@forgezero/vault 0.1.0

package/dist/frameworks.d.ts

@@ -0,0 +1,91 @@
+import { type SecretReader, type HydrateReport } from './env';
+import { type FzConfig } from './config';
+/** Tests, and a process that has genuinely rotated its own credential. */
+export declare const resetHydration: () => void;
+export interface SetupOptions {
+    /** Pre-loaded config. Omit to find `.fz/config.json` by walking up. */
+    config?: FzConfig;
+    vault: SecretReader;
+    cwd?: string;
+    readFile?: (path: string) => string | undefined;
+    env?: Record<string, string | undefined>;
+    /** Defaults to a single line naming counts and variable names, never values. */
+    log?: (line: string) => void;
+    onReport?: (report: HydrateReport) => void;
+}
+/**
+ * Hydrate exactly once per process, whoever asks first.
+ *
+ * The memo is on the PROMISE, not on a completed flag: two requests arriving
+ * during startup would otherwise both see "not done yet" and both fetch.
+ */
+export declare function setupEnv(options: SetupOptions): Promise<HydrateReport>;
+export interface SvelteKitHandleEvent {
+    event: unknown;
+    resolve: (event: unknown) => unknown;
+}
+/**
+ * A SvelteKit `handle` hook.
+ *
+ *     // src/hooks.server.ts
+ *     import { forgeZeroHandle } from '@forgezero/vault/frameworks';
+ *     import { createVault } from '@forgezero/vault';
+ *     import { readFileSync, existsSync } from 'node:fs';
+ *
+ *     export const handle = forgeZeroHandle({
+ *       vault: createVault(),
+ *       readFile: (path) => (existsSync(path) ? readFileSync(path, 'utf8') : undefined)
+ *     });
+ *
+ * Compose it with `sequence()` if you already have hooks — it must come FIRST,
+ * because everything after it expects the environment to be populated.
+ *
+ * Read secrets through `$env/dynamic/private`, never `$env/static/private`. The
+ * static form is substituted at build and the value ends up in a file on disk;
+ * the dynamic form reads `process.env` at request time, which is what this
+ * fills.
+ */
+export declare function forgeZeroHandle(options: SetupOptions): ({ event, resolve }: SvelteKitHandleEvent) => Promise<unknown>;
+/**
+ * A SvelteKit `init` hook, for versions that have one.
+ *
+ * Better than `handle` where available: it runs before the first request rather
+ * than during it, so a missing secret fails the server at start instead of
+ * turning the first visitor into the person who discovers it.
+ */
+export declare function forgeZeroInit(options: SetupOptions): () => Promise<void>;
+/**
+ * A Next.js instrumentation hook.
+ *
+ *     // instrumentation.ts
+ *     import { forgeZeroRegister } from '@forgezero/vault/frameworks';
+ *     import { createVault } from '@forgezero/vault';
+ *     import { readFileSync, existsSync } from 'node:fs';
+ *
+ *     export const register = forgeZeroRegister({
+ *       vault: createVault(),
+ *       readFile: (path) => (existsSync(path) ? readFileSync(path, 'utf8') : undefined)
+ *     });
+ *
+ * `instrumentation.ts` is the only place Next.js runs code once per server
+ * process before any request. Do NOT use the `env` block in `next.config.js`:
+ * it is substituted at build time and, for anything a client component touches,
+ * substituted into the CLIENT bundle.
+ *
+ * The guard below is why this is not just a re-export of `setupEnv`. Next runs
+ * `register` in the edge runtime too, where there is no filesystem and no vault
+ * socket — hydrating there would fail the whole build with an error pointing at
+ * the wrong thing entirely.
+ */
+export declare function forgeZeroRegister(options: SetupOptions): () => Promise<void>;
+/**
+ * For a plain Bun or Node process, before anything else imports.
+ *
+ *     await bootstrapEnv({ vault: createVault(), readFile });
+ *     const { start } = await import('./server');
+ *
+ * The dynamic import is the point: a top-level `import './server'` is hoisted
+ * above this call, so the server module would read `process.env` before it was
+ * filled. That ordering trap is subtle enough to be worth the example.
+ */
+export declare function bootstrapEnv(options: SetupOptions): Promise<HydrateReport>;

package/dist/frameworks.js

@@ -0,0 +1,240 @@
+// src/config.ts
+class ConfigError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "ConfigError";
+  }
+}
+var CONFIG_PATHS = [".fz/config.json", "fz.config.json"];
+var FORBIDDEN_KEYS = ["token", "apikey", "api_key", "secret", "password", "credential", "key"];
+function assertNoSecrets(raw, path = "") {
+  for (const [name, value] of Object.entries(raw)) {
+    const lowered = name.toLowerCase();
+    if (name !== "secrets" && FORBIDDEN_KEYS.some((word) => lowered.includes(word))) {
+      throw new ConfigError("CONFIG_HAS_SECRET", `"${path}${name}" looks like a credential. This file is committed — the credential comes from the agent socket or FORGEZERO_API_KEY, never from here.`);
+    }
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      assertNoSecrets(value, `${path}${name}.`);
+    }
+  }
+}
+function parseConfig(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (cause) {
+    throw new ConfigError("CONFIG_INVALID", `Not valid JSON: ${cause instanceof Error ? cause.message : "parse failed"}`);
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new ConfigError("CONFIG_INVALID", "The config must be a JSON object.");
+  }
+  const config = raw;
+  assertNoSecrets(config);
+  for (const field of ["project", "environment"]) {
+    if (typeof config[field] !== "string" || config[field].length === 0) {
+      throw new ConfigError("CONFIG_INVALID", `"${field}" is required and must be a non-empty string.`);
+    }
+  }
+  if (!Array.isArray(config.secrets)) {
+    throw new ConfigError("CONFIG_INVALID", '"secrets" is required. Naming what this service needs is the point — a process that pulls everything it can reach holds credentials it never uses.');
+  }
+  for (const entry of config.secrets) {
+    const key = typeof entry === "string" ? entry : entry?.entry;
+    if (typeof key !== "string" || key.length === 0) {
+      throw new ConfigError("CONFIG_INVALID", "Every secret must be a name, or an object with `entry`.");
+    }
+  }
+  return config;
+}
+function resolveConfig(config, environment) {
+  const target = environment ?? config.environment;
+  const overrides = config.environments?.[target];
+  if (environment && config.environments && !overrides) {
+    const known = Object.keys(config.environments).join(", ");
+    throw new ConfigError("UNKNOWN_ENVIRONMENT", `"${target}" is not declared in this config. Known environments: ${known || "none"}.`);
+  }
+  const { environments: _dropped, ...base } = config;
+  return { ...base, ...overrides, environment: target };
+}
+function bindingsOf(config) {
+  const prefix = config.prefix ?? "";
+  return config.secrets.map((entry) => {
+    const binding = typeof entry === "string" ? { entry } : entry;
+    return {
+      entry: binding.entry,
+      as: `${prefix}${binding.as ?? binding.entry}`,
+      required: binding.required ?? true
+    };
+  });
+}
+function loadConfig(options = {}) {
+  const read = options.readFile;
+  if (!read) {
+    throw new ConfigError("CONFIG_NOT_FOUND", "loadConfig needs a readFile implementation.");
+  }
+  let directory = options.cwd ?? ".";
+  const seen = [];
+  for (let depth = 0;depth < 32; depth += 1) {
+    for (const candidate of CONFIG_PATHS) {
+      const path = `${directory}/${candidate}`.replace(/\/+/g, "/");
+      seen.push(path);
+      const text = read(path);
+      if (text !== undefined) {
+        const parsed = parseConfig(text);
+        const environment = options.env?.FORGEZERO_ENVIRONMENT;
+        return { config: resolveConfig(parsed, environment), path };
+      }
+    }
+    const parent = directory.replace(/\/[^/]+\/?$/, "");
+    if (parent === directory || parent === "")
+      break;
+    directory = parent;
+  }
+  throw new ConfigError("CONFIG_NOT_FOUND", `No .fz/config.json found from ${options.cwd ?? "."} upwards. Run \`fz init\` to create one.`);
+}
+function exampleConfig(args) {
+  return `${JSON.stringify({
+    project: args.project,
+    environment: "development",
+    framework: args.framework ?? "node",
+    secrets: ["DATABASE_URL", { entry: "STRIPE_SECRET", as: "STRIPE_SECRET_KEY" }],
+    environments: {
+      development: {},
+      staging: {},
+      production: { override: true }
+    }
+  }, null, 2)}
+`;
+}
+
+// src/env.ts
+class EnvError extends Error {
+  code;
+  missing;
+  constructor(code, message, missing) {
+    super(message);
+    this.code = code;
+    this.missing = missing;
+    this.name = "EnvError";
+  }
+}
+function isBuildTime(env = {}) {
+  return Boolean(env.SVELTEKIT_BUILD || env.NEXT_PHASE?.includes("build") || env.VITE_BUILD || env.npm_lifecycle_event === "build" || env.FORGEZERO_BUILD === "1");
+}
+async function hydrateEnv(options) {
+  const env = options.env ?? globalThis.process?.env ?? {};
+  if (!options.allowDuringBuild && isBuildTime(env)) {
+    throw new EnvError("BUILD_TIME_REFUSED", "Refusing to load secrets during a build. A bundler that inlines process.env writes the value into a JavaScript file that ships to a browser. Load them at RUNTIME — a SvelteKit `handle` hook, or Next.js `instrumentation.ts`.");
+  }
+  const bindings = bindingsOf(options.config);
+  const results = await Promise.all(bindings.map(async (binding) => {
+    try {
+      const value = await options.vault.get(binding.entry, {
+        environment: options.config.environment
+      });
+      return { binding, value };
+    } catch (cause) {
+      throw new EnvError("FETCH_FAILED", `Could not read "${binding.entry}": ${cause instanceof Error ? cause.message : "unknown error"}`);
+    }
+  }));
+  const missing = results.filter((result) => result.value === undefined && result.binding.required).map((result) => result.binding.entry);
+  if (missing.length > 0) {
+    throw new EnvError("MISSING_SECRET", `Missing in ${options.config.project}/${options.config.environment}: ${missing.join(", ")}. Add them, or mark them \`"required": false\` if the service can genuinely start without them.`, missing);
+  }
+  const loaded = [];
+  const shadowed = [];
+  const skipped = [];
+  for (const { binding, value } of results) {
+    if (value === undefined) {
+      skipped.push(binding.entry);
+      continue;
+    }
+    if (env[binding.as] !== undefined && !options.config.override) {
+      shadowed.push(binding.as);
+      continue;
+    }
+    env[binding.as] = value;
+    loaded.push(binding.as);
+  }
+  const report = {
+    loaded,
+    shadowed,
+    skipped,
+    environment: options.config.environment,
+    project: options.config.project
+  };
+  options.onReport?.(report);
+  return report;
+}
+function describeReport(report) {
+  const parts = [`[forgezero] ${report.loaded.length} secret(s) → env`];
+  parts.push(`${report.project}/${report.environment}`);
+  if (report.shadowed.length > 0) {
+    parts.push(`SHADOWED by existing env: ${report.shadowed.join(", ")}`);
+  }
+  if (report.skipped.length > 0) {
+    parts.push(`absent (optional): ${report.skipped.join(", ")}`);
+  }
+  return parts.join(" · ");
+}
+function clearEnv(report, env = globalThis.process?.env ?? {}) {
+  for (const name of report.loaded)
+    delete env[name];
+}
+
+// src/frameworks.ts
+var pending = null;
+var resetHydration = () => {
+  pending = null;
+};
+function setupEnv(options) {
+  if (pending)
+    return pending;
+  const env = options.env ?? globalThis.process?.env ?? {};
+  const log = options.log ?? ((line) => console.info(line));
+  pending = (async () => {
+    const config = options.config ?? loadConfig({ cwd: options.cwd, readFile: options.readFile, env }).config;
+    const report = await hydrateEnv({ config, vault: options.vault, env, onReport: options.onReport });
+    log(describeReport(report));
+    return report;
+  })();
+  pending.catch(() => {
+    pending = null;
+  });
+  return pending;
+}
+function forgeZeroHandle(options) {
+  return async ({ event, resolve }) => {
+    await setupEnv(options);
+    return resolve(event);
+  };
+}
+function forgeZeroInit(options) {
+  return async () => {
+    await setupEnv(options);
+  };
+}
+function forgeZeroRegister(options) {
+  return async () => {
+    const env = options.env ?? globalThis.process?.env ?? {};
+    if (env.NEXT_RUNTIME === "edge") {
+      return;
+    }
+    if (isBuildTime(env))
+      return;
+    await setupEnv({ ...options, env });
+  };
+}
+async function bootstrapEnv(options) {
+  return setupEnv(options);
+}
+export {
+  setupEnv,
+  resetHydration,
+  forgeZeroRegister,
+  forgeZeroInit,
+  forgeZeroHandle,
+  bootstrapEnv
+};

package/dist/index.d.ts

@@ -0,0 +1,203 @@
+/**
+ * @forgezero/vault — the client.
+ *
+ * Zero runtime dependencies. Credential discovery, versioned reads and writes,
+ * rotation via `watch`.
+ *
+ * ## Discovery, and why it matters more than it looks
+ *
+ *   /run/forgezero.sock exists   → MANAGED: the agent signs, the app holds
+ *                                   nothing at all
+ *   FORGEZERO_API_KEY present    → EXTERNAL: derive a keypair locally, sign here
+ *   neither                      → throw, naming BOTH so the fix is obvious
+ *
+ * Moving an application onto managed compute means DELETING an environment
+ * variable. There is no code path that differs — the same file runs in both
+ * places, and the stronger posture is the one requiring less configuration
+ * rather than more.
+ *
+ * ## Node assignment
+ *
+ * A directory answers which node to use; the client then talks to it directly
+ * for a short window. Reassignment includes 530 — a node whose TUNNEL is down
+ * returns Cloudflare 1033, not an application status, so a retry list of only
+ * 5xx misses it entirely.
+ *
+ * This package must not import `@forgezero/providers` either. `vaultCredentials`
+ * returns the shape structurally, because a dependency edge in either direction
+ * would make each package need the other.
+ */
+export declare class VaultError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export type CredentialMode = 'managed' | 'external';
+export interface Credential {
+    mode: CredentialMode;
+    /** MANAGED only — the agent socket that signs on our behalf. */
+    socketPath?: string;
+    /** EXTERNAL only — a seed, never transmitted; a keypair derives from it. */
+    apiKey?: string;
+}
+export interface DiscoveryEnvironment {
+    env?: Record<string, string | undefined>;
+    socketPath?: string;
+    socketExists?: (path: string) => boolean;
+}
+export declare const DEFAULT_SOCKET = "/run/forgezero.sock";
+/**
+ * Find a credential, preferring the stronger posture.
+ *
+ * The agent socket wins when both are present. On managed compute an API key in
+ * the environment is a leftover, and honouring it would silently downgrade a
+ * machine that holds nothing into one holding a signing seed.
+ */
+export declare function discover(environment?: DiscoveryEnvironment): Credential;
+/** Signs a request. Supplied by the host, so this package holds no crypto. */
+export interface Signer {
+    readonly keyId: string;
+    sign(payload: string): Promise<string>;
+}
+export interface Assignment {
+    node: string;
+    ttl: number;
+    expiresAt: number;
+}
+/**
+ * Statuses meaning "ask for a different node", not "this failed".
+ *
+ * 530 is the one people miss: a node whose tunnel is down never reaches the
+ * application, so Cloudflare answers 1033 with 530.
+ */
+export declare const REASSIGN_ON: Set<number>;
+export interface VaultOptions {
+    /** Directory endpoint. Unauthenticated — a node hostname is not a secret. */
+    assignUrl?: string;
+    project?: string;
+    environment?: string;
+    fetch?: typeof globalThis.fetch;
+    signer?: Signer;
+    credential?: Credential;
+    discovery?: DiscoveryEnvironment;
+    now?: () => number;
+}
+export interface EntryMeta {
+    name: string;
+    version: number;
+    updatedAtTs: number;
+}
+export interface Change {
+    name: string;
+    version: number;
+}
+export declare const DEFAULT_ASSIGN_URL = "https://api.forgezero.net/v1/assign";
+export declare class ForgeZero {
+    readonly credential: Credential;
+    private assignment;
+    private readonly assignUrl;
+    private readonly doFetch;
+    private readonly now;
+    private readonly signer?;
+    private readonly project;
+    private readonly environment;
+    constructor(options?: VaultOptions);
+    /** The node to talk to, asking the directory only when the lease expired. */
+    node(): Promise<string>;
+    /** Drop the lease so the next call asks the directory again. */
+    reassign(): void;
+    private scope;
+    private request;
+    /** One value, current version unless asked otherwise. */
+    get(name: string, options?: {
+        version?: number;
+    }): Promise<string>;
+    /**
+     * Every value in scope. MANAGED only.
+     *
+     * An API key holder gets `list` plus per-name reads instead, because one
+     * compromised key should not hand over an entire environment in a single
+     * call — and on managed compute the app holds no key to compromise.
+     */
+    getAll(): Promise<Record<string, string>>;
+    /**
+     * The PUBLIC half of a value ForgeZero derived from the realm master seed.
+     *
+     * There is no call that returns the private half, and that is the whole
+     * design rather than an omission. A tenant that can fetch a signing key holds
+     * the full risk of holding one: it lands in their backups, their logs, their
+     * heap dumps and their environment. Here they declare which chain they
+     * activated, the platform derives from the seed, and an ADDRESS is the only
+     * thing that crosses back.
+     *
+     * Deterministic, so losing the row loses the metadata and not the money —
+     * re-declaring the same chain and index derives the same address.
+     */
+    derived(name: string, field: string): Promise<{
+        address: string;
+        path: string;
+    }>;
+    /**
+     * Sign a digest with a derived key, without the key ever leaving.
+     *
+     * The tenant builds the unsigned transaction, hashes it, and sends the
+     * digest. What comes back is a signature. A compromised tenant process can
+     * ASK for signatures — which is bounded, logged and revocable — and cannot
+     * take the key, which would be none of those things.
+     *
+     * A digest rather than a transaction on purpose: the platform is not a
+     * transaction builder for every chain a tenant might use, and pretending
+     * otherwise would make ForgeZero the thing that has to understand every
+     * chain format before a tenant can support one.
+     */
+    sign(name: string, field: string, digest: string): Promise<{
+        signature: string;
+        recovery?: number;
+        path: string;
+    }>;
+    /** Schemas the platform holds, for a managed source. */
+    schemas(): Promise<readonly {
+        name: string;
+        version: number;
+    }[]>;
+    /** Names and metadata. Never values. */
+    list(): Promise<readonly EntryMeta[]>;
+    /** Write a new version. Nothing is overwritten; the previous stays readable. */
+    set(name: string, value: string): Promise<number>;
+    remove(name: string): Promise<void>;
+    /**
+     * Changes since a cursor.
+     *
+     * Polling rather than a socket: an edge runtime cannot hold one open, and a
+     * client that only works on a long-lived server is not the client this
+     * package promises. A gap answers `resync`, and the caller restarts from zero
+     * rather than silently missing a rotation.
+     */
+    watch(options?: {
+        intervalMs?: number;
+        signal?: AbortSignal;
+    }): AsyncGenerator<Change>;
+}
+/**
+ * Adapts a vault to the `CredentialSource` shape `@forgezero/providers` expects.
+ *
+ * Structural rather than imported: neither package may depend on the other, so
+ * the shape is duplicated. Two tiny interfaces beat a dependency cycle.
+ */
+/**
+ * The documented entry point.
+ *
+ * `new ForgeZero()` works and is what this wraps, but every guide, every doc
+ * page and every framework example says `createVault()` — and a quickstart that
+ * does not run is worse than none, because the reader concludes the package is
+ * broken rather than that the docs are.
+ *
+ * A factory is also the right shape for what this does: discovery may throw, so
+ * a caller reads `createVault()` as "give me one, working" rather than as a
+ * constructor that happens to do I/O-adjacent work.
+ */
+export declare const createVault: (options?: VaultOptions) => ForgeZero;
+export declare function vaultCredentials(vault: ForgeZero): {
+    readonly name: string;
+    get(reference: string, field: string): Promise<string>;
+};
+export declare const VERSION = "0.1.0";

package/dist/index.js

@@ -0,0 +1,160 @@
+// src/index.ts
+class VaultError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "VaultError";
+  }
+}
+var DEFAULT_SOCKET = "/run/forgezero.sock";
+function discover(environment = {}) {
+  const env = environment.env ?? {};
+  const socketPath = environment.socketPath ?? env.FORGEZERO_SOCKET ?? DEFAULT_SOCKET;
+  if (environment.socketExists?.(socketPath))
+    return { mode: "managed", socketPath };
+  const apiKey = env.FORGEZERO_API_KEY;
+  if (apiKey)
+    return { mode: "external", apiKey };
+  throw new VaultError("NO_CREDENTIAL", `No credential found. On managed compute the agent socket at ${socketPath} provides one; ` + "elsewhere set FORGEZERO_API_KEY.");
+}
+var REASSIGN_ON = new Set([410, 421, 502, 503, 504, 530]);
+var DEFAULT_ASSIGN_URL = "https://api.forgezero.net/v1/assign";
+
+class ForgeZero {
+  credential;
+  assignment;
+  assignUrl;
+  doFetch;
+  now;
+  signer;
+  project;
+  environment;
+  constructor(options = {}) {
+    this.credential = options.credential ?? discover(options.discovery);
+    this.assignUrl = options.assignUrl ?? DEFAULT_ASSIGN_URL;
+    this.doFetch = options.fetch ?? globalThis.fetch;
+    this.now = options.now ?? Date.now;
+    this.signer = options.signer;
+    this.project = options.project ?? "default";
+    this.environment = options.environment ?? "production";
+  }
+  async node() {
+    const now = this.now();
+    if (this.assignment && this.assignment.expiresAt > now)
+      return this.assignment.node;
+    const response = await this.doFetch(this.assignUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ keyId: this.signer?.keyId })
+    });
+    if (!response.ok)
+      throw new VaultError("NO_NODE", "No vault node is available right now.");
+    const payload = await response.json();
+    const ttl = payload.ttl ?? 60;
+    this.assignment = { node: payload.node, ttl, expiresAt: now + ttl * 1000 };
+    return payload.node;
+  }
+  reassign() {
+    this.assignment = undefined;
+  }
+  scope() {
+    return `${encodeURIComponent(this.project)}/${encodeURIComponent(this.environment)}`;
+  }
+  async request(path, init = {}, retried = false) {
+    const node = await this.node();
+    const body = typeof init.body === "string" ? init.body : "";
+    const headers = {
+      "content-type": "application/json",
+      ...init.headers
+    };
+    if (this.signer) {
+      headers["x-fz-key"] = this.signer.keyId;
+      headers["x-fz-signature"] = await this.signer.sign(`${init.method ?? "GET"}:${path}:${body}`);
+    }
+    const response = await this.doFetch(`https://${node}${path}`, { ...init, headers });
+    if (REASSIGN_ON.has(response.status) && !retried) {
+      this.reassign();
+      return this.request(path, init, true);
+    }
+    const payload = await response.json().catch(() => {
+      return;
+    });
+    if (!response.ok) {
+      throw new VaultError(payload?.error?.code ?? "REQUEST_FAILED", payload?.error?.message ?? `The vault refused with ${response.status}.`);
+    }
+    return payload;
+  }
+  async get(name, options = {}) {
+    const query = options.version ? `?version=${options.version}` : "";
+    const result = await this.request(`/v1/vault/${this.scope()}/entries/${encodeURIComponent(name)}${query}`);
+    return result.value;
+  }
+  async getAll() {
+    if (this.credential.mode !== "managed") {
+      throw new VaultError("MANAGED_ONLY", "getAll is available on managed compute only. Read entries by name with an API key.");
+    }
+    const result = await this.request(`/v1/vault/${this.scope()}/entries`);
+    return result.values;
+  }
+  async derived(name, field) {
+    return this.request(`/v1/entries/${encodeURIComponent(name)}/derived/${encodeURIComponent(field)}${this.scope()}`);
+  }
+  async sign(name, field, digest) {
+    return this.request(`/v1/entries/${encodeURIComponent(name)}/sign/${encodeURIComponent(field)}${this.scope()}`, { method: "POST", body: JSON.stringify({ digest }) });
+  }
+  async schemas() {
+    const payload = await this.request(`/v1/schemas${this.scope()}`);
+    return payload.schemas ?? [];
+  }
+  async list() {
+    const result = await this.request(`/v1/vault/${this.scope()}/list`);
+    return result.entries;
+  }
+  async set(name, value) {
+    const result = await this.request(`/v1/vault/${this.scope()}/entries`, {
+      method: "POST",
+      body: JSON.stringify({ name, value })
+    });
+    return result.version;
+  }
+  async remove(name) {
+    await this.request(`/v1/vault/${this.scope()}/entries/${encodeURIComponent(name)}`, {
+      method: "DELETE"
+    });
+  }
+  async* watch(options = {}) {
+    const interval = options.intervalMs ?? 15000;
+    let since = 0;
+    while (!options.signal?.aborted) {
+      const result = await this.request(`/v1/vault/${this.scope()}/changes?since=${since}`);
+      if (result.resync) {
+        since = 0;
+        continue;
+      }
+      for (const change of result.changed)
+        yield change;
+      since = result.version;
+      await new Promise((resolve) => setTimeout(resolve, interval));
+    }
+  }
+}
+var createVault = (options = {}) => new ForgeZero(options);
+function vaultCredentials(vault) {
+  return {
+    name: "vault",
+    get: (reference, field) => vault.get(`${reference}.${field}`)
+  };
+}
+var VERSION = "0.1.0";
+export {
+  vaultCredentials,
+  discover,
+  createVault,
+  VaultError,
+  VERSION,
+  REASSIGN_ON,
+  ForgeZero,
+  DEFAULT_SOCKET,
+  DEFAULT_ASSIGN_URL
+};