@better-forge/vault 0.0.0-stage → 0.1.1

package/dist/secretFields.js

@@ -0,0 +1,159 @@
+/**
+ * Which parts of a configuration are secrets.
+ *
+ * Secrets never leave the API as stored: reads get a mask, and a write that sends the mask back means "keep the
+ * stored value". The same table drives the config export, so a new secret field is declared in exactly one place.
+ * Values read from a vault are references, not secrets, and are not listed here.
+ *
+ * The table is grouped by type for readability, but masking and restoring look at every secret field of the kind
+ * whatever the object's type. A config can hold leftovers of another type (the type changed, or an API client sent
+ * extra keys), and those must not read back in the clear.
+ */
+export const SECRET_MASK = '••••••••';
+/** Three bullets in a row are never part of a real secret; they are a mask, or a mask somebody edited by hand. */
+const LOOKS_MASKED = /•{3}/;
+/** Credential-looking header names. Wide on purpose: masking `X-Idempotency-Key` costs nothing, leaking `X-Auth` does. */
+export const SENSITIVE_HEADER = /auth|token|secret|key|pass|pwd|credential|cookie|session|signature/i;
+export const uniqueSecretFields = (fields) => {
+    const seen = new Set();
+    return fields.filter((field) => {
+        const id = 'mapAt' in field ? `map:${field.mapAt.join('.')}` : `path:${field.path.join('.')}`;
+        return seen.has(id) ? false : (seen.add(id), true);
+    });
+};
+const isObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+function valueAt(root, path) {
+    let current = root;
+    for (const segment of path) {
+        if (!isObject(current))
+            return undefined;
+        current = current[segment];
+    }
+    return current;
+}
+/** `••••••••`, plus the last 4 characters of a long token so it can be told apart from another one. */
+function mask(value, tail) {
+    return `${SECRET_MASK}${tail && value.length >= 16 ? value.slice(-4) : ''}`;
+}
+export function createSecretFields(kinds) {
+    function slotsIn(config, kind) {
+        const slots = [];
+        for (const field of kinds[kind].fields) {
+            if ('mapAt' in field) {
+                const holder = valueAt(config, field.mapAt);
+                if (!isObject(holder))
+                    continue;
+                for (const key of Object.keys(holder)) {
+                    if (SENSITIVE_HEADER.test(key))
+                        slots.push({ holder, key, label: `${field.mapAt.join('.')}.${key}`, tail: false });
+                }
+            }
+            else {
+                const holder = valueAt(config, field.path.slice(0, -1));
+                const key = field.path[field.path.length - 1];
+                if (isObject(holder) && key in holder)
+                    slots.push({ holder, key, label: field.path.join('.'), tail: field.tail === true });
+            }
+        }
+        return slots;
+    }
+    /** A copy of `config` with every secret replaced by its mask, whatever its type (a number is as secret as a string). */
+    function maskSecrets(kind, config) {
+        const copy = structuredClone(config);
+        for (const { holder, key, tail } of slotsIn(copy, kind)) {
+            const value = holder[key];
+            if (value !== null && value !== undefined && value !== '')
+                holder[key] = mask(String(value), tail);
+        }
+        return copy;
+    }
+    /**
+     * Resolves the secrets of an incoming config against the stored one: a mask that matches the stored secret becomes
+     * that secret again. Refused instead of saved:
+     *  - a mask, or something that looks like an edited mask, that matches nothing stored;
+     *  - a secret that is not text;
+     *  - a kept secret while the place it is sent to changed (URL, host, port), so it cannot be redirected.
+     * Pass `stored` as undefined for a new object (or one whose type changed), where any mask is a mistake.
+     */
+    function restoreSecrets(kind, incoming, stored) {
+        const copy = structuredClone(incoming);
+        const storedSlots = new Map(slotsIn(stored, kind).map((slot) => [slot.label, slot]));
+        let kept = false;
+        for (const { holder, key, label, tail } of slotsIn(copy, kind)) {
+            const value = holder[key];
+            if (value === null || value === undefined)
+                continue;
+            if (typeof value !== 'string')
+                return { error: `${label} must be text` };
+            if (!LOOKS_MASKED.test(value))
+                continue;
+            const previous = storedSlots.get(label);
+            const original = previous?.holder[previous.key];
+            if (typeof original === 'string' && original && value === mask(original, tail)) {
+                holder[key] = original;
+                kept = true;
+            }
+            else {
+                return { error: `${label} is a masked placeholder that does not match the stored value; enter the full value to replace it` };
+            }
+        }
+        if (kept) {
+            const moved = changedDestination(kind, copy, stored);
+            if (moved)
+                return { error: `${moved} changed, so the stored secrets cannot be kept; enter them again` };
+        }
+        return { config: copy };
+    }
+    /** The first place a configuration is sent to (URL, host, port) that differs between `incoming` and `stored`, or null. */
+    function changedDestination(kind, incoming, stored) {
+        for (const path of kinds[kind].destinations) {
+            // An empty value means the same as an absent one.
+            const normalised = (config) => valueAt(config, path) || null;
+            if (JSON.stringify(normalised(incoming)) !== JSON.stringify(normalised(stored)))
+                return path.join('.');
+        }
+        for (const entry of kinds[kind].loosening ?? []) {
+            const { path, value } = Array.isArray(entry) ? { path: entry, value: true } : entry;
+            if (valueAt(incoming, path) === value && valueAt(stored, path) !== value)
+                return path.join('.');
+        }
+        return null;
+    }
+    /** A copy of `config` with every secret that is text passed through `convert` (a vault reference or a number is not text and stays). */
+    function convertSecrets(kind, config, convert) {
+        const copy = structuredClone(config);
+        for (const { holder, key } of slotsIn(copy, kind)) {
+            const value = holder[key];
+            if (typeof value === 'string')
+                holder[key] = convert(value);
+        }
+        return copy;
+    }
+    /**
+     * The codec of a column that stores a configuration as JSON text: the secrets are encrypted on the way in and opened
+     * on the way out, so a copy of the database alone does not carry them. Text that is not JSON is passed through.
+     */
+    function configCodec(kind, sealer) {
+        const through = (convert) => (json) => {
+            let parsed;
+            try {
+                parsed = JSON.parse(json);
+            }
+            catch {
+                return json;
+            }
+            // A config without a secret is returned as it was written, not as JSON.stringify would write it.
+            let changed = false;
+            const converted = convertSecrets(kind, parsed, (value) => {
+                const result = convert(value);
+                if (result !== value)
+                    changed = true;
+                return result;
+            });
+            return changed ? JSON.stringify(converted) : json;
+        };
+        return { seal: through(sealer.seal), open: through(sealer.open) };
+    }
+    return { maskSecrets, restoreSecrets, changedDestination, configCodec };
+}
+//# sourceMappingURL=secretFields.js.map

package/dist/secretFields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretFields.js","sourceRoot":"","sources":["../src/secretFields.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAIH,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAA;AAErC,kHAAkH;AAClH,MAAM,YAAY,GAAG,MAAM,CAAA;AAQ3B,0HAA0H;AAC1H,MAAM,CAAC,MAAM,gBAAgB,GAAG,qEAAqE,CAAA;AAErG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA8B,EAAiB,EAAE;IAClF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;QAC7F,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAID,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAiB,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAEjH,SAAS,OAAO,CAAC,IAAa,EAAE,IAAuB;IACrD,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAA;QACxC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAKD,uGAAuG;AACvG,SAAS,IAAI,CAAC,KAAa,EAAE,IAAa;IACxC,OAAO,GAAG,WAAW,GAAG,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AAC7E,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAAsB,KAKrD;IACD,SAAS,OAAO,CAAC,MAAe,EAAE,IAAU;QAC1C,MAAM,KAAK,GAAW,EAAE,CAAA;QACxB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;gBAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,SAAQ;gBAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBACpH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;gBACvD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;gBAC9C,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,MAAM;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC,CAAA;YAC5H,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,wHAAwH;IACxH,SAAS,WAAW,CAAI,IAAU,EAAE,MAAS;QAC3C,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QACpC,KAAK,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;YACzB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAA;QACpG,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,cAAc,CAAC,IAAU,EAAE,QAAiB,EAAE,MAAe;QACpE,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QACpF,IAAI,IAAI,GAAG,KAAK,CAAA;QAChB,KAAK,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;YACzB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAQ;YACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,eAAe,EAAE,CAAA;YACxE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAQ;YACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACvC,MAAM,QAAQ,GAAG,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;YAC/C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/E,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAA;gBACtB,IAAI,GAAG,IAAI,CAAA;YACb,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,mGAAmG,EAAE,CAAA;YAC/H,CAAC;QACH,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;YACpD,IAAI,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,kEAAkE,EAAE,CAAA;QACzG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IAED,0HAA0H;IAC1H,SAAS,kBAAkB,CAAC,IAAU,EAAE,QAAiB,EAAE,MAAe;QACxE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YAC5C,kDAAkD;YAClD,MAAM,UAAU,GAAG,CAAC,MAAe,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,CAAA;YACrE,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxG,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAA0B,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAoD,CAAA;YACvJ,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjG,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,wIAAwI;IACxI,SAAS,cAAc,CAAI,IAAU,EAAE,MAAS,EAAE,OAAkC;QAClF,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QACpC,KAAK,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;YACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QAC7D,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;OAGG;IACH,SAAS,WAAW,CAAC,IAAU,EAAE,MAAqC;QACpE,MAAM,OAAO,GAAG,CAAC,OAAkC,EAAE,EAAE,CAAC,CAAC,IAAY,EAAU,EAAE;YAC/E,IAAI,MAAe,CAAA;YACnB,IAAI,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YACvD,iGAAiG;YACjG,IAAI,OAAO,GAAG,KAAK,CAAA;YACnB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACvD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;gBAC7B,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,GAAG,IAAI,CAAA;gBACpC,OAAO,MAAM,CAAA;YACf,CAAC,CAAC,CAAA;YACF,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACnD,CAAC,CAAA;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAA;IACnE,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAA;AACzE,CAAC"}

package/dist/tables.d.ts

@@ -0,0 +1,267 @@
+export declare const vaults: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "vaults";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "id";
+            tableName: "vaults";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "name";
+            tableName: "vaults";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        type: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "type";
+            tableName: "vaults";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        description: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "description";
+            tableName: "vaults";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "created_at";
+            tableName: "vaults";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "updated_at";
+            tableName: "vaults";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        connectionConfig: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "connection_config";
+            tableName: "vaults";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+export declare const vaultSecrets: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "vault_secrets";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "id";
+            tableName: "vault_secrets";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        vaultId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "vault_id";
+            tableName: "vault_secrets";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "name";
+            tableName: "vault_secrets";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        type: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "type";
+            tableName: "vault_secrets";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        encryptedValue: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "encrypted_value";
+            tableName: "vault_secrets";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "created_at";
+            tableName: "vault_secrets";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "updated_at";
+            tableName: "vault_secrets";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
+//# sourceMappingURL=tables.d.ts.map

package/dist/tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../src/tables.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASjB,CAAA;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASvB,CAAA"}

package/dist/tables.js

@@ -0,0 +1,22 @@
+import { sqliteTable, integer, text } from 'drizzle-orm/sqlite-core';
+export const vaults = sqliteTable('vaults', {
+    id: integer('id').primaryKey({ autoIncrement: true }),
+    name: text('name').notNull(),
+    type: text('type').notNull().default('local'), // 'local' | 'hashicorp'
+    description: text('description'),
+    createdAt: integer('created_at').notNull(),
+    updatedAt: integer('updated_at').notNull(),
+    /** Encrypted JSON connection settings of a 'hashicorp' vault; NULL for 'local'. Never sent to the browser. */
+    connectionConfig: text('connection_config'),
+});
+export const vaultSecrets = sqliteTable('vault_secrets', {
+    id: integer('id').primaryKey({ autoIncrement: true }),
+    vaultId: integer('vault_id').notNull(),
+    name: text('name').notNull(),
+    type: text('type').notNull(), // 'userpass' | 'value' | 'json'
+    /** Local vault: the encrypted value. HashiCorp vault: the encrypted reference `{ path, key? }`. */
+    encryptedValue: text('encrypted_value').notNull(),
+    createdAt: integer('created_at').notNull(),
+    updatedAt: integer('updated_at').notNull(),
+});
+//# sourceMappingURL=tables.js.map

package/dist/tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../src/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAEpE,MAAM,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE;IAC1C,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,wBAAwB;IACvE,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,8GAA8G;IAC9G,gBAAgB,EAAE,IAAI,CAAC,mBAAmB,CAAC;CAC5C,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC,eAAe,EAAE;IACvD,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACrD,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACtC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,gCAAgC;IAC9D,mGAAmG;IACnG,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CAC3C,CAAC,CAAA"}

package/dist/vaultRoutes.d.ts

@@ -0,0 +1,42 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { AuditAction } from '@better-forge/contracts';
+import type { SqliteDatabase } from '@better-forge/db';
+import type { Hashicorp } from './hashicorp.js';
+import type { SecretResolver } from './resolveSecret.js';
+import type { SecretBox } from './secretBox.js';
+export declare function createVaultRoutes(ctx: {
+    db: SqliteDatabase;
+    secretBox: SecretBox;
+    audit: VaultAudit;
+    /** The signed-in caller of a request (the routes sit behind the application's own guards). */
+    identity: (req: FastifyRequest) => {
+        userId: number;
+        email: string;
+    };
+}, parts: {
+    hashicorp: Hashicorp;
+    resolver: SecretResolver;
+}): {
+    vaultCatalogRoutes: (app: FastifyInstance) => Promise<void>;
+    vaultRoutes: (app: FastifyInstance) => Promise<void>;
+};
+/** What the vault routes need to write audit entries; the audit module's instance fits. */
+export interface VaultAudit {
+    write(actor: {
+        userId: number;
+        userEmail: string;
+    }, action: AuditAction, entityType: string, entityId: number | string | null, entityName: string, diff?: Record<string, unknown>): Promise<void>;
+    actor(identity: {
+        userId: number;
+        email: string;
+    }): {
+        userId: number;
+        userEmail: string;
+    };
+    diffObjects(before: Record<string, unknown>, after: Record<string, unknown>): Record<string, {
+        from: unknown;
+        to: unknown;
+    }>;
+    snapshot(obj: Record<string, unknown>): Record<string, unknown>;
+}
+//# sourceMappingURL=vaultRoutes.d.ts.map

package/dist/vaultRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vaultRoutes.d.ts","sourceRoot":"","sources":["../src/vaultRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAwB/C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE;IACrC,EAAE,EAAE,cAAc,CAAA;IAClB,SAAS,EAAE,SAAS,CAAA;IACpB,KAAK,EAAE,UAAU,CAAA;IACjB,8FAA8F;IAC9F,QAAQ,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CACrE,EAAE,KAAK,EAAE;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE;8BA+EnB,eAAe;uBAkBtB,eAAe;EAsRhD;AAED,2FAA2F;AAC3F,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjM,KAAK,CAAC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IACzF,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC5H,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChE"}