@better-forge/vault 0.0.0-stage → 0.1.0

package/dist/hashicorp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashicorp.js","sourceRoot":"","sources":["../src/hashicorp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,QAAQ,CAAA;AAClD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAErC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAyClD,uDAAuD;AACvD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;CAAG;AAEjD,gDAAgD;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,SAAS,EAAE,MAAM;IACjB,YAAY,EAAE,IAAI,GAAG,IAAI;IACzB,kGAAkG;IAClG,YAAY,EAAE,MAAM;IACpB,kGAAkG;IAClG,iBAAiB,EAAE,MAAM;CAC1B,CAAA;AAED,MAAM,SAAS,GAAG,IAAI,CAAA;AAEtB,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,CAAA;AAExB,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa,EAAE,GAAG,GAAG,SAAS;IAC1D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAA;IACzF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,cAAc,CAAC,CAAA;IAC/E,4CAA4C;IAC5C,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAA;IAChH,OAAO,OAAO,IAAI,SAAS,CAAA;AAC7B,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,KAAa;IACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,aAAa,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YAAC,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,aAAa,CAAC,CAAA;QAAC,CAAC;QAC5G,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,aAAa,CAAC,CAAA;QACtD,CAAC;QACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC5B,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,cAAc,CAAC,CAAA;IAC7D,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAA;IAAC,CAAC;IACjG,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAA;IAC9E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QACnF,MAAM,IAAI,mBAAmB,CAAC,oEAAoE,CAAC,CAAA;IACrG,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC;AAED,wFAAwF;AACxF,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,CAAU,CAAA;AAE1G;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,QAA0B;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAA;IAC1G,MAAM,IAAI,GAAG,KAAgC,CAAA;IAE7C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,QAAQ,EAAE,UAAU,CAAA;IAC7D,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,mBAAmB,CAAC,sCAAsC,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAA;IACtD,MAAM,GAAG,GAAoB;QAC3B,OAAO,EAAE,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QACnE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,EAAE,UAAU,CAAC;QAC1D,UAAU;QACV,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC,IAAI,SAAS;KACvE,CAAA;IACD,IAAI,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,SAAS,CAAA;IACxC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IACjC,UAAU,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;IAC7C,IAAI,GAAG,CAAC,SAAS;QAAE,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAA;IAC7D,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAA;QAC9G,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;IACrB,CAAC;IAED,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9G,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IAChE,6FAA6F;IAC7F,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,GAAG,CAAC,cAAc,GAAG,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAC9D,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC;YAAC,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC;YAAC,OAAO,GAAG,CAAA;QAAC,CAAC;QACnE,MAAM,KAAK,GAAG,KAAK,IAAI,IAAI,EAAE,KAAK,CAAA;QAClC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC,yDAAyD,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAA;QAC5I,GAAG,CAAC,KAAK,GAAG,KAAK,CAAA;IACnB,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,CAAA;QACzD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAA;QACnD,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC;YAAC,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC;YAAC,OAAO,GAAG,CAAA;QAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,WAAW,IAAI,IAAI,EAAE,MAAM,CAAA;QAC1C,MAAM,QAAQ,GAAG,aAAa,IAAI,IAAI,EAAE,QAAQ,CAAA;QAChD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC,yEAAyE,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAA;QACnK,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;QACnB,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAA;IACzB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,UAA+B;IAC1E,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAA;IAC/G,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAK,OAAkB,IAAI,CAAC,IAAK,QAAmB,IAAI,CAAC,EAAE,CAAC;QACvH,MAAM,IAAI,mBAAmB,CAAC,wDAAwD,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,GAAG,GAAmB,EAAE,OAAO,EAAE,OAAiB,EAAE,QAAQ,EAAE,QAAkB,EAAE,CAAA;IACxF,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,KAAK,IAAI,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,IAAI,CAAE,YAAoD,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAA;QACjG,IAAI,GAAG;YAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAA;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,YAAY,GAAG,OAAO,CAAA;IAC3D,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,gBAAgB,CAAC,GAAoB;IACnD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;QAC9B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK;QACrB,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;QAC3B,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;KAC3C,CAAA;AACH,CAAC;AAsBD,MAAM,UAAU,eAAe,CAAC,GAAiD;IAC/E,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAA;IAClB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,CAAA;IAE1C,SAAS,cAAc,CAAC,GAAoB;QAC1C,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC;IAED,SAAS,cAAc,CAAC,MAAqB;QAC3C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAA;QAChF,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAoB,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAA;IAE3C,yGAAyG;IACzG,SAAS,oBAAoB,CAAC,OAAe;QAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACxB,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAA;QAC5B,IAAI,KAAK;YAAE,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC,KAAK,EAAE,CAAA;IACnH,CAAC;IAED;;;OAGG;IACH,SAAS,0BAA0B,CAAC,OAAe,EAAE,QAAiB;QACpE,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;YACtC,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;gBAAE,oBAAoB,CAAC,EAAE,CAAC,CAAA;QACvH,CAAC;IACH,CAAC;IAED,SAAS,UAAU,CAAC,KAAwB;QAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAA;QACzE,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAClD,MAAM,OAAO,GAAY;YACvB,WAAW,EAAE,KAAK,CAAC,SAAS;YAC5B,GAAG;YACH,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1E,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;SACX,CAAA;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QAC/B,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,SAAS,KAAK,CAAC,OAAe,EAAE,KAA8B;QAC5D,IAAI,GAAG,GAAG,OAAO,CAAA;QACjB,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC;YAAE,IAAI,MAAM;gBAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC5G,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,cAAc,CAAC,OAAgB;QAC5C,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAA;QAC9B,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,OAAO,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;QACnG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACvI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAChH,IAAI,CAAC,GAAG,IAAI,KAAK,EAAE,IAAI,KAAK,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,0DAA0D,CAAC,CAAA;QAC9H,IAAI,OAAgC,CAAA;QACpC,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAA4B,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,4CAA4C,CAAC,CAAA;QAAC,CAAC;QAC1K,sHAAsH;QACtH,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC,CAAC,CAAC,CAAA;QACrH,uGAAuG;QACvG,IAAI,MAAM,GAA4B,EAAE,CAAA;QACxC,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAA4B,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;QAC/I,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;QACjF,IAAI,GAAG,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC9G,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oFAAoF,CAAC,CAAA;YAC/H,OAAO,CAAC,OAAO,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACtH,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1H,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,mBAAmB,CAAC,+GAA+G,CAAC,CAAA;QAChJ,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED,SAAS,oBAAoB,CAAC,GAAY;QACxC,MAAM,CAAC,GAAG,GAAuF,CAAA;QACjG,IAAI,CAAC,EAAE,IAAI,KAAK,cAAc,IAAI,CAAC,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YAC3D,OAAO,mBAAmB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAA;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAA;QACjC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;YAAE,OAAO,4BAA4B,CAAA;QAChG,IAAI,6EAA6E,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7F,OAAO,gCAAgC,IAAI,GAAG,CAAA;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,CAAC,mBAAmB,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAA;IAC7D,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAA0C;QAClE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAA;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,MAAM,GAAiB,EAAE,CAAA;QAC/B,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI;gBAAE,MAAK;YACf,IAAI,IAAI,KAAK,CAAC,UAAU,CAAA;YACxB,IAAI,IAAI,GAAG,eAAe,CAAC,YAAY,EAAE,CAAC;gBACxC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAA;gBACpB,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAA;YACnE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;QACD,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;IACzF,CAAC;IAED,KAAK,UAAU,IAAI,CACjB,OAAgB,EAChB,MAAsB,EACtB,OAAe,EACf,KAAyB,EACzB,IAAc;QAEd,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QACvB,MAAM,OAAO,GAA2B,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAA;QACrE,IAAI,KAAK;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,KAAK,CAAA;QAC3C,IAAI,GAAG,CAAC,SAAS;YAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,GAAG,CAAC,SAAS,CAAA;QAC/D,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;QACpE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,GAAG,CAAC,OAAO,OAAO,OAAO,EAAE,EAAE;gBAC1D,MAAM;gBACN,OAAO;gBACP,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzD,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;aACpD,CAAC,CAAA;YACF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,CAAA;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB;gBAAE,MAAM,GAAG,CAAA;YACjD,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;QAChF,CAAC;IACH,CAAC;IAED,SAAS,KAAK,CAAC,OAAgB;QAC7B,OAAO,CAAC,KAAK,KAAK,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;YACvB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;YAC3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,UAAU,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,QAAQ,EAAE,SAAS,EAC3H,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;YACvD,MAAM,IAAI,GAAI,IAA6E,EAAE,IAAI,CAAA;YACjG,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;gBAC1C,MAAM,IAAI,mBAAmB,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,8BAA8B,MAAM,GAAG,CAAC,CAAA;YAC1I,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;YAC/C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAA;YACjC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC5B,yFAAyF;YACzF,OAAO,CAAC,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;YAClG,OAAO,IAAI,CAAC,YAAY,CAAA;QAC1B,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAA,CAAC,CAAC,CAAC,CAAA;QACjD,OAAO,OAAO,CAAC,KAAK,CAAA;IACtB,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,OAAO;YAAE,OAAO,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,KAAM,CAAA;QACrF,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,KAAK,CAAA;QACzE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;IAED,oFAAoF;IACpF,KAAK,UAAU,MAAM,CAAC,OAAgB,EAAE,MAAsB,EAAE,OAAe;QAC7E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;QACpC,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI;eACzE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,YAAY,CAAA;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,SAAS,CAAA;YACzB,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QACrE,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,yDAAyD;IACzD,KAAK,UAAU,YAAY,CAAC,KAAwB,EAAE,IAAY;QAChE,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;QACjC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACvC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;QACpH,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QAC/H,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,CAAC,CAAA;QACjF,MAAM,IAAI,GAAI,IAA6C,EAAE,IAAI,EAAE,IAAI,CAAA;QACvE,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,MAAM,GAAG,CAAC,CAAA;QAClF,CAAC;QACD,OAAO,IAA+B,CAAA;IACxC,CAAC;IAED,6HAA6H;IAC7H,KAAK,UAAU,oBAAoB,CAAC,GAAoB;QACtD,IAAI,GAAG,CAAC,cAAc;YAAE,MAAM,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;IACjG,CAAC;IAED,8FAA8F;IAC9F,KAAK,UAAU,cAAc,CAAC,KAAwB;QACpD,OAAO,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IACzC,CAAC;IAED,+FAA+F;IAC/F,KAAK,UAAU,mBAAmB,CAAC,GAAoB;QACrD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACjF,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;QACtF,CAAC;gBAAS,CAAC;YACT,KAAK,KAAK,EAAE,KAAK,EAAE,CAAA;QACrB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,OAAgB;QAC3C,OAAO,CAAC,KAAK,GAAG,SAAS,CAAA;QACzB,OAAO,CAAC,OAAO,GAAG,CAAC,CAAA;QACnB,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QACvB,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;YACpB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAA;QAChH,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QACpH,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;QAClF,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,MAAM,GAAG,CAAC,CAAA;QACpG,MAAM,GAAG,GAAI,IAA2C,EAAE,IAAI,EAAE,GAAG,CAAA;QACnE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7F,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,mBAAmB,EAAE,CAAA;AACtK,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { createVault, type Vault, type VaultOptions } from './createVault.js';
+export { vaultDbModule } from './module.js';
+export { vaults, vaultSecrets } from './tables.js';
+export { createSecretBox, validateEncryptionKey, type SecretBox } from './secretBox.js';
+export { createSealer, sealedText, SEALED_PREFIX, type Sealer, type SealedText } from './sealed.js';
+export { canonical, createVaultUseGuard } from './vaultUse.js';
+export { createSecretFields, SECRET_MASK, SENSITIVE_HEADER, uniqueSecretFields, type LooseningSwitch, type RestoreResult, type SecretField } from './secretFields.js';
+export { HashicorpVaultError, hashicorpLimits, type HashicorpAuthMethod, type HashicorpConfig, type CredentialsRef, type HashicorpVaultRow } from './hashicorp.js';
+export type { VaultAudit } from './vaultRoutes.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAA;AACnG,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACrK,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClK,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/index.js

@@ -0,0 +1,9 @@
+export { createVault } from './createVault.js';
+export { vaultDbModule } from './module.js';
+export { vaults, vaultSecrets } from './tables.js';
+export { createSecretBox, validateEncryptionKey } from './secretBox.js';
+export { createSealer, sealedText, SEALED_PREFIX } from './sealed.js';
+export { canonical, createVaultUseGuard } from './vaultUse.js';
+export { createSecretFields, SECRET_MASK, SENSITIVE_HEADER, uniqueSecretFields } from './secretFields.js';
+export { HashicorpVaultError, hashicorpLimits } from './hashicorp.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAiC,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAkB,MAAM,gBAAgB,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAgC,MAAM,aAAa,CAAA;AACnG,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,kBAAkB,EAA8D,MAAM,mBAAmB,CAAA;AACrK,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAA+F,MAAM,gBAAgB,CAAA"}

package/dist/migrations.d.ts

@@ -0,0 +1,4 @@
+import type { MigrationStep } from '@better-forge/db';
+/** Vaults and the secrets in them. Steps run in this order. */
+export declare const vaultMigrations: readonly MigrationStep[];
+//# sourceMappingURL=migrations.d.ts.map

package/dist/migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAErD,+DAA+D;AAC/D,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EAyBnD,CAAA"}

package/dist/migrations.js

@@ -0,0 +1,28 @@
+/** Vaults and the secrets in them. Steps run in this order. */
+export const vaultMigrations = [
+    { kind: 'exec', sql: `
+CREATE TABLE IF NOT EXISTS vaults (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name TEXT NOT NULL,
+  type TEXT NOT NULL DEFAULT 'local',
+  description TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+` },
+    { kind: 'exec', sql: `
+CREATE TABLE IF NOT EXISTS vault_secrets (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  vault_id INTEGER NOT NULL,
+  name TEXT NOT NULL,
+  type TEXT NOT NULL,
+  encrypted_value TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  FOREIGN KEY (vault_id) REFERENCES vaults(id) ON DELETE CASCADE,
+  UNIQUE (vault_id, name)
+);
+` },
+    { kind: 'column', sql: `ALTER TABLE vaults ADD COLUMN connection_config TEXT`, desc: 'vaults.connection_config' },
+];
+//# sourceMappingURL=migrations.js.map

package/dist/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAEA,+DAA+D;AAC/D,MAAM,CAAC,MAAM,eAAe,GAA6B;IACvD,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;;;;;;;;;CAStB,EAAE;IACD,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;;;;;;;;;;;;CAYtB,EAAE;IACD,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,sDAAsD,EAAE,IAAI,EAAE,0BAA0B,EAAE;CAClH,CAAA"}

package/dist/module.d.ts

@@ -0,0 +1,8 @@
+import * as tables from './tables.js';
+/** The tables of vaults and their secrets, with their migrations, for the application's list of database modules. */
+export declare const vaultDbModule: {
+    id: string;
+    tables: typeof tables;
+    migrations: readonly import("@better-forge/db").MigrationStep[];
+};
+//# sourceMappingURL=module.d.ts.map

package/dist/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAGrC,qHAAqH;AACrH,eAAO,MAAM,aAAa;;;;CAA0E,CAAA"}

package/dist/module.js

@@ -0,0 +1,5 @@
+import * as tables from './tables.js';
+import { vaultMigrations } from './migrations.js';
+/** The tables of vaults and their secrets, with their migrations, for the application's list of database modules. */
+export const vaultDbModule = { id: 'vault', tables, migrations: vaultMigrations };
+//# sourceMappingURL=module.js.map

package/dist/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjD,qHAAqH;AACrH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAqB,CAAA"}

package/dist/resolveSecret.d.ts

@@ -0,0 +1,17 @@
+import type { VaultRef } from '@better-forge/contracts';
+import type { SqliteDatabase } from '@better-forge/db';
+import { vaults, vaultSecrets } from './tables.js';
+import { type Hashicorp } from './hashicorp.js';
+import type { SecretBox } from './secretBox.js';
+type VaultRow = typeof vaults.$inferSelect;
+type SecretRow = typeof vaultSecrets.$inferSelect;
+export declare function createSecretResolver(ctx: {
+    db: SqliteDatabase;
+    secretBox: SecretBox;
+}, hashicorp: Hashicorp): {
+    loadSecretPayload: (secret: SecretRow, vault: VaultRow) => Promise<Record<string, unknown>>;
+    resolveVaultSecret: (ref: VaultRef) => Promise<Record<string, string>>;
+};
+export type SecretResolver = ReturnType<typeof createSecretResolver>;
+export {};
+//# sourceMappingURL=resolveSecret.d.ts.map

package/dist/resolveSecret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveSecret.d.ts","sourceRoot":"","sources":["../src/resolveSecret.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAuB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,KAAK,QAAQ,GAAG,OAAO,MAAM,CAAC,YAAY,CAAA;AAE1C,KAAK,SAAS,GAAG,OAAO,YAAY,CAAC,YAAY,CAAA;AAEjD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IAAE,EAAE,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,EAAE,SAAS,EAAE,SAAS;gCAUjE,SAAS,SAAS,QAAQ,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;8BA+B/D,QAAQ,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;EAyClF;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA"}

package/dist/resolveSecret.js

@@ -0,0 +1,80 @@
+import { and, eq } from 'drizzle-orm';
+import { vaults, vaultSecrets } from './tables.js';
+import { HashicorpVaultError } from './hashicorp.js';
+export function createSecretResolver(ctx, hashicorp) {
+    const { db } = ctx;
+    const { decrypt } = ctx.secretBox;
+    const { readKvSecret } = hashicorp;
+    /**
+     * Returns the stored payload of a secret in the shape `decrypt` yields for local vaults
+     * (`{ username, password }`, `{ value }` where json holds a JSON string). HashiCorp vaults keep only a
+     * reference `{ path, key? }`; the value is read live from Vault and shaped to match.
+     */
+    async function loadSecretPayload(secret, vault) {
+        if (vault.type !== 'hashicorp')
+            return JSON.parse(decrypt(secret.encryptedValue));
+        try {
+            const ref = JSON.parse(decrypt(secret.encryptedValue));
+            const kv = await readKvSecret(vault, ref.path);
+            if (secret.type === 'userpass') {
+                if (typeof kv['username'] !== 'string' || typeof kv['password'] !== 'string') {
+                    throw new HashicorpVaultError('keys "username" and "password" are required at the path');
+                }
+                return { username: kv['username'], password: kv['password'] };
+            }
+            if (secret.type === 'value') {
+                const found = ref.key ? kv[ref.key] : undefined;
+                if (found === undefined || found === null)
+                    throw new HashicorpVaultError(`key "${ref.key ?? ''}" not found`);
+                return { value: typeof found === 'string' ? found : JSON.stringify(found) };
+            }
+            return { value: JSON.stringify(kv) };
+        }
+        catch (e) {
+            if (e instanceof HashicorpVaultError)
+                throw new Error(`HashiCorp Vault "${vault.name}": ${e.message}`, { cause: e });
+            throw e;
+        }
+    }
+    /**
+     * Resolves a vault secret reference to a flat string map.
+     *
+     * - userpass → { username, password }
+     * - value    → { value }
+     * - json     → all keys as strings, or filtered/renamed via fieldMapping
+     *              e.g. fieldMapping = { clientId: 'client_id' } → { clientId: <json.client_id> }
+     */
+    async function resolveVaultSecret(ref) {
+        const [secret] = await db
+            .select()
+            .from(vaultSecrets)
+            .where(and(eq(vaultSecrets.id, ref.secretId), eq(vaultSecrets.vaultId, ref.vaultId)));
+        const [vault] = secret ? await db.select().from(vaults).where(eq(vaults.id, ref.vaultId)) : [];
+        if (!secret || !vault) {
+            throw new Error(`Vault secret ${ref.secretId} not found in vault ${ref.vaultId}`);
+        }
+        const decrypted = await loadSecretPayload(secret, vault);
+        if (secret.type === 'userpass') {
+            return {
+                username: String(decrypted['username'] ?? ''),
+                password: String(decrypted['password'] ?? ''),
+            };
+        }
+        if (secret.type === 'value') {
+            return { value: String(decrypted['value'] ?? '') };
+        }
+        if (secret.type === 'json') {
+            const raw = JSON.parse(String(decrypted['value'] ?? '{}'));
+            const { fieldMapping } = ref;
+            if (fieldMapping && Object.keys(fieldMapping).length > 0) {
+                return Object.fromEntries(Object.entries(fieldMapping)
+                    .filter(([, jsonKey]) => !!jsonKey)
+                    .map(([ourField, jsonKey]) => [ourField, String(raw[jsonKey] ?? '')]));
+            }
+            return Object.fromEntries(Object.entries(raw).map(([k, v]) => [k, String(v ?? '')]));
+        }
+        throw new Error(`Unknown vault secret type: ${secret.type}`);
+    }
+    return { loadSecretPayload, resolveVaultSecret };
+}
+//# sourceMappingURL=resolveSecret.js.map

package/dist/resolveSecret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveSecret.js","sourceRoot":"","sources":["../src/resolveSecret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAGrC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,gBAAgB,CAAA;AAOpE,MAAM,UAAU,oBAAoB,CAAC,GAAiD,EAAE,SAAoB;IAC1G,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAA;IAClB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,CAAA;IACjC,MAAM,EAAE,YAAY,EAAE,GAAG,SAAS,CAAA;IAElC;;;;OAIG;IACH,KAAK,UAAU,iBAAiB,CAAC,MAAiB,EAAE,KAAe;QACjE,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAA4B,CAAA;QAC5G,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAmC,CAAA;YACxF,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;YAC9C,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,IAAI,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC7E,MAAM,IAAI,mBAAmB,CAAC,yDAAyD,CAAC,CAAA;gBAC1F,CAAC;gBACD,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAA;YAC/D,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;oBAAE,MAAM,IAAI,mBAAmB,CAAC,QAAQ,GAAG,CAAC,GAAG,IAAI,EAAE,aAAa,CAAC,CAAA;gBAC5G,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAA;YAC7E,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAA;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,mBAAmB;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YACpH,MAAM,CAAC,CAAA;QACT,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,kBAAkB,CAAC,GAAa;QAC7C,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAEvF,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC9F,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,QAAQ,uBAAuB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QACnF,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAExD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC7C,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;aAC9C,CAAA;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAA;QACpD,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAA4B,CAAA;YACrF,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAA;YAC5B,IAAI,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;qBACzB,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;qBAClC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CACxE,CAAA;YACH,CAAC;YACD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAA;AAClD,CAAC"}

package/dist/sealed.d.ts

@@ -0,0 +1,45 @@
+import type { SecretBox } from './secretBox.js';
+/** Marks a stored value as encrypted, so a column can hold rows from before it was sealed. */
+export declare const SEALED_PREFIX = "enc:v1:";
+/** Turns a secret into what is stored and back. */
+export interface Sealer {
+    /**
+     * Always encrypts, whatever the value looks like: a value that merely starts with the prefix is somebody's text, or a
+     * ciphertext offered to be decrypted by the next read, and must never be taken for one already sealed. Empty stays empty.
+     */
+    seal(value: string): string;
+    /** Like `seal`, but leaves a value that is already sealed alone. Only for upgrading rows that may hold either. */
+    sealPlain(value: string): string;
+    /** Opens a sealed value; a value without the prefix is a row from before sealing and is returned as it is. Throws when the key does not fit. */
+    open(value: string): string;
+}
+export declare function createSealer(box: Pick<SecretBox, 'encrypt' | 'decrypt'>): Sealer;
+/** A text column whose value goes through `codec` on its way to and from the database; the rest of the code sees the open value. */
+export declare function sealedText(codec: Pick<Sealer, 'seal' | 'open'>): {
+    (): import("drizzle-orm/sqlite-core").SQLiteCustomColumnBuilder<{
+        name: "";
+        dataType: "custom";
+        columnType: "SQLiteCustomColumn";
+        data: string;
+        driverParam: string;
+        enumValues: undefined;
+    }>;
+    <TConfig extends Record<string, any>>(fieldConfig?: TConfig | undefined): import("drizzle-orm/sqlite-core").SQLiteCustomColumnBuilder<{
+        name: "";
+        dataType: "custom";
+        columnType: "SQLiteCustomColumn";
+        data: string;
+        driverParam: string;
+        enumValues: undefined;
+    }>;
+    <TName extends string>(dbName: TName, fieldConfig?: unknown): import("drizzle-orm/sqlite-core").SQLiteCustomColumnBuilder<{
+        name: TName;
+        dataType: "custom";
+        columnType: "SQLiteCustomColumn";
+        data: string;
+        driverParam: string;
+        enumValues: undefined;
+    }>;
+};
+export type SealedText = ReturnType<typeof sealedText>;
+//# sourceMappingURL=sealed.d.ts.map

package/dist/sealed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed.d.ts","sourceRoot":"","sources":["../src/sealed.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,8FAA8F;AAC9F,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,mDAAmD;AACnD,MAAM,WAAW,MAAM;IACrB;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3B,kHAAkH;IAClH,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAA;IAChC,gJAAgJ;IAChJ,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAA;CAC5B;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC,GAAG,MAAM,CAOhF;AAED,oIAAoI;AACpI,wBAAgB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;EAM9D;AAED,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAA"}

package/dist/sealed.js

@@ -0,0 +1,20 @@
+import { customType } from 'drizzle-orm/sqlite-core';
+/** Marks a stored value as encrypted, so a column can hold rows from before it was sealed. */
+export const SEALED_PREFIX = 'enc:v1:';
+export function createSealer(box) {
+    const seal = (value) => (value === '' ? value : `${SEALED_PREFIX}${box.encrypt(value)}`);
+    return {
+        seal,
+        sealPlain: (value) => (value.startsWith(SEALED_PREFIX) ? value : seal(value)),
+        open: (value) => (value.startsWith(SEALED_PREFIX) ? box.decrypt(value.slice(SEALED_PREFIX.length)) : value),
+    };
+}
+/** A text column whose value goes through `codec` on its way to and from the database; the rest of the code sees the open value. */
+export function sealedText(codec) {
+    return customType({
+        dataType: () => 'text',
+        toDriver: codec.seal,
+        fromDriver: codec.open,
+    });
+}
+//# sourceMappingURL=sealed.js.map

package/dist/sealed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed.js","sourceRoot":"","sources":["../src/sealed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAGpD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAA;AAetC,MAAM,UAAU,YAAY,CAAC,GAA2C;IACtE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChG,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7E,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;KAC5G,CAAA;AACH,CAAC;AAED,oIAAoI;AACpI,MAAM,UAAU,UAAU,CAAC,KAAoC;IAC7D,OAAO,UAAU,CAAuC;QACtD,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;QACtB,QAAQ,EAAE,KAAK,CAAC,IAAI;QACpB,UAAU,EAAE,KAAK,CAAC,IAAI;KACvB,CAAC,CAAA;AACJ,CAAC"}

package/dist/secretBox.d.ts

@@ -0,0 +1,17 @@
+export interface SecretBox {
+    /** Encrypts plaintext with AES-256-GCM. Returns `iv:authTag:ciphertext` (all hex). */
+    encrypt(plaintext: string): string;
+    /** Decrypts a value produced by `encrypt`. Throws on tampered data. */
+    decrypt(ciphertext: string): string;
+}
+/**
+ * Encryption of the secrets an application stores, with the key from `VAULT_ENCRYPTION_KEY` (64 hex characters).
+ * The key is read on first use, so the warning about the development fallback appears once per box.
+ * `env` is read at that moment, not captured, so a test may change it before first use.
+ */
+export declare function createSecretBox(options?: {
+    env?: NodeJS.ProcessEnv;
+}): SecretBox;
+/** In production the key must be exactly 64 hexadecimal characters; refuses to start otherwise. Elsewhere anything goes. */
+export declare function validateEncryptionKey(env?: NodeJS.ProcessEnv): void;
+//# sourceMappingURL=secretBox.d.ts.map

package/dist/secretBox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretBox.d.ts","sourceRoot":"","sources":["../src/secretBox.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,SAAS;IACxB,sFAAsF;IACtF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;IAClC,uEAAuE;IACvE,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAA;CACpC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GAAG,SAAS,CA4CpF;AAED,4HAA4H;AAC5H,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAMhF"}

package/dist/secretBox.js

@@ -0,0 +1,63 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+const ALGORITHM = 'aes-256-gcm';
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+/**
+ * Encryption of the secrets an application stores, with the key from `VAULT_ENCRYPTION_KEY` (64 hex characters).
+ * The key is read on first use, so the warning about the development fallback appears once per box.
+ * `env` is read at that moment, not captured, so a test may change it before first use.
+ */
+export function createSecretBox(options = {}) {
+    const env = options.env ?? process.env;
+    let cachedKey = null;
+    function getKey() {
+        const raw = env['VAULT_ENCRYPTION_KEY'];
+        if (!raw) {
+            if (env['NODE_ENV'] === 'production') {
+                throw new Error('VAULT_ENCRYPTION_KEY environment variable must be set in production');
+            }
+            // Dev fallback — 32-byte zero key with warning
+            console.warn('⚠ VAULT_ENCRYPTION_KEY not set — using insecure dev key (development only)');
+            return Buffer.alloc(32, 0);
+        }
+        const buf = Buffer.from(raw, 'hex');
+        if (buf.length !== 32) {
+            throw new Error('VAULT_ENCRYPTION_KEY must be a 64-character hex string (32 bytes)');
+        }
+        return buf;
+    }
+    const key = () => (cachedKey ??= getKey());
+    return {
+        encrypt(plaintext) {
+            const iv = randomBytes(IV_BYTES);
+            const cipher = createCipheriv(ALGORITHM, key(), iv);
+            const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+            const tag = cipher.getAuthTag();
+            return `${iv.toString('hex')}:${tag.toString('hex')}:${encrypted.toString('hex')}`;
+        },
+        decrypt(ciphertext) {
+            const parts = ciphertext.split(':');
+            if (parts.length !== 3)
+                throw new Error('Invalid ciphertext format');
+            const [ivHex, tagHex, encHex] = parts;
+            const iv = Buffer.from(ivHex, 'hex');
+            const tag = Buffer.from(tagHex, 'hex');
+            const enc = Buffer.from(encHex, 'hex');
+            if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES)
+                throw new Error('Invalid ciphertext length');
+            const decipher = createDecipheriv(ALGORITHM, key(), iv);
+            decipher.setAuthTag(tag);
+            return Buffer.concat([decipher.update(enc), decipher.final()]).toString('utf8');
+        },
+    };
+}
+/** In production the key must be exactly 64 hexadecimal characters; refuses to start otherwise. Elsewhere anything goes. */
+export function validateEncryptionKey(env = process.env) {
+    if (env['NODE_ENV'] !== 'production')
+        return;
+    const key = env['VAULT_ENCRYPTION_KEY'];
+    if (!key || !/^[0-9a-fA-F]{64}$/.test(key)) {
+        throw new Error('VAULT_ENCRYPTION_KEY must be set to exactly 64 hexadecimal characters in production');
+    }
+}
+//# sourceMappingURL=secretBox.js.map

package/dist/secretBox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretBox.js","sourceRoot":"","sources":["../src/secretBox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE3E,MAAM,SAAS,GAAG,aAAa,CAAA;AAC/B,MAAM,QAAQ,GAAG,EAAE,CAAA;AACnB,MAAM,SAAS,GAAG,EAAE,CAAA;AASpB;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,UAAuC,EAAE;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACtC,IAAI,SAAS,GAAkB,IAAI,CAAA;IAEnC,SAAS,MAAM;QACb,MAAM,GAAG,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAA;QACvC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;YACxF,CAAC;YACD,+CAA+C;YAC/C,OAAO,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAA;YAC1F,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QAC5B,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;QACtF,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC,CAAA;IAE1C,OAAO;QACL,OAAO,CAAC,SAAS;YACf,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;YAChC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAA;YACnD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACnF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;YAC/B,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;QACpF,CAAC;QACD,OAAO,CAAC,UAAU;YAChB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;YACpE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAA;YACjE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YACpC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACtC,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;YACpG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAA;YACvD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YACxB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACjF,CAAC;KACF,CAAA;AACH,CAAC;AAED,4HAA4H;AAC5H,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACxE,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QAAE,OAAM;IAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAA;IACvC,IAAI,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAA;IACxG,CAAC;AACH,CAAC"}

package/dist/secretFields.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Which parts of a configuration are secrets.
+ *
+ * Secrets never leave the API as stored: reads get a mask, and a write that sends the mask back means "keep the
+ * stored value". The same table drives the config export, so a new secret field is declared in exactly one place.
+ * Values read from a vault are references, not secrets, and are not listed here.
+ *
+ * The table is grouped by type for readability, but masking and restoring look at every secret field of the kind
+ * whatever the object's type. A config can hold leftovers of another type (the type changed, or an API client sent
+ * extra keys), and those must not read back in the clear.
+ */
+import type { Sealer } from './sealed.js';
+export declare const SECRET_MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+export type SecretField = 
+/** A string at `path`; `tail` also shows its last 4 characters (long tokens only) so it can be recognised. */
+{
+    path: readonly string[];
+    tail?: true;
+}
+/** Every entry of the object at `mapAt` whose key names a credential (Authorization, X-Api-Key, ...). */
+ | {
+    mapAt: readonly string[];
+};
+/** Credential-looking header names. Wide on purpose: masking `X-Idempotency-Key` costs nothing, leaking `X-Auth` does. */
+export declare const SENSITIVE_HEADER: RegExp;
+export declare const uniqueSecretFields: (fields: readonly SecretField[]) => SecretField[];
+export type RestoreResult = {
+    config: unknown;
+} | {
+    error: string;
+};
+/** A switch that makes a destination less safe: a path whose value is `true`, or a path with the value that is the unsafe one (`verifyTls` off is `false`). */
+export type LooseningSwitch = readonly string[] | {
+    path: readonly string[];
+    value: unknown;
+};
+export declare function createSecretFields<Kind extends string>(kinds: Readonly<Record<Kind, {
+    fields: readonly SecretField[];
+    destinations: readonly (readonly string[])[];
+    /** Switches that make a destination less safe (certificate checks off): turning one on counts as a changed destination, turning it off does not. */
+    loosening?: readonly LooseningSwitch[];
+}>>): {
+    maskSecrets: <T>(kind: Kind, config: T) => T;
+    restoreSecrets: (kind: Kind, incoming: unknown, stored: unknown) => RestoreResult;
+    changedDestination: (kind: Kind, incoming: unknown, stored: unknown) => string | null;
+    configCodec: (kind: Kind, sealer: Pick<Sealer, "seal" | "open">) => Pick<Sealer, "seal" | "open">;
+};
+//# sourceMappingURL=secretFields.d.ts.map

package/dist/secretFields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretFields.d.ts","sourceRoot":"","sources":["../src/secretFields.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,eAAO,MAAM,WAAW,qDAAa,CAAA;AAKrC,MAAM,MAAM,WAAW;AACrB,8GAA8G;AAC5G;IAAE,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,IAAI,CAAA;CAAE;AAC1C,yGAAyG;GACvG;IAAE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEhC,0HAA0H;AAC1H,eAAO,MAAM,gBAAgB,QAAwE,CAAA;AAErG,eAAO,MAAM,kBAAkB,GAAI,QAAQ,SAAS,WAAW,EAAE,KAAG,WAAW,EAM9E,CAAA;AAuBD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEnE,+JAA+J;AAC/J,MAAM,MAAM,eAAe,GAAG,SAAS,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAA;AAE7F,wBAAgB,kBAAkB,CAAC,IAAI,SAAS,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;IACnF,MAAM,EAAE,SAAS,WAAW,EAAE,CAAA;IAC9B,YAAY,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAA;IAC5C,oJAAoJ;IACpJ,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;CACvC,CAAC,CAAC;kBAoBoB,CAAC,QAAQ,IAAI,UAAU,CAAC,KAAG,CAAC;2BAiBnB,IAAI,YAAY,OAAO,UAAU,OAAO,KAAG,aAAa;+BA0BpD,IAAI,YAAY,OAAO,UAAU,OAAO,KAAG,MAAM,GAAG,IAAI;wBA2B/D,IAAI,UAAU,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,KAAG,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;EAiBvG"}