configre 2.0.0 → 2.1.2

package/README.md

@@ -119,10 +119,10 @@ import Configre from "../../index.js";
 import { join } from "node:path";
 
 const configPath = join(import.meta.dirname, "config");
-const cfg = Configre(configPath, { secrets: true });
+const cfg = Configre(configPath);
 ```
 
-`{ secrets: true }` enables this workflow. Loading remains synchronous, and your application reads the result through ordinary properties such as `cfg.api.key`.
+Secrets activate automatically when the base configuration or selected profile has a corresponding `.secret.cjs` file, or when `secrets.enc.json` already exists. No options are needed. Loading remains synchronous, and your application reads the result through ordinary properties such as `cfg.api.key`.
 
 > The demo reports `API key configured:` without printing the key. Avoid logging `cfg` in your application: it contains the decrypted secrets.
 
@@ -138,18 +138,24 @@ module.exports = {
 };
 ```
 
+Create `demo/secrets/config/index.secret.cjs` yourself to enable secrets, initially with:
+
+```javascript
+module.exports = {};
+```
+
 Then run:
 
 ```bash
 node demo/secrets/demo.js
 ```
 
-For a new setup, Configre creates the following files and directory:
+For a new setup, Configre generates the encrypted file, recipients directory and Git exclusions alongside your existing configuration files:
 
 ```text
 demo/secrets/config/
   index.cjs          # Public configuration
-  index.secret.cjs   # Editable secrets; starts with module.exports = {};
+  index.secret.cjs   # Editable secrets you create yourself
   recipients/        # Public keys of servers that register
   secrets.enc.json   # Generated encrypted values
   .gitignore         # Keeps .secret.cjs files out of Git
@@ -163,7 +169,7 @@ With the public placeholder empty and no secrets added, look for:
 API key configured: false
 ```
 
-**`index.secret.cjs` starts empty on purpose.** Configre does not copy values from `index.cjs` into it. It contains only the fields you choose to override with secrets; public settings continue to come from `index.cjs`.
+**Configre never creates `.secret.cjs` files.** Without a secret counterpart for the base configuration or selected profile, and without an encrypted file, it loads only public settings and creates no identity or secret artifacts. A secret module contains only the fields you choose to override; public settings continue to come from `index.cjs`.
 
 These initialization steps describe a new setup. If `secrets.enc.json` already exists, Configre uses that encrypted file instead of resetting it. A checkout containing the encrypted file but no `.secret.cjs` files is treated as a server checkout.
 
@@ -218,9 +224,11 @@ If this server is not authorized yet, Configre automatically:
 1. Creates its local identity, if needed.
 2. Writes `demo/secrets/config/recipients/truco.pub`.
 3. Creates and pushes a commit containing only that public-key file.
-4. Stops startup with a message explaining that the administrator must publish an updated encrypted file.
+4. Logs a warning and continues with public configuration only until the administrator publishes an updated encrypted file.
+
+Publishing a public key does not let the server decrypt the existing ciphertext. While authorization is pending, `cfg` preserves the public defaults and selected public profile; fields that exist only in the encrypted file are absent. Repeating the command does not publish another registration commit for the same key. If Git registration fails, Configre logs a warning and still returns public settings; the next Configre load retries registration.
 
-This first stop is expected: publishing a public key does not let the server decrypt the existing ciphertext. Repeating the command does not publish another registration commit for the same key.
+Configre uses `log.info` when it creates identity files, writes Git exclusions, creates the recipients directory or a public-key file, updates the encrypted file, and successfully pushes the public key. Messages contain operation names and file paths, never secret values or key contents. These messages use the existing `Configre` LemonLog namespace; use `DEBUG=Configre:*` to display them. Unchanged files and previously published public keys do not generate another creation or publication log.
 
 ### 4. Include the server in the encrypted file
 
@@ -254,7 +262,7 @@ node demo/secrets/demo.js
 
 Commit and push the updated `secrets.enc.json`, then pull and restart the demo on the server. **You do not need to copy or register `truco.pub` again.** Its existing authorization also covers new keys you add later.
 
-For settings specific to `truco`, add `demo/secrets/config/truco.cjs`. The next administrator run creates an empty `truco.secret.cjs` counterpart, which you can fill with that profile's secrets. All profile secret files, including inactive ones, are encrypted together when the administrator runs the demo.
+For settings specific to `truco`, add `demo/secrets/config/truco.cjs` and create `truco.secret.cjs` yourself with that profile's secrets. The secret file activates secrets when `truco` is selected, even without `index.secret.cjs`. A public profile alone never creates a secret counterpart. Once secrets are active, all profile secret files, including inactive ones, are encrypted together when the administrator runs the demo.
 
 For `--config=truco`, the merge order is:
 
@@ -271,11 +279,11 @@ To revoke this server, remove `demo/secrets/config/recipients/truco.pub`, run th
 
 - Secret `.cjs` modules execute on the administrator and are reloaded on each Configre call. They must export plain objects containing JSON-compatible objects, arrays, strings, finite numbers, booleans and `null`. Functions, `undefined`, accessors, symbols, custom objects, circular references, and properties named `__proto__`, `constructor` or `prototype` are rejected. Consumers decrypt data without executing these modules.
 - Empty strings stay empty strings. Configre does not fill them from environment variables or populate `process.env`. The existing deep-merge behavior, including array merging, also applies to secrets.
-- Without `{ secrets: true }`, Configre does not access identities or secret files. The option also works with `new Configre(configPath, { secrets: true }).get()` and CommonJS consumers.
+- Activation depends only on the existing files; there is no `secrets` option. The same behavior applies to `new Configre(configPath).get()` and CommonJS consumers.
 - Each OS user has one identity reused across projects; authorization is per project. A service running under another OS user needs its own registration. All authorized identities can decrypt all profiles in the project's encrypted file.
 - Public recipient files must contain a single RSA-3072 public key in PEM format, with exponent 65537, as generated by Configre. Other file extensions are ignored, and duplicate keys do not add recipients. The administrator is always included.
 - Registration uses an isolated Git index and publishes only the public-key file. It preserves unrelated staged and unstaged changes, runs no commit or pre-push hooks, and does not push local tags, merge, rebase or force-push. Failed registrations can be retried at the next startup; each Git command has a 30-second timeout. An authorized server loads secrets without Git commands or project writes.
-- Registration names must start with a letter or digit and contain only letters, digits, dots, underscores or hyphens. If another key already occupies `truco.pub`, Configre stops without overwriting it; use a distinct profile or resolve the key replacement explicitly.
+- Registration names must start with a letter or digit and contain only letters, digits, dots, underscores or hyphens. If another key already occupies `truco.pub`, registration stops without overwriting it, and configuration loading continues with a warning and public settings only; use a distinct profile or resolve the key replacement explicitly.
 - Configre appends Git exclusions without removing existing rules and refuses to proceed on the administrator if editable secret modules are already tracked. It does not untrack files or rewrite history. It also prepares `.gitignore` when no repository exists yet.
 - The administrator's `.secret.cjs` files are the source of truth for values, and `recipients/` is the source of truth for authorization. Removing all recipient files revokes them on the next administrator reload; old ciphertext does not restore them. Recover accidentally deleted public-key files from Git before reloading. Missing Git exclusions and ciphertext are regenerated on the administrator, and existing secret modules are never overwritten.
 - Back up the administrator's editable secrets and private identity securely. Never share or commit `identity.pem`. On POSIX, its directory must have owner-only permissions (`0700`) and the private file must have owner-only permissions (`0600`); on Windows, protection depends on the user profile's filesystem permissions. Private identities and secret input files cannot be symlinks.

package/demo/secrets/demo.js

@@ -2,7 +2,7 @@ import Configre from "../../index.js";
 import { join } from "node:path";
 
 const configPath = join(import.meta.dirname, "config");
-const cfg = Configre(configPath, { secrets: true });
+const cfg = Configre(configPath);
 console.info("API key configured:", Boolean(cfg.api.key));
 console.info(`Set api.key in ${join(configPath, "index.secret.cjs")} and run this demo again.`);
 console.info(`New servers automatically publish their public key in ${join(configPath, "recipients")}. Pull and rerun here to authorize them.`);

package/index.js

@@ -10,15 +10,10 @@ const requireConfig = createRequire(import.meta.url);
 const log = lemonlog("Configre");
 
 class ConfigreClass {
-    constructor(pathOrDir, options = {}) {
+    constructor(pathOrDir) {
         if (typeof pathOrDir !== "string" || pathOrDir.length === 0) {
             throw new TypeError("Configre path must be a non-empty string");
         }
-        if (options === null || typeof options !== "object" || Array.isArray(options) ||
-            (options.secrets !== undefined && typeof options.secrets !== "boolean")) {
-            throw new TypeError("Configre options must be an object with an optional boolean secrets property");
-        }
-
         const dir = path.join(pathOrDir);
         const isNested = (ConfigreClass._nesting || 0) > 0;
         ConfigreClass._nesting = (ConfigreClass._nesting || 0) + 1;
@@ -35,9 +30,7 @@ class ConfigreClass {
             const configArg = process.argv.find(arg => arg.startsWith('--config='));
             this.profile = configArg ? configArg.slice('--config='.length) : os.hostname();
             this.profileSettings = this.loadProfileSettings();
-            this.secretSettings = options.secrets === true
-                ? loadSecrets(pathOrDir, this.configFile, this.profile)
-                : [];
+            this.secretSettings = loadSecrets(pathOrDir, this.configFile, this.profile);
         } finally {
             ConfigreClass._nesting -= 1;
         }
@@ -93,11 +86,11 @@ class ConfigreClass {
 }
 
 // Wrapper function to support both constructor and function usage
-function Configre(path, options) {
+function Configre(path) {
     if (this instanceof Configre) {
-        return new ConfigreClass(path, options);
+        return new ConfigreClass(path);
     } else {
-        return new ConfigreClass(path, options).get();
+        return new ConfigreClass(path).get();
     }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "configre",
-  "version": "2.0.0",
+  "version": "2.1.2",
   "description": "🔧 Effortlessly Tailor Your Settings",
   "type": "module",
   "engines": {

package/secrets/identity.js

@@ -3,12 +3,15 @@ import os from "node:os";
 import path from "node:path";
 import { generatePrivateKey, parsePrivateKey, parsePublicKey } from "./crypto.js";
 import { stat, readText, withLock } from "./files.js";
+import log from "./log.js";
 
 function loadIdentity() {
     const directory = path.join(os.homedir(), ".config", "configre");
     const privatePath = path.join(directory, "identity.pem");
     const publicPath = path.join(directory, "identity.pub");
-    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    if (fs.mkdirSync(directory, { recursive: true, mode: 0o700 })) {
+        log.info("Created identity directory", directory);
+    }
     const info = stat(directory);
     if (!info.isDirectory() || (process.platform !== "win32" && (info.mode & 0o077) !== 0)) {
         throw new Error(`Configre secrets: identity directory must be private and not a symlink at ${directory}`);
@@ -32,10 +35,12 @@ function loadIdentity() {
                 throw new Error("Configre secrets: private identity is missing; restore it instead of replacing it");
             }
             fs.writeFileSync(privatePath, generatePrivateKey(), { flag: "wx", mode: 0o600 });
+            log.info("Created private identity file", privatePath);
         }
         const identity = parsePrivateKey(readText(privatePath, true));
         if (!stat(publicPath)) {
             fs.writeFileSync(publicPath, identity.publicKey, { flag: "wx", mode: 0o644 });
+            log.info("Created public identity file", publicPath);
         }
         return readIdentity();
     });

package/secrets/index.js

@@ -5,6 +5,7 @@ import { isDeepStrictEqual } from "node:util";
 import { createRequire } from "node:module";
 import loadIdentity from "./identity.js";
 import registerRecipient from "./register.js";
+import log from "./log.js";
 import { parsePublicKey, validateSecrets, encrypt, decrypt } from "./crypto.js";
 import { stat, readText, readJSON, withLock, writeEncrypted } from "./files.js";
 
@@ -63,11 +64,15 @@ function prepareIgnore(paths) {
     const lines = existing.split(/\r?\n/).filter(line => line && !line.startsWith("#"));
     if (!isDeepStrictEqual(lines.slice(-rules.length), rules)) {
         fs.appendFileSync(ignorePath, (existing && !existing.endsWith("\n") ? "\n" : "") + rules.join("\n") + "\n");
+        log.info("Wrote Git exclusions for secret files", ignorePath);
     }
 }
 
 function loadRecipients(directory, identity) {
-    if (!stat(directory)) fs.mkdirSync(directory, { mode: 0o700 });
+    if (!stat(directory)) {
+        fs.mkdirSync(directory, { mode: 0o700 });
+        log.info("Created recipients directory", directory);
+    }
     if (!stat(directory).isDirectory()) {
         throw new Error("Configre secrets: recipients must be a directory, not a symlink");
     }
@@ -122,51 +127,52 @@ function selectSecrets(bundle, paths, profile) {
 
 function loadSecrets(configPath, configFile, profile) {
     const paths = secretPaths(configPath, configFile);
+    const names = localFiles(paths);
+    const hasEncrypted = !!stat(paths.encrypted);
+    const hasLocal = names.includes(path.basename(paths.local)) || (paths.directory &&
+        (names.includes(profile + ".dev.secret.cjs") || names.includes(profile + ".secret.cjs")));
+    if (!hasLocal && !hasEncrypted) return [];
+
     const identity = loadIdentity();
-    if (localFiles(paths).length === 0 && stat(paths.encrypted)) {
-        try {
+    try {
+        if (names.length === 0 && hasEncrypted) {
             return selectSecrets(validateBundle(decrypt(readJSON(paths.encrypted), identity)), paths, profile);
-        } catch (error) {
-            if (error.code !== "CONFIGRE_NOT_AUTHORIZED") throw error;
-            registerRecipient(paths, identity, profile);
-            throw new Error("Configre secrets: not authorized yet; public key is published in Git. The administrator must pull, reload Configre and publish secrets.enc.json; then pull the updated encrypted file and restart this machine");
         }
-    }
 
-    const bundle = withLock(paths.encrypted, () => {
-        const names = localFiles(paths);
-        const hasEncrypted = !!stat(paths.encrypted);
-        const envelope = hasEncrypted ? readJSON(paths.encrypted) : null;
-        const previous = hasEncrypted ? validateBundle(decrypt(envelope, identity)) : null;
-        if (names.length === 0 && hasEncrypted) return previous;
+        const bundle = withLock(paths.encrypted, () => {
+            const names = localFiles(paths);
+            const hasEncrypted = !!stat(paths.encrypted);
+            const envelope = hasEncrypted ? readJSON(paths.encrypted) : null;
+            const previous = hasEncrypted ? validateBundle(decrypt(envelope, identity)) : null;
+            if (names.length === 0 && hasEncrypted) return previous;
 
-        prepareIgnore(paths);
-        const settings = { files: Object.fromEntries(names.map(name => [name, readSecret(path.join(paths.parent, name))])) };
-        const recipients = loadRecipients(paths.recipients, identity);
-        const templates = new Set([path.basename(paths.local)]);
-        if (paths.directory) {
-            for (const name of fs.readdirSync(paths.parent)) {
-                if (name.endsWith(".cjs") && !name.endsWith(".secret.cjs") && stat(path.join(paths.parent, name)).isFile()) {
-                    templates.add(name.slice(0, -4) + ".secret.cjs");
+            prepareIgnore(paths);
+            const settings = { files: Object.fromEntries(names.map(name => [name, readSecret(path.join(paths.parent, name))])) };
+            const recipients = loadRecipients(paths.recipients, identity);
+            if (hasEncrypted) {
+                const previousRecipients = envelope.recipients.map(({ fingerprint, publicKey }) => ({ fingerprint, publicKey }));
+                if (isDeepStrictEqual(settings, previous) && isDeepStrictEqual(recipients, previousRecipients)) {
+                    return settings;
                 }
             }
+            writeEncrypted(paths.encrypted, encrypt(settings, recipients));
+            log.info(hasEncrypted ? "Updated encrypted secrets file" : "Created encrypted secrets file", paths.encrypted);
+            return settings;
+        });
+        return selectSecrets(bundle, paths, profile);
+    } catch (error) {
+        if (error.code !== "CONFIGRE_NOT_AUTHORIZED") throw error;
+        let registration = "Public key is published in Git. The administrator must pull, reload Configre and publish secrets.enc.json; then pull the updated encrypted file and reload Configre.";
+        try {
+            registerRecipient(paths, identity, profile);
+        } catch (registrationError) {
+            registration = registrationError.code === "CONFIGRE_REGISTRATION_FAILED"
+                ? registrationError.message
+                : "Automatic public-key registration failed; check Git and file permissions, then reload Configre to retry.";
         }
-        for (const name of templates) {
-            if (!Object.hasOwn(settings.files, name)) {
-                fs.writeFileSync(path.join(paths.parent, name), "module.exports = {};\n", { flag: "wx", mode: 0o600 });
-                settings.files[name] = {};
-            }
-        }
-        if (hasEncrypted) {
-            const previousRecipients = envelope.recipients.map(({ fingerprint, publicKey }) => ({ fingerprint, publicKey }));
-            if (isDeepStrictEqual(settings, previous) && isDeepStrictEqual(recipients, previousRecipients)) {
-                return settings;
-            }
-        }
-        writeEncrypted(paths.encrypted, encrypt(settings, recipients));
-        return settings;
-    });
-    return selectSecrets(bundle, paths, profile);
+        log.warn("Secrets not authorized; continuing with public settings only.", registration, "Public key:", identity.publicPath);
+        return [];
+    }
 }
 
 export default loadSecrets;

package/secrets/log.js

@@ -0,0 +1,3 @@
+import lemonlog from "lemonlog";
+
+export default lemonlog("Configre");

package/secrets/register.js

@@ -2,11 +2,14 @@ import fs from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import config from "./config.js";
+import log from "./log.js";
 import { parsePublicKey } from "./crypto.js";
 import { stat, readText, withLock } from "./files.js";
 
 function registrationError(message) {
-    return new Error(`Configre secrets: not authorized; automatic registration ${message}`);
+    const error = new Error(`Configre secrets: not authorized; automatic registration ${message}`);
+    error.code = "CONFIGRE_REGISTRATION_FAILED";
+    return error;
 }
 
 function git(directory, args, operation, options = {}) {
@@ -84,9 +87,15 @@ function registerRecipient(paths, identity, profile) {
             git(root, ["update-index", "--add", "--cacheinfo", "100644", blob, relative], "adding the public key to the isolated index", { env });
             const tree = git(root, ["write-tree"], "building the registration tree", { env }).trim();
             const commit = git(root, ["commit-tree", tree, "-p", head, "-m", `Configre: register ${profile}`], "creating the public-key commit (Git author identity must be configured)").trim();
-            fs.mkdirSync(directory, { recursive: true });
-            if (!stat(filename)) fs.writeFileSync(filename, publicKey, { flag: "wx", mode: 0o644 });
+            if (fs.mkdirSync(directory, { recursive: true })) {
+                log.info("Created recipients directory", directory);
+            }
+            if (!stat(filename)) {
+                fs.writeFileSync(filename, publicKey, { flag: "wx", mode: 0o644 });
+                log.info("Created public-key registration file", filename);
+            }
             git(root, ["push", "--no-verify", "--no-follow-tags", "--", remote, `${commit}:${remoteBranch}`], "pushing the public-key commit");
+            log.info("Published public key to Git", filename);
             if (git(root, ["symbolic-ref", "--quiet", "HEAD"], "checking the current branch").trim() !== branch) {
                 throw registrationError("published the public key, but the local branch changed concurrently; synchronize the checkout");
             }

package/test/secrets.test.js

@@ -7,6 +7,7 @@ import { spawnSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import test from "node:test";
 import Configre from "../index.js";
+import log from "../secrets/log.js";
 import { generatePrivateKey, parsePrivateKey, encrypt } from "../secrets/crypto.js";
 
 const sentinel = "synthetic-secret-for-configre-tests";
@@ -17,6 +18,9 @@ test.before(() => {
 });
 
 function fixture(t, { seed = true } = {}) {
+    const logs = { info: [], warn: [] };
+    t.mock.method(log, "info", (...args) => logs.info.push(args));
+    t.mock.method(log, "warn", (...args) => logs.warn.push(args));
     const root = fs.mkdtempSync(path.join(os.tmpdir(), "configre-secrets-"));
     const homes = [0, 1, 2].map(index => path.join(root, `home-${index}`));
     let home = homes[0];
@@ -36,7 +40,7 @@ function fixture(t, { seed = true } = {}) {
     }
     t.after(() => fs.rmSync(root, { recursive: true, force: true }));
     return {
-        root, config, homes,
+        root, config, homes, logs,
         local: path.join(config, "index.secret.cjs"),
         encrypted: path.join(config, "secrets.enc.json"),
         recipients: path.join(config, "recipients"),
@@ -51,7 +55,16 @@ function writeSettings(f, settings = { api: { key: sentinel } }) {
 }
 
 function load(f) {
-    return Configre(f.config, { secrets: true });
+    return Configre(f.config);
+}
+
+function assertPublicOnly(f, logs, warning) {
+    const count = logs.warn.length;
+    const config = load(f);
+    assert.equal(config.api.key, "");
+    assert.equal(logs.warn.length, count + 1);
+    assert.match(logs.warn.at(-1).join(" "), warning);
+    return config;
 }
 
 function envelope(f) {
@@ -98,27 +111,88 @@ function gitFixture(t) {
     };
 }
 
-test("secrets stay opt-in and invalid options fail before creating an identity", t => {
+test("missing secret counterparts leave configuration and identity untouched", t => {
     const f = fixture(t, { seed: false });
-    fs.writeFileSync(f.local, "invalid-json");
+    const publicFiles = fs.readdirSync(f.config);
     t.mock.method(os, "homedir", () => { throw new Error("must not access the identity"); });
     assert.equal(Configre(f.config).api.key, "");
-    assert.equal(Configre(f.config, { secrets: false }).api.key, "");
+    assert.deepEqual(fs.readdirSync(f.config), publicFiles);
+    fs.writeFileSync(path.join(f.config, "other.secret.cjs"), "invalid-json");
+    const files = fs.readdirSync(f.config);
+    assert.equal(Configre(f.config).api.key, "");
     assert.equal(new Configre(f.config).get().api.key, "");
-    for (const options of [null, true, [], { secrets: "true" }]) {
-        assert.throws(() => Configre(f.config, options), /options must be an object/);
-    }
-    assert.equal(fs.existsSync(f.encrypted), false);
-    assert.equal(fs.existsSync(path.join(f.config, ".gitignore")), false);
+    assert.deepEqual(fs.readdirSync(f.config), files);
     assert.equal(fs.existsSync(f.homes[0]), false);
+    assert.deepEqual(f.logs, { info: [], warn: [] });
+});
+
+test("an unauthorized machine keeps public settings and omits every encrypted field", t => {
+    const f = fixture(t);
+    writeSettings(f, { api: { key: sentinel }, encryptedOnly: { token: sentinel } });
+    load(f);
+    const consumer = consumerCopy(f, "unauthorized-consumer");
+    f.useHome(1);
+    const config = assertPublicOnly(consumer, f.logs, /not authorized.*public settings/i);
+    assert.deepEqual(config, { api: { key: "", host: "profile" }, list: [1, 2] });
+    assert.equal(Object.hasOwn(config, "encryptedOnly"), false);
+    assert.deepEqual(new Configre(consumer.config).get(), config);
+    assert.equal(JSON.stringify(f.logs).includes(sentinel), false);
+    const result = spawnSync(process.execPath, ["-e", `
+        const assert = require('node:assert/strict');
+        const os = require('node:os');
+        os.homedir = () => process.env.CONFIGRE_TEST_HOME;
+        const Configre = require(process.env.CONFIGRE_TEST_MODULE);
+        const cfg = Configre(process.env.CONFIGRE_TEST_PATH);
+        assert.equal(cfg.api.key, '');
+        assert.equal(Object.hasOwn(cfg, 'encryptedOnly'), false);
+        console.info('Application started');
+    `], {
+        encoding: "utf8",
+        env: {
+            ...process.env, DEBUG: "Configre:*",
+            CONFIGRE_TEST_HOME: f.homes[1],
+            CONFIGRE_TEST_MODULE: path.join(import.meta.dirname, "..", "index.js"),
+            CONFIGRE_TEST_PATH: consumer.config
+        }
+    });
+    assert.equal(result.status, 0, result.stderr);
+    const output = result.stdout + result.stderr;
+    assert.match(output, /Secrets not authorized; continuing with public settings only/);
+    assert.match(output, /Application started/);
+    assert.equal(output.includes(sentinel), false);
+    assert.equal(output.includes("BEGIN PRIVATE KEY"), false);
+    assert.equal(output.includes("BEGIN PUBLIC KEY"), false);
 });
 
-test("first use initializes empty secrets and reuses all generated files", t => {
+for (const profile of ["testhost", "testhost.dev", "forced"]) {
+    test(`a ${profile} secret activates secrets without a base secret module`, t => {
+        const f = fixture(t);
+        if (profile === "forced") {
+            const previousArgs = process.argv;
+            process.argv = [...previousArgs.filter(arg => !arg.startsWith("--config=")), "--config=forced"];
+            t.after(() => { process.argv = previousArgs; });
+        }
+        const local = path.join(f.config, profile + ".secret.cjs");
+        writeSettings({ local });
+        assert.equal(load(f).api.key, sentinel);
+        assert.equal(fs.existsSync(f.local), false);
+        assert.deepEqual(fs.readdirSync(f.config).filter(name => name.endsWith(".secret.cjs")), [path.basename(local)]);
+        assert.equal(load(consumerCopy(f, "profile-only-consumer")).api.key, sentinel);
+    });
+}
+
+test("an existing empty secret module initializes secrets and reuses generated files", t => {
     const f = fixture(t, { seed: false });
+    fs.writeFileSync(f.local, "module.exports = {};\n", { mode: 0o600 });
     const ignore = path.join(f.config, ".gitignore");
     fs.writeFileSync(ignore, "# existing rules\n*.log");
     const config = load(f);
+    const initialLogs = f.logs.info.length;
     assert.deepEqual(config, Configre(f.config));
+    assert.equal(f.logs.info.length, initialLogs);
+    for (const filename of [path.dirname(f.privatePath(0)), f.privatePath(0), f.publicPath(0), ignore, f.recipients, f.encrypted]) {
+        assert.ok(f.logs.info.some(([message, target]) => /Created|Wrote/.test(message) && target === filename));
+    }
     const original = fs.readFileSync(f.privatePath(0));
     const published = fs.readFileSync(f.publicPath(0), "utf8");
     assert.equal(parsePrivateKey(original).publicKey, published);
@@ -139,6 +213,9 @@ test("first use initializes empty secrets and reuses all generated files", t =>
     assert.equal(fs.existsSync(f.encrypted + ".lock"), false);
     writeSettings(f);
     assert.equal(load(f).api.key, sentinel);
+    assert.deepEqual(f.logs.info.at(-1), ["Updated encrypted secrets file", f.encrypted]);
+    assert.equal(JSON.stringify(f.logs).includes(sentinel), false);
+    assert.equal(JSON.stringify(f.logs).includes("BEGIN PRIVATE KEY"), false);
 });
 
 test("missing administrator files are recreated without losing values or authorized recipients", t => {
@@ -181,7 +258,7 @@ test("removing every recipient revokes access without restoring keys from old ci
     assert.notDeepEqual(fs.readFileSync(f.encrypted), encrypted);
     const consumer = consumerCopy(f, "revoked-consumer");
     f.useHome(1);
-    assert.throws(() => load(consumer), /not authorized/);
+    assertPublicOnly(consumer, f.logs, /not authorized/);
 });
 
 test("secrets merge last with profiles, arrays, JSON values and the constructor API", t => {
@@ -198,7 +275,7 @@ test("secrets merge last with profiles, arrays, JSON values and the constructor
     assert.deepEqual(config.api, settings.api);
     assert.deepEqual(config.list, [9, 2]);
     assert.deepEqual(config.json, settings.json);
-    assert.deepEqual(new Configre(f.config, { secrets: true }).get(), config);
+    assert.deepEqual(new Configre(f.config).get(), config);
     assert.equal(fs.existsSync(f.recipients), true);
     assert.equal(fs.readFileSync(f.encrypted, "utf8").includes(sentinel), false);
     assert.equal(envelope(f).recipients.length, 1);
@@ -277,19 +354,19 @@ test("base and host secrets select dev and forced profiles identically on consum
     assert.deepEqual(fs.readdirSync(consumer.config), consumerFiles);
 });
 
-test("administrator scaffolds empty counterparts without overwriting existing host secrets", t => {
+test("administrator leaves missing counterparts absent and preserves existing host secrets", t => {
     const f = fixture(t);
     writeSettings(f);
     load(f);
     const host = { local: path.join(f.config, "testhost.secret.cjs") };
-    assert.equal(fs.readFileSync(host.local, "utf8"), "module.exports = {};\n");
+    assert.equal(fs.existsSync(host.local), false);
     writeSettings(host, { api: { key: "host-secret" } });
     const original = fs.readFileSync(host.local);
     fs.writeFileSync(path.join(f.config, "newhost.cjs"), "module.exports = { public: true };\n");
     load(f);
     assert.deepEqual(fs.readFileSync(host.local), original);
-    assert.equal(fs.readFileSync(path.join(f.config, "newhost.secret.cjs"), "utf8"), "module.exports = {};\n");
-    const consumer = consumerCopy(f, "scaffold-consumer");
+    assert.equal(fs.existsSync(path.join(f.config, "newhost.secret.cjs")), false);
+    const consumer = consumerCopy(f, "optional-profile-consumer");
     fs.writeFileSync(path.join(consumer.config, "newhost.cjs"), "module.exports = {};\n");
     assert.equal(load(consumer).api.key, "host-secret");
     assert.equal(fs.existsSync(path.join(consumer.config, "newhost.secret.cjs")), false);
@@ -320,7 +397,7 @@ test("grant and revoke work across isolated machines without consumer project wr
     const after = fs.readdirSync(consumer.config).map(name => [name, fs.readFileSync(path.join(consumer.config, name))]);
     assert.deepEqual(after, before);
     f.useHome(2);
-    assert.throws(() => load(consumer), /not authorized/);
+    assertPublicOnly(consumer, f.logs, /not authorized/);
     f.useHome(0);
     fs.unlinkSync(path.join(f.recipients, "developer.pub"));
     load(f);
@@ -329,9 +406,9 @@ test("grant and revoke work across isolated machines without consumer project wr
     assert.notEqual(revoked.iv, shared.iv);
     fs.copyFileSync(f.encrypted, path.join(consumer.config, "secrets.enc.json"));
     f.useHome(1);
-    assert.throws(() => load(consumer), /not authorized/);
+    assertPublicOnly(consumer, f.logs, /not authorized/);
     writeSettings({ local: path.join(consumer.config, "index.secret.cjs") }, { api: { key: "replacement" } });
-    assert.throws(() => load(consumer), /not authorized/);
+    assertPublicOnly(consumer, f.logs, /not authorized/);
     assert.deepEqual(JSON.parse(fs.readFileSync(path.join(consumer.config, "secrets.enc.json"))), revoked);
     fs.writeFileSync(path.join(consumer.config, "secrets.enc.json"), JSON.stringify(shared));
     fs.unlinkSync(path.join(consumer.config, "index.secret.cjs"));
@@ -467,20 +544,33 @@ test("private permissions and symlinks are rejected", { skip: process.platform =
     assert.throws(() => load(f), /regular file/);
 });
 
+test("explicit config files without their own secret sidecar leave identities and files untouched", t => {
+    const f = fixture(t, { seed: false });
+    const filename = path.join(f.root, "settings.cjs");
+    fs.writeFileSync(filename, 'module.exports = { public: true };');
+    fs.writeFileSync(path.join(f.root, "other.secret.cjs"), "invalid-json");
+    const files = fs.readdirSync(f.root);
+    t.mock.method(os, "homedir", () => { throw new Error("must not access the identity"); });
+    assert.deepEqual(Configre(filename), { public: true });
+    assert.deepEqual(Configre(filename.slice(0, -4)), { public: true });
+    assert.deepEqual(fs.readdirSync(f.root), files);
+    assert.equal(fs.existsSync(f.homes[0]), false);
+});
+
 test("explicit config files and extensionless paths use sidecars beside the resolved file", t => {
     const f = fixture(t);
     const filename = path.join(f.root, "settings.cjs");
     fs.writeFileSync(filename, 'module.exports = { api: { key: "", host: "file" } };');
     const local = filename.slice(0, -4) + ".secret.cjs";
     writeSettings({ local });
-    assert.equal(Configre(filename, { secrets: true }).api.key, sentinel);
-    assert.equal(Configre(filename.slice(0, -4), { secrets: true }).api.key, sentinel);
+    assert.equal(Configre(filename).api.key, sentinel);
+    assert.equal(Configre(filename.slice(0, -4)).api.key, sentinel);
     assert.equal(fs.existsSync(filename + ".secrets.enc.json"), true);
     assert.equal(fs.existsSync(filename + ".recipients"), true);
     assert.equal(fs.existsSync(path.join(f.root, "secrets.enc.json")), false);
     const relative = path.relative(process.cwd(), f.config);
     writeSettings(f);
-    assert.equal(Configre(relative, { secrets: true }).api.key, sentinel);
+    assert.equal(Configre(relative).api.key, sentinel);
 });
 
 test("ESM callers can use the same synchronous API", t => {
@@ -494,7 +584,7 @@ test("ESM callers can use the same synchronous API", t => {
         import os from 'node:os';
         import Configre from ${JSON.stringify(moduleURL)};
         os.homedir = () => process.env.CONFIGRE_TEST_HOME;
-        const cfg = Configre(process.env.CONFIGRE_TEST_PATH, { secrets: true });
+        const cfg = Configre(process.env.CONFIGRE_TEST_PATH);
         assert.equal(typeof cfg.then, 'undefined');
         assert.equal(cfg.api.key, ${JSON.stringify(sentinel)});
     `);
@@ -511,7 +601,7 @@ test("symlinked configuration directories keep directory sidecar names", { skip:
     writeSettings(f);
     const linked = path.join(f.root, "linked-config");
     fs.symlinkSync(f.config, linked);
-    assert.equal(Configre(linked, { secrets: true }).api.key, sentinel);
+    assert.equal(Configre(linked).api.key, sentinel);
     assert.equal(fs.existsSync(f.encrypted), true);
     assert.equal(fs.existsSync(path.join(f.config, "index.cjs.secrets.enc.json")), false);
 });
@@ -520,13 +610,12 @@ test("error output never includes local secret values or private key contents",
     const f = fixture(t);
     fs.writeFileSync(f.local, `module.exports = {secret: "${sentinel}", bad`);
     assert.throws(() => load(f), /invalid secret module/);
-    assert.equal(new Configre(f.config)._isNested, false);
     const script = `
         const os = require('node:os');
         os.homedir = () => process.env.CONFIGRE_TEST_HOME;
         const Configre = require(process.env.CONFIGRE_TEST_MODULE);
         try {
-            Configre(process.env.CONFIGRE_TEST_PATH, { secrets: true });
+            Configre(process.env.CONFIGRE_TEST_PATH);
         } catch (error) {
             console.error(error.stack);
             process.exitCode = 1;
@@ -545,6 +634,8 @@ test("error output never includes local secret values or private key contents",
     assert.match(result.stderr, /invalid secret module/);
     assert.equal((result.stdout + result.stderr).includes(sentinel), false);
     assert.equal((result.stdout + result.stderr).includes("BEGIN PRIVATE KEY"), false);
+    writeSettings(f);
+    assert.equal(new Configre(f.config)._isNested, false);
 });
 
 test("Git exclusions preserve existing rules and never hide already tracked local files", t => {
@@ -568,6 +659,7 @@ test("Git exclusions preserve existing rules and never hide already tracked loca
     assert.deepEqual(fs.readFileSync(f.encrypted), original);
     assert.ok(git(f.root, ["ls-files"]).includes("config/index.secret.cjs"));
     git(f.root, ["rm", "--cached", "config/index.secret.cjs"]);
+    writeSettings({ local: path.join(f.config, "testhost.secret.cjs") }, {});
     git(f.root, ["add", "-f", "config/testhost.secret.cjs"]);
     assert.throws(() => load(f), /tracked by Git/);
 });
@@ -579,13 +671,13 @@ test("recipient files can be tracked and sidecar names are escaped literally in
     fs.writeFileSync(filename, "module.exports = {};");
     const local = filename.slice(0, -4) + ".secret.cjs";
     writeSettings({ local });
-    Configre(filename, { secrets: true });
+    Configre(filename);
     assert.ok(git(f.root, ["check-ignore", path.basename(local)]).includes(path.basename(local)));
     const recipient = filename + ".recipients/developer.pub";
     fs.copyFileSync(f.publicPath(1), recipient);
     git(f.root, ["add", "-f", path.relative(f.root, recipient)]);
     const original = fs.readFileSync(filename + ".secrets.enc.json");
-    assert.equal(Configre(filename, { secrets: true }).api.key, sentinel);
+    assert.equal(Configre(filename).api.key, sentinel);
     assert.notDeepEqual(fs.readFileSync(filename + ".secrets.enc.json"), original);
 });
 
@@ -601,7 +693,11 @@ test("a server publishes only its public key once and receives automatic authori
     fs.writeFileSync(untracked, sentinel);
     const index = git(f.checkout, ["ls-files", "--stage", "-z"]);
     f.useHome(1);
-    assert.throws(() => load(f.consumer), /public key is published in Git/);
+    assertPublicOnly(f.consumer, f.logs, /public key is published in Git/i);
+    const registeredPath = fs.realpathSync(f.registration);
+    assert.ok(f.logs.info.some(([message, filename]) => message === "Created public-key registration file" && filename === registeredPath));
+    assert.deepEqual(f.logs.info.at(-1), ["Published public key to Git", registeredPath]);
+    const registrationLogs = f.logs.info.length;
     const published = git(f.remote, ["rev-parse", "main"]).trim();
     assert.equal(git(f.checkout, ["rev-parse", "HEAD"]).trim(), published);
     assert.equal(git(f.remote, ["diff-tree", "--no-commit-id", "--name-only", "-r", "main"]).trim(), "config/recipients/testhost.pub");
@@ -613,7 +709,8 @@ test("a server publishes only its public key once and receives automatic authori
     assert.equal(fs.readFileSync(untracked, "utf8"), sentinel);
     assert.equal(git(f.remote, ["show", "main:tracked.txt"]), "initial\n");
     assert.equal(git(f.remote, ["tag", "--list"]), "");
-    assert.throws(() => load(f.consumer), /public key is published in Git/);
+    assertPublicOnly(f.consumer, f.logs, /public key is published in Git/i);
+    assert.equal(f.logs.info.length, registrationLogs);
     assert.equal(git(f.remote, ["rev-parse", "main"]).trim(), published);
 
     f.useHome(0);
@@ -625,7 +722,9 @@ test("a server publishes only its public key once and receives automatic authori
     git(f.root, ["push", "--quiet"]);
     git(f.checkout, ["pull", "--quiet", "--ff-only"]);
     f.useHome(1);
+    const warnings = f.logs.warn.length;
     assert.equal(load(f.consumer).api.key, sentinel);
+    assert.equal(f.logs.warn.length, warnings);
     f.useHome(0);
     writeSettings(f, { api: { key: sentinel + "-updated" } });
     load(f);
@@ -647,18 +746,16 @@ test("a rejected registration push preserves the branch and staging area and can
     const head = git(f.checkout, ["rev-parse", "HEAD"]);
     const index = fs.readFileSync(path.join(f.checkout, ".git", "index"));
     f.useHome(1);
-    assert.throws(() => load(f.consumer), error => {
-        assert.match(error.message, /failed while pushing the public-key commit/);
-        assert.equal(error.stack.includes(sentinel), false);
-        return true;
-    });
+    assertPublicOnly(f.consumer, f.logs, /failed while pushing the public-key commit/);
+    assert.equal(JSON.stringify(f.logs).includes(sentinel), false);
+    assert.equal(f.logs.info.some(([message]) => message === "Published public key to Git"), false);
     assert.equal(git(f.checkout, ["rev-parse", "HEAD"]), head);
     assert.equal(git(f.remote, ["rev-parse", "main"]), head);
     assert.deepEqual(fs.readFileSync(path.join(f.checkout, ".git", "index")), index);
     assert.equal(fs.existsSync(path.join(f.checkout, ".git", "configre-registration.lock")), false);
     assert.equal(fs.readdirSync(path.join(f.checkout, ".git")).some(name => name.startsWith("configre-registration-")), false);
     fs.unlinkSync(hook);
-    assert.throws(() => load(f.consumer), /public key is published in Git/);
+    assertPublicOnly(f.consumer, f.logs, /public key is published in Git/i);
     assert.equal(git(f.remote, ["rev-list", "--count", "main"]).trim(), "2");
 });
 
@@ -674,9 +771,9 @@ test("registration recovers when publication succeeded before the local branch a
     git(interrupted, ["add", "tracked.txt"]);
     fs.writeFileSync(tracked, "unstaged work\n");
     f.useHome(1);
-    assert.throws(() => load(f.consumer), /public key is published in Git/);
+    assertPublicOnly(f.consumer, f.logs, /public key is published in Git/i);
     const published = git(f.remote, ["rev-parse", "main"]);
-    assert.throws(() => load({ config: path.join(interrupted, "config") }), /public key is published in Git/);
+    assertPublicOnly({ config: path.join(interrupted, "config") }, f.logs, /public key is published in Git/i);
     git(interrupted, ["pull", "--quiet", "--ff-only"]);
     assert.equal(git(interrupted, ["rev-parse", "HEAD"]), published);
     assert.equal(git(f.remote, ["rev-parse", "main"]), published);
@@ -689,16 +786,16 @@ test("registration refuses to publish unrelated local commits or guess a branch"
     const remoteHead = git(f.remote, ["rev-parse", "main"]);
     git(f.checkout, ["checkout", "--quiet", "--detach"]);
     f.useHome(1);
-    assert.throws(() => load(f.consumer), /detached HEAD/);
+    assertPublicOnly(f.consumer, f.logs, /detached HEAD/);
     git(f.checkout, ["checkout", "--quiet", "main"]);
     git(f.checkout, ["branch", "--unset-upstream"]);
-    assert.throws(() => load(f.consumer), /upstream remote/);
+    assertPublicOnly(f.consumer, f.logs, /upstream remote/);
     git(f.checkout, ["branch", "--set-upstream-to=origin/main"]);
     fs.writeFileSync(path.join(f.checkout, "tracked.txt"), "unpublished work\n");
     git(f.checkout, ["add", "tracked.txt"]);
     git(f.checkout, ["commit", "--quiet", "-m", "Unpublished work"]);
     const localHead = git(f.checkout, ["rev-parse", "HEAD"]);
-    assert.throws(() => load(f.consumer), /local branch to match its upstream/);
+    assertPublicOnly(f.consumer, f.logs, /local branch to match its upstream/);
     assert.equal(git(f.checkout, ["rev-parse", "HEAD"]), localHead);
     assert.equal(git(f.remote, ["rev-parse", "main"]), remoteHead);
     assert.equal(fs.existsSync(f.registration), false);
@@ -710,11 +807,11 @@ test("registration rejects profile collisions, unsafe names and damaged encrypte
     const previousArgs = process.argv;
     process.argv = [...previousArgs.filter(arg => !arg.startsWith("--config=")), "--config=../escape"];
     t.after(() => { process.argv = previousArgs; });
-    assert.throws(() => load(f.consumer), /requires a profile/);
+    assertPublicOnly(f.consumer, f.logs, /requires a profile/);
     process.argv = previousArgs;
     fs.mkdirSync(path.dirname(f.registration));
     fs.copyFileSync(f.publicPath(2), f.registration);
-    assert.throws(() => load(f.consumer), /different key for this profile/);
+    assertPublicOnly(f.consumer, f.logs, /different key for this profile/);
     assert.equal(fs.readFileSync(f.registration, "utf8"), fs.readFileSync(f.publicPath(2), "utf8"));
     fs.unlinkSync(f.registration);
     fs.copyFileSync(f.publicPath(2), path.join(f.recipients, "testhost.pub"));
@@ -722,7 +819,7 @@ test("registration rejects profile collisions, unsafe names and damaged encrypte
     git(f.root, ["commit", "--quiet", "-m", "Existing server identity"]);
     git(f.root, ["push", "--quiet"]);
     const remoteHead = git(f.remote, ["rev-parse", "main"]);
-    assert.throws(() => load(f.consumer), /different published key/);
+    assertPublicOnly(f.consumer, f.logs, /different published key/);
     const damaged = envelope(f);
     damaged.extra = sentinel;
     fs.writeFileSync(path.join(f.consumer.config, "secrets.enc.json"), JSON.stringify(damaged));
@@ -773,7 +870,7 @@ test("a second process cannot write while an encrypted replacement is pending",
                 const os = require('node:os');
                 os.homedir = () => process.env.CONFIGRE_TEST_HOME;
                 const Configre = require(process.env.CONFIGRE_TEST_MODULE);
-                assert.throws(() => Configre(process.env.CONFIGRE_TEST_PATH, { secrets: true }), /another writer/);
+                assert.throws(() => Configre(process.env.CONFIGRE_TEST_PATH), /another writer/);
             `], {
                 encoding: "utf8",
                 env: {
@@ -792,6 +889,5 @@ test("a second process cannot write while an encrypted replacement is pending",
     assert.equal(load(f).api.key, sentinel + "-new");
     assert.equal(contested, true);
     fs.unlinkSync(f.local);
-    fs.unlinkSync(path.join(f.config, "testhost.secret.cjs"));
     assert.equal(load(f).api.key, sentinel + "-new");
 });