import { t as writeFileAtomic } from "./atomic-write-8yjqqLtS.js";
import path from "path";
import fs from "fs";
import crypto from "crypto";
//#region src/core/encryption.ts
const ALGORITHM = "aes-256-gcm";
const KEY_LEN = 32;
const IV_LEN = 12;
function deriveKey(secret) {
	return crypto.scryptSync(secret, "dxcrm-salt-v1", KEY_LEN);
}
function encryptField(plaintext, key) {
	const iv = crypto.randomBytes(IV_LEN);
	const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
	const authTag = cipher.getAuthTag();
	return {
		iv: iv.toString("hex"),
		ciphertext: ciphertext.toString("hex"),
		authTag: authTag.toString("hex")
	};
}
function decryptField(encrypted, key) {
	const iv = Buffer.from(encrypted.iv, "hex");
	const ciphertext = Buffer.from(encrypted.ciphertext, "hex");
	const authTag = Buffer.from(encrypted.authTag, "hex");
	const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
	decipher.setAuthTag(authTag);
	return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
}
function encryptFieldStr(plaintext, secret) {
	return JSON.stringify(encryptField(plaintext, deriveKey(secret)));
}
function decryptFieldStr(encryptedJson, secret) {
	return decryptField(JSON.parse(encryptedJson), deriveKey(secret));
}
//#endregion
//#region src/core/vault.ts
function vaultPath(dataDir) {
	return path.join(dataDir, ".agentic", "vault.enc");
}
/** Read + decrypt the vault. Empty vault when the file does not exist yet. */
function loadVault(dataDir, key) {
	const p = vaultPath(dataDir);
	if (!fs.existsSync(p)) return {};
	const encrypted = fs.readFileSync(p, "utf-8");
	let decrypted;
	try {
		decrypted = decryptFieldStr(encrypted, key);
	} catch {
		throw new Error("Unable to decrypt vault: wrong master key or corrupted vault file.");
	}
	const data = JSON.parse(decrypted);
	return data && typeof data === "object" ? data : {};
}
/** Encrypt + write the vault atomically (overwrites the single blob). */
function saveVault(dataDir, key, data) {
	writeFileAtomic(vaultPath(dataDir), encryptFieldStr(JSON.stringify(data), key));
}
/** Store (or overwrite) a secret under `name`. */
function setSecret(dataDir, key, name, value) {
	const data = loadVault(dataDir, key);
	data[name] = value;
	saveVault(dataDir, key, data);
}
/** Retrieve a secret; returns undefined when absent. Throws on wrong master key. */
function getSecret(dataDir, key, name) {
	return loadVault(dataDir, key)[name];
}
/** List the names of all stored secrets (values stay encrypted). */
function listSecretKeys(dataDir, key) {
	return Object.keys(loadVault(dataDir, key));
}
/** Remove a secret; returns true when something was deleted. */
function removeSecret(dataDir, key, name) {
	const data = loadVault(dataDir, key);
	if (!(name in data)) return false;
	delete data[name];
	saveVault(dataDir, key, data);
	return true;
}
//#endregion
export { saveVault as a, removeSecret as i, listSecretKeys as n, setSecret as o, loadVault as r, getSecret as t };

//# sourceMappingURL=vault-CfwZdNzC.js.map