@clicadigital/vault-sdk 0.1.0 → 0.4.0

package/README.md

@@ -1,152 +1,126 @@
-# @clicadigital/vault-sdk
-
-SDK e CLI para criar e carregar variáveis de ambiente a partir do **Clica VPN Vault**.
-
-Pensado para uso **entre pods no mesmo cluster / VPN**. Não há API key: a segurança é a rede interna (NetworkPolicy / VPN). Devs usam a UI do vault; apps usam este SDK no build ou no boot.
-
-## Instalação
-
-```bash
-npm install @clicadigital/vault-sdk
-# ou
-bun add @clicadigital/vault-sdk
-```
-
-## Configuração
-
-| Variável        | Obrigatória | Descrição                                              |
-|-----------------|-------------|--------------------------------------------------------|
-| `VAULT_URL`     | sim*        | URL interna do vault, ex: `http://vault-api:3001`      |
-| `VAULT_PROJECT` | não         | Default de `--project` na CLI                          |
-| `VAULT_ENV`     | não         | Default de `--env` na CLI                              |
-
-\* Também aceita `VAULT_API_URL` ou `API_URL`. Pode passar `--url` / `url` no código.
-
-## CLI
-
-### Garantir projeto + environment
-
-Cria o projeto (se não existir) e o environment (se não existir). Projetos novos já nascem com `production` e `staging` no vault; outros nomes são criados sob demanda.
-
-```bash
-export VAULT_URL=http://vault-api:3001
-
-npx vault-sdk ensure --project meu-app --env production
-```
-
-### Criar environment e gravar variáveis
-
-```bash
-npx vault-sdk create \
-  --project meu-app \
-  --env production \
-  --var DATABASE_URL=postgres://... \
-  --var API_TOKEN=secret
-```
-
-### Puxar variáveis no build (gera `.env`)
-
-```bash
-# Dockerfile / CI / init container
-npx vault-sdk pull \
-  --project meu-app \
-  --env production \
-  --out .env \
-  --no-inject
-```
-
-Sem `--no-inject`, as vars também vão para `process.env` do processo da CLI.
-
-### URL explícita
-
-```bash
-npx vault-sdk pull --url http://vault-api.vpn.svc.cluster.local:3001 \
-  --project meu-app --env staging --out .env
-```
-
-## Uso em código (Node / Bun)
-
-### Carregar no boot / build script
-
-```ts
-import { loadVault, pullVault, createEnv, ensureEnvironment } from "@clicadigital/vault-sdk";
-
-// injeta em process.env
-await loadVault({ project: "meu-app", env: "production" });
-
-// ou grava arquivo
-await pullVault({
-  project: "meu-app",
-  env: "production",
-  out: ".env",
-  inject: false,
-});
-```
-
-### Criar environment + vars pela URL da VPN
-
-```ts
-await createEnv({
-  url: "http://vault-api:3001",
-  project: "meu-app",
-  env: "production",
-  vars: {
-    DATABASE_URL: "postgres://...",
-    REDIS_URL: "redis://...",
-  },
-});
-```
-
-### Só garantir que o environment existe
-
-```ts
-await ensureEnvironment({ project: "meu-app", env: "qa" });
-```
-
-## Exemplo Kubernetes (build)
-
-```dockerfile
-# build stage (mesmo cluster / network policy liberando vault-api)
-ENV VAULT_URL=http://vault-api:3001
-RUN npx vault-sdk pull --project meu-app --env production --out .env --no-inject
-```
-
-Ou no `package.json` do app:
-
-```json
-{
-  "scripts": {
-    "prebuild": "vault-sdk pull --project meu-app --env production --out .env --no-inject",
-    "build": "…"
-  }
-}
-```
-
-## API do vault usada pelo SDK
-
-| Método | Path | Uso |
-|--------|------|-----|
-| `GET` | `/v1/projects` | Árvore projetos + environments |
-| `POST` | `/v1/projects` | Criar projeto |
-| `POST` | `/v1/projects/:id/environments` | Criar environment |
-| `GET` | `/v1/environments/:id/vars` | Listar vars (já descriptografadas) |
-| `PUT` | `/v1/environments/:id/vars` | Upsert var |
-
-## Desenvolvimento local (neste monorepo)
-
-```bash
-cd sdk
-bun install
-bun run build
-
-# vault API em localhost:3001
-VAULT_URL=http://localhost:3001 bun run src/cli.ts pull --project demo --env production --out .env
-```
-
-Publicar:
-
-```bash
-cd sdk
-bun run build
-bun publish --access public
-```
+# @clicadigital/vault-sdk
+
+SDK para carregar variáveis de ambiente do **Clica VPN Vault** em `process.env`. Projeto, environment e allow ficam na UI do vault.
+
+Pensado para uso **entre pods no k3s/k8s**. Sem API key estática.
+
+Segurança em camadas:
+1. **NetworkPolicy** — só pods com `vault.clica.io/access=true` (e o `vault-web`) alcançam a API
+2. **ServiceAccount + TokenReview** — o SDK envia o JWT projetado (`audience: vault`); a API valida e checa allowlist
+3. **Master key** — só no Deployment do vault (`VAULT_MASTER_KEY`), nunca nos apps
+
+Local/dev: API com `VAULT_AUTH=none` (sem token).
+
+## Instalação
+
+```bash
+npm install @clicadigital/vault-sdk
+# ou
+bun add @clicadigital/vault-sdk
+```
+
+## Configuração
+
+| Variável             | Obrigatória | Descrição                                              |
+|----------------------|-------------|--------------------------------------------------------|
+| `VAULT_URL`          | não         | Override da URL. Default: `http://vault-api-service.vault.svc.cluster.local:3001` |
+| `VAULT_SA_TOKEN_PATH`| não         | Path do token SA (default: `/var/run/secrets/tokens/vault/token`) |
+| `VAULT_PROJECT`      | não         | Default de `--project` na CLI                          |
+| `VAULT_ENV`          | não         | Default de `--env` na CLI                              |
+
+Também aceita `VAULT_API_URL` ou `API_URL` no lugar de `VAULT_URL`. Em pods no cluster normalmente **não precisa** setar URL.
+
+No cluster, monte um projected token:
+
+```yaml
+volumeMounts:
+  - name: vault-token
+    mountPath: /var/run/secrets/tokens/vault
+    readOnly: true
+volumes:
+  - name: vault-token
+    projected:
+      sources:
+        - serviceAccountToken:
+            path: token
+            expirationSeconds: 3600
+            audience: vault
+```
+
+O SDK lê o token sozinho e manda `Authorization: Bearer …`.
+
+## CLI
+
+### Puxar variáveis no build (gera `.env`)
+
+```bash
+# Dockerfile / CI / init container
+npx vault-sdk pull \
+  --project meu-app \
+  --env production \
+  --out .env \
+  --no-inject
+```
+
+Sem `--no-inject`, as vars também vão para `process.env` do processo da CLI.
+
+### URL explícita
+
+```bash
+npx vault-sdk pull --url http://vault-api.vpn.svc.cluster.local:3001 \
+  --project meu-app --env staging --out .env
+```
+
+## Uso em código (Node / Bun)
+
+### Carregar no boot / build script
+
+O pacote publica ESM e CJS. Um `import` normal vira `require()` no build CJS e continua funcionando. Não use `new Function` nem `import()` dinâmico.
+
+```ts
+import { loadVault } from "@clicadigital/vault-sdk";
+
+export async function loadProductionVault(): Promise<void> {
+  if (process.env.NODE_ENV !== "production") return;
+  await loadVault({ project: "meu-app", env: "production" });
+}
+```
+
+Mantenha esse import num módulo separado do entry do Next, para o webpack não levar o SDK às outras rotas.
+
+No pod, a URL default é a do Service e o token SA já vem montado. Manifests de referência: [`deploy/k3s/`](../deploy/k3s/) (NetworkPolicy, RBAC TokenReview, SA, exemplos).
+
+```bash
+kubectl apply -k deploy/k3s
+kubectl apply -f deploy/k3s/secrets.yaml   # a partir de secrets.example.yaml
+```
+
+O allow do app é feito no projeto, pela UI do vault. Informe a ServiceAccount `system:serviceaccount:<namespace>:<nome>`.
+
+`VAULT_ALLOWED_SAS` no deployment fica só para o operador da UI (`vault-web`).
+
+## API do vault usada pelo SDK
+
+| Método | Path | Uso |
+|--------|------|-----|
+| `GET` | `/v1/projects` | Achar o projeto e o environment |
+| `GET` | `/v1/environments/:id/vars` | Ler as vars já descriptografadas |
+
+## Desenvolvimento local (neste monorepo)
+
+```bash
+cd sdk
+bun install
+bun run build
+
+# fora do cluster, sobrescreva o default k8s
+VAULT_URL=http://localhost:3001 bun run src/cli.ts pull --project demo --env production --out .env
+```
+
+Publicar:
+
+```bash
+cd sdk
+bun run build
+bun publish --access public
+```

package/dist/cjs/cli.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const index_js_1 = require("./index.js");
+function parseArgs(argv) {
+    const [cmd = "help", ...rest] = argv;
+    const flags = {};
+    for (let i = 0; i < rest.length; i++) {
+        const token = rest[i];
+        if (!token?.startsWith("--"))
+            continue;
+        const key = token.slice(2);
+        const next = rest[i + 1];
+        if (!next || next.startsWith("--")) {
+            flags[key] = true;
+            continue;
+        }
+        flags[key] = next;
+        i++;
+    }
+    return { cmd, flags };
+}
+function str(flags, key, fallback) {
+    const value = flags[key];
+    if (typeof value === "string" && value.length > 0)
+        return value;
+    if (fallback !== undefined)
+        return fallback;
+    throw new Error(`Missing --${key}`);
+}
+function printHelp() {
+    console.log(`@clicadigital/vault-sdk — carrega envs do vault
+
+Usage:
+  vault-sdk pull --project <name> --env <name> [--out .env] [--no-inject] [--url <vpn-url>]
+
+Env:
+  VAULT_URL            opcional; default k8s: http://vault-api-service.vault.svc.cluster.local:3001
+  VAULT_PROJECT        default --project
+  VAULT_ENV            default --env
+  VAULT_SA_TOKEN_PATH  path do token SA (default: /var/run/secrets/tokens/vault/token)
+
+No código: loadVault({ project, env }) injeta em process.env.
+Criar projeto, environment e allow é pela UI do vault.
+`);
+}
+async function main() {
+    const { cmd, flags } = parseArgs(process.argv.slice(2));
+    if (cmd === "help" || flags.help === true) {
+        printHelp();
+        return;
+    }
+    if (typeof flags.url === "string")
+        process.env.VAULT_URL = flags.url;
+    if (cmd !== "pull") {
+        printHelp();
+        process.exit(1);
+    }
+    const project = str(flags, "project", process.env.VAULT_PROJECT);
+    const env = str(flags, "env", process.env.VAULT_ENV);
+    const out = typeof flags.out === "string" ? flags.out : undefined;
+    const inject = flags["no-inject"] !== true;
+    const result = await (0, index_js_1.pullVault)({ project, env, out, inject });
+    console.log(`pulled ${Object.keys(result.vars).length} vars for ${project}/${env}` +
+        (result.out ? ` → ${result.out}` : "") +
+        (inject ? " (injected into process.env)" : ""));
+}
+main().catch((err) => {
+    console.error(err instanceof Error ? err.message : err);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cjs/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";;;AACA,yCAAuC;AAIvC,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,CAAC,GAAG,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACrC,MAAM,KAAK,GAAU,EAAE,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAClB,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QAClB,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,GAAG,CAAC,KAAY,EAAE,GAAW,EAAE,QAAiB;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;CAab,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAExD,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1C,SAAS,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;IAErE,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,IAAA,oBAAS,EAAC,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CACT,UAAU,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,aAAa,OAAO,IAAI,GAAG,EAAE;QACpE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,CAAC,MAAM,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/cjs/client.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VaultClient = exports.DEFAULT_VAULT_URL = void 0;
+exports.createClientFromEnv = createClientFromEnv;
+const node_fs_1 = require("node:fs");
+const DEFAULT_TOKEN_PATHS = [
+    "/var/run/secrets/tokens/vault/token",
+    "/var/run/secrets/kubernetes.io/serviceaccount/token",
+];
+/** DNS interno do Service no k3s (namespace `vault`). Override com VAULT_URL. */
+exports.DEFAULT_VAULT_URL = "http://vault-api-service.vault.svc.cluster.local:3001";
+function resolveToken(opts) {
+    if (opts.token)
+        return opts.token;
+    const paths = opts.tokenPaths ?? DEFAULT_TOKEN_PATHS;
+    for (const path of paths) {
+        if (!(0, node_fs_1.existsSync)(path))
+            continue;
+        try {
+            const token = (0, node_fs_1.readFileSync)(path, "utf8").trim();
+            if (token)
+                return token;
+        }
+        catch {
+            // ignore unreadable path
+        }
+    }
+    return undefined;
+}
+class VaultClient {
+    baseUrl;
+    token;
+    fetchFn;
+    constructor(opts) {
+        this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+        this.token = resolveToken(opts);
+        this.fetchFn = opts.fetch ?? globalThis.fetch.bind(globalThis);
+    }
+    async request(path, init) {
+        const headers = {
+            "content-type": "application/json",
+            ...init?.headers,
+        };
+        if (this.token)
+            headers.authorization = `Bearer ${this.token}`;
+        const res = await this.fetchFn(`${this.baseUrl}${path}`, {
+            ...init,
+            headers,
+        });
+        if (!res.ok) {
+            const body = (await res.json().catch(() => null));
+            throw new Error(body?.error ?? `Vault API ${res.status} ${path}`);
+        }
+        if (res.status === 204)
+            return undefined;
+        return (await res.json());
+    }
+    listProjects() {
+        return this.request("/v1/projects");
+    }
+    listVars(environmentId) {
+        return this.request(`/v1/environments/${environmentId}/vars`);
+    }
+}
+exports.VaultClient = VaultClient;
+function createClientFromEnv(env = process.env) {
+    const baseUrl = env.VAULT_URL ?? env.VAULT_API_URL ?? env.API_URL ?? exports.DEFAULT_VAULT_URL;
+    const tokenPath = env.VAULT_SA_TOKEN_PATH;
+    return new VaultClient({
+        baseUrl,
+        token: env.VAULT_SA_TOKEN,
+        tokenPaths: tokenPath ? [tokenPath, ...DEFAULT_TOKEN_PATHS] : undefined,
+    });
+}
+//# sourceMappingURL=client.js.map

package/dist/cjs/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":";;;AAyEA,kDAWC;AApFD,qCAAmD;AAGnD,MAAM,mBAAmB,GAAG;IAC1B,qCAAqC;IACrC,qDAAqD;CACtD,CAAC;AAEF,iFAAiF;AACpE,QAAA,iBAAiB,GAC5B,uDAAuD,CAAC;AAS1D,SAAS,YAAY,CAAC,IAAwB;IAC5C,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAa,WAAW;IACb,OAAO,CAAS;IACR,KAAK,CAAqB;IAC1B,OAAO,CAA0B;IAElD,YAAY,IAAwB;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,IAAkB;QACvD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,GAAI,IAAI,EAAE,OAA8C;SACzD,CAAC;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QAE/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACvD,GAAG,IAAI;YACP,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA8B,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,aAAa,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC;IAED,QAAQ,CAAC,aAAqB;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,aAAa,OAAO,CAAC,CAAC;IAChE,CAAC;CACF;AArCD,kCAqCC;AAED,SAAgB,mBAAmB,CACjC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GACX,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,OAAO,IAAI,yBAAiB,CAAC;IACzE,MAAM,SAAS,GAAG,GAAG,CAAC,mBAAmB,CAAC;IAC1C,OAAO,IAAI,WAAW,CAAC;QACrB,OAAO;QACP,KAAK,EAAE,GAAG,CAAC,cAAc;QACzB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC,CAAC;AACL,CAAC"}

package/dist/cjs/dotenv.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toDotEnv = toDotEnv;
+exports.varsToRecord = varsToRecord;
+function toDotEnv(vars) {
+    return (Object.entries(vars)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([key, value]) => `${key}=${escapeEnvValue(value)}`)
+        .join("\n") + "\n");
+}
+function escapeEnvValue(value) {
+    if (value === "")
+        return '""';
+    if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(value))
+        return value;
+    return JSON.stringify(value);
+}
+function varsToRecord(rows) {
+    const out = {};
+    for (const row of rows)
+        out[row.key] = row.value;
+    return out;
+}
+//# sourceMappingURL=dotenv.js.map

package/dist/cjs/dotenv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotenv.js","sourceRoot":"","sources":["../../src/dotenv.ts"],"names":[],"mappings":";;AAAA,4BAOC;AAQD,oCAMC;AArBD,SAAgB,QAAQ,CAAC,IAA4B;IACnD,OAAO,CACL,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SACjB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;SACxD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,YAAY,CAC1B,IAAsC;IAEtC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cjs/index.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadVault = loadVault;
+exports.pullVault = pullVault;
+const promises_1 = require("node:fs/promises");
+const client_js_1 = require("./client.js");
+const dotenv_js_1 = require("./dotenv.js");
+async function readVars(opts) {
+    const client = (0, client_js_1.createClientFromEnv)();
+    const projects = await client.listProjects();
+    const project = projects.find((item) => item.name === opts.project);
+    if (!project)
+        throw new Error(`Project not found: ${opts.project}`);
+    const environment = project.environments.find((item) => item.name === opts.env);
+    if (!environment) {
+        throw new Error(`Environment "${opts.env}" not found in project "${opts.project}"`);
+    }
+    const rows = await client.listVars(environment.id);
+    return (0, dotenv_js_1.varsToRecord)(rows);
+}
+/** Lê o environment e injeta as variáveis em `process.env`. */
+async function loadVault(opts) {
+    const vars = await readVars(opts);
+    for (const [key, value] of Object.entries(vars)) {
+        process.env[key] = value;
+    }
+}
+async function pullVault(opts) {
+    const vars = await readVars(opts);
+    if (opts.inject !== false) {
+        for (const [key, value] of Object.entries(vars)) {
+            process.env[key] = value;
+        }
+    }
+    const out = opts.out;
+    if (out)
+        await (0, promises_1.writeFile)(out, (0, dotenv_js_1.toDotEnv)(vars), "utf8");
+    return out ? { vars, out } : { vars };
+}
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;AAyBA,8BAKC;AAED,8BAcC;AA9CD,+CAA6C;AAC7C,2CAAkD;AAClD,2CAAqD;AAOrD,KAAK,UAAU,QAAQ,CAAC,IAAsB;IAC5C,MAAM,MAAM,GAAG,IAAA,+BAAmB,GAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAEpE,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,GAAG,2BAA2B,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACnD,OAAO,IAAA,wBAAY,EAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,+DAA+D;AACxD,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,IAA2D;IAE3D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,GAAG;QAAE,MAAM,IAAA,oBAAS,EAAC,GAAG,EAAE,IAAA,oBAAQ,EAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC"}

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/dist/cjs/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/cjs/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":""}