{
  "slug": "safe/persist-adapter",
  "title": "Store Adapter",
  "description": "Configure the alpha Cuitty Store adapter for Safe records with mandatory E2EE guardrails.",
  "url": "https://cuitty.com/docs/safe/persist-adapter",
  "markdown_url": "https://cuitty.com/docs/safe/persist-adapter.md",
  "json_url": "https://cuitty.com/docs/safe/persist-adapter.json",
  "frontmatter": {
    "title": "Store Adapter",
    "description": "Configure the alpha Cuitty Store adapter for Safe records with mandatory E2EE guardrails.",
    "order": 5,
    "section": "Safe",
    "updatedAt": "2026-06-09"
  },
  "headings": [
    {
      "depth": 1,
      "slug": "store-adapter",
      "text": "Store Adapter"
    },
    {
      "depth": 2,
      "slug": "configuration",
      "text": "Configuration"
    },
    {
      "depth": 2,
      "slug": "guardrails",
      "text": "Guardrails"
    },
    {
      "depth": 2,
      "slug": "record-shape",
      "text": "Record shape"
    }
  ],
  "body_markdown": "# Store Adapter\n\nThe Store adapter stores Safe records in Cuitty Store's `secret` storage class with end-to-end encryption.\n\n> Alpha caveat: Cuitty Safe's Store adapter is alpha until Store's E2EE profile runtime reaches GA. The current server helper keeps the legacy `createSafePersistAdapter` export as a compatibility alias. Use it sparingly for high-value production credentials. Prefer 1Password service accounts or a locked local vault for production CI/CD until GA security review, recovery testing, and multi-device revocation testing are complete.\n\n## Configuration\n\n```ts\nimport { createSafePersistAdapter } from \"@cuitty/safe/server\";\n\nconst adapter = createSafePersistAdapter({\n  profile: \"local-first-laptop\",\n  account: \"acme\",\n  safe: \"dev\",\n  namespace: \"safe/acme/dev\",\n  storageClass: \"secret\",\n  syncMode: \"manual\",\n  alpha: true,\n  acknowledgeE2eeRisk: true,\n});\n```\n\n## Guardrails\n\n- `alpha: true` and `acknowledgeE2eeRisk: true` are required.\n- Manual sync is the default.\n- Remote writes are blocked unless encryption is `required`.\n- Remote Store targets must show a visible warning in UI and CLI output.\n- Audit metadata includes device id, key fingerprint, profile id, provider, result, and timestamp.\n- Store access controls are not the only boundary. Safe encryption remains mandatory.\n\n## Record shape\n\nStore Safe records contain encrypted envelopes and metadata:\n\n```ts\ninterface PersistSafeSecretRecord {\n  id: string;\n  ref: string;\n  account: string;\n  safe: string;\n  secret: string;\n  envelope: SafeEncryptedEnvelope;\n  metadata: SafeSecretMetadata;\n  createdAt: string;\n  updatedAt: string;\n  deletedAt?: string;\n}\n```\n\nList operations return metadata only. Read operations require explicit resolution and must redact values from errors and logs.",
  "links_out": []
}