@absolutejs/vulnerabilities-witness 0.2.0 → 0.2.1

package/dist/server.js

@@ -439,6 +439,18 @@ var loadOrBootstrap = async (name) => {
   await secrets.put(name, bootstrap);
   return bootstrap;
 };
+var loadOptionalBootstrap = async (name) => {
+  const stored = await secrets.fetch(name);
+  if (stored)
+    return stored;
+  const bootstrap = process.env[name]?.trim();
+  if (!bootstrap)
+    return null;
+  if (!secrets.put)
+    throw new Error("Encrypted secret adapter is read-only");
+  await secrets.put(name, bootstrap);
+  return bootstrap;
+};
 var database = new SQL(required("DATABASE_URL"));
 await ensurePostgresEvidenceWitnessSchema(database);
 var encodedSigningState = await loadOrBootstrap(signingStateName);
@@ -447,7 +459,7 @@ var tokens = JSON.parse(await loadOrBootstrap(tokensName));
 var subjectsByToken = new Map(Object.entries(tokens).map(([subject, token]) => [token, subject]));
 var service2 = createEvidenceWitnessService({
   loadBackupVerification: async () => {
-    const encoded = await secrets.fetch(backupVerificationName);
+    const encoded = await loadOptionalBootstrap(backupVerificationName);
     return encoded ? JSON.parse(encoded) : null;
   },
   loadSigningState: async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@absolutejs/vulnerabilities-witness",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Independent durable transparency witness with rollback, equivocation, key-rotation, and HTTP service primitives for AbsoluteJS vulnerability evidence.",
   "type": "module",
   "license": "BSL-1.1",