Fix/at rest encryption

.pre-commit/.just

@@ -209,6 +209,11 @@ executable-scripts:
     cd $(git rev-parse --show-toplevel)
 
     for f in $(git ls-files); do
+        # `git ls-files` includes files that are staged for deletion; skip them.
+        if [[ ! -f "$f" ]]; then
+            continue
+        fi
+
         first_line=$(head -n 1 "$f")
 
         # see if the first line is a shell shebang

CHANGELOG.md

@@ -14,13 +14,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `signed_http` feature and module for application layer HTTP request/response signatures.
 - `network_auth` helpers, types, and PTB templates for tool key registration and leader allowlists.
 - derived gas service identifiers and PTB templates
+- `secret_store` module providing a minimal at-rest secret wrapper with optional encryption.
 - `NexusClient` code for gas tickets
 
 #### Changed
 
 - adjusted transaction templates and events to support tools as derived objects
 - removed all `Tool*` types for a unified `Tool` type that supports both offchain and onchain tools and `ToolRef` type to differentiate
 - `NexusClient::workflow::execute` to work with derived gas service
+- replaced `secret_core` with `secret_store` for at-rest secrets.
 
 #### Fixed
 
@@ -34,15 +36,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `SharedObjectRef` type to represent shared object references with mutability information
 - `AnnounceInterfacePackageEvent` now has `shared_objects` field of type `Vec<SharedObjectRef>` that carries the reference type information
 - added support for tagged_output in sdk
+- `nexus secrets` command group for local at-rest secrets:
+  - `nexus secrets status` / `enable` / `disable` / `rotate` / `wipe`
 
 #### Changed
 
 - `nexus tool list` now works with derived objects
-- extracted gas tickets related logic to the `NexusClient`
+- at-rest secret storage now auto-creates a master key in the OS keyring on first secret write (when possible); if the keyring is unavailable, it warns and writes plaintext.
 
 #### Removed
 
-- `nexus network create` as it was outdated and no longer relevant
+- `nexus crypto set-passphrase` command (passphrase-based encryption).
+- `nexus crypto init-key` and `nexus crypto key-status` (moved to `nexus secrets`).
 
 ### `nexus-toolkit-rust`
 

Cargo.toml

@@ -67,6 +67,7 @@ strum_macros = "0.27"
 tempfile = "3.19.0"
 thiserror = "2.0.12"
 tokio = { version = "1.48.0", features = ["full"] }
+tokio-stream = "0.1.17"
 tokio-retry = "0.3.0"
 toml = "0.8.20"
 tonic = "0.14"

cli/Cargo.toml

@@ -40,14 +40,7 @@ regex.workspace = true
 
 # crypto helpers
 rand.workspace = true
-# Encryption helpers
-aes-gcm.workspace = true
-bincode.workspace = true
-argon2.workspace = true
-directories.workspace = true
 hex.workspace = true
-zeroize.workspace = true
-rpassword.workspace = true
 
 # Add platform-specific keyring dependencies so that the correct backend feature is enabled per operating system.
 [target.'cfg(target_os = "macos")'.dependencies]