Skip to main content
← back to extensions

Secret File

@randybias/secret-filev2026.10.17.2beta· 9d agoBEHAVIORSACCEPTED WARNINGS
01README

Write a secret file onto one host over SSH from vault values delivered over stdin, atomically and idempotently by content hash, with settable owner and group and a remove action. One generic model type; state holds file metadata and at most a keyed HMAC of the content, never the value.

02Behaviors1
@randybias/secret-filev2026.10.17.2secret_file.ts
fn write()
DESTRUCTIVE. Write the file atomically over stdin with the given mode, owner and group, idempotently by content. The owner and group are applied to a staged file before the rename, so the published file is never briefly wrong. The value is never returned, logged or stored; state keeps only a keyed HMAC when hmac_key is given.
fn verify()
READ-ONLY. Stat the file and, when a content form is given, compare its SHA-256 with the local value's; also compares mode, owner and group when given. Stores match flags and metadata only, never the content or a hash.
fn remove()
DESTRUCTIVE. Remove the file from the host and prove it is gone. Idempotent: an already-absent file is a clean no-op.

Resources

secretFile(infinite)— Secret-file metadata: path, mode, owner, group, byte count and change flag
03Previous Versions1
2026.10.17.1
04Stats
A
93 / 100
Downloads
2
Archive size
35.5 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License1/2partial

    no SPDX license declared

  • Verified public repository2/2earned
Repository
https://github.com/randybias/swamp-extensions

06Platforms
07Labels
#secret#dotenv#environment-file#ssh#security#configuration