@patchstack/connect 0.3.29 → 0.3.30

package/dist/index.js

@@ -34,7 +34,7 @@ async function readDeclaredDependencyNames(cwd) {
     return [];
   }
   const names = /* @__PURE__ */ new Set();
-  for (const group of ["dependencies", "devDependencies"]) {
+  for (const group of ["dependencies", "devDependencies", "optionalDependencies"]) {
     const deps = parsed[group];
     if (typeof deps !== "object" || deps === null) {
       continue;
@@ -52,14 +52,171 @@ function missingDependencies(declared, packages) {
   const present = new Set(packages.map((entry) => entry.name));
   return declared.filter((name) => !present.has(name));
 }
+function disagreements(packages, other) {
+  const otherVersions = /* @__PURE__ */ new Map();
+  for (const entry of other) {
+    if (!otherVersions.has(entry.name)) otherVersions.set(entry.name, entry.version);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const conflicts = [];
+  for (const entry of packages) {
+    if (seen.has(entry.name)) continue;
+    seen.add(entry.name);
+    const otherVersion = otherVersions.get(entry.name);
+    if (otherVersion !== void 0 && otherVersion !== entry.version) {
+      conflicts.push({ name: entry.name, version: entry.version, otherVersion });
+    }
+  }
+  return conflicts;
+}
 
-// src/parsers/npm.ts
+// src/parsers/bun.ts
 import { readFile as readFile2 } from "fs/promises";
+
+// src/parsers/report.ts
+var MAX_SAMPLES = 3;
+function newReport() {
+  return { unreadable: 0, samples: [] };
+}
+function recordUnreadable(report, sample) {
+  if (!report) return;
+  report.unreadable++;
+  if (report.samples.length < MAX_SAMPLES) report.samples.push(sample);
+}
+function unreadableWarning(filename, report) {
+  if (report.unreadable === 0) return null;
+  const shown = report.samples.join(", ");
+  const one = report.unreadable === 1;
+  return `${filename}: ${report.unreadable} entr${one ? "y was" : "ies were"} not in a form this scanner reads (${shown}${report.unreadable > report.samples.length ? ", \u2026" : ""}), so ${one ? "it is" : "they are"} absent from this manifest. Anything installed only through ${one ? "that entry" : "those entries"} is not being checked.`;
+}
+
+// src/parsers/bun.ts
+async function parseBunLockfile(lockfilePath, report) {
+  let raw;
+  try {
+    raw = await readFile2(lockfilePath, "utf8");
+  } catch (cause) {
+    throw new PatchstackError(`Could not read lockfile at ${lockfilePath}`, "LOCKFILE_NOT_FOUND", cause);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(stripTrailingCommas(raw));
+  } catch (cause) {
+    throw new PatchstackError(`Lockfile at ${lockfilePath} is not valid JSON`, "LOCKFILE_PARSE_ERROR", cause);
+  }
+  const packages = parsed?.packages;
+  if (typeof packages !== "object" || packages === null) {
+    throw new PatchstackError(`Lockfile at ${lockfilePath} has no "packages" entries`, "LOCKFILE_PARSE_ERROR");
+  }
+  const direct = directDependencyNames(parsed);
+  const entries = [];
+  let skipped = 0;
+  for (const [key, value] of Object.entries(packages)) {
+    const descriptor = Array.isArray(value) ? value[0] : value;
+    if (typeof descriptor !== "string") {
+      skipped++;
+      recordUnreadable(report, key);
+      continue;
+    }
+    const split = splitDescriptor(descriptor);
+    if (split === null) {
+      skipped++;
+      if (!isDeliberatelyExcluded(descriptor)) recordUnreadable(report, key);
+      continue;
+    }
+    entries.push({
+      name: split.name,
+      version: split.version,
+      ...direct.has(split.name) ? { direct: true } : {},
+      ...key === split.name ? {} : { path: key }
+    });
+  }
+  if (entries.length === 0) {
+    throw new PatchstackError(
+      `Lockfile at ${lockfilePath} lists no registry packages${skipped > 0 ? ` (${skipped} non-registry entr${skipped === 1 ? "y" : "ies"} skipped)` : ""}`,
+      "LOCKFILE_PARSE_ERROR"
+    );
+  }
+  return entries;
+}
+function splitDescriptor(descriptor) {
+  const at = descriptor.lastIndexOf("@");
+  if (at <= 0) return null;
+  const name = descriptor.slice(0, at);
+  const version = descriptor.slice(at + 1);
+  if (name === "" || version === "") return null;
+  if (NON_REGISTRY_VERSION.test(version)) return null;
+  return { name, version };
+}
+var NON_REGISTRY_VERSION = /^[a-z][a-z0-9+.-]*:|\//i;
+function isDeliberatelyExcluded(descriptor) {
+  const at = descriptor.lastIndexOf("@");
+  if (at <= 0) return false;
+  return NON_REGISTRY_VERSION.test(descriptor.slice(at + 1));
+}
+function directDependencyNames(parsed) {
+  const names = /* @__PURE__ */ new Set();
+  const workspaces = parsed?.workspaces;
+  if (typeof workspaces !== "object" || workspaces === null) return names;
+  for (const workspace of Object.values(workspaces)) {
+    if (typeof workspace !== "object" || workspace === null) continue;
+    for (const group of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
+      const deps = workspace[group];
+      if (typeof deps !== "object" || deps === null) continue;
+      for (const name of Object.keys(deps)) names.add(name);
+    }
+  }
+  return names;
+}
+function stripTrailingCommas(source) {
+  const out = [];
+  let inString = false;
+  let pendingComma = -1;
+  for (let i = 0; i < source.length; i++) {
+    const ch = source[i];
+    if (inString) {
+      out.push(ch);
+      if (ch === "\\") {
+        const next = source[i + 1];
+        if (next !== void 0) {
+          out.push(next);
+          i++;
+        }
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      pendingComma = -1;
+      out.push(ch);
+      continue;
+    }
+    if (ch === ",") {
+      pendingComma = out.length;
+      out.push(ch);
+      continue;
+    }
+    if (ch === "}" || ch === "]") {
+      if (pendingComma !== -1) out[pendingComma] = " ";
+      pendingComma = -1;
+      out.push(ch);
+      continue;
+    }
+    if (!/\s/.test(ch)) pendingComma = -1;
+    out.push(ch);
+  }
+  return out.join("");
+}
+
+// src/parsers/npm.ts
+import { readFile as readFile3 } from "fs/promises";
 import path2 from "path";
 async function parseNpmLockfile(lockfilePath) {
   let raw;
   try {
-    raw = await readFile2(lockfilePath, "utf8");
+    raw = await readFile3(lockfilePath, "utf8");
   } catch (cause) {
     throw new PatchstackError(`Could not read lockfile at ${lockfilePath}`, "LOCKFILE_NOT_FOUND", cause);
   }
@@ -140,8 +297,9 @@ function isDirectV2(pkgPath) {
 }
 
 // src/parsers/node_modules.ts
-import { lstat, readFile as readFile3, readdir, stat } from "fs/promises";
+import { lstat, readFile as readFile4, readdir, realpath, stat } from "fs/promises";
 import path3 from "path";
+var PACKAGE_STORE_DIRS = /* @__PURE__ */ new Set([".bun", ".pnpm", ".store"]);
 async function walkNodeModules(cwd) {
   const root = path3.join(cwd, "node_modules");
   try {
@@ -162,96 +320,122 @@ async function walkNodeModules(cwd) {
       cause
     );
   }
-  const entries = [];
-  await walk(root, entries, 0);
-  return entries;
+  const seen = /* @__PURE__ */ new Map();
+  try {
+    seen.set(await realpath(cwd), -1);
+  } catch {
+  }
+  return dedupeByShallowest(await walk(root, 0, seen));
+}
+function dedupeByShallowest(found) {
+  const best = /* @__PURE__ */ new Map();
+  for (const item of found) {
+    const current = best.get(item.realpath);
+    if (current === void 0 || item.depth < current.depth) best.set(item.realpath, item);
+  }
+  return [...best.values()].map(({ entry }) => entry);
 }
-async function walk(dir, acc, depth) {
+var CONCURRENCY = 32;
+async function walk(dir, depth, seen) {
   let names;
   try {
     names = await readdir(dir);
   } catch {
-    return;
+    return [];
   }
-  for (const name of names) {
-    if (name.startsWith(".")) {
-      continue;
-    }
+  const perEntry = await mapLimit(names, async (name) => {
+    if (name.startsWith(".") && !PACKAGE_STORE_DIRS.has(name)) return [];
     const fullPath = path3.join(dir, name);
-    if (!await isPlainDirectory(fullPath)) {
-      continue;
-    }
+    const resolved = await claim(fullPath, seen, depth);
+    if (resolved === null) return [];
+    if (PACKAGE_STORE_DIRS.has(name)) return walk(fullPath, depth, seen);
     if (name.startsWith("@")) {
       let subNames;
       try {
         subNames = await readdir(fullPath);
       } catch {
-        continue;
+        return [];
       }
-      for (const sub of subNames) {
-        if (sub.startsWith(".")) {
-          continue;
-        }
+      const scoped = await mapLimit(subNames, async (sub) => {
+        if (sub.startsWith(".")) return [];
         const scopedDir = path3.join(fullPath, sub);
-        if (!await isPlainDirectory(scopedDir)) {
-          continue;
-        }
-        await readPackage(scopedDir, depth, acc);
-        await walkNested(scopedDir, acc, depth);
-      }
-      continue;
+        const scopedReal = await claim(scopedDir, seen, depth);
+        if (scopedReal === null) return [];
+        return packageAndNested(scopedDir, scopedReal, depth, seen);
+      });
+      return scoped.flat();
     }
-    await readPackage(fullPath, depth, acc);
-    await walkNested(fullPath, acc, depth);
-  }
+    return packageAndNested(fullPath, resolved, depth, seen);
+  });
+  return perEntry.flat();
+}
+async function packageAndNested(pkgDir, resolved, depth, seen) {
+  const [own, nested] = await Promise.all([readPackage(pkgDir, depth), walkNested(pkgDir, depth, seen)]);
+  return own === null ? nested : [{ entry: own, realpath: resolved, depth }, ...nested];
 }
-async function readPackage(pkgDir, depth, acc) {
+async function mapLimit(items, fn) {
+  const results = new Array(items.length);
+  let next = 0;
+  const workers = Array.from({ length: Math.min(CONCURRENCY, items.length) }, async () => {
+    while (next < items.length) {
+      const index = next++;
+      results[index] = await fn(items[index]);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}
+async function readPackage(pkgDir, depth) {
   let raw;
   try {
-    raw = await readFile3(path3.join(pkgDir, "package.json"), "utf8");
+    raw = await readFile4(path3.join(pkgDir, "package.json"), "utf8");
   } catch {
-    return;
+    return null;
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    return;
+    return null;
   }
   if (typeof parsed.name !== "string" || parsed.name.length === 0) {
-    return;
+    return null;
   }
   if (typeof parsed.version !== "string" || parsed.version.length === 0) {
-    return;
+    return null;
   }
-  acc.push({
-    name: parsed.name,
-    version: parsed.version,
-    direct: depth === 0
-  });
+  return { name: parsed.name, version: parsed.version, direct: depth === 0 };
 }
-async function walkNested(pkgDir, acc, depth) {
+async function walkNested(pkgDir, depth, seen) {
   const nested = path3.join(pkgDir, "node_modules");
-  if (!await isPlainDirectory(nested)) {
-    return;
+  if (await claim(nested, seen, depth + 1) === null) {
+    return [];
   }
-  await walk(nested, acc, depth + 1);
+  return walk(nested, depth + 1, seen);
 }
-async function isPlainDirectory(dir) {
+async function claim(dir, seen, depth) {
+  let resolved;
   try {
     const info = await lstat(dir);
-    return info.isDirectory() && !info.isSymbolicLink();
+    if (!info.isDirectory() && !info.isSymbolicLink()) return null;
+    resolved = await realpath(dir);
+    const target = await stat(resolved);
+    if (!target.isDirectory()) return null;
   } catch {
-    return false;
+    return null;
   }
+  const claimed = seen.get(resolved);
+  if (claimed !== void 0 && claimed <= depth) return null;
+  seen.set(resolved, depth);
+  return resolved;
 }
 
 // src/parsers/pnpm.ts
-import { readFile as readFile4 } from "fs/promises";
-async function parsePnpmLockfile(lockfilePath) {
+import { readFile as readFile5 } from "fs/promises";
+async function parsePnpmLockfile(lockfilePath, report) {
   let raw;
   try {
-    raw = await readFile4(lockfilePath, "utf8");
+    raw = await readFile5(lockfilePath, "utf8");
   } catch (cause) {
     throw new PatchstackError(
       `Could not read lockfile at ${lockfilePath}`,
@@ -272,6 +456,7 @@ async function parsePnpmLockfile(lockfilePath) {
   for (const key of packageKeys) {
     const parsed = parsePackageKey(key);
     if (parsed === null) {
+      recordUnreadable(report, key);
       continue;
     }
     entries.push({
@@ -499,12 +684,12 @@ function extractLeafName(trimmed) {
 }
 
 // src/parsers/yarn.ts
-import { readFile as readFile5 } from "fs/promises";
+import { readFile as readFile6 } from "fs/promises";
 import path4 from "path";
-async function parseYarnLockfile(lockfilePath) {
+async function parseYarnLockfile(lockfilePath, report) {
   let raw;
   try {
-    raw = await readFile5(lockfilePath, "utf8");
+    raw = await readFile6(lockfilePath, "utf8");
   } catch (cause) {
     throw new PatchstackError(
       `Could not read lockfile at ${lockfilePath}`,
@@ -512,7 +697,7 @@ async function parseYarnLockfile(lockfilePath) {
       cause
     );
   }
-  const blocks = parseBlocks(raw);
+  const blocks = parseBlocks(raw, report);
   if (blocks.length === 0) {
     throw new PatchstackError(
       `Lockfile at ${lockfilePath} contains no package entries`,
@@ -541,13 +726,19 @@ async function parseYarnLockfile(lockfilePath) {
   }
   return entries;
 }
-function parseBlocks(raw) {
+var NON_PACKAGE_KEYS = /* @__PURE__ */ new Set(["__metadata"]);
+function parseBlocks(raw, report) {
   const lines = raw.split(/\r?\n/);
   const blocks = [];
   let current = null;
   const finalize = () => {
-    if (current !== null && current.version.length > 0 && current.names.size > 0) {
+    if (current === null) {
+      return;
+    }
+    if (current.version.length > 0 && current.names.size > 0) {
       blocks.push(current);
+    } else if (current.unreadable) {
+      recordUnreadable(report, current.key);
     }
     current = null;
   };
@@ -564,13 +755,13 @@ function parseBlocks(raw) {
       }
       const keyLine = trimmed.slice(0, -1);
       const names = /* @__PURE__ */ new Set();
+      let unreadable = false;
       for (const spec of splitDescriptors(keyLine)) {
-        const name = extractName(spec);
-        if (name !== null) {
-          names.add(name);
-        }
+        const classified = classifyDescriptor(spec);
+        if (classified.name !== void 0) names.add(classified.name);
+        else if (!classified.excluded) unreadable = true;
       }
-      current = { names, version: "" };
+      current = { names, version: "", key: keyLine, unreadable: unreadable && names.size === 0 };
       continue;
     }
     if (current === null) {
@@ -625,20 +816,37 @@ function splitDescriptors(keyLine) {
   }
   return parts;
 }
-function extractName(rawSpec) {
+var NON_REGISTRY_PROTOCOLS = /^(?:workspace|patch|virtual|portal|file|link|exec|git|github|https?|ssh):/i;
+function classifyDescriptor(rawSpec) {
   let s = rawSpec.trim();
   if (s.length === 0) {
-    return null;
+    return { excluded: true };
   }
   if (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'")) {
     s = s.slice(1, -1);
   }
-  const atIdx = s.lastIndexOf("@");
+  if (NON_PACKAGE_KEYS.has(s)) {
+    return { excluded: true };
+  }
+  const atIdx = s.indexOf("@", 1);
   if (atIdx <= 0) {
-    return null;
+    return {};
   }
   const name = s.slice(0, atIdx);
-  return name.length > 0 ? name : null;
+  const range = s.slice(atIdx + 1);
+  if (name.length === 0) {
+    return {};
+  }
+  if (NON_REGISTRY_PROTOCOLS.test(range)) {
+    return { excluded: true };
+  }
+  const alias = /^npm:(.+)$/i.exec(range);
+  if (alias !== null) {
+    const target = alias[1] ?? "";
+    const targetAt = target.indexOf("@", 1);
+    return { name: targetAt > 0 ? target.slice(0, targetAt) : name };
+  }
+  return { name };
 }
 function parseVersionField(content) {
   if (!content.startsWith("version")) {
@@ -663,7 +871,7 @@ async function readDirectDepNames(cwd) {
   const names = /* @__PURE__ */ new Set();
   let raw;
   try {
-    raw = await readFile5(path4.join(cwd, "package.json"), "utf8");
+    raw = await readFile6(path4.join(cwd, "package.json"), "utf8");
   } catch {
     return names;
   }
@@ -692,7 +900,10 @@ async function readDirectDepNames(cwd) {
 // src/parsers/index.ts
 var LOCKFILE_CANDIDATES = [
   { filename: "package-lock.json", strategy: "npm-lockfile" },
-  { filename: "bun.lock", strategy: "node-modules-walk" },
+  // Read directly, not walked. Bun's isolated layout puts packages under a dot-directory and makes the
+  // top level symlinks into it, so a `node_modules` walk finds nothing there — and isolated is the default
+  // for new workspaces.
+  { filename: "bun.lock", strategy: "bun-lockfile" },
   { filename: "bun.lockb", strategy: "node-modules-walk" },
   { filename: "pnpm-lock.yaml", strategy: "pnpm-lockfile" },
   { filename: "yarn.lock", strategy: "yarn-lockfile" }
@@ -727,33 +938,57 @@ async function scanLockfile(cwd) {
   const declared = await readDeclaredDependencyNames(cwd);
   const warnings = [];
   let firstParsed = null;
-  let walkTried = false;
+  let walked = null;
+  let walkWasCandidate = false;
+  const parsedSources = [];
   for (const candidate of candidates) {
     let packages;
+    const report = newReport();
     try {
-      packages = await runStrategy(candidate, cwd);
+      packages = await runStrategy(candidate, cwd, report);
     } catch {
       continue;
     }
-    walkTried ||= candidate.strategy === "node-modules-walk";
+    const unreadable = unreadableWarning(candidate.filename, report);
+    if (unreadable !== null) warnings.push(unreadable);
+    if (candidate.strategy === "node-modules-walk") {
+      walked = packages;
+      walkWasCandidate = true;
+    }
     firstParsed ??= { packages, filename: candidate.filename };
-    const missing = missingDependencies(declared, packages);
-    if (missing.length === 0) {
-      return manifestWith(packages, warnings);
+    parsedSources.push({ packages, filename: candidate.filename });
+  }
+  for (const source of parsedSources) {
+    const missing = missingDependencies(declared, source.packages);
+    if (missing.length > 0) {
+      warnings.push(staleWarning(source.filename, missing));
+      continue;
+    }
+    const conflicts = otherCompleteSources(parsedSources, source, declared).flatMap(
+      (other) => disagreements(source.packages, other.packages).map((conflict) => ({ other: other.filename, conflict }))
+    );
+    if (conflicts.length === 0) {
+      return manifestWith(source.packages, warnings);
     }
-    warnings.push(staleWarning(candidate.filename, missing));
+    warnings.push(conflictWarning(source.filename, conflicts));
+    break;
   }
-  if (!walkTried) {
+  if (walked === null) {
     try {
-      const packages = await walkNodeModules(cwd);
-      const missing = missingDependencies(declared, packages);
-      if (missing.length > 0) {
-        warnings.push(staleWarning("node_modules/", missing));
-      }
-      warnings.push("Scanned node_modules/ instead. Delete the stale lockfile to silence this warning.");
-      return manifestWith(packages, warnings);
+      walked = await walkNodeModules(cwd);
     } catch {
+      walked = null;
+    }
+  }
+  if (walked !== null) {
+    const missing = missingDependencies(declared, walked);
+    if (missing.length > 0) {
+      warnings.push(staleWarning("node_modules/", missing));
     }
+    warnings.push(
+      walkWasCandidate ? "Reporting node_modules/, which is what the build loads." : "Scanned node_modules/ instead. Delete the stale lockfile to silence this warning."
+    );
+    return manifestWith(walked, warnings);
   }
   if (firstParsed === null) {
     const expected = LOCKFILE_CANDIDATES.map((candidate) => candidate.filename).join(", ");
@@ -770,6 +1005,15 @@ async function scanLockfile(cwd) {
 function manifestWith(packages, warnings) {
   return warnings.length > 0 ? { ecosystem: "npm", packages, warnings } : { ecosystem: "npm", packages };
 }
+function otherCompleteSources(all, current, declared) {
+  return all.filter(
+    (source) => source.filename !== current.filename && missingDependencies(declared, source.packages).length === 0
+  );
+}
+function conflictWarning(filename, conflicts) {
+  const shown = conflicts.slice(0, 3).map(({ other, conflict }) => `${conflict.name} ${conflict.version} vs ${conflict.otherVersion} in ${other}`).join("; ");
+  return `${filename} and another lockfile disagree about installed versions (${shown}${conflicts.length > 3 ? `, +${conflicts.length - 3} more` : ""}). Scanned node_modules/ instead. Remove whichever lockfile your package manager does not maintain.`;
+}
 function staleWarning(source, missing) {
   const sample = missing.slice(0, 3).join(", ");
   const suffix = missing.length > 3 ? `, +${missing.length - 3} more` : "";
@@ -784,14 +1028,18 @@ async function presentLockfiles(cwd) {
   );
   return probed.filter((candidate) => candidate.present).map(({ filename, strategy, filePath }) => ({ ecosystem: "npm", filename, strategy, filePath }));
 }
-async function runStrategy(detected, cwd) {
+async function runStrategy(detected, cwd, report) {
   switch (detected.strategy) {
     case "npm-lockfile":
       return parseNpmLockfile(detected.filePath);
+    case "bun-lockfile":
+      return parseBunLockfile(detected.filePath, report);
+    // The hand-written scanners. Each meets entries it was not written for, and each is asked to say how
+    // many it dropped, because a manifest short a package reads exactly like a project without it.
     case "pnpm-lockfile":
-      return parsePnpmLockfile(detected.filePath);
+      return parsePnpmLockfile(detected.filePath, report);
     case "yarn-lockfile":
-      return parseYarnLockfile(detected.filePath);
+      return parseYarnLockfile(detected.filePath, report);
     case "node-modules-walk":
       return walkNodeModules(cwd);
   }
@@ -1084,12 +1332,14 @@ function isTimeoutError(cause) {
 }
 
 // src/config.ts
-import { readFile as readFile6, writeFile } from "fs/promises";
+import { readFile as readFile7, writeFile, chmod } from "fs/promises";
 import path6 from "path";
 var CONFIG_FILENAME = ".patchstackrc.json";
+var SECRET_FILENAME = ".patchstackrc.local.json";
 var DEFAULT_ENVIRONMENT = "production";
 async function resolveConfig(options) {
   const fromFile = await readConfigFile(options.cwd);
+  const fromSecretFile = await readSecretFile(options.cwd);
   const fromEnv = readEnv();
   const siteUuid = options.cliSiteUuid ?? fromEnv.siteUuid ?? fromFile.siteUuid ?? null;
   const endpoint = options.cliEndpoint ?? fromEnv.endpoint ?? fromFile.endpoint ?? DEFAULT_ENDPOINT;
@@ -1114,8 +1364,8 @@ async function resolveConfig(options) {
       "CONFIG_MISSING"
     );
   }
-  const apiKeyRaw = fromEnv.apiKey ?? fromFile.apiKey ?? null;
-  const pulseAuthRaw = fromEnv.pulseAuth ?? fromFile.pulseAuth ?? apiKeyRaw;
+  const apiKeyRaw = fromEnv.apiKey ?? fromSecretFile.apiKey ?? fromFile.apiKey ?? null;
+  const pulseAuthRaw = fromEnv.pulseAuth ?? fromSecretFile.pulseAuth ?? fromFile.pulseAuth ?? apiKeyRaw;
   return {
     siteUuid: siteUuid === null || siteUuid.length === 0 ? null : siteUuid,
     apiKey: apiKeyRaw === null || apiKeyRaw.length === 0 ? null : apiKeyRaw,
@@ -1132,23 +1382,88 @@ async function writeConfigFile(cwd, config) {
   await writeFile(target, content, "utf8");
   return target;
 }
+async function writeSecretFile(cwd, secrets) {
+  const target = path6.join(cwd, SECRET_FILENAME);
+  await writeFile(target, JSON.stringify(secrets, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+  try {
+    await chmod(target, 384);
+  } catch {
+  }
+  const ignore = await ensureIgnored(cwd, SECRET_FILENAME);
+  return { path: target, ...ignore };
+}
+async function ensureIgnored(cwd, entry) {
+  const target = path6.join(cwd, ".gitignore");
+  let existing = "";
+  try {
+    existing = await readFile7(target, "utf8");
+  } catch (err) {
+    const code = err.code;
+    if (code !== "ENOENT") {
+      return { ignored: false, reason: `.gitignore could not be read (${code ?? "unknown error"})` };
+    }
+  }
+  if (ignoresEntry(existing, entry)) return { ignored: true };
+  const separator = existing === "" || existing.endsWith("\n") ? "" : "\n";
+  const block = `${separator}
+# Patchstack credential \u2014 never commit this
+${entry}
+`;
+  try {
+    await writeFile(target, existing + block, "utf8");
+  } catch (err) {
+    const code = err.code;
+    return { ignored: false, reason: `.gitignore could not be written (${code ?? "unknown error"})` };
+  }
+  try {
+    const written = await readFile7(target, "utf8");
+    if (ignoresEntry(written, entry)) return { ignored: true };
+    return { ignored: false, reason: ".gitignore does not cover the file after writing it" };
+  } catch (err) {
+    const code = err.code;
+    return { ignored: false, reason: `.gitignore could not be read back (${code ?? "unknown error"})` };
+  }
+}
+function ignoresEntry(contents, entry) {
+  let ignored = false;
+  for (const raw of contents.split("\n")) {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    const negated = line.startsWith("!");
+    const pattern = negated ? line.slice(1).trim() : line;
+    if (pattern === entry || pattern === `/${entry}`) ignored = !negated;
+  }
+  return ignored;
+}
 async function persistSiteUuid(cwd, siteUuid) {
   const existing = await readConfigFile(cwd);
   return writeConfigFile(cwd, { ...existing, siteUuid });
 }
 async function persistApiKey(cwd, apiKey) {
-  const { pulseAuth: _dropped, ...existing } = await readConfigFile(cwd);
-  return writeConfigFile(cwd, { ...existing, apiKey });
+  const { apiKey: _movedKey, pulseAuth: _movedPulse, ...publicConfig } = await readConfigFile(cwd);
+  const existingSecrets = await readSecretFile(cwd);
+  const target = await writeSecretFile(cwd, { ...existingSecrets, apiKey, pulseAuth: void 0 });
+  if (_movedKey !== void 0 || _movedPulse !== void 0) {
+    await writeConfigFile(cwd, publicConfig);
+  }
+  return target;
 }
 async function persistPulseAuth(cwd, pulseAuth) {
-  const existing = await readConfigFile(cwd);
-  return writeConfigFile(cwd, { ...existing, pulseAuth });
+  const existing = await readSecretFile(cwd);
+  return writeSecretFile(cwd, { ...existing, pulseAuth });
+}
+async function readSecretFile(cwd) {
+  const file = await readJsonFile(cwd, SECRET_FILENAME);
+  return { apiKey: file.apiKey, pulseAuth: file.pulseAuth };
 }
 async function readConfigFile(cwd) {
-  const target = path6.join(cwd, CONFIG_FILENAME);
+  return readJsonFile(cwd, CONFIG_FILENAME);
+}
+async function readJsonFile(cwd, filename) {
+  const target = path6.join(cwd, filename);
   let raw;
   try {
-    raw = await readFile6(target, "utf8");
+    raw = await readFile7(target, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return {};