sliccy 6.129.0 → 6.130.1

package/README.md

@@ -11,7 +11,7 @@ If this scares, confuses, or excites you, keep reading.
 
 # slicc — Self-Licking Ice Cream Cone
 
-[![51% Vibe_Coded](https://img.shields.io/badge/51%25-Vibe_Coded-ff69b4?style=for-the-badge&logo=claude&logoColor=white)](https://github.com/ai-ecoverse/vibe-coded-badge-action)
+[![53% Vibe_Coded](https://img.shields.io/badge/53%25-Vibe_Coded-ff69b4?style=for-the-badge&logo=claude&logoColor=white)](https://github.com/ai-ecoverse/vibe-coded-badge-action)
 
 [![npm](https://img.shields.io/npm/v/sliccy)](https://www.npmjs.com/package/sliccy)
 

package/dist/node-server/_shared/secret-env-schema.d.ts

@@ -12,10 +12,32 @@ export interface SecretEnvEntry {
 export declare function parseDomainsCsv(raw: string): string[];
 /** Pair values with non-empty domain companions, preserving first-name order. */
 export declare function pairEnvEntriesToSecrets(entries: EnvEntry[]): SecretEnvEntry[];
+/**
+ * Secret values are stored one per line, so a value carrying a line break
+ * cannot survive a `serialize` → `parse` round-trip: `serializeEnvFile` quotes
+ * it with a real LF inside the quotes and `parseEnvFile` then splits on `\n`,
+ * keeping the unbalanced first line and dropping the rest. Writers reject such
+ * a value at the boundary instead of silently truncating it (issue #2828).
+ *
+ * Mirrored by `EnvFileFormat.isSingleLineValue` in
+ * `packages/swift-server/Sources/Keychain/EnvFileFormat.swift`; both sides are
+ * pinned by the cross-implementation vectors.
+ */
+export declare function isSingleLineSecretValue(value: string): boolean;
+/** The single rejection message both servers return for a multiline value. */
+export declare function multilineSecretValueError(name: string): string;
 /** Parse the shared, deliberately small .env subset used for secret storage. */
 export declare function parseEnvFile(content: string): EnvEntry[];
 /** Parse assignment lines while preserving every character after the first `=`. */
 export declare function parseEnvFilePreservingValues(content: string): EnvEntry[];
+/**
+ * Serialize entries to the line-oriented `.env` subset.
+ *
+ * Throws on a value containing a line break rather than emitting a blob that
+ * would parse back truncated. This is the fail-closed backstop behind the
+ * boundary checks in the two privileged servers' secret routes — no write path
+ * can corrupt the store by going around them.
+ */
 export declare function serializeEnvFile(entries: EnvEntry[]): string;
 /** Profile name validation shared by every S3 secret-schema writer. */
 export declare const PROFILE_RE: RegExp;

package/dist/node-server/_shared/secret-env-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-env-schema.d.ts","sourceRoot":"","sources":["../src/secret-env-schema.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAKrD;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAsB7E;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAmBxD;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAYxE;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAO5D;AAED,uEAAuE;AACvE,eAAO,MAAM,UAAU,QAAsB,CAAC;AAE9C,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAStE;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,cAAc,GAAG,mBAAmB,CASjF"}
+{"version":3,"file":"secret-env-schema.d.ts","sourceRoot":"","sources":["../src/secret-env-schema.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAKrD;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAsB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,8EAA8E;AAC9E,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAmBxD;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAYxE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAQ5D;AAED,uEAAuE;AACvE,eAAO,MAAM,UAAU,QAAsB,CAAC;AAE9C,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAStE;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,cAAc,GAAG,mBAAmB,CASjF"}

package/dist/node-server/_shared/secret-env-schema.js

@@ -31,6 +31,24 @@ export function pairEnvEntriesToSecrets(entries) {
             : [];
     });
 }
+/**
+ * Secret values are stored one per line, so a value carrying a line break
+ * cannot survive a `serialize` → `parse` round-trip: `serializeEnvFile` quotes
+ * it with a real LF inside the quotes and `parseEnvFile` then splits on `\n`,
+ * keeping the unbalanced first line and dropping the rest. Writers reject such
+ * a value at the boundary instead of silently truncating it (issue #2828).
+ *
+ * Mirrored by `EnvFileFormat.isSingleLineValue` in
+ * `packages/swift-server/Sources/Keychain/EnvFileFormat.swift`; both sides are
+ * pinned by the cross-implementation vectors.
+ */
+export function isSingleLineSecretValue(value) {
+    return !/[\n\r]/.test(value);
+}
+/** The single rejection message both servers return for a multiline value. */
+export function multilineSecretValueError(name) {
+    return `Secret "${name}" value cannot contain newlines; the secret store is line-oriented and would truncate it to the first line`;
+}
 /** Parse the shared, deliberately small .env subset used for secret storage. */
 export function parseEnvFile(content) {
     const entries = [];
@@ -68,8 +86,18 @@ export function parseEnvFilePreservingValues(content) {
     }
     return entries;
 }
+/**
+ * Serialize entries to the line-oriented `.env` subset.
+ *
+ * Throws on a value containing a line break rather than emitting a blob that
+ * would parse back truncated. This is the fail-closed backstop behind the
+ * boundary checks in the two privileged servers' secret routes — no write path
+ * can corrupt the store by going around them.
+ */
 export function serializeEnvFile(entries) {
     const lines = entries.map(({ key, value }) => {
+        if (!isSingleLineSecretValue(value))
+            throw new Error(multilineSecretValueError(key));
         const needsQuoting = /[\s#"']/.test(value);
         const serialized = needsQuoting ? `"${value.replace(/"/g, '\\"')}"` : value;
         return `${key}=${serialized}`;

package/dist/node-server/_shared/secret-env-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-env-schema.js","sourceRoot":"","sources":["../src/secret-env-schema.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AAazC,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,uBAAuB,CAAC,OAAmB;IACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,KAAK,KAAK,SAAS,IAAI,cAAc,EAAE,MAAM;YAClD,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAC5C,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAE7B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAmB;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3C,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5E,OAAO,GAAG,GAAG,IAAI,UAAU,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAE9C,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,QAA4B;IAC1D,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAkBD,MAAM,UAAU,sBAAsB,CAAC,KAAqB;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+DAA+D,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAC/E,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACnF,MAAM,eAAe,GACnB,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"secret-env-schema.js","sourceRoot":"","sources":["../src/secret-env-schema.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AAazC,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,uBAAuB,CAAC,OAAmB;IACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,KAAK,KAAK,SAAS,IAAI,cAAc,EAAE,MAAM;YAClD,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAC5C,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,WAAW,IAAI,4GAA4G,CAAC;AACrI,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAE7B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAmB;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3C,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;QACrF,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5E,OAAO,GAAG,GAAG,IAAI,UAAU,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAE9C,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,QAA4B;IAC1D,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAkBD,MAAM,UAAU,sBAAsB,CAAC,KAAqB;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+DAA+D,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAC/E,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACnF,MAAM,eAAe,GACnB,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;AACvC,CAAC"}

package/dist/node-server/routes/secrets.js

@@ -1,4 +1,4 @@
-import { previewSecret } from '../_shared/index.js';
+import { isSingleLineSecretValue, multilineSecretValueError, previewSecret, } from '../_shared/index.js';
 import express from 'express';
 import { handleDaSignAndForward, handleS3SignAndForward } from '../secrets/sign-and-forward.js';
 /**
@@ -41,6 +41,12 @@ async function handleScopeEdit(res, name, domains, secretStore, secretProxy) {
             const existing = secretStore.get(name);
             if (!existing)
                 return res.status(404).json({ error: `no secret named "${name}"` });
+            // Re-saving is a full rewrite of the value, so a value the store should
+            // never have held (a hand-edited multiline entry) must not be laundered
+            // through a scope change into a truncated one (#2828).
+            if (!isSingleLineSecretValue(existing.value)) {
+                return res.status(400).json({ error: multilineSecretValueError(name) });
+            }
             secretStore.set(name, existing.value, domains);
         }
         await secretProxy.reload();
@@ -122,6 +128,13 @@ export function registerSecretRoutes(app, deps) {
         if (typeof name !== 'string' || typeof value !== 'string' || !isStringArray(domains)) {
             return res.status(400).json({ error: 'bad-request' });
         }
+        // Fail closed at the boundary: the persisted .env schema stores one value
+        // per line, so a multiline value (a PEM private key, typically) would be
+        // truncated to its first line — and an overwrite would replace a working
+        // credential with an unrecoverable one behind a 200 (#2828).
+        if (!isSingleLineSecretValue(value)) {
+            return res.status(400).json({ error: multilineSecretValueError(name) });
+        }
         try {
             secretStore.set(name, value, domains);
             await secretProxy.reload();

package/dist/node-server/secrets/env-secret-store.js

@@ -9,7 +9,7 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, resolve } from 'node:path';
-import { DOMAINS_SUFFIX, pairEnvEntriesToSecrets } from '../_shared/index.js';
+import { DOMAINS_SUFFIX, isSingleLineSecretValue, multilineSecretValueError, pairEnvEntriesToSecrets, } from '../_shared/index.js';
 import { parseEnvFile, serializeEnvFile } from './env-file.js';
 const DEFAULT_PATH = resolve(homedir(), '.slicc', 'secrets.env');
 const FILE_MODE = 0o600;
@@ -25,6 +25,12 @@ export class EnvSecretStore {
         if (domains.length === 0) {
             throw new Error(`Secret "${name}" must have at least one authorized domain`);
         }
+        // The .env schema is line-oriented, so a multiline value would be written
+        // back truncated to its first line (#2828). Refuse the write rather than
+        // report success over a corrupted credential.
+        if (!isSingleLineSecretValue(value)) {
+            throw new Error(multilineSecretValueError(name));
+        }
         const entries = this.readEntries();
         const domainsKey = name + DOMAINS_SUFFIX;
         upsertEntry(entries, name, value);