LocalSecrets

Creates the platform-specific inner store with deterministic platform selection for tests.

Resolves the executable path that the Linux platform store may launch.

Creates the diagnostic result used when a Linux-only override is configured on a non-Linux platform.

Creates a successful resolution for a trusted executable path.

Creates a failed resolution with the status and diagnostic callers should surface.

Reads one raw platform-stored value without applying indexed-store policy.

Writes one raw platform-stored value without applying indexed-store policy.

Deletes one raw platform-stored value without applying indexed-store policy.

Verifies raw platform store availability for a namespace.

Maps a failed platform command result into the LocalSecrets diagnostic contract.

Builds the display-safe diagnostic cause for a failed platform command.

Creates a result from a platform process that started and exited.

Creates the synthetic result used when the platform command cannot be started.

Creates a successful list result.

Creates a non-success list result.

Registers LocalSecrets services.

Creates a found resolution.

Creates a non-found resolution with a display-safe diagnostic.

Returns the stable text rendered by the LocalSecrets migration command.

Creates a completed migration result.

Creates a migration result that could not start safely.

Copies currently readable legacy records into the current storage format for one normalized namespace.

Creates a found result.

Creates a missing result that may fall through to lower-priority providers.

Creates a non-found result with a display-safe diagnostic.

Reads the raw value for a generic-password query .

Checks whether a generic-password query exists without requesting its value data.

Adds a generic-password value under query without overwriting a record.

Replaces the value for an existing generic-password query .

Deletes the generic-password record identified by query .

Reads a local secret.

Writes a local secret.

Deletes a local secret.

Lists currently retrievable local secret config keys for an application/environment namespace.

Diagnoses whether the store is usable for the supplied namespace.

Converts this local secret diagnostic into a Config terminal diagnostic.

Formats this diagnostic for display without exposing secret values.

Configures LocalSecrets options.

Replaces the local secret store implementation.

Replaces the local secret store with a specific instance.

Creates a successful identity result.

Creates a failed identity result.

Resolves a local secret and returns the structured LocalSecrets status before config-provider adaptation.

Normalizes a local secret identity.

Gets the default per-user AppSurface local secret file path.

Returns whether the configured fallback file exists.

Reads the fallback JSON file after posture inspection has already succeeded.

Opens the fallback JSON file for metadata-only streaming scans after posture inspection has already succeeded.

Inspects only the path shape needed before read attempts that do not need file mode posture.

Inspects the existing fallback file and immediate containing directory before returning or reading secret values.

Prepares the fallback path for a write without reading or mutating existing parent directory permissions.

Atomically writes the fallback JSON file and repairs the final file mode when the platform supports it.

Opens or creates the fallback file and reports ready, repaired, degraded, or unsupported posture.

Creates a ready posture result.

Creates a repaired posture result for fallback files tightened by write or doctor.

Creates a degraded posture result for platforms where owner-only posture cannot be proven in v1.

Creates an unsupported posture result for unsafe path shapes or permanent posture violations.

Converts the posture result to a LocalSecrets diagnostic.

Probes whether a local secret identity is present in store metadata.