Module file 

The file store. Each entry is one file named by the SHA-256 of its account key, so no key text (ids, hostnames) reaches a file name and no key can escape the directory. No timeouts: file operations don’t wait on a user.

Functions

delete 🔒

get_optional 🔒

path_for 🔒

prepare_dir 🔒

Create dir if needed and make it owner-only (0700), also when it already existed with wider permissions.

put 🔒

Write via a fresh 0600 temp file and a rename, so a reader never sees a partial secret and a crash never leaves one behind.