@planu/cli 4.13.0 → 5.0.0

package/dist/resources/usage-stats-resource.js

@@ -4,8 +4,6 @@
 import { usageStore } from '../storage/index.js';
 import { filterEventsByPeriod } from '../engine/usage-tracker/core.js';
 import { calculateUsageStats } from '../engine/usage-tracker/stats.js';
-import { calculateDaysSinceFirstRun, isTrialActive } from '../engine/usage-tracker/trial.js';
-import { getCurrentTier } from '../tools/license-gate.js';
 import { estimateTokenSavings } from '../engine/token-savings-estimator.js';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
@@ -15,22 +13,10 @@ import { join } from 'node:path';
  */
 export async function handleUsageStatsResource() {
     const period = '30d';
-    const tier = await getCurrentTier();
     const usageLog = await usageStore.getUsageLog();
-    const trialState = await usageStore.ensureTrialState();
-    const today = new Date().toISOString().slice(0, 10);
-    const todayCount = await usageStore.getDailyCallCount(today);
-    const daysSinceFirstRun = calculateDaysSinceFirstRun(trialState.firstRunAt);
-    const trialActive = isTrialActive(trialState.firstRunAt);
-    let remainingDailyCalls = -1;
-    if (tier === 'free') {
-        const dailyLimit = trialActive ? 50 : 30;
-        remainingDailyCalls = Math.max(0, dailyLimit - todayCount);
-    }
     const filteredEvents = filterEventsByPeriod(usageLog.events, period);
     const stats = calculateUsageStats(filteredEvents, 0, // activeSpecs — placeholder, no cross-layer access to spec store
-    0, // activeProjects — placeholder
-    tier, daysSinceFirstRun, trialActive, remainingDailyCalls);
+    0);
     const projectPath = process.cwd();
     const hasRules = existsSync(join(projectPath, '.claude/rules/planu-response-style.md'));
     const tokenSavings = estimateTokenSavings({
@@ -41,8 +27,6 @@ export async function handleUsageStatsResource() {
     return JSON.stringify({
         period,
         generatedAt: new Date().toISOString(),
-        tier,
-        trialActive,
         ...stats,
         tokenSavings,
     }, null, 2);
@@ -50,7 +34,7 @@ export async function handleUsageStatsResource() {
 export const usageStatsResourceDefinition = {
     uri: 'planu://usage/stats',
     name: 'Usage Stats',
-    description: 'Aggregated usage statistics for the last 30 days: tool call counts, tier info, trial status. ' +
+    description: 'Aggregated local usage statistics for the last 30 days: tool call counts and health. ' +
         'Read-only. For custom periods use the usage_stats tool.',
     mimeType: 'application/json',
 };

package/dist/security/adapters/environment.d.ts

@@ -0,0 +1,12 @@
+import type { SecretStoreAdapter } from '../../types/security.js';
+/** Explicit, read-only adapter. IDs must be mapped to named process environment variables. */
+export declare class EnvironmentSecretAdapter implements SecretStoreAdapter {
+    private readonly variables;
+    private readonly env;
+    readonly kind: 'environment';
+    constructor(variables: Readonly<Record<string, string>>, env?: NodeJS.ProcessEnv);
+    get(id: string): Promise<string | null>;
+    set(_id: string, _value: string): Promise<void>;
+    delete(_id: string): Promise<void>;
+}
+//# sourceMappingURL=environment.d.ts.map

package/dist/security/adapters/environment.js

@@ -0,0 +1,25 @@
+/** Explicit, read-only adapter. IDs must be mapped to named process environment variables. */
+export class EnvironmentSecretAdapter {
+    variables;
+    env;
+    kind = 'environment';
+    constructor(variables, env = process.env) {
+        this.variables = variables;
+        this.env = env;
+    }
+    get(id) {
+        const variable = this.variables[id];
+        if (!variable) {
+            return Promise.resolve(null);
+        }
+        const value = this.env[variable];
+        return Promise.resolve(value?.trim() ? value : null);
+    }
+    set(_id, _value) {
+        return Promise.reject(new Error('[Planu] Environment secret adapter is read-only'));
+    }
+    delete(_id) {
+        return Promise.reject(new Error('[Planu] Environment secret adapter is read-only'));
+    }
+}
+//# sourceMappingURL=environment.js.map

package/dist/security/adapters/linux-secret-service.d.ts

@@ -0,0 +1,8 @@
+import type { SecretStoreAdapter } from '../../types/security.js';
+export declare class LinuxSecretServiceAdapter implements SecretStoreAdapter {
+    readonly kind: 'linux-secret-service';
+    get(id: string): Promise<string | null>;
+    set(id: string, value: string): Promise<void>;
+    delete(id: string): Promise<void>;
+}
+//# sourceMappingURL=linux-secret-service.d.ts.map

package/dist/security/adapters/linux-secret-service.js

@@ -0,0 +1,64 @@
+import { execFile as execFileCallback, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+const execFile = promisify(execFileCallback);
+const TIMEOUT_MS = 10_000;
+async function storeWithSecretTool(id, value) {
+    await new Promise((resolve, reject) => {
+        const child = spawn('secret-tool', ['store', '--label=Planu', 'planu-id', id], {
+            stdio: ['pipe', 'ignore', 'pipe'],
+        });
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            reject(new Error('[Planu] Secret Service operation timed out'));
+        }, TIMEOUT_MS);
+        child.stderr.resume();
+        child.once('error', (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.once('close', (code) => {
+            clearTimeout(timer);
+            if (code === 0) {
+                resolve();
+            }
+            else {
+                reject(new Error(`[Planu] Secret Service store failed (${String(code)})`));
+            }
+        });
+        child.stdin.end(value);
+    });
+}
+export class LinuxSecretServiceAdapter {
+    kind = 'linux-secret-service';
+    async get(id) {
+        try {
+            const result = await execFile('secret-tool', ['lookup', 'planu-id', id], {
+                timeout: TIMEOUT_MS,
+            });
+            return result.stdout.trim() || null;
+        }
+        catch (error) {
+            const failure = error;
+            if ((failure.code === 1 || failure.code === '1') &&
+                (failure.stderr === undefined ||
+                    (typeof failure.stderr === 'string' && failure.stderr.trim().length === 0))) {
+                return null;
+            }
+            throw error;
+        }
+    }
+    async set(id, value) {
+        await storeWithSecretTool(id, value);
+    }
+    async delete(id) {
+        try {
+            await execFile('secret-tool', ['clear', 'planu-id', id], { timeout: TIMEOUT_MS });
+        }
+        catch (error) {
+            // reliability-cleanup: LINUX_SECRET_DELETE — deletion is idempotent
+            reportClassifiedDegradation('LINUX_SECRET_DELETE', error);
+        }
+    }
+}
+//# sourceMappingURL=linux-secret-service.js.map

package/dist/security/adapters/macos-keychain.d.ts

@@ -0,0 +1,18 @@
+import type { MacOSKeychainNativePort, MacOSKeychainOperation, SecretStoreAdapter } from '../../types/security.js';
+export declare class MacOSKeychainOperationError extends Error {
+    readonly code: 'KEYCHAIN_TIMEOUT' | 'KEYCHAIN_OUTCOME_UNKNOWN';
+    constructor(code: 'KEYCHAIN_TIMEOUT' | 'KEYCHAIN_OUTCOME_UNKNOWN', operation: MacOSKeychainOperation);
+}
+export declare class MacOSKeychainAdapter implements SecretStoreAdapter {
+    private readonly nativePort;
+    private readonly timeoutMs;
+    readonly kind: 'macos-keychain';
+    private readonly pending;
+    private nextFence;
+    constructor(nativePort?: () => MacOSKeychainNativePort, timeoutMs?: number);
+    get(id: string): Promise<string | null>;
+    set(id: string, value: string): Promise<void>;
+    delete(id: string): Promise<void>;
+    private enqueue;
+}
+//# sourceMappingURL=macos-keychain.d.ts.map

package/dist/security/adapters/macos-keychain.js

@@ -0,0 +1,90 @@
+import { requireMacOSKeychainNativePort } from '../../engine/core-bridge.js';
+const TIMEOUT_MS = 10_000;
+const decoder = new TextDecoder('utf-8', { fatal: true });
+export class MacOSKeychainOperationError extends Error {
+    code;
+    constructor(code, operation) {
+        super(code === 'KEYCHAIN_OUTCOME_UNKNOWN'
+            ? `[Planu] macOS Keychain ${operation} timed out; outcome is unknown`
+            : `[Planu] macOS Keychain ${operation} timed out`);
+        this.code = code;
+        this.name = 'MacOSKeychainOperationError';
+    }
+}
+export class MacOSKeychainAdapter {
+    nativePort;
+    timeoutMs;
+    kind = 'macos-keychain';
+    pending = new Map();
+    nextFence = 0;
+    constructor(nativePort = requireMacOSKeychainNativePort, timeoutMs = TIMEOUT_MS) {
+        this.nativePort = nativePort;
+        this.timeoutMs = timeoutMs;
+        if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1) {
+            throw new Error('[Planu] macOS Keychain timeout must be a positive integer');
+        }
+    }
+    get(id) {
+        return this.enqueue(id, 'get', false, async () => {
+            const secret = await this.nativePort().get(id);
+            if (secret === null) {
+                return null;
+            }
+            try {
+                return decoder.decode(secret);
+            }
+            finally {
+                secret.fill(0);
+            }
+        });
+    }
+    set(id, value) {
+        return this.enqueue(id, 'set', true, () => {
+            const secret = Buffer.from(value, 'utf8');
+            try {
+                return this.nativePort().set(id, secret);
+            }
+            finally {
+                secret.fill(0);
+            }
+        });
+    }
+    delete(id) {
+        return this.enqueue(id, 'delete', true, () => this.nativePort().delete(id));
+    }
+    enqueue(id, operation, mutates, execute) {
+        const predecessor = this.pending.get(id)?.settled ?? Promise.resolve();
+        const fence = (this.nextFence += 1);
+        let dispatched = false;
+        let timedOut = false;
+        let timer;
+        const underlying = predecessor.then(() => {
+            if (timedOut) {
+                throw new MacOSKeychainOperationError('KEYCHAIN_TIMEOUT', operation);
+            }
+            dispatched = true;
+            return execute();
+        });
+        const settled = underlying.then(() => undefined, () => undefined);
+        this.pending.set(id, { fence, settled });
+        void settled.then(() => {
+            if (this.pending.get(id)?.fence === fence) {
+                this.pending.delete(id);
+            }
+        });
+        const timeout = new Promise((_resolve, reject) => {
+            timer = setTimeout(() => {
+                timedOut = true;
+                reject(new MacOSKeychainOperationError(mutates && dispatched ? 'KEYCHAIN_OUTCOME_UNKNOWN' : 'KEYCHAIN_TIMEOUT', operation));
+            }, this.timeoutMs);
+            timer.unref();
+        });
+        void underlying.then(() => {
+            clearTimeout(timer);
+        }, () => {
+            clearTimeout(timer);
+        });
+        return Promise.race([underlying, timeout]);
+    }
+}
+//# sourceMappingURL=macos-keychain.js.map

package/dist/security/adapters/windows-credential-manager.d.ts

@@ -0,0 +1,8 @@
+import type { SecretStoreAdapter } from '../../types/security.js';
+export declare class WindowsCredentialManagerAdapter implements SecretStoreAdapter {
+    readonly kind: 'windows-credential-manager';
+    get(id: string): Promise<string | null>;
+    set(id: string, value: string): Promise<void>;
+    delete(id: string): Promise<void>;
+}
+//# sourceMappingURL=windows-credential-manager.d.ts.map

package/dist/security/adapters/windows-credential-manager.js

@@ -0,0 +1,60 @@
+import { execFile as execFileCallback, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+const execFile = promisify(execFileCallback);
+const TIMEOUT_MS = 10_000;
+const GET_SCRIPT = "$v=New-Object Windows.Security.Credentials.PasswordVault;try{$c=$v.Retrieve('Planu',$args[0]);$c.RetrievePassword();[Console]::Out.Write($c.Password)}catch{if($_.Exception.HResult -eq -2147023728){exit 3};throw}";
+const SET_SCRIPT = "$v=New-Object Windows.Security.Credentials.PasswordVault;$p=[Console]::In.ReadToEnd();$v.Add((New-Object Windows.Security.Credentials.PasswordCredential('Planu',$args[0],$p)))";
+const DELETE_SCRIPT = "$v=New-Object Windows.Security.Credentials.PasswordVault;$c=$v.Retrieve('Planu',$args[0]);$v.Remove($c)";
+async function storeWithoutArgv(id, value) {
+    await new Promise((resolve, reject) => {
+        const child = spawn('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', SET_SCRIPT, id], { stdio: ['pipe', 'ignore', 'ignore'] });
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            reject(new Error('[Planu] Credential Manager operation timed out'));
+        }, TIMEOUT_MS);
+        child.once('error', (error) => {
+            clearTimeout(timer);
+            reject(new Error(`[Planu] Credential Manager store failed: ${error.name}`));
+        });
+        child.once('close', (code) => {
+            clearTimeout(timer);
+            if (code === 0) {
+                resolve();
+            }
+            else {
+                reject(new Error(`[Planu] Credential Manager store failed (${String(code)})`));
+            }
+        });
+        child.stdin.end(value);
+    });
+}
+export class WindowsCredentialManagerAdapter {
+    kind = 'windows-credential-manager';
+    async get(id) {
+        try {
+            const result = await execFile('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', GET_SCRIPT, id], { timeout: TIMEOUT_MS });
+            return result.stdout || null;
+        }
+        catch (error) {
+            const failure = error;
+            if (failure.code === 3 || failure.code === '3') {
+                return null;
+            }
+            throw error;
+        }
+    }
+    async set(id, value) {
+        await storeWithoutArgv(id, value);
+    }
+    async delete(id) {
+        try {
+            await execFile('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', DELETE_SCRIPT, id], { timeout: TIMEOUT_MS });
+        }
+        catch (error) {
+            // reliability-cleanup: WINDOWS_SECRET_DELETE — deletion is idempotent
+            reportClassifiedDegradation('WINDOWS_SECRET_DELETE', error);
+        }
+    }
+}
+//# sourceMappingURL=windows-credential-manager.js.map

package/dist/security/redactor.d.ts

@@ -0,0 +1,5 @@
+/** Redact sensitive substrings without mutating the input string. */
+export declare function redactText(value: string): string;
+/** Return a detached, redacted representation. Unsupported or cyclic values fail closed. */
+export declare function redactSensitiveValue(value: unknown): unknown;
+//# sourceMappingURL=redactor.d.ts.map

package/dist/security/redactor.js

@@ -0,0 +1,58 @@
+const REDACTED = '[REDACTED]';
+import { emitClassifiedDegradation } from '../errors/degradation-sink.js';
+const SENSITIVE_KEY = /(?:api[-_]?key|token|authorization|client[-_]?secret|license[-_]?key|password|private[-_]?key|seed|mnemonic|service[-_]?role|webhook[-_]?(?:url|secret)|dsn)/iu;
+const TEXT_PATTERNS = [
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gu,
+    /\b(?:eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})\b/gu,
+    /\b(?:sk|ghp|github_pat|xox[baprs])[-_A-Za-z0-9]{12,}\b/gu,
+    /(?:\/Users\/|\/home\/)[^/\s]+/gu,
+    /[A-Za-z]:\\Users\\[^\\\s]+/gu,
+    /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/giu,
+    /\b(?:api[-_]?key|token|authorization|client[-_]?secret|license[-_]?key|password|private[-_]?key|seed|mnemonic|service[-_]?role|webhook[-_]?(?:url|secret)|dsn)\s*[:=]\s*[^\s,;]+/giu,
+];
+/** Redact sensitive substrings without mutating the input string. */
+export function redactText(value) {
+    return TEXT_PATTERNS.reduce((current, pattern) => current.replace(pattern, REDACTED), value);
+}
+function redactRecord(value, seen) {
+    const output = {};
+    for (const [key, entry] of Object.entries(value)) {
+        output[key] = SENSITIVE_KEY.test(key) ? REDACTED : redactUnknown(entry, seen);
+    }
+    return output;
+}
+function redactUnknown(value, seen) {
+    if (typeof value === 'string') {
+        return redactText(value);
+    }
+    if (value === null || typeof value === 'number' || typeof value === 'boolean') {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        if (seen.has(value)) {
+            return REDACTED;
+        }
+        seen.add(value);
+        return value.map((entry) => redactUnknown(entry, seen));
+    }
+    if (typeof value === 'object') {
+        if (seen.has(value)) {
+            return REDACTED;
+        }
+        seen.add(value);
+        return redactRecord(value, seen);
+    }
+    return REDACTED;
+}
+/** Return a detached, redacted representation. Unsupported or cyclic values fail closed. */
+export function redactSensitiveValue(value) {
+    try {
+        return redactUnknown(value, new WeakSet());
+    }
+    catch {
+        // reliability-cleanup: REDACTION_FALLBACK — unsupported hostile values stay hidden
+        emitClassifiedDegradation('REDACTION_FALLBACK', REDACTED);
+        return REDACTED;
+    }
+}
+//# sourceMappingURL=redactor.js.map

package/dist/security/secret-field.d.ts

@@ -0,0 +1,5 @@
+import type { SecretPurpose } from '../types/security.js';
+export declare function storeSecretField(id: string, purpose: SecretPurpose, value: string): Promise<string>;
+export declare function resolveSecretField(value: string): Promise<string>;
+export declare function deleteSecretField(value: string | undefined): Promise<void>;
+//# sourceMappingURL=secret-field.d.ts.map

package/dist/security/secret-field.js

@@ -0,0 +1,17 @@
+import { formatSecretReference, getSecretProvider, parseSecretReference, } from './secret-provider.js';
+export async function storeSecretField(id, purpose, value) {
+    const provider = getSecretProvider();
+    const reference = provider.reference(id, purpose);
+    await provider.store(reference, value);
+    return formatSecretReference(reference);
+}
+export async function resolveSecretField(value) {
+    return getSecretProvider().resolve(parseSecretReference(value));
+}
+export async function deleteSecretField(value) {
+    if (value === undefined) {
+        return;
+    }
+    await getSecretProvider().delete(parseSecretReference(value));
+}
+//# sourceMappingURL=secret-field.js.map

package/dist/security/secret-migration.d.ts

@@ -0,0 +1,3 @@
+import type { SecretMigrationOptions, SecretMigrationReport, SecretMigrationTarget } from '../types/security.js';
+export declare function migrateSecrets(targets: readonly SecretMigrationTarget[], options: SecretMigrationOptions): Promise<SecretMigrationReport>;
+//# sourceMappingURL=secret-migration.d.ts.map

package/dist/security/secret-migration.js

@@ -0,0 +1,123 @@
+import { readFile, readdir, unlink } from 'node:fs/promises';
+import { dirname, basename, join } from 'node:path';
+import { formatSecretReference, isSecretReference } from './secret-provider.js';
+import { writeSecureJson } from './secure-json.js';
+function readAtPath(root, path) {
+    let current = root;
+    for (const segment of path) {
+        if (current === null || typeof current !== 'object' || !(segment in current)) {
+            return undefined;
+        }
+        current = current[segment];
+    }
+    return current;
+}
+function writeAtPath(root, path, value) {
+    if (path.length === 0) {
+        throw new Error('[Planu] Secret migration path cannot be empty');
+    }
+    let current = root;
+    for (const segment of path.slice(0, -1)) {
+        if (current === null || typeof current !== 'object') {
+            throw new Error('[Planu] Secret migration path is invalid');
+        }
+        current = current[segment];
+    }
+    if (current === null || typeof current !== 'object') {
+        throw new Error('[Planu] Secret migration path is invalid');
+    }
+    const leaf = path[path.length - 1];
+    if (leaf === undefined) {
+        throw new Error('[Planu] Secret migration path cannot be empty');
+    }
+    current[leaf] = value;
+}
+async function removePlaintextBackups(sourcePath) {
+    const directory = dirname(sourcePath);
+    const fileName = basename(sourcePath);
+    const prefix = `${fileName}.bak.`;
+    const jsonStem = fileName.endsWith('.json') ? fileName.slice(0, -'.json'.length) : fileName;
+    let entries;
+    try {
+        entries = await readdir(directory);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            entries = [];
+        }
+        else {
+            throw error;
+        }
+    }
+    await Promise.all(entries
+        .filter((entry) => entry === `${fileName}.bak` ||
+        (entry.startsWith(prefix) && /^\d+$/u.test(entry.slice(prefix.length))) ||
+        (entry.startsWith(`${jsonStem}.backup-`) && entry.endsWith('.json')))
+        .map((entry) => unlink(join(directory, entry))));
+}
+export async function migrateSecrets(targets, options) {
+    const findings = [];
+    for (const target of targets) {
+        let document;
+        try {
+            document = JSON.parse(await readFile(target.sourcePath, 'utf8'));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                continue;
+            }
+            throw new Error('[Planu] Secret migration source is invalid', { cause: error });
+        }
+        let changed = false;
+        let hasSecureReference = false;
+        for (const binding of target.bindings) {
+            const existing = readAtPath(document, binding.jsonPath);
+            const destination = formatSecretReference(options.provider.reference(binding.secretId, binding.purpose));
+            if (isSecretReference(existing)) {
+                hasSecureReference = true;
+                findings.push({
+                    sourcePath: target.sourcePath,
+                    destination,
+                    jsonPath: binding.jsonPath.join('.'),
+                    state: 'already-secure',
+                });
+            }
+            else if (typeof existing !== 'string' || !existing.trim()) {
+                findings.push({
+                    sourcePath: target.sourcePath,
+                    destination,
+                    jsonPath: binding.jsonPath.join('.'),
+                    state: 'missing',
+                });
+            }
+            else {
+                findings.push({
+                    sourcePath: target.sourcePath,
+                    destination,
+                    jsonPath: binding.jsonPath.join('.'),
+                    state: options.mode === 'apply' ? 'migrated' : 'pending',
+                });
+                if (options.mode === 'apply') {
+                    const reference = options.provider.reference(binding.secretId, binding.purpose);
+                    await options.provider.store(reference, existing);
+                    writeAtPath(document, binding.jsonPath, destination);
+                    changed = true;
+                    hasSecureReference = true;
+                    await writeSecureJson(options.journalPath, { schemaVersion: 1, findings });
+                }
+            }
+        }
+        if (options.mode === 'apply' && changed) {
+            await writeSecureJson(target.sourcePath, document);
+        }
+        if (options.mode === 'apply' && hasSecureReference) {
+            await removePlaintextBackups(target.sourcePath);
+        }
+    }
+    const report = { schemaVersion: 1, mode: options.mode, findings };
+    if (options.mode === 'apply') {
+        await writeSecureJson(options.journalPath, report);
+    }
+    return report;
+}
+//# sourceMappingURL=secret-migration.js.map

package/dist/security/secret-provider.d.ts

@@ -0,0 +1,23 @@
+import type { SecretPurpose, SecretReference, SecretStoreAdapter } from '../types/security.js';
+export { EnvironmentSecretAdapter } from './adapters/environment.js';
+export declare class SecretProviderError extends Error {
+    readonly code: 'SECRET_REFERENCE_INVALID' | 'SECRET_NOT_FOUND' | 'SECRET_VERIFY_FAILED';
+    constructor(code: 'SECRET_REFERENCE_INVALID' | 'SECRET_NOT_FOUND' | 'SECRET_VERIFY_FAILED');
+}
+export declare function formatSecretReference(reference: SecretReference): string;
+export declare function parseSecretReference(value: string): SecretReference;
+export declare function isSecretReference(value: unknown): value is string;
+export declare class SecretProvider {
+    readonly adapter: SecretStoreAdapter;
+    constructor(adapter: SecretStoreAdapter);
+    reference(id: string, purpose: SecretPurpose): SecretReference;
+    store(reference: SecretReference, value: string): Promise<void>;
+    resolve(reference: SecretReference): Promise<string>;
+    delete(reference: SecretReference): Promise<void>;
+    private assertOwned;
+}
+export declare function getSecretProvider(): SecretProvider;
+/** Explicitly configure a provider (including the environment adapter) before secret access. */
+export declare function configureSecretProvider(provider: SecretProvider): void;
+export declare function resetSecretProviderForTests(): void;
+//# sourceMappingURL=secret-provider.d.ts.map