//go:build !windows

package config

// On non-Windows hosts secrets are stored as-is. This exists so the rest of
// the agent compiles and tests on a developer machine; the shipping platform
// is Windows, where protect.go's DPAPI implementation is used instead.
//
// It is a passthrough, NOT encryption, and Save() marks such values plainly so
// nobody can mistake a dev config for a protected one.
func protect(plain []byte) ([]byte, error)  { return plain, nil }
func unprotect(blob []byte) ([]byte, error) { return blob, nil }
func protectionAvailable() bool             { return false }