configre 1.2.4 → 2.0.0

package/README.md

@@ -15,7 +15,7 @@ To get started with Configre, follow these steps:
 
 1. **Install the Library**
 
-   First, make sure you have `Node.js` installed. Then, add Configre to your project:
+   Configre requires **Node.js 22.13 or later**. Add it to your project:
 
    ```bash
    npm install configre --save
@@ -38,13 +38,29 @@ To get started with Configre, follow these steps:
 
 3. **Use Configre in Your Project**
 
-   Import and use Configre to load your configurations:
+   Import and use Configre to load your configurations. The configuration path is required:
 
    ```javascript
-   const cfg = require("Configre")(); // default dir '/config'
+   import Configre from "configre";
+   import { join } from "node:path";
+
+   const cfg = Configre(join(import.meta.dirname, "config"));
    console.log(cfg.db); // Access your db configuration
    ```
 
+   Prefer an absolute path anchored to the module, as above. Avoid deriving it from `process.cwd()` (for example, `path.join(process.cwd(), "config")`), because that can point to a different location depending on where the process is started.
+
+   Configre is a native ES module. CommonJS consumers keep the same synchronous API, without accessing `.default`:
+
+   ```javascript
+   const Configre = require("configre");
+   const { join } = require("node:path");
+
+   const cfg = Configre(join(__dirname, "config"));
+   ```
+
+   Both module systems share the same implementation. Existing configuration files stay in `.cjs` format; Configre uses Node's `createRequire` only to load these files synchronously.
+
 ## 📚 Example
 
 Imagine you have the following structure in your `config` directory:
@@ -92,6 +108,184 @@ node demo.js --port=3000 --config=myhost --debug
 
 This loads `config/staging.cjs` (or `config/staging.dev.cjs`) instead of the one for the actual hostname. The `--config=` flag can appear anywhere in the command and works alongside other arguments.
 
+## 🔐 Shared secrets: follow the demo
+
+The [secrets demo](demo/secrets/) shows how to keep API keys out of your public configuration and share them with a server through Git. Use one checkout as the **administrator**, where you edit secrets, and another as the **server**, which reads the encrypted values.
+
+Run the commands below from the repository root. In [demo/secrets/demo.js](demo/secrets/demo.js), the configuration is loaded with:
+
+```javascript
+import Configre from "../../index.js";
+import { join } from "node:path";
+
+const configPath = join(import.meta.dirname, "config");
+const cfg = Configre(configPath, { secrets: true });
+```
+
+`{ secrets: true }` enables this workflow. Loading remains synchronous, and your application reads the result through ordinary properties such as `cfg.api.key`.
+
+> The demo reports `API key configured:` without printing the key. Avoid logging `cfg` in your application: it contains the decrypted secrets.
+
+### 1. Start the demo on the administrator machine
+
+For this walkthrough, use an empty public placeholder in [demo/secrets/config/index.cjs](demo/secrets/config/index.cjs):
+
+```javascript
+module.exports = {
+    api: {
+        key: ""
+    }
+};
+```
+
+Then run:
+
+```bash
+node demo/secrets/demo.js
+```
+
+For a new setup, Configre creates the following files and directory:
+
+```text
+demo/secrets/config/
+  index.cjs          # Public configuration
+  index.secret.cjs   # Editable secrets; starts with module.exports = {};
+  recipients/        # Public keys of servers that register
+  secrets.enc.json   # Generated encrypted values
+  .gitignore         # Keeps .secret.cjs files out of Git
+```
+
+It also creates this OS user's identity outside the repository, at `~/.config/configre/identity.pem` and `identity.pub`.
+
+With the public placeholder empty and no secrets added, look for:
+
+```text
+API key configured: false
+```
+
+**`index.secret.cjs` starts empty on purpose.** Configre does not copy values from `index.cjs` into it. It contains only the fields you choose to override with secrets; public settings continue to come from `index.cjs`.
+
+These initialization steps describe a new setup. If `secrets.enc.json` already exists, Configre uses that encrypted file instead of resetting it. A checkout containing the encrypted file but no `.secret.cjs` files is treated as a server checkout.
+
+### 2. Add an API key and publish the encrypted file
+
+On the administrator machine, edit `demo/secrets/config/index.secret.cjs`:
+
+```javascript
+module.exports = {
+    api: {
+        key: ""
+    }
+};
+```
+
+Replace the empty string with your actual key **in this local file**, then run the demo again:
+
+```bash
+node demo/secrets/demo.js
+```
+
+Configre updates `demo/secrets/config/secrets.enc.json`, merges the secret into the configuration, and the demo reports:
+
+```text
+API key configured: true
+```
+
+Commit and push the demo's public files, including `config/index.cjs`, the generated `config/.gitignore`, and `config/secrets.enc.json`. Keep `config/index.secret.cjs` on the administrator machine.
+
+| File in `demo/secrets/config/` | Purpose | Share through Git? |
+| --- | --- | --- |
+| `index.cjs` | Public settings and empty placeholders | Yes |
+| `index.secret.cjs` | Values you edit on the administrator | No |
+| `secrets.enc.json` | Encrypted values generated by Configre | Yes |
+| `recipients/truco.pub` | Public identity of the server named `truco` | Yes; the server publishes it |
+| `.gitignore` | Excludes editable secret files | Yes |
+
+### 3. Register the server as `truco`
+
+On the server, clone or pull the repository **including `demo/secrets/config/secrets.enc.json`**. Use a branch with a configured upstream, Git author name/email, and credentials that allow a push without an interactive prompt. Before a new registration, the local branch must match its upstream.
+
+Run:
+
+```bash
+node demo/secrets/demo.js --config=truco
+```
+
+`--config=truco` selects the profile and names the public-key file. Without this flag, Configre uses the hostname.
+
+If this server is not authorized yet, Configre automatically:
+
+1. Creates its local identity, if needed.
+2. Writes `demo/secrets/config/recipients/truco.pub`.
+3. Creates and pushes a commit containing only that public-key file.
+4. Stops startup with a message explaining that the administrator must publish an updated encrypted file.
+
+This first stop is expected: publishing a public key does not let the server decrypt the existing ciphertext. Repeating the command does not publish another registration commit for the same key.
+
+### 4. Include the server in the encrypted file
+
+Back on the administrator machine:
+
+```bash
+git pull --ff-only
+node demo/secrets/demo.js
+```
+
+The pull brings in `demo/secrets/config/recipients/truco.pub`. When the demo runs, Configre automatically includes that public key and regenerates `demo/secrets/config/secrets.enc.json`. There is no separate approval step.
+
+Commit and push the updated encrypted file. Then, on the server:
+
+```bash
+git pull --ff-only
+node demo/secrets/demo.js --config=truco
+```
+
+The server can now decrypt the key, and the demo reports `API key configured: true`. It does not need `index.secret.cjs`; the value reaches `cfg.api.key` through the encrypted file.
+
+**Repository write access allows a machine to register for all project secrets.** Configre publishes the server's public key automatically. Pulling changes and publishing the administrator's updated encrypted file remain part of your Git/deployment workflow.
+
+### 5. Update keys or use profile-specific secrets
+
+To change the shared API key, edit `demo/secrets/config/index.secret.cjs` on the administrator and run:
+
+```bash
+node demo/secrets/demo.js
+```
+
+Commit and push the updated `secrets.enc.json`, then pull and restart the demo on the server. **You do not need to copy or register `truco.pub` again.** Its existing authorization also covers new keys you add later.
+
+For settings specific to `truco`, add `demo/secrets/config/truco.cjs`. The next administrator run creates an empty `truco.secret.cjs` counterpart, which you can fill with that profile's secrets. All profile secret files, including inactive ones, are encrypted together when the administrator runs the demo.
+
+For `--config=truco`, the merge order is:
+
+```text
+index.cjs → truco.cjs → index.secret.cjs → truco.secret.cjs
+```
+
+Later files override matching fields while preserving other fields. If `truco.dev.cjs` exists, it is selected instead of `truco.cjs`. Secret selection independently prefers `truco.dev.secret.cjs` over `truco.secret.cjs`; those two secret variants do not merge with each other. A missing profile uses the available base configuration and base secrets.
+
+To revoke this server, remove `demo/secrets/config/recipients/truco.pub`, run the demo on the administrator, and commit and push both the removal and the updated encrypted file. Remove the server's repository write access too if it must not register itself again. Revocation protects new encrypted versions; rotate the key at its provider to invalidate a credential the server already received.
+
+<details>
+<summary>File formats, Git behavior and recovery</summary>
+
+- Secret `.cjs` modules execute on the administrator and are reloaded on each Configre call. They must export plain objects containing JSON-compatible objects, arrays, strings, finite numbers, booleans and `null`. Functions, `undefined`, accessors, symbols, custom objects, circular references, and properties named `__proto__`, `constructor` or `prototype` are rejected. Consumers decrypt data without executing these modules.
+- Empty strings stay empty strings. Configre does not fill them from environment variables or populate `process.env`. The existing deep-merge behavior, including array merging, also applies to secrets.
+- Without `{ secrets: true }`, Configre does not access identities or secret files. The option also works with `new Configre(configPath, { secrets: true }).get()` and CommonJS consumers.
+- Each OS user has one identity reused across projects; authorization is per project. A service running under another OS user needs its own registration. All authorized identities can decrypt all profiles in the project's encrypted file.
+- Public recipient files must contain a single RSA-3072 public key in PEM format, with exponent 65537, as generated by Configre. Other file extensions are ignored, and duplicate keys do not add recipients. The administrator is always included.
+- Registration uses an isolated Git index and publishes only the public-key file. It preserves unrelated staged and unstaged changes, runs no commit or pre-push hooks, and does not push local tags, merge, rebase or force-push. Failed registrations can be retried at the next startup; each Git command has a 30-second timeout. An authorized server loads secrets without Git commands or project writes.
+- Registration names must start with a letter or digit and contain only letters, digits, dots, underscores or hyphens. If another key already occupies `truco.pub`, Configre stops without overwriting it; use a distinct profile or resolve the key replacement explicitly.
+- Configre appends Git exclusions without removing existing rules and refuses to proceed on the administrator if editable secret modules are already tracked. It does not untrack files or rewrite history. It also prepares `.gitignore` when no repository exists yet.
+- The administrator's `.secret.cjs` files are the source of truth for values, and `recipients/` is the source of truth for authorization. Removing all recipient files revokes them on the next administrator reload; old ciphertext does not restore them. Recover accidentally deleted public-key files from Git before reloading. Missing Git exclusions and ciphertext are regenerated on the administrator, and existing secret modules are never overwritten.
+- Back up the administrator's editable secrets and private identity securely. Never share or commit `identity.pem`. On POSIX, its directory must have owner-only permissions (`0700`) and the private file must have owner-only permissions (`0600`); on Windows, protection depends on the user profile's filesystem permissions. Private identities and secret input files cannot be symlinks.
+- A corrupt or missing private identity is never silently replaced. Restore it from backup, or register a new identity on a consumer. A missing public file can be regenerated from the valid private key. Losing every authorized private key makes existing ciphertext unrecoverable; an administrator with surviving editable secret files can create fresh ciphertext.
+- The encrypted JSON envelope uses AES-256-GCM with a fresh content key and nonce for each update, wrapping that key for each recipient with RSA-3072 / OAEP-SHA-256. Version and recipient metadata are authenticated. Invalid modules, malformed ciphertext and authentication failures stop loading without replacing the existing encrypted file.
+- Ciphertext is replaced atomically under an exclusive writer lock. Temporary vault files contain only encrypted data and public metadata. After a crash, remove a reported stale `.lock` only after confirming its writer has stopped. Unchanged values and recipient keys do not cause a rewrite.
+- For an individual configuration file, the same workflow uses sidecars beside that file: `settings.secret.cjs`, `settings.cjs.recipients/` and `settings.cjs.secrets.enc.json`. An extensionless path resolving to `settings.cjs` uses the same sidecars.
+
+</details>
+
 ## 🤔 Why Configre?
 
 - **No More Manual Switching**: Automatically adjusts your configuration based on the environment.
@@ -114,4 +308,4 @@ Permission is hereby granted, free of charge, to any person obtaining a copy of
 
 The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/demo/demo.js

@@ -1,4 +1,8 @@
-const cfg = require("../index")(__dirname + "/config");
-const log = require("lemonlog")("Configre");
+import Configre from "../index.js";
+import lemonlog from "lemonlog";
+import { join } from "node:path";
 
-log.info(cfg.db);
+const cfg = Configre(join(import.meta.dirname, "config"));
+const log = lemonlog("Configre");
+
+log.info(cfg.db);

package/demo/module/demo.js

@@ -1,12 +1,8 @@
 import Configre from "../../index.js";
 import lemonlog from "lemonlog";
-import { fileURLToPath } from "url";
-import { dirname, join } from "path";
+import { join } from "node:path";
 
 const log = lemonlog("Configre");
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
 
-const cfg = Configre(join(__dirname, "config"));
+const cfg = Configre(join(import.meta.dirname, "config"));
 log.info(cfg.db);
-

package/demo/secrets/config/index.cjs

@@ -0,0 +1,5 @@
+module.exports = {
+    api: {
+        key: ""
+    }
+};

package/demo/secrets/demo.js

@@ -0,0 +1,9 @@
+import Configre from "../../index.js";
+import { join } from "node:path";
+
+const configPath = join(import.meta.dirname, "config");
+const cfg = Configre(configPath, { secrets: true });
+console.info("API key configured:", Boolean(cfg.api.key));
+console.info(`Set api.key in ${join(configPath, "index.secret.cjs")} and run this demo again.`);
+console.info(`New servers automatically publish their public key in ${join(configPath, "recipients")}. Pull and rerun here to authorize them.`);
+console.info(`Share ${join(configPath, "secrets.enc.json")} through Git.`);

package/index.js

@@ -1,34 +1,55 @@
-const fs = require("fs");
-const path = require("path");
-const os = require("os");
-const obj = require("./merge");
-const log = require("lemonlog")("Configre");
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { createRequire } from "node:module";
+import lemonlog from "lemonlog";
+import { merge } from "./merge.js";
+import loadSecrets from "./secrets/index.js";
+
+const requireConfig = createRequire(import.meta.url);
+const log = lemonlog("Configre");
 
 class ConfigreClass {
-    constructor(pathOrDir = __dirname + "/../../config") {
+    constructor(pathOrDir, options = {}) {
+        if (typeof pathOrDir !== "string" || pathOrDir.length === 0) {
+            throw new TypeError("Configre path must be a non-empty string");
+        }
+        if (options === null || typeof options !== "object" || Array.isArray(options) ||
+            (options.secrets !== undefined && typeof options.secrets !== "boolean")) {
+            throw new TypeError("Configre options must be an object with an optional boolean secrets property");
+        }
+
         const dir = path.join(pathOrDir);
         const isNested = (ConfigreClass._nesting || 0) > 0;
         ConfigreClass._nesting = (ConfigreClass._nesting || 0) + 1;
 
-        this.defaultSettings = this.tryRequire([
-            dir,
-            path.join(dir, "index.cjs"),
-            pathOrDir + ".cjs"
-        ]);
+        try {
+            this.defaultSettings = this.tryRequire([
+                dir,
+                path.join(dir, "index.cjs"),
+                pathOrDir + ".cjs"
+            ]);
 
-        this.dirname = dir;
-        this._isNested = isNested;
-        const configArg = process.argv.find(arg => arg.startsWith('--config='));
-        this.profile = configArg ? configArg.slice('--config='.length) : os.hostname();
-        this.profileSettings = this.loadProfileSettings();
-        ConfigreClass._nesting -= 1;
+            this.dirname = dir;
+            this._isNested = isNested;
+            const configArg = process.argv.find(arg => arg.startsWith('--config='));
+            this.profile = configArg ? configArg.slice('--config='.length) : os.hostname();
+            this.profileSettings = this.loadProfileSettings();
+            this.secretSettings = options.secrets === true
+                ? loadSecrets(pathOrDir, this.configFile, this.profile)
+                : [];
+        } finally {
+            ConfigreClass._nesting -= 1;
+        }
     }
 
     // Helper method to try requiring files with different extensions or paths
     tryRequire(paths) {
         for (const p of paths) {
             try {
-                return require(p);
+                const settings = requireConfig(p);
+                this.configFile = requireConfig.resolve(p);
+                return settings;
             } catch (e) {
                 continue;
             }
@@ -41,7 +62,7 @@ class ConfigreClass {
         const ext = '.cjs';
         const fullPath = path.join(basePath + ext);
         if (fs.existsSync(fullPath)) {
-            return { path: fullPath, module: require(fullPath) };
+            return { path: fullPath, module: requireConfig(fullPath) };
         }
         return null;
     }
@@ -67,17 +88,17 @@ class ConfigreClass {
     }
 
     get() {
-        return obj.merge({}, this.defaultSettings, this.profileSettings);
+        return merge({}, this.defaultSettings, this.profileSettings, ...this.secretSettings);
     }
 }
 
 // Wrapper function to support both constructor and function usage
-function Configre(path) {
+function Configre(path, options) {
     if (this instanceof Configre) {
-        return new ConfigreClass(path);
+        return new ConfigreClass(path, options);
     } else {
-        return new ConfigreClass(path).get();
+        return new ConfigreClass(path, options).get();
     }
 }
 
-module.exports = Configre;
+export { Configre as default, Configre as "module.exports" };

package/merge.js

@@ -76,6 +76,4 @@ function merge(object, ...sources) {
     return output;
 }
 
-module.exports = {
-    merge
-};
+export { merge };

package/package.json

@@ -1,7 +1,14 @@
 {
   "name": "configre",
-  "version": "1.2.4",
+  "version": "2.0.0",
   "description": "🔧 Effortlessly Tailor Your Settings",
+  "type": "module",
+  "engines": {
+    "node": ">=22.13.0"
+  },
+  "scripts": {
+    "test": "node --test"
+  },
   "dependencies": {
     "lemonlog": "^1.2.2"
   },
@@ -12,6 +19,16 @@
     "setup",
     "deployment",
     "configuration",
+    "secrets",
+    "secret-management",
+    "api-keys",
+    "encryption",
+    "encrypted-config",
+    "public-key",
+    "asymmetric-encryption",
+    "secret-sharing",
+    "sops",
+    "dotenv-alternative",
     "convention",
     "stage",
     "environment",
@@ -32,5 +49,22 @@
   "bugs": {
     "url": "https://github.com/clasen/Configre/issues"
   },
-  "homepage": "https://github.com/clasen/Configre#readme"
+  "homepage": "https://github.com/clasen/Configre#readme",
+  "packageManager": "pnpm@11.9.0",
+  "files": [
+    "index.js",
+    "merge.js",
+    "secrets/*.js",
+    "test/*.js",
+    "skills/configre/SKILL.md",
+    "demo/demo.js",
+    "demo/config/index.cjs",
+    "demo/config/hostname.cjs",
+    "demo/module/demo.js",
+    "demo/module/package.json",
+    "demo/module/config/index.cjs",
+    "demo/module/config/hostname.cjs",
+    "demo/secrets/demo.js",
+    "demo/secrets/config/index.cjs"
+  ]
 }

package/secrets/config.js

@@ -0,0 +1,5 @@
+export default {
+    git: {
+        timeoutMs: 30_000
+    }
+};

package/secrets/crypto.js

@@ -0,0 +1,203 @@
+import crypto from "node:crypto";
+
+const version = 2;
+const algorithm = "RSA-OAEP-SHA256+AES-256-GCM";
+
+function publicIdentity(key) {
+    if (key.asymmetricKeyType !== "rsa" || key.asymmetricKeyDetails.modulusLength !== 3072 ||
+        key.asymmetricKeyDetails.publicExponent !== 65537n) {
+        throw new Error("Configre secrets: keys must be RSA-3072");
+    }
+    const publicKey = key.type === "private" ? crypto.createPublicKey(key) : key;
+    return {
+        fingerprint: crypto.createHash("sha256")
+            .update(publicKey.export({ type: "spki", format: "der" })).digest("hex"),
+        publicKey: publicKey.export({ type: "spki", format: "pem" })
+    };
+}
+
+function parsePublicKey(pem) {
+    try {
+        if (typeof pem !== "string" || !/^-----BEGIN PUBLIC KEY-----\r?\n[A-Za-z0-9+/=\r\n]+\r?\n-----END PUBLIC KEY-----$/.test(pem.trim())) {
+            throw new Error();
+        }
+        return publicIdentity(crypto.createPublicKey(pem));
+    } catch {
+        throw new Error("Configre secrets: invalid RSA-3072 public key");
+    }
+}
+
+function parsePrivateKey(pem) {
+    try {
+        const privateKey = crypto.createPrivateKey(pem);
+        return { ...publicIdentity(privateKey), privateKey };
+    } catch {
+        throw new Error("Configre secrets: invalid private identity; restore it instead of replacing it");
+    }
+}
+
+function generatePrivateKey() {
+    return crypto.generateKeyPairSync("rsa", {
+        modulusLength: 3072,
+        publicExponent: 65537,
+        publicKeyEncoding: { type: "spki", format: "pem" },
+        privateKeyEncoding: { type: "pkcs8", format: "pem" }
+    }).privateKey;
+}
+
+function validateSecrets(value) {
+    const ancestors = new Set();
+    function visit(entry) {
+        if (typeof entry === "number" && !Number.isFinite(entry)) {
+            throw new Error("Configre secrets: secret numbers must be finite");
+        }
+        if (entry !== null && typeof entry === "object") {
+            if (ancestors.has(entry) || (!Array.isArray(entry) && Object.getPrototypeOf(entry) !== Object.prototype)) {
+                throw new Error("Configre secrets: secrets must contain only JSON values without circular references");
+            }
+            ancestors.add(entry);
+            const keys = Reflect.ownKeys(entry);
+            if (Array.isArray(entry) && keys.length !== entry.length + 1) {
+                throw new Error("Configre secrets: secret arrays must not contain holes or extra properties");
+            }
+            for (const key of keys) {
+                if (Array.isArray(entry) && key === "length") continue;
+                if (key === "__proto__" || key === "constructor" || key === "prototype") {
+                    throw new Error("Configre secrets: unsafe property in secrets object");
+                }
+                const descriptor = Object.getOwnPropertyDescriptor(entry, key);
+                if (typeof key !== "string" || !descriptor.enumerable || !Object.hasOwn(descriptor, "value") ||
+                    (Array.isArray(entry) && (!/^(0|[1-9][0-9]*)$/.test(key) || Number(key) >= entry.length))) {
+                    throw new Error("Configre secrets: secrets must contain only JSON data properties");
+                }
+                visit(descriptor.value);
+            }
+            ancestors.delete(entry);
+        } else if (entry !== null && !["string", "number", "boolean"].includes(typeof entry)) {
+            throw new Error("Configre secrets: secrets must contain only JSON values");
+        }
+    }
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Configre secrets: secrets must be a JSON object");
+    }
+    visit(value);
+    return value;
+}
+
+function exactFields(object, names) {
+    if (!object || Array.isArray(object) || typeof object !== "object" ||
+        Object.keys(object).length !== names.length ||
+        !names.every(name => Object.hasOwn(object, name))) {
+        throw new Error("Configre secrets: invalid encrypted file structure");
+    }
+}
+
+function decode(value, length) {
+    if (typeof value !== "string") {
+        throw new Error("Configre secrets: invalid encrypted data");
+    }
+    const buffer = Buffer.from(value, "base64");
+    if (buffer.length === 0 || buffer.toString("base64") !== value ||
+        (length !== undefined && buffer.length !== length)) {
+        throw new Error("Configre secrets: invalid encrypted data");
+    }
+    return buffer;
+}
+
+function authenticatedHeader(envelope) {
+    return Buffer.from(JSON.stringify({
+        version: envelope.version,
+        algorithm: envelope.algorithm,
+        recipients: envelope.recipients.map(({ fingerprint, publicKey, wrappedKey }) => ({
+            fingerprint, publicKey, wrappedKey
+        }))
+    }));
+}
+
+function validateEnvelope(envelope) {
+    exactFields(envelope, ["version", "algorithm", "recipients", "iv", "tag", "ciphertext"]);
+    if (envelope.version !== version || envelope.algorithm !== algorithm) {
+        throw new Error("Configre secrets: unsupported encrypted file version or algorithm");
+    }
+    if (!Array.isArray(envelope.recipients) || envelope.recipients.length === 0) {
+        throw new Error("Configre secrets: encrypted file has no recipients");
+    }
+    let previous = "";
+    for (const recipient of envelope.recipients) {
+        exactFields(recipient, ["fingerprint", "publicKey", "wrappedKey"]);
+        const parsed = parsePublicKey(recipient.publicKey);
+        if (recipient.fingerprint !== parsed.fingerprint || recipient.publicKey !== parsed.publicKey ||
+            recipient.fingerprint <= previous) {
+            throw new Error("Configre secrets: invalid encrypted recipients");
+        }
+        previous = recipient.fingerprint;
+        decode(recipient.wrappedKey, 384);
+    }
+    decode(envelope.iv, 12);
+    decode(envelope.tag, 16);
+    decode(envelope.ciphertext);
+}
+
+function encrypt(settings, recipients) {
+    const contentKey = crypto.randomBytes(32);
+    const iv = crypto.randomBytes(12);
+    try {
+        const envelope = {
+            version,
+            algorithm,
+            recipients: recipients.map(recipient => ({
+                ...recipient,
+                wrappedKey: crypto.publicEncrypt({
+                    key: recipient.publicKey,
+                    padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
+                    oaepHash: "sha256"
+                }, contentKey).toString("base64")
+            })),
+            iv: iv.toString("base64")
+        };
+        const cipher = crypto.createCipheriv("aes-256-gcm", contentKey, iv, { authTagLength: 16 });
+        cipher.setAAD(authenticatedHeader(envelope));
+        envelope.ciphertext = Buffer.concat([
+            cipher.update(JSON.stringify(settings), "utf8"), cipher.final()
+        ]).toString("base64");
+        envelope.tag = cipher.getAuthTag().toString("base64");
+        return envelope;
+    } finally {
+        contentKey.fill(0);
+    }
+}
+
+function decrypt(envelope, identity) {
+    validateEnvelope(envelope);
+    const recipient = envelope.recipients.find(entry => entry.fingerprint === identity.fingerprint);
+    if (!recipient) {
+        const error = new Error("Configre secrets: this machine is not authorized by the current encrypted file");
+        error.code = "CONFIGRE_NOT_AUTHORIZED";
+        throw error;
+    }
+    let contentKey;
+    let plaintext;
+    let settings;
+    try {
+        contentKey = crypto.privateDecrypt({
+            key: identity.privateKey,
+            padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
+            oaepHash: "sha256"
+        }, decode(recipient.wrappedKey, 384));
+        const decipher = crypto.createDecipheriv("aes-256-gcm", contentKey, decode(envelope.iv, 12), {
+            authTagLength: 16
+        });
+        decipher.setAAD(authenticatedHeader(envelope));
+        decipher.setAuthTag(decode(envelope.tag, 16));
+        plaintext = Buffer.concat([decipher.update(decode(envelope.ciphertext)), decipher.final()]);
+        settings = JSON.parse(plaintext.toString("utf8"));
+    } catch {
+        throw new Error("Configre secrets: could not authenticate or decrypt secrets; encrypted file was not changed");
+    } finally {
+        if (contentKey) contentKey.fill(0);
+        if (plaintext) plaintext.fill(0);
+    }
+    return validateSecrets(settings);
+}
+
+export { parsePublicKey, parsePrivateKey, generatePrivateKey, validateSecrets, encrypt, decrypt };