/**
 * SecretsStore — persists secret values in the state directory (gitignored).
 * Separate from project.yaml (config dir) so secrets never appear in git diffs.
 */
import fs from "node:fs";
import path from "node:path";
export class SecretsStore {
    data = {};
    filePath;
    constructor(stateDir) {
        this.filePath = path.join(stateDir, "secrets.json");
        this.load();
    }
    load() {
        try {
            if (fs.existsSync(this.filePath)) {
                const raw = JSON.parse(fs.readFileSync(this.filePath, "utf-8"));
                if (raw && typeof raw === "object" && !Array.isArray(raw)) {
                    this.data = {};
                    for (const [k, v] of Object.entries(raw)) {
                        if (typeof v === "string")
                            this.data[k] = v;
                    }
                }
            }
        }
        catch { /* ignore read errors */ }
    }
    get(key) {
        return this.data[key];
    }
    set(key, value) {
        this.data[key] = value;
        this.save();
    }
    remove(key) {
        delete this.data[key];
        this.save();
    }
    getAll() {
        return { ...this.data };
    }
    /** Bulk update: set multiple keys at once, remove keys with empty values */
    update(entries) {
        for (const [k, v] of Object.entries(entries)) {
            if (v) {
                this.data[k] = v;
            }
            else {
                delete this.data[k];
            }
        }
        this.save();
    }
    save() {
        try {
            const dir = path.dirname(this.filePath);
            if (!fs.existsSync(dir))
                fs.mkdirSync(dir, { recursive: true });
            fs.writeFileSync(this.filePath, JSON.stringify(this.data, null, 2) + "\n", "utf-8");
        }
        catch (err) {
            console.error("[secrets-store] Failed to save:", err);
        }
    }
}
//# sourceMappingURL=secrets-store.js.map