Binds the store to one file.
Filesystem the file lives on.
Absolute path of the token file.
Seals and opens the records; plaintext when no password is set.
Returns what the file says about one bank account.
No file, no entry and an unusable entry all read as NO_RECORD; `isIntact` tells the caller whether the file vouches for everything else it holds. A file that could not be read at all is reported as a failure, so the caller can say why the run went cold instead of hiding it.
Opaque key identifying one bank account.
The account's view of the file, or why the store is unreadable.
Persists one account's token, bound to its login, merging it into what is stored.
Every write reads the file afresh, so it merges into what is on disk now rather than a copy that may be stale. A blank token, which is what a run minting none returns, and a binding the intact file already holds write nothing. Three are refused: a login that is not a fingerprint; a token the file binds to another login, under any key, since the first binding is the one the bank issued; and a file that could not be read, which is never replaced — overwriting what cannot be read would destroy every other account's token along with any evidence.
Opaque key identifying one bank account.
The long-term token to persist.
Fingerprint of the login that minted the token.
Whether the file was replaced, or why it was not.
Deletes one account's entry, keeping every other entry as it was.
It reads the file afresh and replaces it whole, exactly as a write does, so a damaged file is quarantined first and a file that could not be read is never replaced. A key the file holds no usable entry under writes nothing: there is nothing this account could send, and the next write sets any damage aside.
Opaque key identifying one bank account.
Whether the file was replaced, or why it was not.
Deletes one account's entry only while it still holds the given token.
The comparison and the removal share one read, so a token minted after the caller decided to retire the old one is never deleted. The removal replaces the file exactly as remove does.
Opaque key identifying one bank account.
Digest of the token to retire; never the token itself.
What the entry held, or why the file could not be read or replaced.
Deletes staged token files an earlier run was killed before cleaning up.
Each one holds a live credential, and a crashed process never returns to remove it. Whoever owns the store should call this on every run, not only after a restart: a file staged just before a restart is still inside the grace period when the process comes back, and a warm run that writes nothing never commits. The store itself only collects leftovers after its own commits.
How many were removed, or why the directory could not be read.
Durable long-term bank tokens, keyed by an opaque store key.