@fonderie/config 2.0.0 → 4.0.0

package/dist/index.d.cts

@@ -1,17 +1,22 @@
-import { IFonderieModule, IFonderieApp } from '@fonderie/core';
+import { IFonderieModule, IFonderieApp, Middleware } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
-import { R as RemoteConfigManager, I as IRemoteConfigOptions } from './index-v2hLmm2m.cjs';
-export { C as CONFIG_MANAGER_KEY, c as configContextMiddleware, g as getConfig } from './index-v2hLmm2m.cjs';
-import { IConfigEntry } from './types.cjs';
+export { VersionConflictError as ConfigConflictError } from '@fonderie/store';
+import { R as RemoteConfigManager, I as IConfigOptions, a as ISecretEncryptor } from './index-CLaJRR69.cjs';
+export { C as CONFIG_MANAGER_KEY, c as configContextMiddleware, b as createAesGcmEncryptor, g as getConfig, n as noopEncryptor } from './index-CLaJRR69.cjs';
+import { IConfigEntry, IConfigRevision, ISecretEntry, ISecretRevision } from './types.cjs';
 export { IConfigSnapshot } from './types.cjs';
 
-declare class RemoteConfigModule implements IFonderieModule {
+declare class ConfigModule implements IFonderieModule {
+    private store;
+    private options;
     readonly name = "@fonderie/config";
     readonly manager: RemoteConfigManager;
-    constructor(store: IStoreAdapter, options?: IRemoteConfigOptions);
+    constructor(store: IStoreAdapter, options?: IConfigOptions);
     install(app: IFonderieApp): Promise<void>;
 }
 
+declare function buildAdminRoutes(store: IStoreAdapter, adminToken: string, encryptor?: ISecretEncryptor): Array<[string, string, Middleware]>;
+
 declare function listConfigEntries(environment: string | null, store: IStoreAdapter): Promise<IConfigEntry[]>;
 declare function getConfigEntry(key: string, environment: string, store: IStoreAdapter): Promise<IConfigEntry | null>;
 declare function setConfigEntry(opts: {
@@ -20,7 +25,37 @@ declare function setConfigEntry(opts: {
     environment?: string;
     description?: string;
     active?: boolean;
+    ifVersion?: number;
+    actor?: string;
+}, store: IStoreAdapter): Promise<IConfigEntry>;
+declare function rollbackConfigEntry(opts: {
+    key: string;
+    environment?: string;
+    toVersion: number;
+    actor?: string;
 }, store: IStoreAdapter): Promise<IConfigEntry>;
+declare function listConfigRevisions(key: string, environment: string, store: IStoreAdapter): Promise<IConfigRevision[]>;
 declare function deleteConfigEntry(key: string, environment: string, store: IStoreAdapter): Promise<boolean>;
 
-export { IConfigEntry, IRemoteConfigOptions, RemoteConfigManager, RemoteConfigModule, deleteConfigEntry, getConfigEntry, listConfigEntries, setConfigEntry };
+declare function listSecrets(environment: string | null, store: IStoreAdapter): Promise<ISecretEntry[]>;
+declare function getSecret(key: string, environment: string, store: IStoreAdapter): Promise<ISecretEntry | null>;
+declare function revealSecret(key: string, environment: string, store: IStoreAdapter, encryptor?: ISecretEncryptor): Promise<string | null>;
+declare function setSecret(opts: {
+    key: string;
+    value: string;
+    environment?: string;
+    description?: string;
+    active?: boolean;
+    ifVersion?: number;
+    actor?: string;
+}, store: IStoreAdapter, encryptor?: ISecretEncryptor): Promise<ISecretEntry>;
+declare function rollbackSecret(opts: {
+    key: string;
+    environment?: string;
+    toVersion: number;
+    actor?: string;
+}, store: IStoreAdapter): Promise<ISecretEntry>;
+declare function listSecretRevisions(key: string, environment: string, store: IStoreAdapter): Promise<ISecretRevision[]>;
+declare function deleteSecret(key: string, environment: string, store: IStoreAdapter): Promise<boolean>;
+
+export { ConfigModule, IConfigEntry, IConfigOptions, IConfigRevision, ISecretEncryptor, ISecretEntry, ISecretRevision, RemoteConfigManager, buildAdminRoutes, deleteConfigEntry, deleteSecret, getConfigEntry, getSecret, listConfigEntries, listConfigRevisions, listSecretRevisions, listSecrets, revealSecret, rollbackConfigEntry, rollbackSecret, setConfigEntry, setSecret };

package/dist/index.d.ts

@@ -1,17 +1,22 @@
-import { IFonderieModule, IFonderieApp } from '@fonderie/core';
+import { IFonderieModule, IFonderieApp, Middleware } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
-import { R as RemoteConfigManager, I as IRemoteConfigOptions } from './index-v2hLmm2m.js';
-export { C as CONFIG_MANAGER_KEY, c as configContextMiddleware, g as getConfig } from './index-v2hLmm2m.js';
-import { IConfigEntry } from './types.js';
+export { VersionConflictError as ConfigConflictError } from '@fonderie/store';
+import { R as RemoteConfigManager, I as IConfigOptions, a as ISecretEncryptor } from './index-CLaJRR69.js';
+export { C as CONFIG_MANAGER_KEY, c as configContextMiddleware, b as createAesGcmEncryptor, g as getConfig, n as noopEncryptor } from './index-CLaJRR69.js';
+import { IConfigEntry, IConfigRevision, ISecretEntry, ISecretRevision } from './types.js';
 export { IConfigSnapshot } from './types.js';
 
-declare class RemoteConfigModule implements IFonderieModule {
+declare class ConfigModule implements IFonderieModule {
+    private store;
+    private options;
     readonly name = "@fonderie/config";
     readonly manager: RemoteConfigManager;
-    constructor(store: IStoreAdapter, options?: IRemoteConfigOptions);
+    constructor(store: IStoreAdapter, options?: IConfigOptions);
     install(app: IFonderieApp): Promise<void>;
 }
 
+declare function buildAdminRoutes(store: IStoreAdapter, adminToken: string, encryptor?: ISecretEncryptor): Array<[string, string, Middleware]>;
+
 declare function listConfigEntries(environment: string | null, store: IStoreAdapter): Promise<IConfigEntry[]>;
 declare function getConfigEntry(key: string, environment: string, store: IStoreAdapter): Promise<IConfigEntry | null>;
 declare function setConfigEntry(opts: {
@@ -20,7 +25,37 @@ declare function setConfigEntry(opts: {
     environment?: string;
     description?: string;
     active?: boolean;
+    ifVersion?: number;
+    actor?: string;
+}, store: IStoreAdapter): Promise<IConfigEntry>;
+declare function rollbackConfigEntry(opts: {
+    key: string;
+    environment?: string;
+    toVersion: number;
+    actor?: string;
 }, store: IStoreAdapter): Promise<IConfigEntry>;
+declare function listConfigRevisions(key: string, environment: string, store: IStoreAdapter): Promise<IConfigRevision[]>;
 declare function deleteConfigEntry(key: string, environment: string, store: IStoreAdapter): Promise<boolean>;
 
-export { IConfigEntry, IRemoteConfigOptions, RemoteConfigManager, RemoteConfigModule, deleteConfigEntry, getConfigEntry, listConfigEntries, setConfigEntry };
+declare function listSecrets(environment: string | null, store: IStoreAdapter): Promise<ISecretEntry[]>;
+declare function getSecret(key: string, environment: string, store: IStoreAdapter): Promise<ISecretEntry | null>;
+declare function revealSecret(key: string, environment: string, store: IStoreAdapter, encryptor?: ISecretEncryptor): Promise<string | null>;
+declare function setSecret(opts: {
+    key: string;
+    value: string;
+    environment?: string;
+    description?: string;
+    active?: boolean;
+    ifVersion?: number;
+    actor?: string;
+}, store: IStoreAdapter, encryptor?: ISecretEncryptor): Promise<ISecretEntry>;
+declare function rollbackSecret(opts: {
+    key: string;
+    environment?: string;
+    toVersion: number;
+    actor?: string;
+}, store: IStoreAdapter): Promise<ISecretEntry>;
+declare function listSecretRevisions(key: string, environment: string, store: IStoreAdapter): Promise<ISecretRevision[]>;
+declare function deleteSecret(key: string, environment: string, store: IStoreAdapter): Promise<boolean>;
+
+export { ConfigModule, IConfigEntry, IConfigOptions, IConfigRevision, ISecretEncryptor, ISecretEntry, ISecretRevision, RemoteConfigManager, buildAdminRoutes, deleteConfigEntry, deleteSecret, getConfigEntry, getSecret, listConfigEntries, listConfigRevisions, listSecretRevisions, listSecrets, revealSecret, rollbackConfigEntry, rollbackSecret, setConfigEntry, setSecret };

package/dist/index.js

@@ -1,29 +1,54 @@
 // src/manager.ts
+import pg from "pg";
 var FONDERIE_CONFIG_KEY = "fonderie.config.snapshot";
+var NOTIFY_CHANNEL = "fonderie_config_changed";
 var RemoteConfigManager = class {
   constructor(store, options = {}) {
     this.store = store;
     this.ttl = options.ttl ?? 3e4;
     this.environment = options.environment ?? process.env["NODE_ENV"] ?? "development";
     this.table = options.table ?? "fonderie_config";
+    this.connectionUrl = options.connectionUrl;
   }
   store;
   snapshot = null;
   interval = null;
+  listenClient = null;
   environment;
   ttl;
   table;
+  connectionUrl;
   async boot() {
     await this.refresh();
     this.interval = setInterval(() => {
       this.refresh().catch((err) => console.error("[config] refresh error:", err));
     }, this.ttl);
+    if (this.connectionUrl) await this.startListening();
+  }
+  async startListening() {
+    try {
+      this.listenClient = new pg.Client(this.connectionUrl);
+      await this.listenClient.connect();
+      await this.listenClient.query(`LISTEN ${NOTIFY_CHANNEL}`);
+      this.listenClient.on("notification", () => {
+        this.refresh().catch((err) => console.error("[config] refresh error:", err));
+      });
+      this.listenClient.on(
+        "error",
+        (err) => console.error("[config] listen client error:", err.message)
+      );
+    } catch (err) {
+      console.error("[config] failed to start LISTEN, falling back to poll:", err);
+      this.listenClient = null;
+    }
   }
   stop() {
     if (this.interval) {
       clearInterval(this.interval);
       this.interval = null;
     }
+    void this.listenClient?.end();
+    this.listenClient = null;
   }
   // Get a single value with a typed fallback
   get(key, fallback) {
@@ -97,29 +122,71 @@ function getConfig(ctx, key, fallback = null) {
   return manager.get(key, fallback);
 }
 
-// src/module.ts
-var RemoteConfigModule = class {
-  name = "@fonderie/config";
-  manager;
-  constructor(store, options = {}) {
-    this.manager = new RemoteConfigManager(store, options);
-  }
-  async install(app) {
-    await this.manager.boot();
-    app.use(configContextMiddleware(this.manager));
-  }
+// src/admin.ts
+import { setApiResponse, HTTP } from "@fonderie/core";
+
+// src/crypto.ts
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+var noopEncryptor = {
+  encrypt: (plain) => plain,
+  decrypt: (cipher) => cipher
 };
+function createAesGcmEncryptor(keyHex) {
+  const key = Buffer.from(keyHex, "hex");
+  if (key.length !== 32) {
+    throw new Error("[config] secret encryptor key must be 32 bytes (64 hex chars)");
+  }
+  return {
+    encrypt(plain) {
+      const iv = randomBytes(12);
+      const cipher = createCipheriv("aes-256-gcm", key, iv);
+      const enc = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+      const tag = cipher.getAuthTag();
+      return `${iv.toString("hex")}:${tag.toString("hex")}:${enc.toString("hex")}`;
+    },
+    decrypt(cipher) {
+      const [ivHex, tagHex, dataHex] = cipher.split(":");
+      if (!ivHex || !tagHex || !dataHex) {
+        throw new Error("[config] malformed secret ciphertext");
+      }
+      const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(ivHex, "hex"));
+      decipher.setAuthTag(Buffer.from(tagHex, "hex"));
+      return Buffer.concat([
+        decipher.update(Buffer.from(dataHex, "hex")),
+        decipher.final()
+      ]).toString("utf8");
+    }
+  };
+}
+
+// src/services/versioned.ts
+import {
+  versionedWrite,
+  versionedRollback,
+  VersionConflictError,
+  VersionConflictError as VersionConflictError2
+} from "@fonderie/store";
 
 // src/services/config.ts
-var SELECT_ENTRY = `
-	SELECT
-		key,
-		value,
-		environment,
-		description,
-		active,
-		updated_at AS "updatedAt"
-	FROM fonderie_config`;
+var ENTRY_COLS = `
+	key,
+	value,
+	environment,
+	description,
+	active,
+	version,
+	updated_by AS "updatedBy",
+	updated_at AS "updatedAt"`;
+var SELECT_ENTRY = `SELECT ${ENTRY_COLS} FROM fonderie_config`;
+var CONFIG_TABLE = {
+  table: "fonderie_config",
+  revisions: "fonderie_config_revisions",
+  channel: "fonderie_config_changed",
+  keyColumns: ["key", "environment"],
+  contentColumns: ["value"],
+  metaColumns: ["description", "active"],
+  returning: ENTRY_COLS
+};
 async function listConfigEntries(environment, store) {
   return environment ? store.query(
     `${SELECT_ENTRY} WHERE (environment = $1 OR environment = 'all') AND active = true ORDER BY key`,
@@ -134,24 +201,33 @@ async function getConfigEntry(key, environment, store) {
   return row ?? null;
 }
 async function setConfigEntry(opts, store) {
-  const env = opts.environment ?? "all";
-  const raw = typeof opts.value === "string" ? opts.value : JSON.stringify(opts.value);
-  const active = opts.active ?? true;
-  const [row] = await store.query(
-    `INSERT INTO fonderie_config (key, value, environment, description, active)
-		VALUES ($1, $2, $3, $4, $5)
-		ON CONFLICT (key, environment) DO UPDATE SET
-			value       = $2,
-			description = COALESCE($4, fonderie_config.description),
-			active      = $5,
-			updated_at  = now()
-		RETURNING
-			key, value, environment, description, active,
-			updated_at AS "updatedAt"`,
-    [opts.key, raw, env, opts.description ?? null, active]
+  const rawValue = typeof opts.value === "string" ? opts.value : JSON.stringify(opts.value);
+  const data = { value: rawValue, active: opts.active ?? true };
+  if (opts.description !== void 0) data["description"] = opts.description;
+  return versionedWrite(CONFIG_TABLE, store, {
+    key: opts.key,
+    scope: opts.environment ?? "all",
+    data,
+    ...opts.ifVersion !== void 0 ? { ifVersion: opts.ifVersion } : {},
+    actor: opts.actor ?? null
+  });
+}
+async function rollbackConfigEntry(opts, store) {
+  return versionedRollback(CONFIG_TABLE, store, {
+    key: opts.key,
+    scope: opts.environment ?? "all",
+    toVersion: opts.toVersion,
+    actor: opts.actor ?? null
+  });
+}
+async function listConfigRevisions(key, environment, store) {
+  return store.query(
+    `SELECT key, environment, value, version, actor, created_at AS "createdAt"
+		 FROM fonderie_config_revisions
+		 WHERE key = $1 AND environment = $2
+		 ORDER BY version DESC`,
+    [key, environment]
   );
-  if (!row) throw new Error("Failed to upsert config entry");
-  return row;
 }
 async function deleteConfigEntry(key, environment, store) {
   const rows = await store.query(
@@ -160,15 +236,292 @@ async function deleteConfigEntry(key, environment, store) {
   );
   return rows.length > 0;
 }
+
+// src/services/secrets.ts
+var META_COLS = `
+	key,
+	environment,
+	description,
+	active,
+	version,
+	updated_by AS "updatedBy",
+	updated_at AS "updatedAt"`;
+var SECRET_TABLE = {
+  table: "fonderie_secrets",
+  revisions: "fonderie_secret_revisions",
+  channel: "fonderie_secrets_changed",
+  keyColumns: ["key", "environment"],
+  contentColumns: ["value"],
+  metaColumns: ["description", "active"],
+  returning: META_COLS
+  // masked — no value
+};
+async function listSecrets(environment, store) {
+  return environment ? store.query(
+    `SELECT ${META_COLS} FROM fonderie_secrets
+				 WHERE (environment = $1 OR environment = 'all') AND active = true ORDER BY key`,
+    [environment]
+  ) : store.query(
+    `SELECT ${META_COLS} FROM fonderie_secrets ORDER BY environment, key`
+  );
+}
+async function getSecret(key, environment, store) {
+  const [row] = await store.query(
+    `SELECT ${META_COLS} FROM fonderie_secrets WHERE key = $1 AND environment = $2`,
+    [key, environment]
+  );
+  return row ?? null;
+}
+async function revealSecret(key, environment, store, encryptor = noopEncryptor) {
+  const [row] = await store.query(
+    `SELECT value FROM fonderie_secrets WHERE key = $1 AND environment = $2`,
+    [key, environment]
+  );
+  return row ? encryptor.decrypt(row.value) : null;
+}
+async function setSecret(opts, store, encryptor = noopEncryptor) {
+  const data = {
+    value: encryptor.encrypt(opts.value),
+    active: opts.active ?? true
+  };
+  if (opts.description !== void 0) data["description"] = opts.description;
+  return versionedWrite(SECRET_TABLE, store, {
+    key: opts.key,
+    scope: opts.environment ?? "all",
+    data,
+    ...opts.ifVersion !== void 0 ? { ifVersion: opts.ifVersion } : {},
+    actor: opts.actor ?? null
+  });
+}
+async function rollbackSecret(opts, store) {
+  return versionedRollback(SECRET_TABLE, store, {
+    key: opts.key,
+    scope: opts.environment ?? "all",
+    toVersion: opts.toVersion,
+    actor: opts.actor ?? null
+  });
+}
+async function listSecretRevisions(key, environment, store) {
+  return store.query(
+    `SELECT key, environment, version, actor, created_at AS "createdAt"
+		 FROM fonderie_secret_revisions
+		 WHERE key = $1 AND environment = $2
+		 ORDER BY version DESC`,
+    [key, environment]
+  );
+}
+async function deleteSecret(key, environment, store) {
+  const rows = await store.query(
+    `DELETE FROM fonderie_secrets WHERE key = $1 AND environment = $2 RETURNING key`,
+    [key, environment]
+  );
+  return rows.length > 0;
+}
+
+// src/admin.ts
+function checkAdmin(ctx, adminToken) {
+  const header = ctx.request.headers.get("authorization") ?? "";
+  const token = header.startsWith("Bearer ") ? header.slice(7) : "";
+  if (!token || token !== adminToken) {
+    return setApiResponse(HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Missing or invalid admin token");
+  }
+  return null;
+}
+function actorOf(ctx) {
+  return ctx.request.headers.get("x-actor") || "admin-token";
+}
+function envOf(ctx) {
+  return new URL(ctx.request.url).searchParams.get("environment") ?? void 0;
+}
+function keyOf(ctx) {
+  return ctx.meta.params?.["key"] ?? "";
+}
+function body(ctx) {
+  return ctx.meta["body"] ?? {};
+}
+function writeOpts(ctx, b) {
+  const opts = {
+    actor: actorOf(ctx)
+  };
+  const env = b["environment"] ?? envOf(ctx);
+  if (env !== void 0) opts.environment = env;
+  if (typeof b["description"] === "string") opts.description = b["description"];
+  if (typeof b["ifVersion"] === "number") opts.ifVersion = b["ifVersion"];
+  return opts;
+}
+function rollbackOpts(ctx, b, toVersion) {
+  const opts = {
+    key: keyOf(ctx),
+    toVersion,
+    actor: actorOf(ctx)
+  };
+  const env = b["environment"] ?? envOf(ctx);
+  if (env !== void 0) opts.environment = env;
+  return opts;
+}
+function guarded(adminToken, handler) {
+  return async (ctx, next) => {
+    const denied = checkAdmin(ctx, adminToken);
+    return denied ?? handler(ctx, next);
+  };
+}
+function buildAdminRoutes(store, adminToken, encryptor = noopEncryptor) {
+  const g = (h) => guarded(adminToken, h);
+  return [
+    // ── config ──────────────────────────────────────────────────
+    ["GET", "/admin/config", g(async (ctx) => {
+      const rows = await listConfigEntries(envOf(ctx) ?? null, store);
+      return setApiResponse(HTTP.OK, "CONFIG_LISTED", "Config entries", rows);
+    })],
+    ["GET", "/admin/config/:key", g(async (ctx) => {
+      const row = await getConfigEntry(keyOf(ctx), envOf(ctx) ?? "all", store);
+      return row ? setApiResponse(HTTP.OK, "CONFIG_ENTRY", "Config entry", row) : setApiResponse(HTTP.NOT_FOUND, "NOT_FOUND", "No such config entry");
+    })],
+    ["PUT", "/admin/config/:key", g(async (ctx) => {
+      const b = body(ctx);
+      if (!("value" in b)) {
+        return setApiResponse(HTTP.UNPROCESSABLE, "INVALID", "body.value is required");
+      }
+      try {
+        const row = await setConfigEntry(
+          { key: keyOf(ctx), value: b["value"], ...writeOpts(ctx, b) },
+          store
+        );
+        return setApiResponse(HTTP.OK, "CONFIG_SET", "Config entry saved", row);
+      } catch (err) {
+        return conflictOr(err);
+      }
+    })],
+    ["DELETE", "/admin/config/:key", g(async (ctx) => {
+      const ok = await deleteConfigEntry(keyOf(ctx), envOf(ctx) ?? "all", store);
+      return setApiResponse(ok ? HTTP.OK : HTTP.NOT_FOUND, ok ? "DELETED" : "NOT_FOUND", ok ? "Deleted" : "No such config entry");
+    })],
+    ["GET", "/admin/config/:key/revisions", g(async (ctx) => {
+      const revs = await listConfigRevisions(keyOf(ctx), envOf(ctx) ?? "all", store);
+      return setApiResponse(HTTP.OK, "REVISIONS", "Config revisions", revs);
+    })],
+    ["POST", "/admin/config/:key/rollback", g(async (ctx) => {
+      const b = body(ctx);
+      const toVersion = Number(b["toVersion"]);
+      if (!Number.isInteger(toVersion)) {
+        return setApiResponse(HTTP.UNPROCESSABLE, "INVALID", "body.toVersion (int) is required");
+      }
+      const row = await rollbackConfigEntry(
+        rollbackOpts(ctx, b, toVersion),
+        store
+      );
+      return setApiResponse(HTTP.OK, "ROLLED_BACK", `Rolled back to v${toVersion}`, row);
+    })],
+    // ── secrets (masked) ────────────────────────────────────────
+    ["GET", "/admin/secrets", g(async (ctx) => {
+      const rows = await listSecrets(envOf(ctx) ?? null, store);
+      return setApiResponse(HTTP.OK, "SECRETS_LISTED", "Secrets (masked)", rows);
+    })],
+    ["GET", "/admin/secrets/:key", g(async (ctx) => {
+      const row = await getSecret(keyOf(ctx), envOf(ctx) ?? "all", store);
+      return row ? setApiResponse(HTTP.OK, "SECRET", "Secret (masked)", row) : setApiResponse(HTTP.NOT_FOUND, "NOT_FOUND", "No such secret");
+    })],
+    ["PUT", "/admin/secrets/:key", g(async (ctx) => {
+      const b = body(ctx);
+      if (typeof b["value"] !== "string") {
+        return setApiResponse(HTTP.UNPROCESSABLE, "INVALID", "body.value (string) is required");
+      }
+      try {
+        const row = await setSecret(
+          { key: keyOf(ctx), value: b["value"], ...writeOpts(ctx, b) },
+          store,
+          encryptor
+        );
+        return setApiResponse(HTTP.OK, "SECRET_SET", "Secret saved (masked)", row);
+      } catch (err) {
+        return conflictOr(err);
+      }
+    })],
+    ["DELETE", "/admin/secrets/:key", g(async (ctx) => {
+      const ok = await deleteSecret(keyOf(ctx), envOf(ctx) ?? "all", store);
+      return setApiResponse(ok ? HTTP.OK : HTTP.NOT_FOUND, ok ? "DELETED" : "NOT_FOUND", ok ? "Deleted" : "No such secret");
+    })],
+    ["GET", "/admin/secrets/:key/revisions", g(async (ctx) => {
+      const revs = await listSecretRevisions(keyOf(ctx), envOf(ctx) ?? "all", store);
+      return setApiResponse(HTTP.OK, "REVISIONS", "Secret revisions", revs);
+    })],
+    ["POST", "/admin/secrets/:key/rollback", g(async (ctx) => {
+      const b = body(ctx);
+      const toVersion = Number(b["toVersion"]);
+      if (!Number.isInteger(toVersion)) {
+        return setApiResponse(HTTP.UNPROCESSABLE, "INVALID", "body.toVersion (int) is required");
+      }
+      const row = await rollbackSecret(
+        rollbackOpts(ctx, b, toVersion),
+        store
+      );
+      return setApiResponse(HTTP.OK, "ROLLED_BACK", `Rolled back to v${toVersion}`, row);
+    })],
+    // The one plaintext path — behind the same token; POST so the value never
+    // lands in a URL/log. Returns the decrypted value.
+    ["POST", "/admin/secrets/:key/reveal", g(async (ctx) => {
+      const value = await revealSecret(keyOf(ctx), envOf(ctx) ?? "all", store, encryptor);
+      return value === null ? setApiResponse(HTTP.NOT_FOUND, "NOT_FOUND", "No such secret") : setApiResponse(HTTP.OK, "SECRET_REVEALED", "Decrypted secret value", { value });
+    })]
+  ];
+}
+function conflictOr(err) {
+  if (err instanceof VersionConflictError2) {
+    return setApiResponse(HTTP.CONFLICT, "VERSION_CONFLICT", err.message, {
+      currentVersion: err.currentVersion
+    });
+  }
+  throw err;
+}
+
+// src/module.ts
+var ConfigModule = class {
+  constructor(store, options = {}) {
+    this.store = store;
+    this.options = options;
+    this.manager = new RemoteConfigManager(store, options);
+  }
+  store;
+  options;
+  name = "@fonderie/config";
+  manager;
+  async install(app) {
+    await this.manager.boot();
+    app.use(configContextMiddleware(this.manager));
+    if (this.options.adminToken) {
+      const routes = buildAdminRoutes(
+        this.store,
+        this.options.adminToken,
+        this.options.secretEncryptor ?? noopEncryptor
+      );
+      for (const [method, path, handler] of routes) {
+        app.addRoute(method, path, handler);
+      }
+    }
+  }
+};
 export {
   CONFIG_MANAGER_KEY,
+  VersionConflictError2 as ConfigConflictError,
+  ConfigModule,
   RemoteConfigManager,
-  RemoteConfigModule,
+  buildAdminRoutes,
   configContextMiddleware,
+  createAesGcmEncryptor,
   deleteConfigEntry,
+  deleteSecret,
   getConfig,
   getConfigEntry,
+  getSecret,
   listConfigEntries,
-  setConfigEntry
+  listConfigRevisions,
+  listSecretRevisions,
+  listSecrets,
+  noopEncryptor,
+  revealSecret,
+  rollbackConfigEntry,
+  rollbackSecret,
+  setConfigEntry,
+  setSecret
 };
 //# sourceMappingURL=index.js.map