secret

type EnvResolver struct{}

type Kind string

type MaxVersioner interface {
	MaxKeyVersion(ctx context.Context) (int32, error)
}

type Ref struct {
	Kind Kind `json:"kind"`

	// Env is the OS variable name when Kind == KindEnv.
	Env string `json:"env,omitempty"`

	// ID is the backend key when Kind == KindStored (and future
	// id-addressed backends): the secret_values row id.
	ID string `json:"id,omitempty"`

	// Path is the locator for path-addressed external backends (KindAWS,
	// KindBitwarden, …): an opaque per-backend reference string the
	// resolver parses (e.g. "prod/openai-key:apiKey", "openai-key/password").
	Path string `json:"path,omitempty"`
}

type Registry struct {
	// contains filtered or unexported fields
}

type Resolver interface {
	Resolve(ctx context.Context, ref Ref) ([]byte, error)
}

type RotateResult struct {
	Rotated    int
	NewVersion int32
}

type Rotator interface {
	// Rotate re-encrypts every stored value within one transaction,
	// stamping newKeyVersion. reencrypt maps old (ct, nonce) → new.
	Rotate(ctx context.Context, newKeyVersion int32,
		reencrypt func(ct, nonce []byte) (newCt, newNonce []byte, err error)) (rotated int, err error)
}

type Store interface {
	// Get returns the ciphertext, nonce, and key version for id, or an
	// error if absent.
	Get(ctx context.Context, id string) (ciphertext, nonce []byte, keyVersion int32, err error)
	// Put writes (overwriting) the ciphertext for id.
	Put(ctx context.Context, id string, ciphertext, nonce []byte, keyVersion int32) error
	// Delete removes the secret at id. Deleting a missing id is not an
	// error (idempotent cleanup).
	Delete(ctx context.Context, id string) error
}

type StoredResolver struct {
	// contains filtered or unexported fields
}

type StoredRow struct {
	ID         string
	Ciphertext []byte
	Nonce      []byte
	KeyVersion int32
}

type Writer interface {
	// Create persists plaintext under id and returns a Ref resolving to
	// it. Overwrites any existing secret at id.
	Create(ctx context.Context, id string, plaintext []byte) (Ref, error)
}