Remove the EnvInjector closure and replace with a secrets_config path
that loads notsecrets.toml and uses SecretResolver for env injection.
Existing parse_env_line validation (blocked keys, null bytes) is
preserved in the injection loop.
Add a config-driven, strongly-typed secret/env resolution system to
notsecrets with 11 provider backends. The system supports explicit
key bindings with typed SecretRef enums and a priority chain fallback.
Tier 1 providers (implemented): Env, 1Password, dotenvx, SOPS, GSM
Tier 2 providers (stubbed): nuenv, direnv, mise, Bitwarden, Vault, dotenvy
New types: Provider, ProviderConfig, SecretRef, SecretsConfig,
SecretsError, SecretSource, EnumerableSecretSource, SecretResolver
Config lives in notsecrets.toml with typed serde deserialization.
ISP split: EnumerableSecretSource for backends that support bulk
enumeration, SecretSource for single-key lookup only.
Includes conformance test suite, 33 new tests (161 workspace total).
notstrap EnvInjector migration deferred to follow-up.
Remove hardcoded nu interpreter. HookSpec gains an optional interpreter
field; runner infers from file extension (.sh, .nu, .py, .rb, .zsh,
.bash) when not set. Integration tests now use sh — no nu runtime dep
on CI.
Replace AgeKeySource/resolve_age_key/install_age_key with IdentitySource/resolve_identities.
Update integration tests to use a valid age bech32 key fixture.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Three tests covering the full bootstrap path: dot-hook execution with
symlink verification, setup-hook skip-on-rerun via state file, and
fail-fast behaviour when the age key is missing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Move src/ and tests/ into crates/notfiles/ as a proper lib+bin crate.
Internal config/error/paths modules replaced with notcore imports.
All 31 workspace tests pass.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
