@forgezero/vault 0.1.1 → 0.1.2

package/dist/index.d.ts

@@ -16,12 +16,13 @@
  * places, and the stronger posture is the one requiring less configuration
  * rather than more.
  *
- * ## Node assignment
+ * ## Stable API origin
  *
- * A directory answers which node to use; the client then talks to it directly
- * for a short window. Reassignment includes 530 — a node whose TUNNEL is down
- * returns Cloudflare 1033, not an application status, so a retry list of only
- * 5xx misses it entirely.
+ * External clients always call one API origin. Node selection and failover are
+ * edge responsibilities; exposing node hostnames here would couple every SDK
+ * to platform topology and can route a tenant to a process that does not hold
+ * its realm seed. Managed applications continue to use the local agent socket
+ * and make no remote request at all.
  *
  * This package must not import `@forgezero/providers` either. `vaultCredentials`
  * returns the shape structurally, because a dependency edge in either direction
@@ -104,23 +105,9 @@ export type AgentResponse = {
     };
 };
 export type AgentTransport = (socketPath: string, request: AgentRequest) => Promise<AgentResponse>;
-export interface Assignment {
-    node: string;
-    ttl: number;
-    expiresAt: number;
-}
-/**
- * Statuses meaning "ask for a different node", not "this failed".
- *
- * 530 is the one people miss: a node whose tunnel is down never reaches the
- * application, so Cloudflare answers 1033 with 530.
- */
-export declare const REASSIGN_ON: Set<number>;
 export interface VaultOptions {
-    /** Directory endpoint. Unauthenticated — a node hostname is not a secret. */
-    assignUrl?: string;
-    /** Override only for a private ForgeZero installation with its own node domain. */
-    nodeAllowed?: (hostname: string) => boolean;
+    /** Stable public API origin. Node topology is never exposed to the client. */
+    apiUrl?: string;
     requestTimeoutMs?: number;
     project?: string;
     environment?: string;
@@ -129,7 +116,6 @@ export interface VaultOptions {
     agentTransport?: AgentTransport;
     credential?: Credential;
     discovery?: DiscoveryEnvironment;
-    now?: () => number;
 }
 export interface EntryMeta {
     name: string;
@@ -142,27 +128,18 @@ export interface Change {
     name: string;
     version: number;
 }
-export declare const DEFAULT_ASSIGN_URL = "https://assign.forgezero.net/v1/assign";
+export declare const DEFAULT_API_URL = "https://api.forgezero.net";
 export declare const DEFAULT_REQUEST_TIMEOUT_MS = 15000;
-/** A compromised directory must not turn a signed secret read into an open relay. */
-export declare const isForgeZeroNode: (hostname: string) => boolean;
 export declare class ForgeZero {
     readonly credential: Credential;
-    private assignment;
-    private readonly assignUrl;
+    private readonly apiUrl;
     private readonly doFetch;
-    private readonly now;
     private readonly signer?;
     private readonly agentTransport;
-    private readonly nodeAllowed;
     private readonly requestTimeoutMs;
     private readonly project;
     private readonly environment;
     constructor(options?: VaultOptions);
-    /** The node to talk to, asking the directory only when the lease expired. */
-    node(): Promise<string>;
-    /** Drop the lease so the next call asks the directory again. */
-    reassign(): void;
     private scope;
     private request;
     private managedRequest;
@@ -296,4 +273,4 @@ export declare function systemdCredentials(options?: SystemdCredentialOptions):
     readonly name: 'systemd';
     get(reference: string, field: string): Promise<string>;
 };
-export declare const VERSION = "0.1.1";
+export declare const VERSION = "0.1.2";

package/dist/index.js

@@ -110,32 +110,37 @@ var requestAgent = (socketPath, request) => new Promise((resolveRequest, reject)
   });
   socket.on("error", (cause) => reject(new VaultError("AGENT_UNAVAILABLE", cause.message)));
 });
-var REASSIGN_ON = new Set([410, 421, 502, 503, 504, 530]);
-var DEFAULT_ASSIGN_URL = "https://assign.forgezero.net/v1/assign";
+var DEFAULT_API_URL = "https://api.forgezero.net";
 var DEFAULT_REQUEST_TIMEOUT_MS = 15000;
-var isForgeZeroNode = (hostname) => /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+forgezero\.net$/.test(hostname);
+function apiOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new VaultError("API_URL_INVALID", "apiUrl must be an absolute HTTPS origin.");
+  }
+  const local = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
+  if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.search || url.hash || url.pathname !== "/" && url.pathname !== "")
+    throw new VaultError("API_URL_INVALID", "apiUrl must be an HTTPS origin without credentials, path, query or fragment.");
+  return url;
+}
 
 class ForgeZero {
   credential;
-  assignment;
-  assignUrl;
+  apiUrl;
   doFetch;
-  now;
   signer;
   agentTransport;
-  nodeAllowed;
   requestTimeoutMs;
   project;
   environment;
   constructor(options = {}) {
     const credential = options.credential ?? discover(options.discovery);
     this.credential = credential.mode === "managed" && !credential.socketPath ? { ...credential, socketPath: DEFAULT_SOCKET } : credential;
-    this.assignUrl = options.assignUrl ?? DEFAULT_ASSIGN_URL;
+    this.apiUrl = apiOrigin(options.apiUrl ?? DEFAULT_API_URL);
     this.doFetch = options.fetch ?? globalThis.fetch;
-    this.now = options.now ?? Date.now;
     this.signer = options.signer ?? (this.credential.mode === "external" ? signerFromApiKey(this.credential.apiKey) : undefined);
     this.agentTransport = options.agentTransport ?? requestAgent;
-    this.nodeAllowed = options.nodeAllowed ?? isForgeZeroNode;
     this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
     if (!Number.isFinite(this.requestTimeoutMs) || this.requestTimeoutMs < 100 || this.requestTimeoutMs > 120000) {
       throw new VaultError("INVALID_TIMEOUT", "requestTimeoutMs must be between 100 and 120000 milliseconds.");
@@ -143,45 +148,14 @@ class ForgeZero {
     this.project = options.project ?? "default";
     this.environment = options.environment ?? "production";
   }
-  async node() {
-    const now = this.now();
-    if (this.assignment && this.assignment.expiresAt > now)
-      return this.assignment.node;
-    const assignmentUrl = new URL(this.assignUrl);
-    if (this.signer?.keyId && !assignmentUrl.searchParams.has("client")) {
-      assignmentUrl.searchParams.set("client", this.signer.keyId);
-    }
-    const response = await this.doFetch(assignmentUrl, {
-      method: "GET",
-      headers: { accept: "application/json" },
-      signal: AbortSignal.timeout(this.requestTimeoutMs)
-    });
-    if (!response.ok)
-      throw new VaultError("NO_NODE", "No vault node is available right now.");
-    const payload = await response.json().catch(() => null);
-    const hostname = typeof payload?.node === "string" ? payload.node : payload?.node && typeof payload.node === "object" && ("hostname" in payload.node) ? payload.node.hostname : undefined;
-    if (typeof hostname !== "string" || !this.nodeAllowed(hostname)) {
-      throw new VaultError("UNTRUSTED_NODE", "The directory returned an untrusted vault node hostname.");
-    }
-    const ttl = payload?.ttl ?? 60;
-    if (typeof ttl !== "number" || !Number.isFinite(ttl) || ttl < 1 || ttl > 300) {
-      throw new VaultError("INVALID_ASSIGNMENT", "The directory returned an invalid vault-node lease.");
-    }
-    this.assignment = { node: hostname, ttl, expiresAt: now + ttl * 1000 };
-    return hostname;
-  }
-  reassign() {
-    this.assignment = undefined;
-  }
   scope() {
     return `${encodeURIComponent(this.project)}/${encodeURIComponent(this.environment)}`;
   }
-  async request(path, init = {}, retried = false) {
+  async request(path, init = {}) {
     if (this.credential.mode === "managed")
       return this.managedRequest(path, init);
-    const node = await this.node();
     const body = typeof init.body === "string" ? init.body : "";
-    const target = new URL(path, "https://vault.invalid");
+    const target = new URL(path, this.apiUrl);
     const headers = {
       "content-type": "application/json",
       ...init.headers
@@ -195,15 +169,11 @@ class ForgeZero {
         body
       });
     }
-    const response = await this.doFetch(`https://${node}${path}`, {
+    const response = await this.doFetch(target, {
       ...init,
       headers,
       signal: init.signal ?? AbortSignal.timeout(this.requestTimeoutMs)
     });
-    if (REASSIGN_ON.has(response.status) && !retried) {
-      this.reassign();
-      return this.request(path, init, true);
-    }
     const payload = await response.json().catch(() => {
       return;
     });
@@ -362,20 +332,18 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.1";
+var VERSION = "0.1.2";
 export {
   vaultCredentials,
   systemdCredentials,
   signerFromApiKey,
-  isForgeZeroNode,
   discover,
   directCredentials,
   createVault,
   VaultError,
   VERSION,
-  REASSIGN_ON,
   ForgeZero,
   DEFAULT_SOCKET,
   DEFAULT_REQUEST_TIMEOUT_MS,
-  DEFAULT_ASSIGN_URL
+  DEFAULT_API_URL
 };

package/dist/providers.js

@@ -110,32 +110,37 @@ var requestAgent = (socketPath, request) => new Promise((resolveRequest, reject)
   });
   socket.on("error", (cause) => reject(new VaultError("AGENT_UNAVAILABLE", cause.message)));
 });
-var REASSIGN_ON = new Set([410, 421, 502, 503, 504, 530]);
-var DEFAULT_ASSIGN_URL = "https://assign.forgezero.net/v1/assign";
+var DEFAULT_API_URL = "https://api.forgezero.net";
 var DEFAULT_REQUEST_TIMEOUT_MS = 15000;
-var isForgeZeroNode = (hostname) => /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+forgezero\.net$/.test(hostname);
+function apiOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new VaultError("API_URL_INVALID", "apiUrl must be an absolute HTTPS origin.");
+  }
+  const local = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
+  if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.search || url.hash || url.pathname !== "/" && url.pathname !== "")
+    throw new VaultError("API_URL_INVALID", "apiUrl must be an HTTPS origin without credentials, path, query or fragment.");
+  return url;
+}
 
 class ForgeZero {
   credential;
-  assignment;
-  assignUrl;
+  apiUrl;
   doFetch;
-  now;
   signer;
   agentTransport;
-  nodeAllowed;
   requestTimeoutMs;
   project;
   environment;
   constructor(options = {}) {
     const credential = options.credential ?? discover(options.discovery);
     this.credential = credential.mode === "managed" && !credential.socketPath ? { ...credential, socketPath: DEFAULT_SOCKET } : credential;
-    this.assignUrl = options.assignUrl ?? DEFAULT_ASSIGN_URL;
+    this.apiUrl = apiOrigin(options.apiUrl ?? DEFAULT_API_URL);
     this.doFetch = options.fetch ?? globalThis.fetch;
-    this.now = options.now ?? Date.now;
     this.signer = options.signer ?? (this.credential.mode === "external" ? signerFromApiKey(this.credential.apiKey) : undefined);
     this.agentTransport = options.agentTransport ?? requestAgent;
-    this.nodeAllowed = options.nodeAllowed ?? isForgeZeroNode;
     this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
     if (!Number.isFinite(this.requestTimeoutMs) || this.requestTimeoutMs < 100 || this.requestTimeoutMs > 120000) {
       throw new VaultError("INVALID_TIMEOUT", "requestTimeoutMs must be between 100 and 120000 milliseconds.");
@@ -143,45 +148,14 @@ class ForgeZero {
     this.project = options.project ?? "default";
     this.environment = options.environment ?? "production";
   }
-  async node() {
-    const now = this.now();
-    if (this.assignment && this.assignment.expiresAt > now)
-      return this.assignment.node;
-    const assignmentUrl = new URL(this.assignUrl);
-    if (this.signer?.keyId && !assignmentUrl.searchParams.has("client")) {
-      assignmentUrl.searchParams.set("client", this.signer.keyId);
-    }
-    const response = await this.doFetch(assignmentUrl, {
-      method: "GET",
-      headers: { accept: "application/json" },
-      signal: AbortSignal.timeout(this.requestTimeoutMs)
-    });
-    if (!response.ok)
-      throw new VaultError("NO_NODE", "No vault node is available right now.");
-    const payload = await response.json().catch(() => null);
-    const hostname = typeof payload?.node === "string" ? payload.node : payload?.node && typeof payload.node === "object" && ("hostname" in payload.node) ? payload.node.hostname : undefined;
-    if (typeof hostname !== "string" || !this.nodeAllowed(hostname)) {
-      throw new VaultError("UNTRUSTED_NODE", "The directory returned an untrusted vault node hostname.");
-    }
-    const ttl = payload?.ttl ?? 60;
-    if (typeof ttl !== "number" || !Number.isFinite(ttl) || ttl < 1 || ttl > 300) {
-      throw new VaultError("INVALID_ASSIGNMENT", "The directory returned an invalid vault-node lease.");
-    }
-    this.assignment = { node: hostname, ttl, expiresAt: now + ttl * 1000 };
-    return hostname;
-  }
-  reassign() {
-    this.assignment = undefined;
-  }
   scope() {
     return `${encodeURIComponent(this.project)}/${encodeURIComponent(this.environment)}`;
   }
-  async request(path, init = {}, retried = false) {
+  async request(path, init = {}) {
     if (this.credential.mode === "managed")
       return this.managedRequest(path, init);
-    const node = await this.node();
     const body = typeof init.body === "string" ? init.body : "";
-    const target = new URL(path, "https://vault.invalid");
+    const target = new URL(path, this.apiUrl);
     const headers = {
       "content-type": "application/json",
       ...init.headers
@@ -195,15 +169,11 @@ class ForgeZero {
         body
       });
     }
-    const response = await this.doFetch(`https://${node}${path}`, {
+    const response = await this.doFetch(target, {
       ...init,
       headers,
       signal: init.signal ?? AbortSignal.timeout(this.requestTimeoutMs)
     });
-    if (REASSIGN_ON.has(response.status) && !retried) {
-      this.reassign();
-      return this.request(path, init, true);
-    }
     const payload = await response.json().catch(() => {
       return;
     });
@@ -362,7 +332,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.1";
+var VERSION = "0.1.2";
 
 // src/providers.ts
 var MISSING = new Set(["ENTRY_NOT_FOUND", "VERSION_NOT_FOUND"]);

package/dist/schema.js

@@ -110,32 +110,37 @@ var requestAgent = (socketPath, request) => new Promise((resolveRequest, reject)
   });
   socket.on("error", (cause) => reject(new VaultError("AGENT_UNAVAILABLE", cause.message)));
 });
-var REASSIGN_ON = new Set([410, 421, 502, 503, 504, 530]);
-var DEFAULT_ASSIGN_URL = "https://assign.forgezero.net/v1/assign";
+var DEFAULT_API_URL = "https://api.forgezero.net";
 var DEFAULT_REQUEST_TIMEOUT_MS = 15000;
-var isForgeZeroNode = (hostname) => /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+forgezero\.net$/.test(hostname);
+function apiOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new VaultError("API_URL_INVALID", "apiUrl must be an absolute HTTPS origin.");
+  }
+  const local = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
+  if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.search || url.hash || url.pathname !== "/" && url.pathname !== "")
+    throw new VaultError("API_URL_INVALID", "apiUrl must be an HTTPS origin without credentials, path, query or fragment.");
+  return url;
+}
 
 class ForgeZero {
   credential;
-  assignment;
-  assignUrl;
+  apiUrl;
   doFetch;
-  now;
   signer;
   agentTransport;
-  nodeAllowed;
   requestTimeoutMs;
   project;
   environment;
   constructor(options = {}) {
     const credential = options.credential ?? discover(options.discovery);
     this.credential = credential.mode === "managed" && !credential.socketPath ? { ...credential, socketPath: DEFAULT_SOCKET } : credential;
-    this.assignUrl = options.assignUrl ?? DEFAULT_ASSIGN_URL;
+    this.apiUrl = apiOrigin(options.apiUrl ?? DEFAULT_API_URL);
     this.doFetch = options.fetch ?? globalThis.fetch;
-    this.now = options.now ?? Date.now;
     this.signer = options.signer ?? (this.credential.mode === "external" ? signerFromApiKey(this.credential.apiKey) : undefined);
     this.agentTransport = options.agentTransport ?? requestAgent;
-    this.nodeAllowed = options.nodeAllowed ?? isForgeZeroNode;
     this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
     if (!Number.isFinite(this.requestTimeoutMs) || this.requestTimeoutMs < 100 || this.requestTimeoutMs > 120000) {
       throw new VaultError("INVALID_TIMEOUT", "requestTimeoutMs must be between 100 and 120000 milliseconds.");
@@ -143,45 +148,14 @@ class ForgeZero {
     this.project = options.project ?? "default";
     this.environment = options.environment ?? "production";
   }
-  async node() {
-    const now = this.now();
-    if (this.assignment && this.assignment.expiresAt > now)
-      return this.assignment.node;
-    const assignmentUrl = new URL(this.assignUrl);
-    if (this.signer?.keyId && !assignmentUrl.searchParams.has("client")) {
-      assignmentUrl.searchParams.set("client", this.signer.keyId);
-    }
-    const response = await this.doFetch(assignmentUrl, {
-      method: "GET",
-      headers: { accept: "application/json" },
-      signal: AbortSignal.timeout(this.requestTimeoutMs)
-    });
-    if (!response.ok)
-      throw new VaultError("NO_NODE", "No vault node is available right now.");
-    const payload = await response.json().catch(() => null);
-    const hostname = typeof payload?.node === "string" ? payload.node : payload?.node && typeof payload.node === "object" && ("hostname" in payload.node) ? payload.node.hostname : undefined;
-    if (typeof hostname !== "string" || !this.nodeAllowed(hostname)) {
-      throw new VaultError("UNTRUSTED_NODE", "The directory returned an untrusted vault node hostname.");
-    }
-    const ttl = payload?.ttl ?? 60;
-    if (typeof ttl !== "number" || !Number.isFinite(ttl) || ttl < 1 || ttl > 300) {
-      throw new VaultError("INVALID_ASSIGNMENT", "The directory returned an invalid vault-node lease.");
-    }
-    this.assignment = { node: hostname, ttl, expiresAt: now + ttl * 1000 };
-    return hostname;
-  }
-  reassign() {
-    this.assignment = undefined;
-  }
   scope() {
     return `${encodeURIComponent(this.project)}/${encodeURIComponent(this.environment)}`;
   }
-  async request(path, init = {}, retried = false) {
+  async request(path, init = {}) {
     if (this.credential.mode === "managed")
       return this.managedRequest(path, init);
-    const node = await this.node();
     const body = typeof init.body === "string" ? init.body : "";
-    const target = new URL(path, "https://vault.invalid");
+    const target = new URL(path, this.apiUrl);
     const headers = {
       "content-type": "application/json",
       ...init.headers
@@ -195,15 +169,11 @@ class ForgeZero {
         body
       });
     }
-    const response = await this.doFetch(`https://${node}${path}`, {
+    const response = await this.doFetch(target, {
       ...init,
       headers,
       signal: init.signal ?? AbortSignal.timeout(this.requestTimeoutMs)
     });
-    if (REASSIGN_ON.has(response.status) && !retried) {
-      this.reassign();
-      return this.request(path, init, true);
-    }
     const payload = await response.json().catch(() => {
       return;
     });
@@ -362,7 +332,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.1";
+var VERSION = "0.1.2";
 
 // src/schema.ts
 function managedSchemas(vault, options = {}) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "Publishing happens from an operator's machine, not CI \u2014 CLAUDE.md records that the absence of CI is deliberate. npm's `provenance` attests a tarball was built by a recognised CI provider from a named commit, so it cannot be produced here: it was set, and the first publish failed with `Automatic provenance generation not supported for provider: null`. A setting that can never be satisfied is worse than none, because it reads as a guarantee nobody is getting. Restore it the day this publishes from CI, and not before.",
   "name": "@forgezero/vault",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -49,7 +49,7 @@
     "@noble/post-quantum": "^0.6.1",
     "@noble/hashes": "^2.2.0"
   },
-  "description": "ForgeZero vault client. Credential discovery, versioned secrets, node assignment.",
+  "description": "ForgeZero vault client. Credential discovery and versioned secrets through one stable API origin.",
   "keywords": [
     "secrets",
     "vault",