stzSecretStore

(sans commentaire dans la source : le nom se lit comme une phrase) initaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) nameaucune extension

the registry ----------------------------------------------------- register a secret under its own Name(). Registering a name that exists REPLACES it -- that is rotation (RotateQ is the explicit alias).aucune extension

rotate a secret: replace whatever is registered under poNewSecret's name.QCSXTZZZIBWU

ROTATE IN PLACE, to a fresh random value -- containment's :RotateSecret. Only a secret whose value THIS store holds (a :literal) can be regenerated here: a key it issues, a token it signs with. A secret that lives in an environment variable, a file or a vault is not this store's to change -- that REFUSES loudly, naming where to rotate it, rather than pretending. Creating a credential is an effect, so poActor passes the same gate as a reveal. The new value is 32 random bytes as 64 hex characters; kind and name are kept (a token's expiry is cleared -- a new value is a new credential). Returns This.aucune extension

revoke (remove) a secret by name.aucune extension

safe reads (never leak a value)aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) number of secretsaucune extension

the project's whole credential surface, by name -- safe to show/log.aucune extension

the secret OBJECT (still self-redacting -- holding it does not reveal it).aucune extension

the redacted descriptor of a registered secret (never its value).aucune extension

the ONE governed door to a value (gate + audit) ----------------- reveal a secret's plaintext -- GATED (only an effectful, non-sandboxed actor) and AUDITED (the access is recorded either way). This is the only path a value leaves the store, so the log is complete.aucune extension

reveal through a vault RESOLVER (for a :vault-sourced secret), still gated and AUDITED by the store. For a non-vault secret the resolver is ignored, so this is a safe superset of Reveal.aucune extension

may this actor reveal this secret? (no side effect, no audit entry.)aucune extension

Write the whole store to pcPath as ONE authenticated-encryption blob (XChaCha20-Poly1305), keyed by poKeySecret -- itself a stzSecret, whose 64-hex value comes from wherever secrets come from (an environment variable, a file, a vault). Literal values are sealed; env / file / vault secrets are saved as their POINTER only -- the plaintext never leaves its source. The store's name is bound as the aad, so one store's file cannot be passed off as another's. Sealing reads every literal value, so poActor passes the same gate as a reveal.aucune extension

As SaveSealedTo, with the KEY fetched through a vault resolver (R4).aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) access logaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) number of accessesaucune extension

refused reveals -- a misuse signal worth watching.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) showaucune extension