{ "slug": "safe/persist-adapter", "title": "Persist Adapter", "description": "Configure the alpha Cuitty Persist adapter for Safe records with mandatory E2EE guardrails.", "url": "https://cuitty.com/docs/safe/persist-adapter", "markdown_url": "https://cuitty.com/docs/safe/persist-adapter.md", "json_url": "https://cuitty.com/docs/safe/persist-adapter.json", "frontmatter": { "title": "Persist Adapter", "description": "Configure the alpha Cuitty Persist adapter for Safe records with mandatory E2EE guardrails.", "order": 5, "section": "Safe", "updatedAt": "2026-06-09" }, "headings": [ { "depth": 1, "slug": "persist-adapter", "text": "Persist Adapter" }, { "depth": 2, "slug": "configuration", "text": "Configuration" }, { "depth": 2, "slug": "guardrails", "text": "Guardrails" }, { "depth": 2, "slug": "record-shape", "text": "Record shape" } ], "body_markdown": "# Persist Adapter\n\nThe Persist adapter stores Safe records in Cuitty Persist's `secret` storage class with end-to-end encryption.\n\n> Alpha caveat: Cuitty Safe's Persist adapter is alpha until Persist's E2EE profile runtime reaches GA. Use it sparingly for high-value production credentials. Prefer 1Password service accounts or a locked local vault for production CI/CD until GA security review, recovery testing, and multi-device revocation testing are complete.\n\n## Configuration\n\n```ts\nimport { createSafePersistAdapter } from \"@cuitty/safe/server\";\n\nconst adapter = createSafePersistAdapter({\n profile: \"local-first-laptop\",\n account: \"acme\",\n safe: \"dev\",\n namespace: \"safe/acme/dev\",\n storageClass: \"secret\",\n syncMode: \"manual\",\n alpha: true,\n acknowledgeE2eeRisk: true,\n});\n```\n\n## Guardrails\n\n- `alpha: true` and `acknowledgeE2eeRisk: true` are required.\n- Manual sync is the default.\n- Remote writes are blocked unless encryption is `required`.\n- Remote Persist targets must show a visible warning in UI and CLI output.\n- Audit metadata includes device id, key fingerprint, profile id, provider, result, and timestamp.\n- Persist access controls are not the only boundary. Safe encryption remains mandatory.\n\n## Record shape\n\nPersist Safe records contain encrypted envelopes and metadata:\n\n```ts\ninterface PersistSafeSecretRecord {\n id: string;\n ref: string;\n account: string;\n safe: string;\n secret: string;\n envelope: SafeEncryptedEnvelope;\n metadata: SafeSecretMetadata;\n createdAt: string;\n updatedAt: string;\n deletedAt?: string;\n}\n```\n\nList operations return metadata only. Read operations require explicit resolution and must redact values from errors and logs.", "body_html": "

Persist Adapter

\n

The Persist adapter stores Safe records in Cuitty Persist’s secret storage class with end-to-end encryption.

\n
\n

Alpha caveat: Cuitty Safe’s Persist adapter is alpha until Persist’s E2EE profile runtime reaches GA. Use it sparingly for high-value production credentials. Prefer 1Password service accounts or a locked local vault for production CI/CD until GA security review, recovery testing, and multi-device revocation testing are complete.

\n
\n

Configuration

\n
import { createSafePersistAdapter } from \"@cuitty/safe/server\";\n\nconst adapter = createSafePersistAdapter({\n  profile: \"local-first-laptop\",\n  account: \"acme\",\n  safe: \"dev\",\n  namespace: \"safe/acme/dev\",\n  storageClass: \"secret\",\n  syncMode: \"manual\",\n  alpha: true,\n  acknowledgeE2eeRisk: true,\n});
\n

Guardrails

\n\n

Record shape

\n

Persist Safe records contain encrypted envelopes and metadata:

\n
interface PersistSafeSecretRecord {\n  id: string;\n  ref: string;\n  account: string;\n  safe: string;\n  secret: string;\n  envelope: SafeEncryptedEnvelope;\n  metadata: SafeSecretMetadata;\n  createdAt: string;\n  updatedAt: string;\n  deletedAt?: string;\n}
\n

List operations return metadata only. Read operations require explicit resolution and must redact values from errors and logs.

", "links_out": [] }