internal/

Package atomicfile writes a file so that a concurrent reader never sees a partial document, the destination always lands at exactly the mode asked for, and a power loss immediately after a successful write cannot resurrect the old contents.

Package audit is arca's access log: an append-only history of every secret access, backed by a local SQLite database.

Package buildinfo assembles and renders arca's build stamp: the version, the VCS commit and date Go embeds, and the toolchain and platform.

Package crypto is arca's thin encryption layer over filippo.io/age.

Package policy parses the values arca's per-secret controls are expressed in: relative lifetimes (--ttl) and use caps (--rate).

Package remote replicates opaque store envelopes to an untrusted network backend.

Package secretname decides what a secret may be called.

Package store is arca's on-disk secret store: a single JSON document holding cleartext metadata plus per-value age ciphertext.

Package storesign is the operator-held Ed25519 key that authenticates a synced store (audit H1).

Package xdg resolves where arca's files live from configuration alone: the XDG base directories, the user's home, and the documented environment overrides.