@warlock.js/core 5.32.0 → 5.34.0

package/esm/secrets/file-backend.mjs

@@ -0,0 +1,167 @@
+import { SecretStoreError } from "./errors.mjs";
+import { registerLogSecret } from "@warlock.js/logger";
+import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes } from "node:crypto";
+import path from "node:path";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, rename, unlink } from "node:fs/promises";
+
+//#region ../../packages/core/src/secrets/file-backend.ts
+function digest(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
+function isMissing(error) {
+	return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+/** One authenticated file per secret: concurrent writes to different keys cannot clobber each other. */
+var FileSecretBackend = class {
+	constructor(directory, encryptionKey) {
+		this.directory = directory;
+		this.encryptionKey = encryptionKey;
+	}
+	key(namespace) {
+		const secret = this.encryptionKey();
+		if (typeof secret !== "string" || !/^[a-f\d]{64}$/i.test(secret)) throw new SecretStoreError("KEY_REQUIRED");
+		registerLogSecret(secret, ["encryptionKey"]);
+		return Buffer.from(hkdfSync("sha256", Buffer.from(secret, "hex"), namespace, "warlock:secrets:v1", 32));
+	}
+	validateOwner(stats, directory) {
+		if ((directory ? !stats.isDirectory() : !stats.isFile() || stats.nlink !== 1) || process.getuid && stats.uid !== process.getuid()) throw new SecretStoreError("UNSAFE_FILE");
+	}
+	async folder(namespace, create) {
+		const root = path.resolve(this.directory);
+		const folder = path.join(root, digest(namespace));
+		for (const directory of [root, folder]) {
+			if (!create) try {
+				await lstat(directory);
+			} catch (error) {
+				if (isMissing(error)) return void 0;
+				throw error;
+			}
+			if (process.platform === "win32") throw new SecretStoreError("UNSAFE_FILE");
+			if (create) await mkdir(directory, {
+				recursive: true,
+				mode: 448
+			});
+			this.validateOwner(await lstat(directory), true);
+			const handle = await open(directory, constants.O_RDONLY | constants.O_NOFOLLOW);
+			try {
+				this.validateOwner(await handle.stat(), true);
+				await handle.chmod(448);
+				if (((await handle.stat()).mode & 511) !== 448) throw new SecretStoreError("UNSAFE_FILE");
+			} finally {
+				await handle.close();
+			}
+		}
+		return folder;
+	}
+	async location(namespace, name, create) {
+		const folder = await this.folder(namespace, create);
+		return folder ? path.join(folder, `${digest(name)}.secret`) : void 0;
+	}
+	aad(namespace, name) {
+		return Buffer.from(JSON.stringify([
+			"warlock:secrets:v1",
+			namespace,
+			name
+		]));
+	}
+	async safe(operation) {
+		try {
+			return await operation();
+		} catch (error) {
+			if (error instanceof SecretStoreError) throw error;
+			if (error instanceof Error && "code" in error && error.code === "ELOOP") throw new SecretStoreError("UNSAFE_FILE");
+			throw new SecretStoreError("UNAVAILABLE");
+		}
+	}
+	async get(namespace, name) {
+		return this.safe(async () => {
+			const file = await this.location(namespace, name, false);
+			if (!file) return void 0;
+			let handle;
+			try {
+				handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+			} catch (error) {
+				if (isMissing(error)) return void 0;
+				throw error;
+			}
+			let payload;
+			try {
+				this.validateOwner(await handle.stat(), false);
+				await handle.chmod(384);
+				if (((await handle.stat()).mode & 511) !== 384) throw new SecretStoreError("UNSAFE_FILE");
+				payload = await handle.readFile();
+			} finally {
+				await handle.close();
+			}
+			const key = this.key(namespace);
+			try {
+				if (payload.length < 29 || payload[0] !== 1) throw new Error();
+				const decipher = createDecipheriv("aes-256-gcm", key, payload.subarray(1, 13));
+				decipher.setAAD(this.aad(namespace, name));
+				decipher.setAuthTag(payload.subarray(13, 29));
+				return Buffer.concat([decipher.update(payload.subarray(29)), decipher.final()]).toString("utf8");
+			} catch {
+				throw new SecretStoreError("CORRUPT_FILE");
+			}
+		});
+	}
+	async set(namespace, name, value) {
+		return this.safe(async () => {
+			const key = this.key(namespace);
+			const file = await this.location(namespace, name, true);
+			if (!file) throw new SecretStoreError("UNAVAILABLE");
+			try {
+				this.validateOwner(await lstat(file), false);
+			} catch (error) {
+				if (!isMissing(error)) throw error;
+			}
+			const iv = randomBytes(12);
+			const cipher = createCipheriv("aes-256-gcm", key, iv);
+			cipher.setAAD(this.aad(namespace, name));
+			const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+			const payload = Buffer.concat([
+				Buffer.from([1]),
+				iv,
+				cipher.getAuthTag(),
+				encrypted
+			]);
+			const temporary = `${file}.${randomBytes(16).toString("hex")}.tmp`;
+			const handle = await open(temporary, "wx", 384);
+			try {
+				try {
+					await handle.chmod(384);
+					this.validateOwner(await handle.stat(), false);
+					if (((await handle.stat()).mode & 511) !== 384) throw new SecretStoreError("UNSAFE_FILE");
+					await handle.writeFile(payload);
+					await handle.sync();
+				} finally {
+					await handle.close();
+				}
+				await rename(temporary, file);
+			} finally {
+				await unlink(temporary).catch((error) => {
+					if (!isMissing(error)) throw error;
+				});
+			}
+		});
+	}
+	async remove(namespace, name) {
+		return this.safe(async () => {
+			const file = await this.location(namespace, name, false);
+			if (!file) return false;
+			try {
+				this.validateOwner(await lstat(file), false);
+				await unlink(file);
+				return true;
+			} catch (error) {
+				if (isMissing(error)) return false;
+				throw error;
+			}
+		});
+	}
+};
+
+//#endregion
+export { FileSecretBackend };
+//# sourceMappingURL=file-backend.mjs.map

package/esm/secrets/file-backend.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-backend.mjs","names":[],"sources":["../../../../../../../../packages/core/src/secrets/file-backend.ts"],"sourcesContent":["import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes } from \"node:crypto\";\nimport { registerLogSecret } from \"@warlock.js/logger\";\nimport { constants, type Stats } from \"node:fs\";\nimport { lstat, mkdir, open, rename, unlink, type FileHandle } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { SecretStoreError } from \"./errors\";\nimport type { SecretBackend } from \"./types\";\n\nfunction digest(value: string): string {\n  return createHash(\"sha256\").update(value).digest(\"hex\");\n}\n\nfunction isMissing(error: unknown): boolean {\n  return error instanceof Error && \"code\" in error && error.code === \"ENOENT\";\n}\n\n/** One authenticated file per secret: concurrent writes to different keys cannot clobber each other. */\nexport class FileSecretBackend implements SecretBackend {\n  public constructor(\n    private readonly directory: string,\n    private readonly encryptionKey: () => string | undefined,\n  ) {}\n\n  private key(namespace: string): Buffer {\n    const secret = this.encryptionKey();\n    if (typeof secret !== \"string\" || !/^[a-f\\d]{64}$/i.test(secret)) {\n      throw new SecretStoreError(\"KEY_REQUIRED\");\n    }\n    registerLogSecret(secret, [\"encryptionKey\"]);\n    // Core's encrypt/decrypt helpers use global config directly. Derive a\n    // separate AES-256-GCM key without changing that global config.\n    // https://nodejs.org/docs/latest-v22.x/api/crypto.html#cryptohkdfsyncdigest-ikm-salt-info-keylen\n    return Buffer.from(\n      hkdfSync(\"sha256\", Buffer.from(secret, \"hex\"), namespace, \"warlock:secrets:v1\", 32),\n    );\n  }\n\n  private validateOwner(stats: Stats, directory: boolean): void {\n    if (\n      (directory ? !stats.isDirectory() : !stats.isFile() || stats.nlink !== 1) ||\n      (process.getuid && stats.uid !== process.getuid())\n    ) {\n      throw new SecretStoreError(\"UNSAFE_FILE\");\n    }\n  }\n\n  private async folder(namespace: string, create: boolean): Promise<string | undefined> {\n    // Node's Windows modes cannot enforce owner-only ACLs. Fail closed there.\n    // https://nodejs.org/docs/latest-v22.x/api/fs.html#file-modes\n    const root = path.resolve(this.directory);\n    const folder = path.join(root, digest(namespace));\n    for (const directory of [root, folder]) {\n      if (!create) {\n        try {\n          await lstat(directory);\n        } catch (error) {\n          if (isMissing(error)) return undefined;\n          throw error;\n        }\n      }\n      if (process.platform === \"win32\") throw new SecretStoreError(\"UNSAFE_FILE\");\n      if (create) await mkdir(directory, { recursive: true, mode: 0o700 });\n      this.validateOwner(await lstat(directory), true);\n      const handle = await open(directory, constants.O_RDONLY | constants.O_NOFOLLOW);\n      try {\n        this.validateOwner(await handle.stat(), true);\n        await handle.chmod(0o700);\n        if (((await handle.stat()).mode & 0o777) !== 0o700) {\n          throw new SecretStoreError(\"UNSAFE_FILE\");\n        }\n      } finally {\n        await handle.close();\n      }\n    }\n    return folder;\n  }\n\n  private async location(\n    namespace: string,\n    name: string,\n    create: boolean,\n  ): Promise<string | undefined> {\n    const folder = await this.folder(namespace, create);\n    return folder ? path.join(folder, `${digest(name)}.secret`) : undefined;\n  }\n\n  private aad(namespace: string, name: string): Buffer {\n    return Buffer.from(JSON.stringify([\"warlock:secrets:v1\", namespace, name]));\n  }\n\n  private async safe<T>(operation: () => Promise<T>): Promise<T> {\n    try {\n      return await operation();\n    } catch (error) {\n      if (error instanceof SecretStoreError) throw error;\n      if (error instanceof Error && \"code\" in error && error.code === \"ELOOP\") {\n        throw new SecretStoreError(\"UNSAFE_FILE\");\n      }\n      throw new SecretStoreError(\"UNAVAILABLE\");\n    }\n  }\n\n  public async get(namespace: string, name: string): Promise<string | undefined> {\n    return this.safe(async () => {\n      const file = await this.location(namespace, name, false);\n      if (!file) return undefined;\n      let handle: FileHandle;\n      try {\n        handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);\n      } catch (error) {\n        if (isMissing(error)) return undefined;\n        throw error;\n      }\n      let payload: Buffer;\n      try {\n        this.validateOwner(await handle.stat(), false);\n        await handle.chmod(0o600);\n        if (((await handle.stat()).mode & 0o777) !== 0o600) {\n          throw new SecretStoreError(\"UNSAFE_FILE\");\n        }\n        payload = await handle.readFile();\n      } finally {\n        await handle.close();\n      }\n      const key = this.key(namespace);\n      try {\n        // v1 (one byte), 12-byte IV, 16-byte tag, then ciphertext (possibly empty).\n        if (payload.length < 29 || payload[0] !== 1) throw new Error();\n        const decipher = createDecipheriv(\"aes-256-gcm\", key, payload.subarray(1, 13));\n        decipher.setAAD(this.aad(namespace, name));\n        decipher.setAuthTag(payload.subarray(13, 29));\n        return Buffer.concat([decipher.update(payload.subarray(29)), decipher.final()]).toString(\n          \"utf8\",\n        );\n      } catch {\n        throw new SecretStoreError(\"CORRUPT_FILE\");\n      }\n    });\n  }\n\n  public async set(namespace: string, name: string, value: string): Promise<void> {\n    return this.safe(async () => {\n      const key = this.key(namespace);\n      const file = await this.location(namespace, name, true);\n      if (!file) throw new SecretStoreError(\"UNAVAILABLE\");\n      try {\n        this.validateOwner(await lstat(file), false);\n      } catch (error) {\n        if (!isMissing(error)) throw error;\n      }\n      const iv = randomBytes(12);\n      const cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n      cipher.setAAD(this.aad(namespace, name));\n      const encrypted = Buffer.concat([cipher.update(value, \"utf8\"), cipher.final()]);\n      const payload = Buffer.concat([Buffer.from([1]), iv, cipher.getAuthTag(), encrypted]);\n      const temporary = `${file}.${randomBytes(16).toString(\"hex\")}.tmp`;\n      const handle = await open(temporary, \"wx\", 0o600);\n      try {\n        try {\n          await handle.chmod(0o600);\n          this.validateOwner(await handle.stat(), false);\n          if (((await handle.stat()).mode & 0o777) !== 0o600) {\n            throw new SecretStoreError(\"UNSAFE_FILE\");\n          }\n          await handle.writeFile(payload);\n          await handle.sync();\n        } finally {\n          await handle.close();\n        }\n        await rename(temporary, file);\n      } finally {\n        await unlink(temporary).catch((error: unknown) => {\n          if (!isMissing(error)) throw error;\n        });\n      }\n    });\n  }\n\n  public async remove(namespace: string, name: string): Promise<boolean> {\n    return this.safe(async () => {\n      const file = await this.location(namespace, name, false);\n      if (!file) return false;\n      try {\n        this.validateOwner(await lstat(file), false);\n        await unlink(file);\n        return true;\n      } catch (error) {\n        if (isMissing(error)) return false;\n        throw error;\n      }\n    });\n  }\n}\n"],"mappings":";;;;;;;;AAQA,SAAS,OAAO,OAAuB;CACrC,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AACxD;AAEA,SAAS,UAAU,OAAyB;CAC1C,OAAO,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS;AACrE;;AAGA,IAAa,oBAAb,MAAwD;CACtD,AAAO,YACL,AAAiB,WACjB,AAAiB,eACjB;EAFiB;EACA;CAChB;CAEH,AAAQ,IAAI,WAA2B;EACrC,MAAM,SAAS,KAAK,cAAc;EAClC,IAAI,OAAO,WAAW,YAAY,CAAC,iBAAiB,KAAK,MAAM,GAC7D,MAAM,IAAI,iBAAiB,cAAc;EAE3C,kBAAkB,QAAQ,CAAC,eAAe,CAAC;EAI3C,OAAO,OAAO,KACZ,SAAS,UAAU,OAAO,KAAK,QAAQ,KAAK,GAAG,WAAW,sBAAsB,EAAE,CACpF;CACF;CAEA,AAAQ,cAAc,OAAc,WAA0B;EAC5D,KACG,YAAY,CAAC,MAAM,YAAY,IAAI,CAAC,MAAM,OAAO,KAAK,MAAM,UAAU,MACtE,QAAQ,UAAU,MAAM,QAAQ,QAAQ,OAAO,GAEhD,MAAM,IAAI,iBAAiB,aAAa;CAE5C;CAEA,MAAc,OAAO,WAAmB,QAA8C;EAGpF,MAAM,OAAO,KAAK,QAAQ,KAAK,SAAS;EACxC,MAAM,SAAS,KAAK,KAAK,MAAM,OAAO,SAAS,CAAC;EAChD,KAAK,MAAM,aAAa,CAAC,MAAM,MAAM,GAAG;GACtC,IAAI,CAAC,QACH,IAAI;IACF,MAAM,MAAM,SAAS;GACvB,SAAS,OAAO;IACd,IAAI,UAAU,KAAK,GAAG,OAAO;IAC7B,MAAM;GACR;GAEF,IAAI,QAAQ,aAAa,SAAS,MAAM,IAAI,iBAAiB,aAAa;GAC1E,IAAI,QAAQ,MAAM,MAAM,WAAW;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GACnE,KAAK,cAAc,MAAM,MAAM,SAAS,GAAG,IAAI;GAC/C,MAAM,SAAS,MAAM,KAAK,WAAW,UAAU,WAAW,UAAU,UAAU;GAC9E,IAAI;IACF,KAAK,cAAc,MAAM,OAAO,KAAK,GAAG,IAAI;IAC5C,MAAM,OAAO,MAAM,GAAK;IACxB,MAAM,MAAM,OAAO,KAAK,EAAC,CAAE,OAAO,SAAW,KAC3C,MAAM,IAAI,iBAAiB,aAAa;GAE5C,UAAU;IACR,MAAM,OAAO,MAAM;GACrB;EACF;EACA,OAAO;CACT;CAEA,MAAc,SACZ,WACA,MACA,QAC6B;EAC7B,MAAM,SAAS,MAAM,KAAK,OAAO,WAAW,MAAM;EAClD,OAAO,SAAS,KAAK,KAAK,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,IAAI;CAChE;CAEA,AAAQ,IAAI,WAAmB,MAAsB;EACnD,OAAO,OAAO,KAAK,KAAK,UAAU;GAAC;GAAsB;GAAW;EAAI,CAAC,CAAC;CAC5E;CAEA,MAAc,KAAQ,WAAyC;EAC7D,IAAI;GACF,OAAO,MAAM,UAAU;EACzB,SAAS,OAAO;GACd,IAAI,iBAAiB,kBAAkB,MAAM;GAC7C,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,SAC9D,MAAM,IAAI,iBAAiB,aAAa;GAE1C,MAAM,IAAI,iBAAiB,aAAa;EAC1C;CACF;CAEA,MAAa,IAAI,WAAmB,MAA2C;EAC7E,OAAO,KAAK,KAAK,YAAY;GAC3B,MAAM,OAAO,MAAM,KAAK,SAAS,WAAW,MAAM,KAAK;GACvD,IAAI,CAAC,MAAM,OAAO;GAClB,IAAI;GACJ,IAAI;IACF,SAAS,MAAM,KAAK,MAAM,UAAU,WAAW,UAAU,aAAa,UAAU,UAAU;GAC5F,SAAS,OAAO;IACd,IAAI,UAAU,KAAK,GAAG,OAAO;IAC7B,MAAM;GACR;GACA,IAAI;GACJ,IAAI;IACF,KAAK,cAAc,MAAM,OAAO,KAAK,GAAG,KAAK;IAC7C,MAAM,OAAO,MAAM,GAAK;IACxB,MAAM,MAAM,OAAO,KAAK,EAAC,CAAE,OAAO,SAAW,KAC3C,MAAM,IAAI,iBAAiB,aAAa;IAE1C,UAAU,MAAM,OAAO,SAAS;GAClC,UAAU;IACR,MAAM,OAAO,MAAM;GACrB;GACA,MAAM,MAAM,KAAK,IAAI,SAAS;GAC9B,IAAI;IAEF,IAAI,QAAQ,SAAS,MAAM,QAAQ,OAAO,GAAG,MAAM,IAAI,MAAM;IAC7D,MAAM,WAAW,iBAAiB,eAAe,KAAK,QAAQ,SAAS,GAAG,EAAE,CAAC;IAC7E,SAAS,OAAO,KAAK,IAAI,WAAW,IAAI,CAAC;IACzC,SAAS,WAAW,QAAQ,SAAS,IAAI,EAAE,CAAC;IAC5C,OAAO,OAAO,OAAO,CAAC,SAAS,OAAO,QAAQ,SAAS,EAAE,CAAC,GAAG,SAAS,MAAM,CAAC,CAAC,CAAC,CAAC,SAC9E,MACF;GACF,QAAQ;IACN,MAAM,IAAI,iBAAiB,cAAc;GAC3C;EACF,CAAC;CACH;CAEA,MAAa,IAAI,WAAmB,MAAc,OAA8B;EAC9E,OAAO,KAAK,KAAK,YAAY;GAC3B,MAAM,MAAM,KAAK,IAAI,SAAS;GAC9B,MAAM,OAAO,MAAM,KAAK,SAAS,WAAW,MAAM,IAAI;GACtD,IAAI,CAAC,MAAM,MAAM,IAAI,iBAAiB,aAAa;GACnD,IAAI;IACF,KAAK,cAAc,MAAM,MAAM,IAAI,GAAG,KAAK;GAC7C,SAAS,OAAO;IACd,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;GAC/B;GACA,MAAM,KAAK,YAAY,EAAE;GACzB,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;GACpD,OAAO,OAAO,KAAK,IAAI,WAAW,IAAI,CAAC;GACvC,MAAM,YAAY,OAAO,OAAO,CAAC,OAAO,OAAO,OAAO,MAAM,GAAG,OAAO,MAAM,CAAC,CAAC;GAC9E,MAAM,UAAU,OAAO,OAAO;IAAC,OAAO,KAAK,CAAC,CAAC,CAAC;IAAG;IAAI,OAAO,WAAW;IAAG;GAAS,CAAC;GACpF,MAAM,YAAY,GAAG,KAAK,GAAG,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK,EAAE;GAC7D,MAAM,SAAS,MAAM,KAAK,WAAW,MAAM,GAAK;GAChD,IAAI;IACF,IAAI;KACF,MAAM,OAAO,MAAM,GAAK;KACxB,KAAK,cAAc,MAAM,OAAO,KAAK,GAAG,KAAK;KAC7C,MAAM,MAAM,OAAO,KAAK,EAAC,CAAE,OAAO,SAAW,KAC3C,MAAM,IAAI,iBAAiB,aAAa;KAE1C,MAAM,OAAO,UAAU,OAAO;KAC9B,MAAM,OAAO,KAAK;IACpB,UAAU;KACR,MAAM,OAAO,MAAM;IACrB;IACA,MAAM,OAAO,WAAW,IAAI;GAC9B,UAAU;IACR,MAAM,OAAO,SAAS,CAAC,CAAC,OAAO,UAAmB;KAChD,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;IAC/B,CAAC;GACH;EACF,CAAC;CACH;CAEA,MAAa,OAAO,WAAmB,MAAgC;EACrE,OAAO,KAAK,KAAK,YAAY;GAC3B,MAAM,OAAO,MAAM,KAAK,SAAS,WAAW,MAAM,KAAK;GACvD,IAAI,CAAC,MAAM,OAAO;GAClB,IAAI;IACF,KAAK,cAAc,MAAM,MAAM,IAAI,GAAG,KAAK;IAC3C,MAAM,OAAO,IAAI;IACjB,OAAO;GACT,SAAS,OAAO;IACd,IAAI,UAAU,KAAK,GAAG,OAAO;IAC7B,MAAM;GACR;EACF,CAAC;CACH;AACF"}

package/esm/secrets/index.d.mts

@@ -0,0 +1,6 @@
+import { SecretStoreError, SecretStoreErrorCode } from "./errors.mjs";
+import { SecretBackend, SecretStoreOptions, SecretsConfigurations } from "./types.mjs";
+import { MemorySecretBackend } from "./memory-backend.mjs";
+import { SecretStore } from "./secret-store.mjs";
+import { secrets } from "./secrets.mjs";
+export { MemorySecretBackend, type SecretBackend, SecretStore, SecretStoreError, SecretStoreErrorCode, type SecretStoreOptions, type SecretsConfigurations, secrets };

package/esm/secrets/index.mjs

@@ -0,0 +1,6 @@
+import { SecretStoreError } from "./errors.mjs";
+import { MemorySecretBackend } from "./memory-backend.mjs";
+import { SecretStore } from "./secret-store.mjs";
+import { secrets } from "./secrets.mjs";
+
+export { MemorySecretBackend, SecretStore, SecretStoreError, secrets };

package/esm/secrets/keyring-backend.mjs

@@ -0,0 +1,50 @@
+import { SecretStoreError } from "./errors.mjs";
+
+//#region ../../packages/core/src/secrets/keyring-backend.ts
+var KeyringSecretBackend = class KeyringSecretBackend {
+	constructor(keyring) {
+		this.keyring = keyring;
+	}
+	/** Read-only availability probe; never writes a setup credential. */
+	static async load(namespace, importer = importKeyring) {
+		try {
+			const keyring = await importer();
+			const backend = new KeyringSecretBackend(keyring);
+			await backend.entry(namespace, "").getPassword();
+			return backend;
+		} catch {
+			return;
+		}
+	}
+	entry(namespace, name) {
+		return new this.keyring.AsyncEntry(`warlock:${namespace}`, name || "__availability__", { linux: { store: "secret-service" } });
+	}
+	async get(namespace, name) {
+		try {
+			return await this.entry(namespace, name).getPassword() ?? void 0;
+		} catch {
+			throw new SecretStoreError("UNAVAILABLE");
+		}
+	}
+	async set(namespace, name, value) {
+		try {
+			await this.entry(namespace, name).setPassword(value);
+		} catch {
+			throw new SecretStoreError("UNAVAILABLE");
+		}
+	}
+	async remove(namespace, name) {
+		try {
+			return await this.entry(namespace, name).deletePassword();
+		} catch {
+			throw new SecretStoreError("UNAVAILABLE");
+		}
+	}
+};
+async function importKeyring() {
+	return import("@napi-rs/keyring");
+}
+
+//#endregion
+export { KeyringSecretBackend };
+//# sourceMappingURL=keyring-backend.mjs.map

package/esm/secrets/keyring-backend.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring-backend.mjs","names":[],"sources":["../../../../../../../../packages/core/src/secrets/keyring-backend.ts"],"sourcesContent":["import { SecretStoreError } from \"./errors\";\nimport type { SecretBackend } from \"./types\";\n\n// Verified against @napi-rs/keyring 2.1.1's published index.d.ts and README:\n// https://github.com/Brooooooklyn/keyring-node (2026-10-19).\n// Structural types keep the optional peer unnecessary for TypeScript consumers.\ninterface KeyringEntry {\n  getPassword(): Promise<string | null>;\n  setPassword(value: string): Promise<void>;\n  deletePassword(): Promise<boolean>;\n}\n\ntype KeyringModule = {\n  AsyncEntry: new (\n    service: string,\n    username: string,\n    options: { linux: { store: \"secret-service\" } },\n  ) => KeyringEntry;\n};\n\nexport class KeyringSecretBackend implements SecretBackend {\n  private constructor(private readonly keyring: KeyringModule) {}\n\n  /** Read-only availability probe; never writes a setup credential. */\n  public static async load(\n    namespace: string,\n    importer: () => Promise<unknown> = importKeyring,\n  ): Promise<KeyringSecretBackend | undefined> {\n    try {\n      const keyring = (await importer()) as KeyringModule;\n      const backend = new KeyringSecretBackend(keyring);\n      await backend.entry(namespace, \"\").getPassword();\n      return backend;\n    } catch {\n      return undefined;\n    }\n  }\n\n  private entry(namespace: string, name: string): KeyringEntry {\n    // Require persistence on Linux: the library's automatic keyutils fallback\n    // is memory-only and loses credentials on reboot. Ignored on other OSes.\n    return new this.keyring.AsyncEntry(`warlock:${namespace}`, name || \"__availability__\", {\n      linux: { store: \"secret-service\" },\n    });\n  }\n\n  public async get(namespace: string, name: string): Promise<string | undefined> {\n    try {\n      return (await this.entry(namespace, name).getPassword()) ?? undefined;\n    } catch {\n      throw new SecretStoreError(\"UNAVAILABLE\");\n    }\n  }\n\n  public async set(namespace: string, name: string, value: string): Promise<void> {\n    try {\n      await this.entry(namespace, name).setPassword(value);\n    } catch {\n      throw new SecretStoreError(\"UNAVAILABLE\");\n    }\n  }\n\n  public async remove(namespace: string, name: string): Promise<boolean> {\n    try {\n      return await this.entry(namespace, name).deletePassword();\n    } catch {\n      throw new SecretStoreError(\"UNAVAILABLE\");\n    }\n  }\n}\n\nasync function importKeyring(): Promise<unknown> {\n  const peer = \"@napi-rs/keyring\";\n  return import(peer);\n}\n"],"mappings":";;;AAoBA,IAAa,uBAAb,MAAa,qBAA8C;CACzD,AAAQ,YAAY,AAAiB,SAAwB;EAAxB;CAAyB;;CAG9D,aAAoB,KAClB,WACA,WAAmC,eACQ;EAC3C,IAAI;GACF,MAAM,UAAW,MAAM,SAAS;GAChC,MAAM,UAAU,IAAI,qBAAqB,OAAO;GAChD,MAAM,QAAQ,MAAM,WAAW,EAAE,CAAC,CAAC,YAAY;GAC/C,OAAO;EACT,QAAQ;GACN;EACF;CACF;CAEA,AAAQ,MAAM,WAAmB,MAA4B;EAG3D,OAAO,IAAI,KAAK,QAAQ,WAAW,WAAW,aAAa,QAAQ,oBAAoB,EACrF,OAAO,EAAE,OAAO,iBAAiB,EACnC,CAAC;CACH;CAEA,MAAa,IAAI,WAAmB,MAA2C;EAC7E,IAAI;GACF,OAAQ,MAAM,KAAK,MAAM,WAAW,IAAI,CAAC,CAAC,YAAY,KAAM;EAC9D,QAAQ;GACN,MAAM,IAAI,iBAAiB,aAAa;EAC1C;CACF;CAEA,MAAa,IAAI,WAAmB,MAAc,OAA8B;EAC9E,IAAI;GACF,MAAM,KAAK,MAAM,WAAW,IAAI,CAAC,CAAC,YAAY,KAAK;EACrD,QAAQ;GACN,MAAM,IAAI,iBAAiB,aAAa;EAC1C;CACF;CAEA,MAAa,OAAO,WAAmB,MAAgC;EACrE,IAAI;GACF,OAAO,MAAM,KAAK,MAAM,WAAW,IAAI,CAAC,CAAC,eAAe;EAC1D,QAAQ;GACN,MAAM,IAAI,iBAAiB,aAAa;EAC1C;CACF;AACF;AAEA,eAAe,gBAAkC;CAE/C,OAAO,OAAO;AAChB"}

package/esm/secrets/memory-backend.d.mts

@@ -0,0 +1,12 @@
+import { SecretBackend } from "./types.mjs";
+//#region ../../packages/core/src/secrets/memory-backend.d.ts
+/** Isolated, namespace-aware storage. No OS, environment or filesystem access. */
+export declare class MemorySecretBackend implements SecretBackend {
+  private readonly values;
+  get(namespace: string, name: string): Promise<string | undefined>;
+  set(namespace: string, name: string, value: string): Promise<void>;
+  remove(namespace: string, name: string): Promise<boolean>;
+  clear(): void;
+}
+//#endregion
+//# sourceMappingURL=memory-backend.d.mts.map

package/esm/secrets/memory-backend.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-backend.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/secrets/memory-backend.ts"],"mappings":";;;qBAGa,+BAA+B;mBACzB;EAEJ,IAAI,mBAAmB,eAAe;EAItC,IAAI,mBAAmB,cAAc,gBAAgB;EASrD,OAAO,mBAAmB,eAAe;EAI/C"}

package/esm/secrets/memory-backend.mjs

@@ -0,0 +1,28 @@
+//#region ../../packages/core/src/secrets/memory-backend.ts
+/** Isolated, namespace-aware storage. No OS, environment or filesystem access. */
+var MemorySecretBackend = class {
+	constructor() {
+		this.values = /* @__PURE__ */ new Map();
+	}
+	async get(namespace, name) {
+		return this.values.get(namespace)?.get(name);
+	}
+	async set(namespace, name, value) {
+		let entries = this.values.get(namespace);
+		if (!entries) {
+			entries = /* @__PURE__ */ new Map();
+			this.values.set(namespace, entries);
+		}
+		entries.set(name, value);
+	}
+	async remove(namespace, name) {
+		return this.values.get(namespace)?.delete(name) ?? false;
+	}
+	clear() {
+		this.values.clear();
+	}
+};
+
+//#endregion
+export { MemorySecretBackend };
+//# sourceMappingURL=memory-backend.mjs.map

package/esm/secrets/memory-backend.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-backend.mjs","names":[],"sources":["../../../../../../../../packages/core/src/secrets/memory-backend.ts"],"sourcesContent":["import type { SecretBackend } from \"./types\";\n\n/** Isolated, namespace-aware storage. No OS, environment or filesystem access. */\nexport class MemorySecretBackend implements SecretBackend {\n  private readonly values = new Map<string, Map<string, string>>();\n\n  public async get(namespace: string, name: string): Promise<string | undefined> {\n    return this.values.get(namespace)?.get(name);\n  }\n\n  public async set(namespace: string, name: string, value: string): Promise<void> {\n    let entries = this.values.get(namespace);\n    if (!entries) {\n      entries = new Map();\n      this.values.set(namespace, entries);\n    }\n    entries.set(name, value);\n  }\n\n  public async remove(namespace: string, name: string): Promise<boolean> {\n    return this.values.get(namespace)?.delete(name) ?? false;\n  }\n\n  public clear(): void {\n    this.values.clear();\n  }\n}\n"],"mappings":";;AAGA,IAAa,sBAAb,MAA0D;;gCAC9B,IAAI,IAAiC;;CAE/D,MAAa,IAAI,WAAmB,MAA2C;EAC7E,OAAO,KAAK,OAAO,IAAI,SAAS,CAAC,EAAE,IAAI,IAAI;CAC7C;CAEA,MAAa,IAAI,WAAmB,MAAc,OAA8B;EAC9E,IAAI,UAAU,KAAK,OAAO,IAAI,SAAS;EACvC,IAAI,CAAC,SAAS;GACZ,0BAAU,IAAI,IAAI;GAClB,KAAK,OAAO,IAAI,WAAW,OAAO;EACpC;EACA,QAAQ,IAAI,MAAM,KAAK;CACzB;CAEA,MAAa,OAAO,WAAmB,MAAgC;EACrE,OAAO,KAAK,OAAO,IAAI,SAAS,CAAC,EAAE,OAAO,IAAI,KAAK;CACrD;CAEA,AAAO,QAAc;EACnB,KAAK,OAAO,MAAM;CACpB;AACF"}

package/esm/secrets/resolve-driver.mjs

@@ -0,0 +1,14 @@
+import { SecretStoreError } from "./errors.mjs";
+
+//#region ../../packages/core/src/secrets/resolve-driver.ts
+/** Resolve and enforce policy before looking up even an already cached store. */
+function resolveSecretsDriver(options) {
+	const driver = options.driver ?? process.env.SECRETS_DRIVER ?? "auto";
+	if (driver !== "auto" && driver !== "memory") throw new SecretStoreError("INVALID_DRIVER");
+	if (driver === "memory" && process.env.NODE_ENV === "production" && options.allowMemoryInProduction !== true) throw new SecretStoreError("MEMORY_IN_PRODUCTION");
+	return driver;
+}
+
+//#endregion
+export { resolveSecretsDriver };
+//# sourceMappingURL=resolve-driver.mjs.map

package/esm/secrets/resolve-driver.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-driver.mjs","names":[],"sources":["../../../../../../../../packages/core/src/secrets/resolve-driver.ts"],"sourcesContent":["import { SecretStoreError } from \"./errors\";\nimport type { SecretsConfigurations } from \"./types\";\n\n/** Resolve and enforce policy before looking up even an already cached store. */\nexport function resolveSecretsDriver(options: SecretsConfigurations): \"auto\" | \"memory\" {\n  const driver = options.driver ?? process.env.SECRETS_DRIVER ?? \"auto\";\n  if (driver !== \"auto\" && driver !== \"memory\") throw new SecretStoreError(\"INVALID_DRIVER\");\n  if (\n    driver === \"memory\" &&\n    process.env.NODE_ENV === \"production\" &&\n    options.allowMemoryInProduction !== true\n  ) {\n    throw new SecretStoreError(\"MEMORY_IN_PRODUCTION\");\n  }\n  return driver;\n}\n"],"mappings":";;;;AAIA,SAAgB,qBAAqB,SAAmD;CACtF,MAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI,kBAAkB;CAC/D,IAAI,WAAW,UAAU,WAAW,UAAU,MAAM,IAAI,iBAAiB,gBAAgB;CACzF,IACE,WAAW,YACX,QAAQ,IAAI,aAAa,gBACzB,QAAQ,4BAA4B,MAEpC,MAAM,IAAI,iBAAiB,sBAAsB;CAEnD,OAAO;AACT"}

package/esm/secrets/secret-store.d.mts

@@ -0,0 +1,25 @@
+import { SecretStoreOptions } from "./types.mjs";
+//#region ../../packages/core/src/secrets/secret-store.d.ts
+/** Lazily prepared, application-scoped credentials. All operations are asynchronous. */
+export declare class SecretStore {
+  private primary;
+  private readonly file;
+  private readonly backend;
+  readonly namespace: string;
+  constructor(options: SecretStoreOptions);
+  private validate;
+  /** Exact, collision-free environment variable name (UTF-8 encoded as uppercase hex). */
+  environmentName(name: string): string;
+  private keyring;
+  private register;
+  private environment;
+  private assertWritable;
+  private safe;
+  get(name: string): Promise<string | undefined>;
+  has(name: string): Promise<boolean>;
+  set(name: string, value: string): Promise<void>;
+  /** Remove every writable layer so a fallback value cannot reappear. */
+  remove(name: string): Promise<boolean>;
+}
+//#endregion
+//# sourceMappingURL=secret-store.d.mts.map

package/esm/secrets/secret-store.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/secrets/secret-store.ts"],"mappings":";;;qBAWa;UACH;mBACS;mBACA;WACD;EAEhB,YAAmB,SAAS;UAoBpB;;EAYD,gBAAgB;UAMf;UAKA;UAIA;UAIA;UAQM;EAUD,IAAI,eAAe;EAkBnB,IAAI,eAAe;EAInB,IAAI,cAAc,gBAAgB;;EA2BlC,OAAO,eAAe"}

package/esm/secrets/secret-store.mjs

@@ -0,0 +1,120 @@
+import { config } from "../config/config-getter.mjs";
+import { storagePath } from "../utils/paths.mjs";
+import { SecretStoreError } from "./errors.mjs";
+import { MemorySecretBackend } from "./memory-backend.mjs";
+import { FileSecretBackend } from "./file-backend.mjs";
+import { resolveSecretsDriver } from "./resolve-driver.mjs";
+import { KeyringSecretBackend } from "./keyring-backend.mjs";
+import { registerLogSecret } from "@warlock.js/logger";
+
+//#region ../../packages/core/src/secrets/secret-store.ts
+/** Lazily prepared, application-scoped credentials. All operations are asynchronous. */
+var SecretStore = class {
+	constructor(options) {
+		if (typeof options.namespace !== "string" || !options.namespace.trim() || Buffer.from(options.namespace).toString("utf8") !== options.namespace) throw new SecretStoreError("INVALID_NAMESPACE");
+		this.namespace = options.namespace;
+		const driver = options.backend ? "auto" : resolveSecretsDriver(options);
+		this.backend = options.backend ?? (driver === "memory" ? new MemorySecretBackend() : void 0);
+		const encryptionKey = options.encryptionKey;
+		this.file = new FileSecretBackend(options.directory ?? storagePath("secrets"), typeof encryptionKey === "function" ? encryptionKey : () => encryptionKey ?? config.key("encryption.key"));
+	}
+	validate(name) {
+		if (typeof name !== "string" || !name.length || name.length > 256 || Buffer.from(name).toString("utf8") !== name) throw new SecretStoreError("INVALID_NAME");
+	}
+	/** Exact, collision-free environment variable name (UTF-8 encoded as uppercase hex). */
+	environmentName(name) {
+		this.validate(name);
+		const hex = (value) => Buffer.from(value).toString("hex").toUpperCase();
+		return `WARLOCK_SECRET_${hex(this.namespace)}_${hex(name)}`;
+	}
+	keyring() {
+		this.primary ??= KeyringSecretBackend.load(this.namespace);
+		return this.primary;
+	}
+	register(name, value) {
+		registerLogSecret(value ?? "", [name, this.environmentName(name)]);
+	}
+	environment(name) {
+		return process.env[this.environmentName(name)];
+	}
+	assertWritable(name) {
+		const value = this.environment(name);
+		if (value !== void 0) {
+			this.register(name, value);
+			throw new SecretStoreError("READ_ONLY");
+		}
+	}
+	async safe(operation) {
+		try {
+			return await operation();
+		} catch (error) {
+			if (error instanceof SecretStoreError) throw error;
+			throw new SecretStoreError("UNAVAILABLE");
+		}
+	}
+	async get(name) {
+		this.validate(name);
+		this.register(name);
+		return this.safe(async () => {
+			let value;
+			if (this.backend) value = await this.backend.get(this.namespace, name);
+			else {
+				value = await (await this.keyring())?.get(this.namespace, name);
+				value ??= this.environment(name);
+				value ??= await this.file.get(this.namespace, name);
+			}
+			if (value !== void 0) this.register(name, value);
+			return value;
+		});
+	}
+	async has(name) {
+		return await this.get(name) !== void 0;
+	}
+	async set(name, value) {
+		this.validate(name);
+		if (typeof value !== "string") throw new SecretStoreError("INVALID_VALUE");
+		this.register(name, value);
+		return this.safe(async () => {
+			if (this.backend) {
+				const previous = await this.backend.get(this.namespace, name);
+				if (previous !== void 0) this.register(name, previous);
+				return this.backend.set(this.namespace, name, value);
+			}
+			this.assertWritable(name);
+			const primary = await this.keyring();
+			const backend = primary ?? this.file;
+			if (primary) {
+				const fallback = await this.file.get(this.namespace, name);
+				if (fallback !== void 0) this.register(name, fallback);
+			}
+			const previous = await backend.get(this.namespace, name);
+			if (previous !== void 0) this.register(name, previous);
+			await backend.set(this.namespace, name, value);
+			if (primary) await this.file.remove(this.namespace, name);
+		});
+	}
+	/** Remove every writable layer so a fallback value cannot reappear. */
+	async remove(name) {
+		this.validate(name);
+		this.register(name);
+		return this.safe(async () => {
+			if (this.backend) {
+				const previous = await this.backend.get(this.namespace, name);
+				if (previous !== void 0) this.register(name, previous);
+				return this.backend.remove(this.namespace, name);
+			}
+			this.assertWritable(name);
+			const primary = await this.keyring();
+			const previous = await primary?.get(this.namespace, name);
+			if (previous !== void 0) this.register(name, previous);
+			const fromFile = await this.file.get(this.namespace, name);
+			if (fromFile !== void 0) this.register(name, fromFile);
+			const removed = await primary?.remove(this.namespace, name) ?? false;
+			return await this.file.remove(this.namespace, name) || removed;
+		});
+	}
+};
+
+//#endregion
+export { SecretStore };
+//# sourceMappingURL=secret-store.mjs.map

package/esm/secrets/secret-store.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.mjs","names":[],"sources":["../../../../../../../../packages/core/src/secrets/secret-store.ts"],"sourcesContent":["import { registerLogSecret } from \"@warlock.js/logger\";\nimport { config } from \"../config/config-getter\";\nimport { storagePath } from \"../utils/paths\";\nimport { SecretStoreError } from \"./errors\";\nimport { FileSecretBackend } from \"./file-backend\";\nimport { MemorySecretBackend } from \"./memory-backend\";\nimport { resolveSecretsDriver } from \"./resolve-driver\";\nimport { KeyringSecretBackend } from \"./keyring-backend\";\nimport type { SecretBackend, SecretStoreOptions } from \"./types\";\n\n/** Lazily prepared, application-scoped credentials. All operations are asynchronous. */\nexport class SecretStore {\n  private primary: Promise<KeyringSecretBackend | undefined> | undefined;\n  private readonly file: FileSecretBackend;\n  private readonly backend: SecretBackend | undefined;\n  public readonly namespace: string;\n\n  public constructor(options: SecretStoreOptions) {\n    if (\n      typeof options.namespace !== \"string\" ||\n      !options.namespace.trim() ||\n      Buffer.from(options.namespace).toString(\"utf8\") !== options.namespace\n    ) {\n      throw new SecretStoreError(\"INVALID_NAMESPACE\");\n    }\n    this.namespace = options.namespace;\n    const driver = options.backend ? \"auto\" : resolveSecretsDriver(options);\n    this.backend = options.backend ?? (driver === \"memory\" ? new MemorySecretBackend() : undefined);\n    const encryptionKey = options.encryptionKey;\n    this.file = new FileSecretBackend(\n      options.directory ?? storagePath(\"secrets\"),\n      typeof encryptionKey === \"function\"\n        ? encryptionKey\n        : () => encryptionKey ?? config.key<string | undefined>(\"encryption.key\"),\n    );\n  }\n\n  private validate(name: string): void {\n    if (\n      typeof name !== \"string\" ||\n      !name.length ||\n      name.length > 256 ||\n      Buffer.from(name).toString(\"utf8\") !== name\n    ) {\n      throw new SecretStoreError(\"INVALID_NAME\");\n    }\n  }\n\n  /** Exact, collision-free environment variable name (UTF-8 encoded as uppercase hex). */\n  public environmentName(name: string): string {\n    this.validate(name);\n    const hex = (value: string) => Buffer.from(value).toString(\"hex\").toUpperCase();\n    return `WARLOCK_SECRET_${hex(this.namespace)}_${hex(name)}`;\n  }\n\n  private keyring(): Promise<KeyringSecretBackend | undefined> {\n    this.primary ??= KeyringSecretBackend.load(this.namespace);\n    return this.primary;\n  }\n\n  private register(name: string, value?: string): void {\n    registerLogSecret(value ?? \"\", [name, this.environmentName(name)]);\n  }\n\n  private environment(name: string): string | undefined {\n    return process.env[this.environmentName(name)];\n  }\n\n  private assertWritable(name: string): void {\n    const value = this.environment(name);\n    if (value !== undefined) {\n      this.register(name, value);\n      throw new SecretStoreError(\"READ_ONLY\");\n    }\n  }\n\n  private async safe<T>(operation: () => Promise<T>): Promise<T> {\n    try {\n      return await operation();\n    } catch (error) {\n      if (error instanceof SecretStoreError) throw error;\n      // Custom backends may throw messages containing values. Do not propagate them.\n      throw new SecretStoreError(\"UNAVAILABLE\");\n    }\n  }\n\n  public async get(name: string): Promise<string | undefined> {\n    this.validate(name);\n    this.register(name);\n    return this.safe(async () => {\n      let value: string | undefined;\n      if (this.backend) {\n        value = await this.backend.get(this.namespace, name);\n      } else {\n        const primary = await this.keyring();\n        value = await primary?.get(this.namespace, name);\n        value ??= this.environment(name);\n        value ??= await this.file.get(this.namespace, name);\n      }\n      if (value !== undefined) this.register(name, value);\n      return value;\n    });\n  }\n\n  public async has(name: string): Promise<boolean> {\n    return (await this.get(name)) !== undefined;\n  }\n\n  public async set(name: string, value: string): Promise<void> {\n    this.validate(name);\n    if (typeof value !== \"string\") throw new SecretStoreError(\"INVALID_VALUE\");\n    // Register before any backend call, including failed writes.\n    this.register(name, value);\n    return this.safe(async () => {\n      if (this.backend) {\n        const previous = await this.backend.get(this.namespace, name);\n        if (previous !== undefined) this.register(name, previous);\n        return this.backend.set(this.namespace, name, value);\n      }\n      this.assertWritable(name);\n      const primary = await this.keyring();\n      const backend = primary ?? this.file;\n      if (primary) {\n        const fallback = await this.file.get(this.namespace, name);\n        if (fallback !== undefined) this.register(name, fallback);\n      }\n      // Retain masking for the old value after replacement as well.\n      const previous = await backend.get(this.namespace, name);\n      if (previous !== undefined) this.register(name, previous);\n      await backend.set(this.namespace, name, value);\n      if (primary) await this.file.remove(this.namespace, name);\n    });\n  }\n\n  /** Remove every writable layer so a fallback value cannot reappear. */\n  public async remove(name: string): Promise<boolean> {\n    this.validate(name);\n    this.register(name);\n    return this.safe(async () => {\n      if (this.backend) {\n        const previous = await this.backend.get(this.namespace, name);\n        if (previous !== undefined) this.register(name, previous);\n        return this.backend.remove(this.namespace, name);\n      }\n      this.assertWritable(name);\n      const primary = await this.keyring();\n      const previous = await primary?.get(this.namespace, name);\n      if (previous !== undefined) this.register(name, previous);\n      const fromFile = await this.file.get(this.namespace, name);\n      if (fromFile !== undefined) this.register(name, fromFile);\n      const removed = (await primary?.remove(this.namespace, name)) ?? false;\n      return (await this.file.remove(this.namespace, name)) || removed;\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;AAWA,IAAa,cAAb,MAAyB;CAMvB,AAAO,YAAY,SAA6B;EAC9C,IACE,OAAO,QAAQ,cAAc,YAC7B,CAAC,QAAQ,UAAU,KAAK,KACxB,OAAO,KAAK,QAAQ,SAAS,CAAC,CAAC,SAAS,MAAM,MAAM,QAAQ,WAE5D,MAAM,IAAI,iBAAiB,mBAAmB;EAEhD,KAAK,YAAY,QAAQ;EACzB,MAAM,SAAS,QAAQ,UAAU,SAAS,qBAAqB,OAAO;EACtE,KAAK,UAAU,QAAQ,YAAY,WAAW,WAAW,IAAI,oBAAoB,IAAI;EACrF,MAAM,gBAAgB,QAAQ;EAC9B,KAAK,OAAO,IAAI,kBACd,QAAQ,aAAa,YAAY,SAAS,GAC1C,OAAO,kBAAkB,aACrB,sBACM,iBAAiB,OAAO,IAAwB,gBAAgB,CAC5E;CACF;CAEA,AAAQ,SAAS,MAAoB;EACnC,IACE,OAAO,SAAS,YAChB,CAAC,KAAK,UACN,KAAK,SAAS,OACd,OAAO,KAAK,IAAI,CAAC,CAAC,SAAS,MAAM,MAAM,MAEvC,MAAM,IAAI,iBAAiB,cAAc;CAE7C;;CAGA,AAAO,gBAAgB,MAAsB;EAC3C,KAAK,SAAS,IAAI;EAClB,MAAM,OAAO,UAAkB,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,YAAY;EAC9E,OAAO,kBAAkB,IAAI,KAAK,SAAS,EAAE,GAAG,IAAI,IAAI;CAC1D;CAEA,AAAQ,UAAqD;EAC3D,KAAK,YAAY,qBAAqB,KAAK,KAAK,SAAS;EACzD,OAAO,KAAK;CACd;CAEA,AAAQ,SAAS,MAAc,OAAsB;EACnD,kBAAkB,SAAS,IAAI,CAAC,MAAM,KAAK,gBAAgB,IAAI,CAAC,CAAC;CACnE;CAEA,AAAQ,YAAY,MAAkC;EACpD,OAAO,QAAQ,IAAI,KAAK,gBAAgB,IAAI;CAC9C;CAEA,AAAQ,eAAe,MAAoB;EACzC,MAAM,QAAQ,KAAK,YAAY,IAAI;EACnC,IAAI,UAAU,QAAW;GACvB,KAAK,SAAS,MAAM,KAAK;GACzB,MAAM,IAAI,iBAAiB,WAAW;EACxC;CACF;CAEA,MAAc,KAAQ,WAAyC;EAC7D,IAAI;GACF,OAAO,MAAM,UAAU;EACzB,SAAS,OAAO;GACd,IAAI,iBAAiB,kBAAkB,MAAM;GAE7C,MAAM,IAAI,iBAAiB,aAAa;EAC1C;CACF;CAEA,MAAa,IAAI,MAA2C;EAC1D,KAAK,SAAS,IAAI;EAClB,KAAK,SAAS,IAAI;EAClB,OAAO,KAAK,KAAK,YAAY;GAC3B,IAAI;GACJ,IAAI,KAAK,SACP,QAAQ,MAAM,KAAK,QAAQ,IAAI,KAAK,WAAW,IAAI;QAC9C;IAEL,QAAQ,OAAM,MADQ,KAAK,QAAQ,EACd,EAAE,IAAI,KAAK,WAAW,IAAI;IAC/C,UAAU,KAAK,YAAY,IAAI;IAC/B,UAAU,MAAM,KAAK,KAAK,IAAI,KAAK,WAAW,IAAI;GACpD;GACA,IAAI,UAAU,QAAW,KAAK,SAAS,MAAM,KAAK;GAClD,OAAO;EACT,CAAC;CACH;CAEA,MAAa,IAAI,MAAgC;EAC/C,OAAQ,MAAM,KAAK,IAAI,IAAI,MAAO;CACpC;CAEA,MAAa,IAAI,MAAc,OAA8B;EAC3D,KAAK,SAAS,IAAI;EAClB,IAAI,OAAO,UAAU,UAAU,MAAM,IAAI,iBAAiB,eAAe;EAEzE,KAAK,SAAS,MAAM,KAAK;EACzB,OAAO,KAAK,KAAK,YAAY;GAC3B,IAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,QAAQ,IAAI,KAAK,WAAW,IAAI;IAC5D,IAAI,aAAa,QAAW,KAAK,SAAS,MAAM,QAAQ;IACxD,OAAO,KAAK,QAAQ,IAAI,KAAK,WAAW,MAAM,KAAK;GACrD;GACA,KAAK,eAAe,IAAI;GACxB,MAAM,UAAU,MAAM,KAAK,QAAQ;GACnC,MAAM,UAAU,WAAW,KAAK;GAChC,IAAI,SAAS;IACX,MAAM,WAAW,MAAM,KAAK,KAAK,IAAI,KAAK,WAAW,IAAI;IACzD,IAAI,aAAa,QAAW,KAAK,SAAS,MAAM,QAAQ;GAC1D;GAEA,MAAM,WAAW,MAAM,QAAQ,IAAI,KAAK,WAAW,IAAI;GACvD,IAAI,aAAa,QAAW,KAAK,SAAS,MAAM,QAAQ;GACxD,MAAM,QAAQ,IAAI,KAAK,WAAW,MAAM,KAAK;GAC7C,IAAI,SAAS,MAAM,KAAK,KAAK,OAAO,KAAK,WAAW,IAAI;EAC1D,CAAC;CACH;;CAGA,MAAa,OAAO,MAAgC;EAClD,KAAK,SAAS,IAAI;EAClB,KAAK,SAAS,IAAI;EAClB,OAAO,KAAK,KAAK,YAAY;GAC3B,IAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,QAAQ,IAAI,KAAK,WAAW,IAAI;IAC5D,IAAI,aAAa,QAAW,KAAK,SAAS,MAAM,QAAQ;IACxD,OAAO,KAAK,QAAQ,OAAO,KAAK,WAAW,IAAI;GACjD;GACA,KAAK,eAAe,IAAI;GACxB,MAAM,UAAU,MAAM,KAAK,QAAQ;GACnC,MAAM,WAAW,MAAM,SAAS,IAAI,KAAK,WAAW,IAAI;GACxD,IAAI,aAAa,QAAW,KAAK,SAAS,MAAM,QAAQ;GACxD,MAAM,WAAW,MAAM,KAAK,KAAK,IAAI,KAAK,WAAW,IAAI;GACzD,IAAI,aAAa,QAAW,KAAK,SAAS,MAAM,QAAQ;GACxD,MAAM,UAAW,MAAM,SAAS,OAAO,KAAK,WAAW,IAAI,KAAM;GACjE,OAAQ,MAAM,KAAK,KAAK,OAAO,KAAK,WAAW,IAAI,KAAM;EAC3D,CAAC;CACH;AACF"}

package/esm/secrets/secrets.d.mts

@@ -0,0 +1,11 @@
+//#region ../../packages/core/src/secrets/secrets.d.ts
+/** App identity and configuration are resolved on first use, after config has loaded. */
+export declare const secrets: {
+  get(name: string): Promise<string | undefined>;
+  set(name: string, value: string): Promise<void>;
+  remove(name: string): Promise<boolean>;
+  has(name: string): Promise<boolean>;
+  environmentName(name: string): string;
+};
+//#endregion
+//# sourceMappingURL=secrets.d.mts.map

package/esm/secrets/secrets.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/secrets/secrets.ts"],"mappings":";;qBA6Ca;EACL,IAAG,eAAgB;EAGnB,IAAG,cAAa,gBAAkB;EAGlC,OAAM,eAAgB;EAGtB,IAAG,eAAgB;EAGzB,gBAAe"}

package/esm/secrets/secrets.mjs

@@ -0,0 +1,72 @@
+import { config } from "../config/config-getter.mjs";
+import { rootPath, storagePath } from "../utils/paths.mjs";
+import { resolveSecretsDriver } from "./resolve-driver.mjs";
+import { SecretStore } from "./secret-store.mjs";
+import { createHash } from "node:crypto";
+import path from "node:path";
+
+//#region ../../packages/core/src/secrets/secrets.ts
+let testBackend;
+let stores = /* @__PURE__ */ new Map();
+/** @internal The test kit swaps only the facade, never explicitly constructed stores. */
+function replaceSecretsBackend(backend) {
+	const previous = testBackend;
+	const previousStores = stores;
+	testBackend = backend;
+	stores = /* @__PURE__ */ new Map();
+	return () => {
+		testBackend = previous;
+		stores = previousStores;
+	};
+}
+function current() {
+	const root = rootPath();
+	const appName = config.key("app.appName") || path.basename(root);
+	const namespace = config.key("secrets.namespace") ?? `${appName}:${createHash("sha256").update(root).digest("hex")}`;
+	const directory = config.key("secrets.directory") ?? storagePath("secrets");
+	const options = {
+		driver: config.key("secrets.driver"),
+		allowMemoryInProduction: config.key("secrets.allowMemoryInProduction")
+	};
+	const driver = testBackend ? "auto" : resolveSecretsDriver(options);
+	const identity = JSON.stringify([
+		root,
+		namespace,
+		directory,
+		driver
+	]);
+	let store = stores.get(identity);
+	if (!store) {
+		store = new SecretStore({
+			...options,
+			driver,
+			namespace,
+			directory,
+			backend: testBackend
+		});
+		stores.set(identity, store);
+	}
+	return store;
+}
+/** App identity and configuration are resolved on first use, after config has loaded. */
+const secrets = {
+	async get(name) {
+		return current().get(name);
+	},
+	async set(name, value) {
+		return current().set(name, value);
+	},
+	async remove(name) {
+		return current().remove(name);
+	},
+	async has(name) {
+		return current().has(name);
+	},
+	environmentName(name) {
+		return current().environmentName(name);
+	}
+};
+
+//#endregion
+export { replaceSecretsBackend, secrets };
+//# sourceMappingURL=secrets.mjs.map

package/esm/secrets/secrets.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.mjs","names":[],"sources":["../../../../../../../../packages/core/src/secrets/secrets.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport path from \"node:path\";\nimport { config } from \"../config/config-getter\";\nimport { rootPath, storagePath } from \"../utils/paths\";\nimport { resolveSecretsDriver } from \"./resolve-driver\";\nimport { SecretStore } from \"./secret-store\";\nimport type { SecretBackend, SecretsConfigurations } from \"./types\";\n\nlet testBackend: SecretBackend | undefined;\nlet stores = new Map<string, SecretStore>();\n\n/** @internal The test kit swaps only the facade, never explicitly constructed stores. */\nexport function replaceSecretsBackend(backend: SecretBackend): () => void {\n  const previous = testBackend;\n  const previousStores = stores;\n  testBackend = backend;\n  stores = new Map();\n  return () => {\n    testBackend = previous;\n    stores = previousStores;\n  };\n}\n\nfunction current(): SecretStore {\n  const root = rootPath();\n  const appName = config.key<string | undefined>(\"app.appName\") || path.basename(root);\n  const namespace =\n    config.key<string | undefined>(\"secrets.namespace\") ??\n    `${appName}:${createHash(\"sha256\").update(root).digest(\"hex\")}`;\n  const directory = config.key<string | undefined>(\"secrets.directory\") ?? storagePath(\"secrets\");\n  const options: SecretsConfigurations = {\n    driver: config.key<SecretsConfigurations[\"driver\"]>(\"secrets.driver\"),\n    allowMemoryInProduction: config.key<boolean | undefined>(\"secrets.allowMemoryInProduction\"),\n  };\n  const driver = testBackend ? \"auto\" : resolveSecretsDriver(options);\n  const identity = JSON.stringify([root, namespace, directory, driver]);\n  let store = stores.get(identity);\n  if (!store) {\n    store = new SecretStore({ ...options, driver, namespace, directory, backend: testBackend });\n    stores.set(identity, store);\n  }\n  return store;\n}\n\n/** App identity and configuration are resolved on first use, after config has loaded. */\nexport const secrets = {\n  async get(name: string): Promise<string | undefined> {\n    return current().get(name);\n  },\n  async set(name: string, value: string): Promise<void> {\n    return current().set(name, value);\n  },\n  async remove(name: string): Promise<boolean> {\n    return current().remove(name);\n  },\n  async has(name: string): Promise<boolean> {\n    return current().has(name);\n  },\n  environmentName(name: string): string {\n    return current().environmentName(name);\n  },\n};\n"],"mappings":";;;;;;;;AAQA,IAAI;AACJ,IAAI,yBAAS,IAAI,IAAyB;;AAG1C,SAAgB,sBAAsB,SAAoC;CACxE,MAAM,WAAW;CACjB,MAAM,iBAAiB;CACvB,cAAc;CACd,yBAAS,IAAI,IAAI;CACjB,aAAa;EACX,cAAc;EACd,SAAS;CACX;AACF;AAEA,SAAS,UAAuB;CAC9B,MAAM,OAAO,SAAS;CACtB,MAAM,UAAU,OAAO,IAAwB,aAAa,KAAK,KAAK,SAAS,IAAI;CACnF,MAAM,YACJ,OAAO,IAAwB,mBAAmB,KAClD,GAAG,QAAQ,GAAG,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK;CAC9D,MAAM,YAAY,OAAO,IAAwB,mBAAmB,KAAK,YAAY,SAAS;CAC9F,MAAM,UAAiC;EACrC,QAAQ,OAAO,IAAqC,gBAAgB;EACpE,yBAAyB,OAAO,IAAyB,iCAAiC;CAC5F;CACA,MAAM,SAAS,cAAc,SAAS,qBAAqB,OAAO;CAClE,MAAM,WAAW,KAAK,UAAU;EAAC;EAAM;EAAW;EAAW;CAAM,CAAC;CACpE,IAAI,QAAQ,OAAO,IAAI,QAAQ;CAC/B,IAAI,CAAC,OAAO;EACV,QAAQ,IAAI,YAAY;GAAE,GAAG;GAAS;GAAQ;GAAW;GAAW,SAAS;EAAY,CAAC;EAC1F,OAAO,IAAI,UAAU,KAAK;CAC5B;CACA,OAAO;AACT;;AAGA,MAAa,UAAU;CACrB,MAAM,IAAI,MAA2C;EACnD,OAAO,QAAQ,CAAC,CAAC,IAAI,IAAI;CAC3B;CACA,MAAM,IAAI,MAAc,OAA8B;EACpD,OAAO,QAAQ,CAAC,CAAC,IAAI,MAAM,KAAK;CAClC;CACA,MAAM,OAAO,MAAgC;EAC3C,OAAO,QAAQ,CAAC,CAAC,OAAO,IAAI;CAC9B;CACA,MAAM,IAAI,MAAgC;EACxC,OAAO,QAAQ,CAAC,CAAC,IAAI,IAAI;CAC3B;CACA,gBAAgB,MAAsB;EACpC,OAAO,QAAQ,CAAC,CAAC,gBAAgB,IAAI;CACvC;AACF"}

package/esm/secrets/types.d.mts

@@ -0,0 +1,26 @@
+//#region ../../packages/core/src/secrets/types.d.ts
+/** Backend implementations must never log credentials or attach them to errors. */
+export interface SecretBackend {
+  get(namespace: string, name: string): Promise<string | undefined>;
+  set(namespace: string, name: string, value: string): Promise<void>;
+  remove(namespace: string, name: string): Promise<boolean>;
+}
+export type SecretsConfigurations = {
+  /** auto selects keychain/environment/files; memory is isolated to this process. */
+  driver?: "auto" | "memory";
+  /** Explicitly permit the volatile memory driver under NODE_ENV=production. */
+  allowMemoryInProduction?: boolean;
+  /** Stable identity shared only by processes belonging to this app installation. */
+  namespace?: string;
+  /** Trusted parent location; defaults to storage/secrets. */
+  directory?: string;
+};
+export type SecretStoreOptions = SecretsConfigurations & {
+  namespace: string;
+  /** Bypasses keychain, environment and files, for isolated tests. */
+  backend?: SecretBackend;
+  /** Defaults to the current encryption.key config, read only when files are used. */
+  encryptionKey?: string | (() => string | undefined);
+};
+//#endregion
+//# sourceMappingURL=types.d.mts.map

package/esm/secrets/types.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/secrets/types.ts"],"mappings":";;iBACiB;EACf,IAAI,mBAAmB,eAAe;EACtC,IAAI,mBAAmB,cAAc,gBAAgB;EACrD,OAAO,mBAAmB,eAAe;;YAG/B;;EAEV;;EAEA;;EAEA;;EAEA;;YAGU,qBAAqB;EAC/B;;EAEA,UAAU;;EAEV"}