ -0,0 +1,198 @@
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { asSecret, SepError } from '@envseal/protocol';
+import { CliSinkBase, execCli, exitCodeOf } from './cli-sink-base.js';
+import { unsafeSecretToUtf8 } from './dotenv.js';
+/**
+ * Doppler secrets live under a project/config pair, the provider's analog of
+ * vault's mount/path: the project defaults to the sanitized project directory
+ * name (same leaf keychain.ts and vault.ts scope by) and the config to `dev`,
+ * both overridable per environment via ENVSEAL_DOPPLER_PROJECT /
+ * ENVSEAL_DOPPLER_CONFIG. Overrides pass through verbatim — an explicit name
+ * is aimed at an existing project, not renamed behind the user's back.
+ *
+ * Transport: `doppler secrets set KEY` reads the value from stdin when stdin
+ * is a pipe (`cat cert.pem | doppler secrets set TLS_CERT` is the documented
+ * form), so values never touch argv. The `KEY=value` argv form also exists
+ * but is rejected here — argv is world-readable via process listings. The
+ * other stdin route, `secrets upload` with a JSON blob, replaces the config's
+ * whole secret set: scoping it to one key would mean a read-merge-upload
+ * cycle that both pulls unrelated secrets through this process and races
+ * concurrent writers into lost updates. One-key set through stdin has no
+ * such race.
+ *
+ * Auth: DOPPLER_TOKEN in the environment or a token captured by
+ * `doppler configure`. This sink never passes tokens itself.
+ */
+/** The config envseal writes to when ENVSEAL_DOPPLER_CONFIG does not override it. */
+const DEFAULT_CONFIG = 'dev';
+/**
+ * Doppler documents no exit code for a missing secret; absence arrives as
+ * stderr wording instead. Since DopplerHQ/cli PR #215 the CLI prints
+ * `Could not find requested secret: NAME` and exits nonzero (older builds
+ * returned an empty --plain body with exit 0, which read() maps to null) —
+ * both shapes mean ABSENCE, which read()/remove() must report as null/false
+ * rather than a thrown failure.
+ *
+ * The marker, not bare "not found", is what carries that meaning: scope
+ * misses surface as their own errors (`project "x" not found`, `config
+ * "dev" not found`), and mapping those to null would turn a mistyped
+ * ENVSEAL_DOPPLER_PROJECT into an ensure() prompt loop on every run instead
+ * of a loud error naming the bad scope. Any other nonzero exit (expired
+ * token, unreachable API) stays loud for the same reason.
+ */
+const MISSING_SECRET = /could not find requested secrets?\b/i;
+/**
+ * True when a doppler credential exists: DOPPLER_TOKEN set, or a config file
+ * on disk from a previous `doppler configure` (~/.doppler/.doppler.json, the
+ * documented location). homedir() is resolved per call — os.homedir() honors
+ * HOME/USERPROFILE, which lets tests isolate the file branch. The check also
+ * degrades safely: a wrong guess about the path yields false (with an
+ * unavailable message that names DOPPLER_TOKEN), never a false "ready".
+ */
+export function dopplerCredentialConfigured() {
+    if (process.env.DOPPLER_TOKEN)
+        return true;
+    return existsSync(join(homedir(), '.doppler', '.doppler.json'));
+}
+/** The project directory name every other provider sink scopes entries by. */
+function projectIdOf(paths) {
+    return paths.root.split(/[\\/]/).pop() ?? 'unknown';
+}
+/**
+ * Map a project directory name onto doppler's project-name alphabet
+ * (lowercase letters, digits, dashes, underscores). Best effort by design:
+ * envseal never creates the project — the user provisions it under this name
+ * or points ENVSEAL_DOPPLER_PROJECT at an existing one, and the first
+ * operation fails loudly with doppler's own error if it does not exist.
+ */
+function sanitizeProjectName(raw) {
+    const cleaned = raw
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 60)
+        .replace(/-+$/g, '');
+    return cleaned.length > 0 ? cleaned : 'envseal-project';
+}
+/** The project/config pair every operation targets, resolved per call. */
+function scopeFor(paths) {
+    return {
+        project: process.env.ENVSEAL_DOPPLER_PROJECT ?? sanitizeProjectName(projectIdOf(paths)),
+        config: process.env.ENVSEAL_DOPPLER_CONFIG ?? DEFAULT_CONFIG,
+    };
+}
+/** Absence signal only: a real exit code plus doppler's missing-secret wording. */
+function isNotFound(error) {
+    const stderr = error?.stderr;
+    return exitCodeOf(error) !== undefined && stderr !== undefined && MISSING_SECRET.test(stderr);
+}
+export class DopplerSink extends CliSinkBase {
+    id = 'doppler';
+    requiredCommands = ['doppler'];
+    unavailableReason() {
+        return 'the doppler CLI is not installed or no Doppler credential is configured (DOPPLER_TOKEN or doppler configure)';
+    }
+    /**
+     * Single choke point for every spawn this sink makes. Production resolves
+     * `doppler` off PATH; tests substitute a fake provider here instead of
+     * staging one on PATH, because Windows cannot spawn shebang scripts and
+     * modern Node refuses .cmd shims outright (CVE-2024-27980) — a PATH-only
+     * double would leave the parsing/error-mapping logic unexercised there
+     * (same trade as vault.ts).
+     */
+    run(args, options = {}) {
+        return execCli('doppler', [...args], options);
+    }
+    /**
+     * Doppler on PATH AND a credential to talk to. The base probe deliberately
+     * checks binaries only — credential configuration is validated here and at
+     * operation time, where its absence can produce a precise message.
+     */
+    async available(_paths) {
+        return (await super.available(_paths)) && dopplerCredentialConfigured();
+    }
+    async read(paths, key) {
+        await this.requireReady();
+        const scope = scopeFor(paths);
+        try {
+            const { stdout } = await this.run([
+                'secrets',
+                'get',
+                key,
+                '--plain',
+                '--project',
+                scope.project,
+                '--config',
+                scope.config,
+            ]);
+            // --plain prints the bare value plus one trailing newline; an empty body
+            // is the exit-0 shape of a miss, the same read keychain.ts gives
+            // secret-tool. Strip exactly that one newline, byte-exact, never a
+            // blanket trim.
+            if (stdout.length === 0)
+                return null;
+            return asSecret(Buffer.from(stdout.replace(/\r?\n$/, ''), 'utf8'));
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return null;
+            throw this.sinkFailure('read', error, key);
+        }
+    }
+    async write(paths, key, value) {
+        await this.requireReady();
+        const scope = scopeFor(paths);
+        try {
+            // Value on stdin only. One caveat left to the live round-trip suite
+            // where a CLI exists: doppler may trim a single trailing newline off
+            // piped input, echo-style — envseal values do not end in newlines in
+            // practice, so nothing here pre-trims or pre-pads to compensate.
+            await this.run(['secrets', 'set', key, '--project', scope.project, '--config', scope.config], { input: unsafeSecretToUtf8(value) });
+        }
+        catch (error) {
+            throw this.sinkFailure('write', error, key);
+        }
+    }
+    async remove(paths, key) {
+        await this.requireReady();
+        const scope = scopeFor(paths);
+        try {
+            // --yes: the interactive confirmation can never be answered on a pipe.
+            await this.run([
+                'secrets',
+                'delete',
+                key,
+                '--yes',
+                '--project',
+                scope.project,
+                '--config',
+                scope.config,
+            ]);
+            return true;
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return false;
+            throw this.sinkFailure('remove', error, key);
+        }
+    }
+    /**
+     * Every operation re-probes the CLI — available() may have been consulted
+     * long before, and the binary can vanish in between — then demands a
+     * credential separately, whose absence gets its own precise message instead
+     * of hiding behind the generic reason.
+     */
+    async requireReady() {
+        await this.requirePrerequisites();
+        if (!dopplerCredentialConfigured()) {
+            throw new SepError({
+                code: 'SEP_SINK_UNAVAILABLE',
+                userMessage: `The ${this.id} sink is not available — no Doppler credential is configured (DOPPLER_TOKEN or doppler configure).`,
+            });
+        }
+    }
+}
+export const dopplerSink = new DopplerSink();
+//# sourceMappingURL=doppler.js.map

package/dist/sinks/dotenv.d.ts

@@ -0,0 +1,57 @@
+import type { SecretValue } from '@envseal/protocol';
+import type { ProjectPaths } from '../paths.js';
+import type { Sink } from './types.js';
+export type DotenvLine = {
+    kind: 'comment';
+    text: string;
+} | {
+    kind: 'blank';
+    text: string;
+} | {
+    kind: 'raw';
+    text: string;
+} | {
+    kind: 'assignment';
+    text: string;
+    key: string;
+    value: string;
+    quote: '"' | "'" | null;
+    exported: boolean;
+    lead: string;
+    prefix: string;
+    trailing: string;
+};
+export interface ParsedDotenv {
+    lines: DotenvLine[];
+    eol: '\r\n' | '\n';
+    bom: boolean;
+    trailingNewline: boolean;
+}
+/**
+ * The single permitted SecretValue -> string conversion in the whole broker.
+ * It exists so a value can be handed to the dotenv sink for writing (and, in
+ * turn, fed to the redactor). It MUST NOT be re-exported from the package
+ * index and MUST NOT be used for logging, printing, or error messages.
+ */
+export declare function unsafeSecretToUtf8(value: SecretValue): string;
+export declare function parseDotenv(text: string): ParsedDotenv;
+export declare function serializeDotenv(parsed: ParsedDotenv): string;
+export interface WriteDotenvOptions {
+    allowUnsafe?: boolean;
+    description?: string;
+}
+export declare function readDotenv(paths: ProjectPaths): Record<string, string>;
+export declare function setDotenvValue(paths: ProjectPaths, key: string, value: string, options?: WriteDotenvOptions): void;
+export declare function removeDotenvKey(paths: ProjectPaths, key: string, options?: {
+    allowUnsafe?: boolean;
+}): boolean;
+export declare class DotenvSink implements Sink {
+    readonly id = "dotenv";
+    available(_paths: ProjectPaths): Promise<boolean>;
+    read(paths: ProjectPaths, key: string): Promise<SecretValue | null>;
+    write(paths: ProjectPaths, key: string, value: SecretValue, options?: WriteDotenvOptions): Promise<void>;
+    remove(paths: ProjectPaths, key: string, options?: {
+        allowUnsafe?: boolean;
+    }): Promise<boolean>;
+}
+//# sourceMappingURL=dotenv.d.ts.map

package/dist/sinks/dotenv.js

@@ -0,0 +1,407 @@
+import { closeSync, fsyncSync, openSync, readFileSync, renameSync, unlinkSync, writeSync, chmodSync, } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { dirname, basename, join, relative } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { asSecret, SepError } from '@envseal/protocol';
+import { ensureStateDir } from '../paths.js';
+const isPosix = process.platform !== 'win32';
+/**
+ * The single permitted SecretValue -> string conversion in the whole broker.
+ * It exists so a value can be handed to the dotenv sink for writing (and, in
+ * turn, fed to the redactor). It MUST NOT be re-exported from the package
+ * index and MUST NOT be used for logging, printing, or error messages.
+ */
+export function unsafeSecretToUtf8(value) {
+    return value.toString('utf8');
+}
+const ASSIGNMENT_RE = /^(\s*)(?:export\s+)?([A-Za-z0-9_.]+)\s*=\s*(.*)$/;
+export function parseDotenv(text) {
+    const bom = text.charCodeAt(0) === 0xfeff;
+    const body = bom ? text.slice(1) : text;
+    const eol = body.includes('\r\n') ? '\r\n' : '\n';
+    const rawLines = body.split(/\r\n|\n/);
+    let trailingNewline = false;
+    if (body.endsWith('\n')) {
+        rawLines.pop();
+        trailingNewline = true;
+    }
+    const lines = rawLines.map(parseLine);
+    return { lines, eol, bom, trailingNewline };
+}
+function parseLine(raw) {
+    if (/^\s*$/.test(raw))
+        return { kind: 'blank', text: raw };
+    if (/^\s*#/.test(raw))
+        return { kind: 'comment', text: raw };
+    const match = ASSIGNMENT_RE.exec(raw);
+    if (!match)
+        return { kind: 'raw', text: raw };
+    const lead = match[1] ?? '';
+    const key = match[2] ?? '';
+    const exported = /^export\s/.test(raw.slice(lead.length));
+    let rest = match[3] ?? '';
+    let quote = null;
+    let value = '';
+    let trailing = '';
+    const first = rest[0];
+    if (first === '"' || first === "'") {
+        quote = first;
+        rest = rest.slice(1);
+        let str = '';
+        let i = 0;
+        let closed = false;
+        for (; i < rest.length; i++) {
+            const ch = rest[i];
+            if (ch === '\\' && quote === '"') {
+                const next = rest[i + 1];
+                i++;
+                if (next === 'n')
+                    str += '\n';
+                else if (next === 'r')
+                    str += '\r';
+                else if (next === 't')
+                    str += '\t';
+                else if (next === '"')
+                    str += '"';
+                else if (next === '\\')
+                    str += '\\';
+                else
+                    str += next ?? '';
+            }
+            else if (ch === quote) {
+                closed = true;
+                i++;
+                break;
+            }
+            else {
+                str += ch;
+            }
+        }
+        if (!closed)
+            return { kind: 'raw', text: raw };
+        value = str;
+        trailing = rest.slice(i);
+    }
+    else {
+        const commentMatch = /(\s+)#/.exec(rest);
+        if (commentMatch && commentMatch[1]) {
+            value = rest.slice(0, commentMatch.index).replace(/\s+$/, '');
+            trailing = rest.slice(commentMatch.index);
+        }
+        else {
+            value = rest.replace(/\s+$/, '');
+            trailing = '';
+        }
+    }
+    return {
+        kind: 'assignment',
+        text: raw,
+        key,
+        value,
+        quote,
+        exported,
+        lead,
+        prefix: exported ? 'export ' : '',
+        trailing,
+    };
+}
+export function serializeDotenv(parsed) {
+    const body = parsed.lines.map((line) => line.text).join(parsed.eol);
+    let out = parsed.bom ? '\uFEFF' : '';
+    out += body;
+    if (parsed.trailingNewline)
+        out += parsed.eol;
+    return out;
+}
+function escapeDoubleQuoted(value) {
+    return value
+        .replace(/\\/g, '\\\\')
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, '\\n')
+        .replace(/\r/g, '\\r');
+}
+function renderValue(value, prefer = null) {
+    const needsQuote = value.length === 0 ||
+        /[\s#\\]/.test(value) ||
+        value.includes('\n') ||
+        value.includes('\r') ||
+        value.includes('"') ||
+        value.includes("'");
+    if (!needsQuote) {
+        if (prefer === '"')
+            return `"${value}"`;
+        if (prefer === "'")
+            return `'${value}'`;
+        return value;
+    }
+    if (prefer === "'" && !/[\r\n'"\\]/.test(value)) {
+        return `'${value}'`;
+    }
+    return `"${escapeDoubleQuoted(value)}"`;
+}
+function rebuildAssignment(line, value) {
+    if (line.kind !== 'assignment')
+        return line;
+    const text = `${line.lead}${line.prefix}${line.key}=${renderValue(value, line.quote)}${line.trailing}`;
+    return { ...line, value, text };
+}
+// On Windows, touching a file another process has a handle on intermittently
+// fails with EPERM / EACCES / EBUSY: antivirus scanners, the search indexer and
+// editors all take brief handles on a file they just saw written. The operation
+// succeeds once the handle is released, so the fix is a bounded retry rather
+// than a fallback to something non-atomic. Found by the dotenv property test,
+// which only reproduced it after ~250 writes in quick succession.
+//
+// F-W7-4: this used to guard the rename only. The same transient handle fails
+// the *read* just as readily — and a read failure happens before the rename
+// loop is ever reached, so the retry budget never ran.
+const RETRY_DELAYS_MS = [1, 2, 5, 10, 25, 50, 100];
+const TRANSIENT_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+function withTransientRetry(operation) {
+    let lastError;
+    for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) {
+        try {
+            return operation();
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === undefined || !TRANSIENT_CODES.has(code))
+                throw error;
+            lastError = error;
+            const delay = RETRY_DELAYS_MS[attempt];
+            if (delay === undefined)
+                break;
+            // Synchronous sleep: this path must stay sync because the whole sink API
+            // is sync, and the waits are sub-100ms.
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, delay);
+        }
+    }
+    throw lastError;
+}
+function readFileIfPresent(path) {
+    try {
+        return withTransientRetry(() => readFileSync(path, 'utf8'));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        return null;
+    }
+}
+function writeTempFile(tmp, content) {
+    const fd = openSync(tmp, 'wx', 0o600);
+    try {
+        writeSync(fd, content, null, 'utf8');
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    if (isPosix)
+        chmodSync(tmp, 0o600);
+}
+/**
+ * Write `content` to `target` so that a reader never observes a partial file.
+ *
+ * The temp file holds the complete plaintext, so where it lives matters
+ * (F-W7-3): `.<basename>.<hex>.tmp` next to the target is `..env.<hex>.tmp`,
+ * which a `.gitignore` entry of `.env` does NOT match — a leftover would be a
+ * stageable plaintext secret. It goes in `.envseal/` instead, which is mode
+ * 0700 and carries its own `.gitignore` of `*` (see ensureStateDir).
+ *
+ * `.envseal/` is `<root>/.envseal`, so it is on the same volume as `.env` by
+ * construction and the rename stays atomic. If someone has made it a junction
+ * onto another volume the rename reports EXDEV, and we fall back to a sibling
+ * temp file rather than performing a non-atomic cross-volume copy.
+ */
+function atomicWrite(paths, target, content) {
+    const suffix = `${basename(target)}.${randomBytes(6).toString('hex')}.tmp`;
+    const sibling = join(dirname(target), `.${suffix}`);
+    let tmp = join(paths.stateDir, suffix);
+    try {
+        ensureStateDir(paths);
+        writeTempFile(tmp, content);
+    }
+    catch {
+        tmp = sibling;
+        writeTempFile(tmp, content);
+    }
+    try {
+        renameOverwrite(tmp, target);
+    }
+    catch (error) {
+        if (error.code !== 'EXDEV')
+            throw error;
+        writeTempFile(sibling, content);
+        renameOverwrite(sibling, target);
+    }
+}
+function renameOverwrite(tmp, target) {
+    try {
+        withTransientRetry(() => renameSync(tmp, target));
+    }
+    catch (error) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            // best effort: leaving a stray tmp file is preferable to masking the error
+        }
+        throw error;
+    }
+}
+/**
+ * F-W7-4: every filesystem failure used to escape as a bare Node error, so the
+ * CLI never mapped it to exit code 5 and the message carried the target's
+ * absolute path. Callers see SEP_SINK_WRITE_FAILED with the errno only.
+ */
+function asSinkWriteError(error, target) {
+    if (error instanceof SepError)
+        return error;
+    const code = error.code;
+    const name = basename(target);
+    const detail = code === undefined
+        ? ''
+        : ` (${code}) — it may be open in another program, read-only, or on a full disk`;
+    return new SepError({
+        code: 'SEP_SINK_WRITE_FAILED',
+        userMessage: `Could not update ${name} in the project directory${detail}.`,
+        details: { file: name, errno: code ?? null },
+    });
+}
+function runGit(cwd, args) {
+    try {
+        execFileSync('git', args, { cwd, stdio: 'ignore' });
+        return 0;
+    }
+    catch (error) {
+        const status = error.status;
+        return typeof status === 'number' ? status : 1;
+    }
+}
+function assertGitSafe(paths, allowUnsafe) {
+    if (allowUnsafe)
+        return;
+    if (runGit(paths.root, ['rev-parse', '--is-inside-work-tree']) !== 0)
+        return;
+    const relPath = relative(paths.root, paths.dotenv);
+    const tracked = runGit(paths.root, ['ls-files', '--error-unmatch', '--', relPath]) === 0;
+    if (tracked) {
+        throw new SepError({ code: 'SEP_GITIGNORE_UNSAFE' });
+    }
+    const ignored = runGit(paths.root, ['check-ignore', '-q', relPath]) === 0;
+    if (!ignored) {
+        throw new SepError({ code: 'SEP_GITIGNORE_UNSAFE' });
+    }
+}
+export function readDotenv(paths) {
+    const text = readFileIfPresent(paths.dotenv);
+    if (text === null)
+        return {};
+    const parsed = parseDotenv(text);
+    const out = {};
+    for (const line of parsed.lines) {
+        if (line.kind === 'assignment' && line.key.length > 0) {
+            out[line.key] = line.value;
+        }
+    }
+    return out;
+}
+function sanitizeComment(description) {
+    return description.replace(/[\r\n]+/g, ' ').trim();
+}
+function buildNewFile(key, value, description) {
+    const lines = [
+        '# This file is managed by envseal. It contains real secrets.',
+        '# Do NOT commit it to version control.',
+    ];
+    if (description !== undefined && description.length > 0) {
+        lines.push(`# ${sanitizeComment(description)}`);
+    }
+    lines.push(`${key}=${renderValue(value)}`);
+    return `${lines.join('\n')}\n`;
+}
+function buildAppendLines(key, value, description) {
+    const lines = [];
+    if (description !== undefined && description.length > 0) {
+        lines.push({ kind: 'comment', text: `# ${sanitizeComment(description)}` });
+    }
+    lines.push({
+        kind: 'assignment',
+        text: `${key}=${renderValue(value)}`,
+        key,
+        value,
+        quote: null,
+        exported: false,
+        lead: '',
+        prefix: '',
+        trailing: '',
+    });
+    return lines;
+}
+export function setDotenvValue(paths, key, value, options) {
+    // Outside the try: SEP_GITIGNORE_UNSAFE is a refusal, not a write failure.
+    assertGitSafe(paths, options?.allowUnsafe);
+    try {
+        const text = readFileIfPresent(paths.dotenv);
+        if (text === null) {
+            atomicWrite(paths, paths.dotenv, buildNewFile(key, value, options?.description));
+            return;
+        }
+        const parsed = parseDotenv(text);
+        let lastIndex = -1;
+        parsed.lines.forEach((line, index) => {
+            if (line.kind === 'assignment' && line.key === key)
+                lastIndex = index;
+        });
+        if (lastIndex >= 0) {
+            const existing = parsed.lines[lastIndex];
+            if (existing && existing.kind === 'assignment') {
+                parsed.lines[lastIndex] = rebuildAssignment(existing, value);
+            }
+        }
+        else {
+            parsed.lines.push(...buildAppendLines(key, value, options?.description));
+        }
+        atomicWrite(paths, paths.dotenv, serializeDotenv(parsed));
+    }
+    catch (error) {
+        throw asSinkWriteError(error, paths.dotenv);
+    }
+}
+export function removeDotenvKey(paths, key, options) {
+    assertGitSafe(paths, options?.allowUnsafe);
+    try {
+        const parsed = parseDotenv(readFileIfPresent(paths.dotenv) ?? '');
+        const before = parsed.lines.length;
+        parsed.lines = parsed.lines.filter((line) => !(line.kind === 'assignment' && line.key === key));
+        const removed = parsed.lines.length !== before;
+        if (removed) {
+            atomicWrite(paths, paths.dotenv, serializeDotenv(parsed));
+        }
+        return removed;
+    }
+    catch (error) {
+        throw asSinkWriteError(error, paths.dotenv);
+    }
+}
+export class DotenvSink {
+    id = 'dotenv';
+    async available(_paths) {
+        return true;
+    }
+    async read(paths, key) {
+        const values = readDotenv(paths);
+        const value = values[key];
+        if (value === undefined)
+            return null;
+        return asSecret(Buffer.from(value, 'utf8'));
+    }
+    async write(paths, key, value, options) {
+        setDotenvValue(paths, key, unsafeSecretToUtf8(value), options);
+    }
+    async remove(paths, key, options) {
+        return removeDotenvKey(paths, key, options);
+    }
+}
+//# sourceMappingURL=dotenv.js.map

package/dist/sinks/keychain.d.ts

@@ -0,0 +1,21 @@
+import type { SecretValue } from '@envseal/protocol';
+import type { ProjectPaths } from '../paths.js';
+import type { Sink } from './types.js';
+declare class KeychainSink implements Sink {
+    readonly id = "keychain";
+    available(): Promise<boolean>;
+    read(paths: ProjectPaths, key: string): Promise<SecretValue | null>;
+    /**
+     * Decrypt the DPAPI blob write() left at creds\<KEY>. Absent file means the
+     * value is not stored (null); anything present-but-unreadable is a loud
+     * error, never a silent null — a corrupt blob pretending to be "absent"
+     * would send ensure() back to the prompt instead of telling the user their
+     * credential store needs attention.
+     */
+    private readWindows;
+    write(_paths: ProjectPaths, key: string, value: SecretValue): Promise<void>;
+    remove(paths: ProjectPaths, key: string): Promise<boolean>;
+}
+export declare const keychainSink: KeychainSink;
+export {};
+//# sourceMappingURL=keychain.d.ts.map