feat(FN-4945): complete Step 1 — add isSecretScope guard

Fusion-Task-Id: FN-4945
Fusion-Task-Lineage: f3049b2a-26de-4d48-be99-eb90e4780a9e

packages/core/src/__tests__/is-secret-scope.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import { isSecretScope } from "../secrets-store.js";
+
+describe("isSecretScope", () => {
+  it("accepts project and global", () => {
+    expect(isSecretScope("project")).toBe(true);
+    expect(isSecretScope("global")).toBe(true);
+  });
+
+  it("rejects invalid values", () => {
+    expect(isSecretScope(null)).toBe(false);
+    expect(isSecretScope(undefined)).toBe(false);
+    expect(isSecretScope(123)).toBe(false);
+    expect(isSecretScope("local")).toBe(false);
+    expect(isSecretScope("GLOBAL")).toBe(false);
+  });
+});

packages/core/src/index.ts

@@ -1143,6 +1143,7 @@ export type {
   EncryptedSecret,
 } from "./secrets-crypto.js";
 export {
+  isSecretScope,
   SecretsStore,
   SecretsStoreError,
 } from "./secrets-store.js";

packages/core/src/secrets-store.ts

@@ -4,6 +4,10 @@ import type { CentralDatabase } from "./central-db.js";
 import { createSecretCipher, SecretCryptoError, type MasterKeyProvider } from "./secrets-crypto.js";
 
 export type SecretScope = "project" | "global";
+export function isSecretScope(value: unknown): value is SecretScope {
+  return value === "project" || value === "global";
+}
+
 export type SecretAccessPolicy = "auto" | "prompt" | "deny";
 
 export interface SecretRecord {