@wrongstack/core 0.310.1 → 0.313.1

package/dist/chunk-6AKOTGLM.js

@@ -0,0 +1,597 @@
+import {
+  encryptConfigSecrets,
+  isSecretField
+} from "./chunk-YY6APYUM.js";
+import {
+  restrictFilePermissions
+} from "./chunk-H5E77KUJ.js";
+import {
+  deepMerge
+} from "./chunk-DEIQMBD2.js";
+import {
+  atomicWrite
+} from "./chunk-7ZHZE5EO.js";
+import {
+  ConfigError,
+  ERROR_CODES
+} from "./chunk-WOEZV3Q4.js";
+
+// src/types/secret-vault.ts
+var ENCRYPTED_PREFIX_PATTERN = /^enc:v(\d+):/;
+function encryptedPrefixForVersion(version) {
+  return `enc:v${version}:`;
+}
+function parseEncryptedVersion(value) {
+  const match = value.match(ENCRYPTED_PREFIX_PATTERN);
+  return match ? Number.parseInt(match[1], 10) : void 0;
+}
+var noOpVault = {
+  encrypt: (v) => v,
+  decrypt: (v) => v,
+  isEncrypted: () => false,
+  keyVersion: 1
+};
+
+// src/security/secret-vault.ts
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto";
+import * as fs from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as path from "node:path";
+var KEY_BYTES = 32;
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+var ALGO = "aes-256-gcm";
+var KEY_FILE_MODE = 384;
+var KEY_FILE_MAGIC = Buffer.from("WSKV", "ascii");
+var VERSIONED_KEY_FILE_SIZE = KEY_FILE_MAGIC.length + 1 + KEY_BYTES;
+var KEK_MAGIC = Buffer.from("WSKW", "ascii");
+var KEK_SALT_BYTES = 16;
+var WRAPPED_KEY_FILE_SIZE = KEK_MAGIC.length + 1 + KEK_SALT_BYTES + IV_BYTES + TAG_BYTES + KEY_BYTES;
+var SCRYPT_N = 1 << 15;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SCRYPT_MAXMEM = 64 * 1024 * 1024;
+function getVaultPassphrase() {
+  const v = process.env["WRONGSTACK_VAULT_PASSPHRASE"];
+  return v && v.length > 0 ? v : void 0;
+}
+function isWrappedKeyFile(buf) {
+  return buf.length === WRAPPED_KEY_FILE_SIZE && buf.subarray(0, KEK_MAGIC.length).equals(KEK_MAGIC);
+}
+function deriveKEK(passphrase, salt) {
+  return scryptSync(passphrase, salt, KEY_BYTES, {
+    N: SCRYPT_N,
+    r: SCRYPT_R,
+    p: SCRYPT_P,
+    maxmem: SCRYPT_MAXMEM
+  });
+}
+function wrapDataKey(dataKey, keyVersion, passphrase) {
+  const salt = randomBytes(KEK_SALT_BYTES);
+  const iv = randomBytes(IV_BYTES);
+  const kek = deriveKEK(passphrase, salt);
+  const cipher = createCipheriv(ALGO, kek, iv);
+  const ct = Buffer.concat([cipher.update(dataKey), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const out = Buffer.alloc(WRAPPED_KEY_FILE_SIZE);
+  let off = 0;
+  KEK_MAGIC.copy(out, off);
+  off += KEK_MAGIC.length;
+  out[off] = keyVersion & 255;
+  off += 1;
+  salt.copy(out, off);
+  off += KEK_SALT_BYTES;
+  iv.copy(out, off);
+  off += IV_BYTES;
+  tag.copy(out, off);
+  off += TAG_BYTES;
+  ct.copy(out, off);
+  return out;
+}
+function unwrapDataKey(buf, keyFile) {
+  const passphrase = getVaultPassphrase();
+  if (!passphrase) {
+    throw new ConfigError({
+      message: `SecretVault: key file ${keyFile} is passphrase-protected \u2014 set the WRONGSTACK_VAULT_PASSPHRASE environment variable to unlock it.`,
+      code: ERROR_CODES.CONFIG_INVALID,
+      context: { keyFile }
+    });
+  }
+  let off = KEK_MAGIC.length;
+  const version = buf[off];
+  off += 1;
+  const salt = buf.subarray(off, off + KEK_SALT_BYTES);
+  off += KEK_SALT_BYTES;
+  const iv = buf.subarray(off, off + IV_BYTES);
+  off += IV_BYTES;
+  const tag = buf.subarray(off, off + TAG_BYTES);
+  off += TAG_BYTES;
+  const ct = buf.subarray(off, off + KEY_BYTES);
+  const kek = deriveKEK(passphrase, salt);
+  const decipher = createDecipheriv(ALGO, kek, iv);
+  decipher.setAuthTag(tag);
+  try {
+    const key = Buffer.concat([decipher.update(ct), decipher.final()]);
+    return { key: Buffer.from(key), version };
+  } catch {
+    throw new ConfigError({
+      message: `SecretVault: failed to unlock key file ${keyFile} \u2014 wrong WRONGSTACK_VAULT_PASSPHRASE (key unwrap authentication failed).`,
+      code: ERROR_CODES.CONFIG_INVALID,
+      context: { keyFile }
+    });
+  }
+}
+function keyFileNeedsHardening(keyFile, opts) {
+  if (process.platform === "win32") return false;
+  const warn = opts?.warn ?? ((msg) => console.warn(msg));
+  try {
+    const stat = fs.statSync(keyFile);
+    const actualMode = stat.mode & 511;
+    if (actualMode !== KEY_FILE_MODE) {
+      warn(
+        `Key file ${keyFile} has mode ${actualMode.toString(8)} \u2014 expected ${KEY_FILE_MODE.toString(8)}. Hardening\u2026`
+      );
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+function mkdirSecretDirSync(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (process.platform === "win32") return;
+  try {
+    fs.chmodSync(dir, 448);
+  } catch {
+  }
+}
+function writeKeyFileAtomicSync(keyFile, content) {
+  const tmp = `${keyFile}.${randomBytes(4).toString("hex")}.tmp`;
+  const fd = fs.openSync(tmp, "w", 384);
+  try {
+    fs.writeFileSync(fd, content);
+    try {
+      fs.fsyncSync(fd);
+    } catch {
+    }
+  } finally {
+    fs.closeSync(fd);
+  }
+  try {
+    fs.renameSync(tmp, keyFile);
+  } catch (err) {
+    try {
+      fs.unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+var DefaultSecretVault = class {
+  keyFile;
+  logger;
+  key;
+  _keyVersion = 1;
+  /**
+   * Pending key-file hardening promises (Windows ACL restrictions via icacls).
+   * Tracked so async callers can `flushHardening()` before returning, ensuring
+   * a short-lived CLI process does not exit before the hardening resolves.
+   * Sync-only callers (encrypt/decrypt lazy-load) leave these pending —
+   * hardening remains best-effort in that case.
+   */
+  pendingHardening = [];
+  constructor(opts) {
+    this.keyFile = opts.keyFile;
+    this.logger = opts.logger;
+  }
+  /**
+   * Emit a structured warning. Uses the configured Logger when available;
+   * falls back to console.warn(JSON) so warnings are never silently dropped
+   * during early boot.
+   */
+  logWarn(msg, ctx) {
+    if (this.logger) {
+      this.logger.warn(msg, ctx);
+    } else {
+      console.warn(JSON.stringify({ ...ctx, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    }
+  }
+  /**
+   * Schedule best-effort key-file hardening and track the promise so async
+   * callers can await it via `flushHardening()` before returning. Rejections
+   * are swallowed here (the helper already warns on failure) so a rejection
+   * can never become an unhandled one.
+   */
+  scheduleKeyHardening() {
+    const p = restrictFilePermissions(this.keyFile, {
+      label: "secret-vault-key",
+      warn: (msg) => this.logWarn(msg)
+    }).catch(() => void 0);
+    this.pendingHardening.push(p);
+  }
+  /** Detect and schedule repair of a pre-existing POSIX key with loose mode bits. */
+  checkKeyFilePermissions() {
+    if (keyFileNeedsHardening(this.keyFile, {
+      warn: (msg) => this.logWarn(msg)
+    })) {
+      this.scheduleKeyHardening();
+    }
+  }
+  /** Flush all pending key-file hardening promises. */
+  flushHardening() {
+    if (this.pendingHardening.length === 0) return Promise.resolve();
+    const all = Promise.all(this.pendingHardening).then(() => void 0);
+    this.pendingHardening = [];
+    return all;
+  }
+  /** Current key version. Starts at 1; incremented by rotateKey(). */
+  get keyVersion() {
+    if (!this.key) this.loadOrCreateKey();
+    return this._keyVersion;
+  }
+  isEncrypted(value) {
+    return typeof value === "string" && ENCRYPTED_PREFIX_PATTERN.test(value);
+  }
+  encrypt(plaintext) {
+    if (this.isEncrypted(plaintext)) return plaintext;
+    const key = this.loadOrCreateKey();
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv(ALGO, key, iv);
+    const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const prefix = encryptedPrefixForVersion(this._keyVersion);
+    return `${prefix}${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
+  }
+  decrypt(value) {
+    if (!this.isEncrypted(value)) return value;
+    const prefixMatch = value.match(ENCRYPTED_PREFIX_PATTERN);
+    if (!prefixMatch) {
+      throw new ConfigError({
+        message: "SecretVault: malformed encrypted value",
+        code: ERROR_CODES.CONFIG_PARSE_FAILED,
+        context: { field: "encrypted_value" }
+      });
+    }
+    const rest = value.slice(prefixMatch[0].length);
+    const parts = rest.split(":");
+    if (parts.length !== 3) {
+      throw new ConfigError({
+        message: "SecretVault: malformed encrypted value",
+        code: ERROR_CODES.CONFIG_PARSE_FAILED,
+        context: { field: "encrypted_value" }
+      });
+    }
+    const [ivB64, tagB64, ctB64] = parts;
+    const iv = Buffer.from(ivB64, "base64");
+    const tag = Buffer.from(tagB64, "base64");
+    const ct = Buffer.from(ctB64, "base64");
+    if (iv.length !== IV_BYTES)
+      throw new ConfigError({
+        message: "SecretVault: bad IV length",
+        code: ERROR_CODES.CONFIG_PARSE_FAILED,
+        context: { expected: IV_BYTES, actual: iv.length }
+      });
+    if (tag.length !== TAG_BYTES)
+      throw new ConfigError({
+        message: "SecretVault: bad tag length",
+        code: ERROR_CODES.CONFIG_PARSE_FAILED,
+        context: { expected: TAG_BYTES, actual: tag.length }
+      });
+    const key = this.loadOrCreateKey();
+    const decipher = createDecipheriv(ALGO, key, iv);
+    decipher.setAuthTag(tag);
+    const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+    return pt.toString("utf8");
+  }
+  /**
+   * Generate a new encryption key, write it to disk, and increment the key version.
+   * After rotation, encrypt() emits the new version prefix (e.g. enc:v2:).
+   * The caller must re-encrypt existing config values (see rotateConfigKeys()).
+   */
+  rotateKey() {
+    const oldVersion = this._keyVersion;
+    const newKey = randomBytes(KEY_BYTES);
+    const newVersion = oldVersion + 1;
+    mkdirSecretDirSync(path.dirname(this.keyFile));
+    const passphrase = getVaultPassphrase();
+    if (passphrase) {
+      writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
+    } else {
+      const keyFileBuf = Buffer.alloc(VERSIONED_KEY_FILE_SIZE);
+      KEY_FILE_MAGIC.copy(keyFileBuf, 0);
+      keyFileBuf[KEY_FILE_MAGIC.length] = newVersion;
+      newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
+      writeKeyFileAtomicSync(this.keyFile, keyFileBuf);
+    }
+    this.scheduleKeyHardening();
+    this.checkKeyFilePermissions();
+    this.key = newKey;
+    this._keyVersion = newVersion;
+    return { oldVersion, newVersion };
+  }
+  /**
+   * If WRONGSTACK_VAULT_PASSPHRASE is set but the key on disk is still stored
+   * unwrapped (legacy v1 / versioned v2), re-write it in passphrase-wrapped (v3)
+   * form. The data key is preserved, so all existing ciphertext keeps
+   * decrypting. Best-effort: a write failure leaves the working unwrapped file
+   * in place and is not fatal to load.
+   */
+  migrateToWrappedIfPassphrase() {
+    const passphrase = getVaultPassphrase();
+    if (!passphrase || !this.key) return;
+    try {
+      writeKeyFileAtomicSync(this.keyFile, wrapDataKey(this.key, this._keyVersion, passphrase));
+      this.scheduleKeyHardening();
+      this.checkKeyFilePermissions();
+    } catch {
+    }
+  }
+  loadOrCreateKey() {
+    if (this.key) return this.key;
+    try {
+      const buf = fs.readFileSync(this.keyFile);
+      if (isWrappedKeyFile(buf)) {
+        const { key: key2, version } = unwrapDataKey(buf, this.keyFile);
+        this.key = key2;
+        this._keyVersion = version;
+        this.checkKeyFilePermissions();
+        return this.key;
+      }
+      if (buf.length === KEY_BYTES) {
+        this.key = buf;
+        this._keyVersion = 1;
+        this.checkKeyFilePermissions();
+        this.migrateToWrappedIfPassphrase();
+        return this.key;
+      }
+      if (buf.length === VERSIONED_KEY_FILE_SIZE) {
+        const magic = buf.subarray(0, KEY_FILE_MAGIC.length);
+        if (!magic.equals(KEY_FILE_MAGIC)) {
+          throw new ConfigError({
+            message: `SecretVault: key file ${this.keyFile} has invalid magic header`,
+            code: ERROR_CODES.CONFIG_INVALID,
+            context: { keyFile: this.keyFile }
+          });
+        }
+        const version = buf[KEY_FILE_MAGIC.length];
+        const key2 = buf.subarray(KEY_FILE_MAGIC.length + 1);
+        if (key2.length !== KEY_BYTES) {
+          throw new ConfigError({
+            message: `SecretVault: key file ${this.keyFile} has wrong key size (${key2.length} bytes, expected ${KEY_BYTES})`,
+            code: ERROR_CODES.CONFIG_INVALID,
+            context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: key2.length }
+          });
+        }
+        this.key = Buffer.from(key2);
+        this._keyVersion = version;
+        this.checkKeyFilePermissions();
+        this.migrateToWrappedIfPassphrase();
+        return this.key;
+      }
+      throw new ConfigError({
+        message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES} for v1 or ${VERSIONED_KEY_FILE_SIZE} for v2+). Remove it manually to generate a new key.`,
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
+      });
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+    mkdirSecretDirSync(path.dirname(this.keyFile));
+    const key = randomBytes(KEY_BYTES);
+    const passphrase = getVaultPassphrase();
+    const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
+    try {
+      fs.writeFileSync(this.keyFile, initialBytes, { mode: 384, flag: "wx" });
+      this.scheduleKeyHardening();
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      this.scheduleKeyHardening();
+      const buf = fs.readFileSync(this.keyFile);
+      if (isWrappedKeyFile(buf)) {
+        const { key: winnerKey, version } = unwrapDataKey(buf, this.keyFile);
+        this.key = winnerKey;
+        this._keyVersion = version;
+        this.checkKeyFilePermissions();
+        return this.key;
+      }
+      if (buf.length === KEY_BYTES) {
+        this.key = buf;
+        this._keyVersion = 1;
+        this.checkKeyFilePermissions();
+        return this.key;
+      }
+      if (buf.length === VERSIONED_KEY_FILE_SIZE) {
+        const magic = buf.subarray(0, KEY_FILE_MAGIC.length);
+        if (!magic.equals(KEY_FILE_MAGIC)) {
+          throw new ConfigError({
+            message: `SecretVault: key file ${this.keyFile} has invalid magic header`,
+            code: ERROR_CODES.CONFIG_INVALID,
+            context: { keyFile: this.keyFile }
+          });
+        }
+        const version = buf[KEY_FILE_MAGIC.length];
+        const winnerKey = buf.subarray(KEY_FILE_MAGIC.length + 1);
+        this.key = Buffer.from(winnerKey);
+        this._keyVersion = version;
+        this.checkKeyFilePermissions();
+        return this.key;
+      }
+      throw new ConfigError({
+        message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES} for v1 or ${VERSIONED_KEY_FILE_SIZE} for v2+). Remove it manually to generate a new key.`,
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
+      });
+    }
+    this.key = key;
+    this._keyVersion = 1;
+    return key;
+  }
+};
+async function rewriteConfigEncrypted(configPath, vault, patch) {
+  let current = {};
+  try {
+    const raw = await fsp.readFile(configPath, "utf8");
+    current = JSON.parse(raw);
+  } catch {
+  }
+  const merged = deepMerge(current, patch ?? {});
+  const encrypted = encryptConfigSecrets(merged, vault);
+  await fsp.mkdir(path.dirname(configPath), { recursive: true });
+  await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  await restrictFilePermissions2(configPath);
+  await vault.flushHardening?.();
+}
+async function migratePlaintextSecrets(configPath, vault, logger) {
+  let raw;
+  try {
+    raw = await fsp.readFile(configPath, "utf8");
+  } catch {
+    return { migrated: 0, file: configPath };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { migrated: 0, file: configPath };
+  }
+  const counter = { n: 0 };
+  const migrated = walkCount(parsed, vault, counter);
+  if (counter.n === 0) return { migrated: 0, file: configPath };
+  await atomicWrite(configPath, JSON.stringify(migrated, null, 2), { mode: 384 });
+  await restrictFilePermissions2(
+    configPath,
+    logger ? { warn: (msg) => logger.warn(msg) } : void 0
+  );
+  await vault.flushHardening?.();
+  return { migrated: counter.n, file: configPath };
+}
+async function rotateConfigKeys(configPath, vault, logger) {
+  const log = logger?.info ?? (() => {
+  });
+  const warn = logger?.warn ?? ((msg) => console.warn(msg));
+  let raw;
+  try {
+    raw = await fsp.readFile(configPath, "utf8");
+  } catch {
+    const { oldVersion: oldVersion2, newVersion: newVersion2 } = vault.rotateKey();
+    log(
+      `[secret-vault] Key rotated (v${oldVersion2} \u2192 v${newVersion2}) \u2014 no config file to re-encrypt`
+    );
+    await vault.flushHardening?.();
+    return { rotated: 0, oldVersion: oldVersion2, newVersion: newVersion2, file: configPath };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    warn(`[secret-vault] Config file ${configPath} is not valid JSON \u2014 skipping rotation`);
+    return {
+      rotated: 0,
+      oldVersion: vault.keyVersion,
+      newVersion: vault.keyVersion,
+      file: configPath
+    };
+  }
+  const counter = { n: 0, failed: [] };
+  const decrypted = walkDecryptCount(parsed, vault, counter);
+  if (counter.failed.length > 0) {
+    throw new Error(
+      `[secret-vault] Aborting key rotation: ${counter.failed.length} field(s) could not be decrypted with the current key and would be permanently lost on rotation: ${counter.failed.join(", ")}. Restore or remove these fields before rotating.`
+    );
+  }
+  if (counter.n === 0) {
+    const { oldVersion: oldVersion2, newVersion: newVersion2 } = vault.rotateKey();
+    log(
+      `[secret-vault] Key rotated (v${oldVersion2} \u2192 v${newVersion2}) \u2014 no encrypted fields to re-encrypt`
+    );
+    await vault.flushHardening?.();
+    return { rotated: 0, oldVersion: oldVersion2, newVersion: newVersion2, file: configPath };
+  }
+  const { oldVersion, newVersion } = vault.rotateKey();
+  const reencrypted = walkReencrypt(decrypted, vault);
+  await atomicWrite(configPath, JSON.stringify(reencrypted, null, 2), { mode: 384 });
+  await restrictFilePermissions2(configPath, { warn });
+  log(
+    `[secret-vault] Key rotated (v${oldVersion} \u2192 v${newVersion}) \u2014 re-encrypted ${counter.n} field(s)`
+  );
+  await vault.flushHardening?.();
+  return { rotated: counter.n, oldVersion, newVersion, file: configPath };
+}
+function walkDecryptCount(node, vault, counter, pathPrefix = "") {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map(
+      (item, i) => walkDecryptCount(item, vault, counter, `${pathPrefix}[${i}]`)
+    );
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [k, v] of Object.entries(node)) {
+    const keyPath = pathPrefix ? `${pathPrefix}.${k}` : k;
+    if (typeof v === "string" && vault.isEncrypted(v)) {
+      try {
+        out[k] = vault.decrypt(v);
+        counter.n++;
+      } catch {
+        counter.failed.push(keyPath);
+        out[k] = v;
+      }
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walkDecryptCount(v, vault, counter, keyPath);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+function walkReencrypt(node, vault) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walkReencrypt(item, vault));
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && isSecretField(k) && v.length > 0 && !vault.isEncrypted(v)) {
+      out[k] = vault.encrypt(v);
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walkReencrypt(v, vault);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+async function restrictFilePermissions2(filePath, opts) {
+  await restrictFilePermissions(filePath, { label: "secret-vault", warn: opts?.warn });
+}
+function walkCount(node, vault, counter) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walkCount(item, vault, counter));
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && isSecretField(k) && !vault.isEncrypted(v) && v.length > 0) {
+      out[k] = vault.encrypt(v);
+      counter.n++;
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walkCount(v, vault, counter);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
+export {
+  encryptedPrefixForVersion,
+  parseEncryptedVersion,
+  noOpVault,
+  DefaultSecretVault,
+  rewriteConfigEncrypted,
+  migratePlaintextSecrets,
+  rotateConfigKeys
+};
+//# sourceMappingURL=chunk-6AKOTGLM.js.map

package/dist/chunk-7ZHZE5EO.js

@@ -0,0 +1,28 @@
+import {
+  FsError
+} from "./chunk-WOEZV3Q4.js";
+
+// src/utils/atomic-write.ts
+import {
+  createPersistencePrimitives
+} from "@wrongstack/persistence";
+var primitives = createPersistencePrimitives({
+  createLockTimeoutError: ({ targetPath, timeoutMs }) => new FsError({
+    message: `Timed out waiting for file lock: ${targetPath}`,
+    code: "FS_ATOMIC_WRITE_FAILED",
+    path: targetPath,
+    context: { timeoutMs }
+  })
+});
+var atomicWrite = primitives.atomicWrite;
+var atomicReplaceWithWriter = primitives.atomicReplaceWithWriter;
+var ensureDir = primitives.ensureDir;
+var withFileLock = primitives.withFileLock;
+
+export {
+  atomicWrite,
+  atomicReplaceWithWriter,
+  ensureDir,
+  withFileLock
+};
+//# sourceMappingURL=chunk-7ZHZE5EO.js.map