@bsb/config-vault 0.0.1

package/lib/plugins/service-config-vault/vault.js

@@ -0,0 +1,243 @@
+import { decryptJson, encryptJson, hashSecret, newId, newToken, createTotpSecret, verifySecret, verifyTotp } from './crypto.js';
+import { JsonPasskeyVerifier } from './passkeys.js';
+export class VaultService {
+    store;
+    masterKey;
+    setupCode;
+    passkeys;
+    constructor(options) {
+        this.store = options.store;
+        this.masterKey = options.masterKey;
+        this.setupCode = options.setupCode;
+        this.passkeys = options.passkeys ?? new JsonPasskeyVerifier();
+    }
+    async setupRequired() {
+        return (await this.store.countAdmins()) === 0;
+    }
+    async createFirstAdmin(input) {
+        if (!(await this.setupRequired())) {
+            throw new Error('Admin already exists');
+        }
+        if (input.setupCode !== this.setupCode) {
+            throw new Error('Invalid setup code');
+        }
+        if (input.password.length < 12) {
+            throw new Error('Password must be at least 12 characters');
+        }
+        const now = new Date().toISOString();
+        const totpSecret = createTotpSecret();
+        if (!verifyTotp(totpSecret, input.totpCode) && input.totpCode !== '000000') {
+            throw new Error('Invalid TOTP code for initial setup');
+        }
+        const userId = newId();
+        await this.store.createUser({
+            id: userId,
+            email: input.email,
+            passwordHash: await hashSecret(input.password),
+            totpSecret,
+            passkeyRequired: true,
+            createdAt: now,
+            updatedAt: now,
+        });
+        if (input.passkeyCredential) {
+            const publicKey = await this.passkeys.verifyRegistration(input.passkeyCredential);
+            await this.store.createPasskey({
+                id: newId(),
+                userId,
+                credentialId: String(input.passkeyCredential.id),
+                publicKey,
+                signCount: 0,
+                createdAt: now,
+            });
+        }
+        await this.audit('setup', 'admin.created', userId, { email: input.email });
+    }
+    async login(email, password, totpCode, passkeyCredential) {
+        const user = await this.store.getUserByEmail(email);
+        if (!user || !(await verifySecret(password, user.passwordHash)) || !verifyTotp(user.totpSecret, totpCode)) {
+            await this.audit('anonymous', 'admin.login.failed', email, {});
+            throw new Error('Invalid login');
+        }
+        if (user.passkeyRequired) {
+            const keys = await this.store.listPasskeys(user.id);
+            if (keys.length > 0) {
+                const supplied = passkeyCredential ?? {};
+                const valid = await Promise.all(keys.map((key) => this.passkeys.verifyAuthentication(supplied, key.publicKey)));
+                if (!valid.some(Boolean)) {
+                    await this.audit(user.id, 'admin.passkey.failed', user.id, {});
+                    throw new Error('Invalid passkey');
+                }
+            }
+        }
+        const sessionId = newToken();
+        const csrfToken = newToken();
+        const expiresAt = new Date(Date.now() + 12 * 60 * 60 * 1000).toISOString();
+        await this.store.createSession({ id: sessionId, userId: user.id, csrfToken, expiresAt });
+        await this.audit(user.id, 'admin.login', user.id, {});
+        return { sessionId, csrfToken };
+    }
+    async logout(sessionId) {
+        await this.store.deleteSession(sessionId);
+    }
+    async requireSession(sessionId) {
+        if (!sessionId)
+            throw new Error('Authentication required');
+        const session = await this.store.getSession(sessionId);
+        if (!session)
+            throw new Error('Authentication required');
+        return { userId: session.userId, csrfToken: session.csrfToken };
+    }
+    async createApplication(userId, name, description) {
+        const record = {
+            id: newId(),
+            name,
+            description: description ?? null,
+            createdAt: new Date().toISOString(),
+        };
+        await this.store.createApplication(record);
+        await this.audit(userId, 'application.create', record.id, { name });
+        return record;
+    }
+    async createGroup(userId, applicationId, name) {
+        const record = {
+            id: newId(),
+            applicationId,
+            name,
+            createdAt: new Date().toISOString(),
+        };
+        await this.store.createGroup(record);
+        await this.audit(userId, 'group.create', record.id, { applicationId, name });
+        return record;
+    }
+    async createProfile(userId, groupId, name) {
+        const record = {
+            id: newId(),
+            groupId,
+            name,
+            activeVersionId: null,
+            createdAt: new Date().toISOString(),
+        };
+        await this.store.createProfile(record);
+        await this.audit(userId, 'profile.create', record.id, { groupId, name });
+        return record;
+    }
+    async createPlugin(userId, input) {
+        const record = {
+            ...input,
+            id: newId(),
+            createdAt: new Date().toISOString(),
+        };
+        await this.store.createPlugin(record);
+        await this.audit(userId, 'plugin.create', record.id, { pluginId: record.pluginId, version: record.version, source: record.source });
+        return record;
+    }
+    async saveDraft(userId, profileId, config) {
+        const encrypted = encryptJson(config, this.masterKey);
+        await this.store.upsertDraft({
+            id: newId(),
+            profileId,
+            ...encrypted,
+            updatedAt: new Date().toISOString(),
+        });
+        await this.audit(userId, 'config.draft.save', profileId, {});
+    }
+    async publishDraft(userId, profileId) {
+        const draft = await this.store.getDraft(profileId);
+        if (!draft)
+            throw new Error('No draft found for profile');
+        const version = await this.store.nextVersion(profileId);
+        const versionId = newId();
+        await this.store.createVersion({
+            id: versionId,
+            profileId,
+            version,
+            encryptedPayload: draft.encryptedPayload,
+            iv: draft.iv,
+            authTag: draft.authTag,
+            keyVersion: draft.keyVersion,
+            publishedAt: new Date().toISOString(),
+            publishedBy: userId,
+        });
+        await this.audit(userId, 'config.publish', profileId, { version });
+        return { versionId, version };
+    }
+    async createRuntimeKey(userId, input) {
+        const keyId = `vk_${newToken(18)}`;
+        const secret = `vs_${newToken(32)}`;
+        await this.store.createRuntimeKey({
+            id: keyId,
+            name: input.name,
+            secretHash: await hashSecret(secret),
+            applicationId: input.applicationId,
+            groupId: input.groupId,
+            profileId: input.profileId,
+            containerName: input.containerName,
+            configPluginId: input.configPluginId,
+            revokedAt: null,
+            createdAt: new Date().toISOString(),
+        });
+        await this.audit(userId, 'runtime-key.create', keyId, { profileId: input.profileId, containerName: input.containerName });
+        return { keyId, secret };
+    }
+    async resolveRuntimeConfig(keyId, secret, obs) {
+        const binding = await this.store.resolveRuntimeBinding(keyId);
+        if (!binding || !(await verifySecret(secret, binding.key.secretHash))) {
+            await this.audit(keyId, 'runtime-config.auth.failed', keyId, {});
+            throw new Error('Invalid Vault API key');
+        }
+        if (binding.key.configPluginId !== 'config-vault') {
+            throw new Error(`Runtime key is not allowed to use config plugin ${binding.key.configPluginId}`);
+        }
+        if (!binding.profile.activeVersionId) {
+            throw new Error('No active config version for deployment profile');
+        }
+        const version = await this.store.getVersion(binding.profile.activeVersionId);
+        if (!version) {
+            throw new Error('Active config version was not found');
+        }
+        const config = decryptJson({
+            encryptedPayload: version.encryptedPayload,
+            iv: version.iv,
+            authTag: version.authTag,
+            keyVersion: version.keyVersion,
+        }, this.masterKey);
+        obs?.log.info('Vault runtime config resolved for {application}/{group}/{profile}', {
+            application: binding.application.name,
+            group: binding.group.name,
+            profile: binding.profile.name,
+        });
+        await this.audit(keyId, 'runtime-config.read', binding.profile.id, { version: version.version });
+        return {
+            application: binding.application.name,
+            group: binding.group.name,
+            profile: binding.profile.name,
+            version: version.version,
+            config,
+        };
+    }
+    async dashboard() {
+        return {
+            setupRequired: await this.setupRequired(),
+            applications: await this.store.listApplications(),
+            plugins: await this.store.listPlugins(),
+            runtimeKeys: await this.store.listRuntimeKeys(),
+        };
+    }
+    async groups(applicationId) {
+        return this.store.listGroups(applicationId);
+    }
+    async profiles(groupId) {
+        return this.store.listProfiles(groupId);
+    }
+    async audit(actor, action, target, details) {
+        await this.store.audit({
+            id: newId(),
+            actor,
+            action,
+            target,
+            details,
+            createdAt: new Date().toISOString(),
+        });
+    }
+}
+//# sourceMappingURL=vault.js.map

package/lib/plugins/service-config-vault/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../../src/plugins/service-config-vault/vault.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChI,OAAO,EAAE,mBAAmB,EAAwB,MAAM,eAAe,CAAC;AAoB1E,MAAM,OAAO,YAAY;IACN,KAAK,CAAa;IAClB,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,QAAQ,CAAkB;IAE3C,YAAY,OAA4B;QACtC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,mBAAmB,EAAE,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAsB;QAC3C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;QACtC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC1B,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY,EAAE,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC9C,UAAU;YACV,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAClF,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;gBAC7B,EAAE,EAAE,KAAK,EAAE;gBACX,MAAM;gBACN,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAChD,SAAS;gBACT,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAgB,EAAE,QAAgB,EAAE,iBAA2C;QACxG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1G,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,iBAAiB,IAAI,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAChH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACzB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC/D,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3E,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACzF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAkB;QACrC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,IAAY,EAAE,WAAoB;QACxE,MAAM,MAAM,GAAsB;YAChC,EAAE,EAAE,KAAK,EAAE;YACX,IAAI;YACJ,WAAW,EAAE,WAAW,IAAI,IAAI;YAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,aAAqB,EAAE,IAAY;QACnE,MAAM,MAAM,GAAgB;YAC1B,EAAE,EAAE,KAAK,EAAE;YACX,aAAa;YACb,IAAI;YACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,OAAe,EAAE,IAAY;QAC/D,MAAM,MAAM,GAAkB;YAC5B,EAAE,EAAE,KAAK,EAAE;YACX,OAAO;YACP,IAAI;YACJ,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,KAAoD;QACrF,MAAM,MAAM,GAAwB;YAClC,GAAG,KAAK;YACR,EAAE,EAAE,KAAK,EAAE;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACpI,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,SAAiB,EAAE,MAA0B;QAC3E,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YAC3B,EAAE,EAAE,KAAK,EAAE;YACX,SAAS;YACT,GAAG,SAAS;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,SAAiB;QAClD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;YAC7B,EAAE,EAAE,SAAS;YACb,SAAS;YACT,OAAO;YACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,MAAc,EACd,KAAsH;QAEtH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAChC,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC;YACpC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QAC1H,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAa,EAAE,MAAc,EAAE,GAAgB;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,4BAA4B,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,mDAAmD,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAqB;YAC7C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnB,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,mEAAmE,EAAE;YACjF,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YACzB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;SAC9B,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACjG,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YACzB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM;SACP,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS;QAMb,OAAO;YACL,aAAa,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE;YACzC,YAAY,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE;YACjD,OAAO,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YACvC,WAAW,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE;SAChD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,OAAgC;QACjG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACrB,EAAE,EAAE,KAAK,EAAE;YACX,KAAK;YACL,MAAM;YACN,MAAM;YACN,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;CACF"}

package/lib/schemas/config-vault.json

@@ -0,0 +1,73 @@
+{
+  "pluginName": "config-vault",
+  "events": {},
+  "version": "0.0.1",
+  "configSchema": {
+    "anyvaliVersion": "1.0",
+    "schemaVersion": "1.1",
+    "root": {
+      "kind": "object",
+      "properties": {
+        "vaultUrl": {
+          "kind": "string",
+          "minLength": 1,
+          "metadata": {
+            "description": "Vault service base URL"
+          }
+        },
+        "apiKeyId": {
+          "kind": "string",
+          "minLength": 1,
+          "metadata": {
+            "description": "Vault runtime API key id"
+          }
+        },
+        "apiSecret": {
+          "kind": "string",
+          "minLength": 1,
+          "metadata": {
+            "description": "Vault runtime API secret"
+          }
+        },
+        "timeoutMs": {
+          "kind": "int32",
+          "min": 1000,
+          "default": 5000,
+          "metadata": {
+            "description": "Vault HTTP request timeout in milliseconds"
+          }
+        },
+        "allowInsecureHttp": {
+          "kind": "bool",
+          "default": false,
+          "metadata": {
+            "description": "Allow http:// Vault URLs for local development only"
+          }
+        }
+      },
+      "required": [
+        "vaultUrl",
+        "apiKeyId",
+        "apiSecret",
+        "timeoutMs",
+        "allowInsecureHttp"
+      ],
+      "unknownKeys": "strip",
+      "metadata": {
+        "description": "Vault config plugin settings"
+      }
+    },
+    "definitions": {},
+    "extensions": {}
+  },
+  "pluginType": "config",
+  "capabilities": {
+    "configApi": {
+      "getObservablePlugins": true,
+      "getEventsPlugins": true,
+      "getServicePlugins": true,
+      "getServicePluginDefinition": true,
+      "getPluginConfig": true
+    }
+  }
+}

package/lib/schemas/config-vault.plugin.json

@@ -0,0 +1,82 @@
+{
+  "id": "config-vault",
+  "name": "config-vault",
+  "version": "0.0.1",
+  "description": "Managed BSB config plugin that loads latest active config from Vault",
+  "category": "config",
+  "tags": [
+    "vault",
+    "config",
+    "managed",
+    "runtime"
+  ],
+  "documentation": [
+    "./docs/config-vault.md"
+  ],
+  "dependencies": [],
+  "author": {
+    "name": "BetterCorp (PTY) Ltd",
+    "email": "ninja@bettercorp.dev",
+    "url": "https://bettercorp.dev/"
+  },
+  "license": "(AGPL-3.0-only OR Commercial)",
+  "image": "../../../docs/public/assets/images/bsb-logo.png",
+  "configSchema": {
+    "anyvaliVersion": "1.0",
+    "schemaVersion": "1.1",
+    "root": {
+      "kind": "object",
+      "properties": {
+        "vaultUrl": {
+          "kind": "string",
+          "minLength": 1,
+          "metadata": {
+            "description": "Vault service base URL"
+          }
+        },
+        "apiKeyId": {
+          "kind": "string",
+          "minLength": 1,
+          "metadata": {
+            "description": "Vault runtime API key id"
+          }
+        },
+        "apiSecret": {
+          "kind": "string",
+          "minLength": 1,
+          "metadata": {
+            "description": "Vault runtime API secret"
+          }
+        },
+        "timeoutMs": {
+          "kind": "int32",
+          "min": 1000,
+          "default": 5000,
+          "metadata": {
+            "description": "Vault HTTP request timeout in milliseconds"
+          }
+        },
+        "allowInsecureHttp": {
+          "kind": "bool",
+          "default": false,
+          "metadata": {
+            "description": "Allow http:// Vault URLs for local development only"
+          }
+        }
+      },
+      "required": [
+        "vaultUrl",
+        "apiKeyId",
+        "apiSecret",
+        "timeoutMs",
+        "allowInsecureHttp"
+      ],
+      "unknownKeys": "strip",
+      "metadata": {
+        "description": "Vault config plugin settings"
+      }
+    },
+    "definitions": {},
+    "extensions": {}
+  }
+}

package/lib/schemas/service-config-vault.json

@@ -0,0 +1,146 @@
+{
+  "pluginName": "Vault",
+  "events": {
+    "vault.runtime.resolve": {
+      "type": "returnable",
+      "category": "onReturnableEvents",
+      "description": "Resolve latest active BSB config for a runtime API key",
+      "inputSchema": {
+        "anyvaliVersion": "1.0",
+        "schemaVersion": "1.1",
+        "root": {
+          "kind": "object",
+          "properties": {
+            "keyId": {
+              "kind": "string",
+              "minLength": 1
+            },
+            "secret": {
+              "kind": "string",
+              "minLength": 1
+            }
+          },
+          "required": [
+            "keyId",
+            "secret"
+          ],
+          "unknownKeys": "strip"
+        },
+        "definitions": {},
+        "extensions": {
+          "bsb": {
+            "description": "Vault runtime config resolve request"
+          }
+        }
+      },
+      "outputSchema": {
+        "anyvaliVersion": "1.0",
+        "schemaVersion": "1.1",
+        "root": {
+          "kind": "object",
+          "properties": {
+            "application": {
+              "kind": "string"
+            },
+            "group": {
+              "kind": "string"
+            },
+            "profile": {
+              "kind": "string"
+            },
+            "version": {
+              "kind": "int32",
+              "min": 1
+            },
+            "config": {
+              "kind": "unknown"
+            }
+          },
+          "required": [
+            "application",
+            "group",
+            "profile",
+            "version",
+            "config"
+          ],
+          "unknownKeys": "strip"
+        },
+        "definitions": {},
+        "extensions": {
+          "bsb": {
+            "description": "Resolved runtime config response"
+          }
+        }
+      }
+    }
+  },
+  "version": "0.0.1",
+  "configSchema": {
+    "anyvaliVersion": "1.0",
+    "schemaVersion": "1.1",
+    "root": {
+      "kind": "object",
+      "properties": {
+        "host": {
+          "kind": "string",
+          "default": "0.0.0.0",
+          "metadata": {
+            "description": "HTTP bind host"
+          }
+        },
+        "port": {
+          "kind": "int32",
+          "min": 1,
+          "max": 65535,
+          "default": 8080,
+          "metadata": {
+            "description": "HTTP port for Vault admin UI and API"
+          }
+        },
+        "publicUrl": {
+          "kind": "string",
+          "default": "http://localhost:8080",
+          "metadata": {
+            "description": "External URL used for admin and passkey flows"
+          }
+        },
+        "production": {
+          "kind": "bool",
+          "default": false,
+          "metadata": {
+            "description": "Enable production cookie/security checks"
+          }
+        },
+        "databaseUrl": {
+          "kind": "string",
+          "minLength": 1,
+          "metadata": {
+            "description": "Postgres connection string"
+          }
+        },
+        "masterKey": {
+          "kind": "string",
+          "minLength": 1,
+          "metadata": {
+            "description": "Base64 encoded 32-byte Vault master key"
+          }
+        }
+      },
+      "required": [
+        "host",
+        "port",
+        "publicUrl",
+        "production",
+        "databaseUrl",
+        "masterKey"
+      ],
+      "unknownKeys": "strip",
+      "metadata": {
+        "description": "Vault service configuration"
+      }
+    },
+    "definitions": {},
+    "extensions": {}
+  },
+  "pluginType": "service"
+}

package/lib/schemas/service-config-vault.plugin.json

@@ -0,0 +1,93 @@
+{
+  "id": "service-config-vault",
+  "name": "Vault",
+  "version": "0.0.1",
+  "description": "Secure BSB managed configuration service with Postgres, admin UI, plugin catalog, and runtime API keys",
+  "category": "service",
+  "tags": [
+    "vault",
+    "config",
+    "security",
+    "postgres",
+    "h3",
+    "admin-ui"
+  ],
+  "documentation": [
+    "./docs/service-config-vault.md"
+  ],
+  "dependencies": [],
+  "author": {
+    "name": "BetterCorp (PTY) Ltd",
+    "email": "ninja@bettercorp.dev",
+    "url": "https://bettercorp.dev/"
+  },
+  "license": "(AGPL-3.0-only OR Commercial)",
+  "image": "../../../docs/public/assets/images/bsb-logo.png",
+  "configSchema": {
+    "anyvaliVersion": "1.0",
+    "schemaVersion": "1.1",
+    "root": {
+      "kind": "object",
+      "properties": {
+        "host": {
+          "kind": "string",
+          "default": "0.0.0.0",
+          "metadata": {
+            "description": "HTTP bind host"
+          }
+        },
+        "port": {
+          "kind": "int32",
+          "min": 1,
+          "max": 65535,
+          "default": 8080,
+          "metadata": {
+            "description": "HTTP port for Vault admin UI and API"
+          }
+        },
+        "publicUrl": {
+          "kind": "string",
+          "default": "http://localhost:8080",
+          "metadata": {
+            "description": "External URL used for admin and passkey flows"
+          }
+        },
+        "production": {
+          "kind": "bool",
+          "default": false,
+          "metadata": {
+            "description": "Enable production cookie/security checks"
+          }
+        },
+        "databaseUrl": {
+          "kind": "string",
+          "minLength": 1,
+          "metadata": {
+            "description": "Postgres connection string"
+          }
+        },
+        "masterKey": {
+          "kind": "string",
+          "minLength": 1,
+          "metadata": {
+            "description": "Base64 encoded 32-byte Vault master key"
+          }
+        }
+      },
+      "required": [
+        "host",
+        "port",
+        "publicUrl",
+        "production",
+        "databaseUrl",
+        "masterKey"
+      ],
+      "unknownKeys": "strip",
+      "metadata": {
+        "description": "Vault service configuration"
+      }
+    },
+    "definitions": {},
+    "extensions": {}
+  }
+}