Monorepo

Architecture

One private core with all logic, bundled into two published packages that have no dependencies.

@msecrets/ui      CLI + TUI  ─┐
                              ├─ core ─ node:crypto
@msecrets/ts-sdk  runtime    ─┘

Packages

`packages/core`

Private. age (X25519, ML-KEM-768 + X25519, scrypt, ssh-ed25519), keys, the file format and validation, operations, status, file storage, identity sources, and the OS keychain.

`@msecrets/ts-sdk`

Runtime: createClient turns an imported secrets file into typed values; injectEnv fills process.env. ESM, CommonJS, and type declarations.

`@msecrets/ui`

The msecrets binary: commands, the terminal UI, run, and git integration. A thin layer over core.

Principles

Core is the source of truth. The CLI, the terminal UI, and the SDK only call core operations.
Operations are transactions. Each one runs on a copy of the document; the result is validated before an atomic write, and nothing is written when anything fails.
The file is the contract. Everything durable is in msecrets.json. Keys and identity sources come from the caller, the environment, or the user’s own config, never from the repository.
Standards over invention. Encryption is age, so values interoperate with age, rage, and other tools.
No dependencies. Cryptography is node:crypto; the terminal UI is plain ANSI. Packages are bundled with tsdown.

Repository

packages/core      src/crypto (age, bech32, ssh, bcrypt_pbkdf), keys, document, values, status,
                   operations, store, sources, keychain; test vectors and tests
packages/ts-sdk    src/index.ts
packages/ui        src/cli.ts, commands.ts, tui/, git.ts, spawn.ts
scripts            verify-packages.ts: pack, install offline, and exercise the published packages
docs               this site and the JSON schema