@forgezero/vault 0.1.10 → 0.1.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +89 -26
- package/dist/index.d.ts +1 -1
- package/dist/index.js +1 -1
- package/dist/providers.js +1 -1
- package/dist/schema.js +1 -1
- package/package.json +9 -10
package/README.md
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
<!--
|
|
2
2
|
GENERATED FILE — do not edit.
|
|
3
3
|
|
|
4
|
-
Change
|
|
4
|
+
Change tools/generate-guides.ts or its typed sources, run `bun run guides`,
|
|
5
5
|
and commit the generator and rendered files together.
|
|
6
6
|
-->
|
|
7
7
|
|
|
@@ -9,14 +9,39 @@
|
|
|
9
9
|
|
|
10
10
|
One scoped contract over platform-direct, managed-agent and external API-key trust paths.
|
|
11
11
|
|
|
12
|
-
##
|
|
12
|
+
## Package overview
|
|
13
13
|
|
|
14
|
-
The scoped vault facade. A tenant application uses its local agent or an API key; trusted platform code injects a direct realm backend instead of calling itself. The one package that ends up in somebody else's production dependency tree, which is why it stays alone and stays small. Supported runtimes: bun, node, workers, deno.
|
|
14
|
+
The scoped vault facade. A tenant application uses its local agent or an API key; trusted platform code injects a direct realm backend instead of calling itself. The one package that ends up in somebody else's production dependency tree, which is why it stays alone and stays small. Supported runtimes: bun, node, workers, deno. Package root: @forgezero/vault. The sections below show the actual named imports emitted by each declaration entry point; wildcard imports are intentionally not used in the documentation.
|
|
15
15
|
|
|
16
16
|
```text
|
|
17
|
-
|
|
17
|
+
bun add @forgezero/vault
|
|
18
18
|
```
|
|
19
19
|
|
|
20
|
+
## ForgeZero package family
|
|
21
|
+
|
|
22
|
+
The five packages are installation boundaries. Choose a package by who installs it; choose a subpath by the capability used in that file.
|
|
23
|
+
|
|
24
|
+
| package | short description | runtimes | documentation |
|
|
25
|
+
|---|---|---|---|
|
|
26
|
+
| @forgezero/vault | Scoped secret access with Agent, API-key and systemd-credential sources. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/vault-package) |
|
|
27
|
+
| @forgezero/access | Typed route, principal, factor, RBAC and request-pipeline contracts. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/access) |
|
|
28
|
+
| @forgezero/providers | Typed external providers with priority, health and classified fallback. | bun, node, workers, deno | [Open](https://www.forgezero.net/docs/providers) |
|
|
29
|
+
| @forgezero/runtime | Portable runtime primitives for queries, jobs, events, schemas and finance. | bun, node | [Open](https://www.forgezero.net/docs/runtime) |
|
|
30
|
+
| @forgezero/agent | Operator CLI and managed-node agent for bootstrap, deploy and lifecycle. | bun, node | [Open](https://www.forgezero.net/docs/agent) |
|
|
31
|
+
|
|
32
|
+
## @forgezero/vault public imports and commands
|
|
33
|
+
|
|
34
|
+
Every row links to the detailed explanation and named-import/example area below. This table and those details are generated from the package inventory and emitted declarations.
|
|
35
|
+
|
|
36
|
+
| public entry | short description | runtime | details |
|
|
37
|
+
|---|---|---|---|
|
|
38
|
+
| @forgezero/vault | One scoped contract over an explicitly injected platform backend, a managed tenant socket or an automatically derived external API-key signer. | portable | [Details + example](#forgezero-vault) |
|
|
39
|
+
| @forgezero/vault/schema | Where an entry’s shape comes from: pulled from the platform when ForgeZero has to render it, declared locally when only the tenant needs it. | portable | [Details + example](#forgezero-vault-schema) |
|
|
40
|
+
| @forgezero/vault/config | Read `.fz/config.json` — which project, which environment, which secrets, and what to call them. | portable | [Details + example](#forgezero-vault-config) |
|
|
41
|
+
| @forgezero/vault/env | Envless: fill `process.env` from the vault at boot, refusing to run during a build. | portable | [Details + example](#forgezero-vault-env) |
|
|
42
|
+
| @forgezero/vault/frameworks | SvelteKit and Next.js wiring, attached at the one place that runs once, on the server, before any request. | portable | [Details + example](#forgezero-vault-frameworks) |
|
|
43
|
+
| @forgezero/vault/providers | Adapters that make Vault a provider-configuration and credential source without coupling the providers package to ForgeZero. | portable | [Details + example](#forgezero-vault-providers) |
|
|
44
|
+
|
|
20
45
|
## Commands
|
|
21
46
|
|
|
22
47
|
bun add @forgezero/vault — Install the scoped Vault client and its public subpaths.
|
|
@@ -25,63 +50,101 @@ bun add @forgezero/vault — Install the scoped Vault client and its public subp
|
|
|
25
50
|
bun add @forgezero/vault
|
|
26
51
|
```
|
|
27
52
|
|
|
53
|
+
<a id="forgezero-vault"></a>
|
|
28
54
|
## @forgezero/vault
|
|
29
55
|
|
|
30
|
-
One scoped contract over an explicitly injected platform backend, a managed tenant socket or an automatically derived external API-key signer.
|
|
56
|
+
One scoped contract over an explicitly injected platform backend, a managed tenant socket or an automatically derived external API-key signer. Named value imports: DEFAULT_API_URL, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_SOCKET, ForgeZero, VERSION, VaultError, createVault, directCredentials, discover, managedAgentTransport, signerFromApiKey, systemdCredentials, vaultCredentials. Named type imports: AgentRequest, AgentResponse, AgentTransport, Change, Credential, CredentialMode, DiscoveryEnvironment, EntryMeta, SignRequest, Signer, SystemdCredentialOptions, VaultOptions. Import only the names used by this file.
|
|
31
57
|
|
|
32
58
|
```text
|
|
33
|
-
import
|
|
59
|
+
import { DEFAULT_API_URL, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_SOCKET, ForgeZero, VERSION, VaultError } from '@forgezero/vault';
|
|
60
|
+
import { createVault, directCredentials, discover, managedAgentTransport, signerFromApiKey, systemdCredentials } from '@forgezero/vault';
|
|
61
|
+
import { vaultCredentials } from '@forgezero/vault';
|
|
62
|
+
import type { AgentRequest, AgentResponse, AgentTransport, Change, Credential, CredentialMode } from '@forgezero/vault';
|
|
63
|
+
import type { DiscoveryEnvironment, EntryMeta, SignRequest, Signer, SystemdCredentialOptions, VaultOptions } from '@forgezero/vault';
|
|
34
64
|
```
|
|
35
65
|
|
|
36
|
-
## @forgezero/vault
|
|
66
|
+
## @forgezero/vault — Read a scoped secret
|
|
37
67
|
|
|
38
|
-
|
|
68
|
+
The same client discovers the managed Agent socket or uses an external API-key signer. Project and environment remain explicit.
|
|
39
69
|
|
|
40
70
|
```text
|
|
41
|
-
import
|
|
71
|
+
import { createVault } from '@forgezero/vault';
|
|
72
|
+
|
|
73
|
+
const vault = createVault({ project: 'payments', environment: 'production' });
|
|
74
|
+
const token = await vault.get('STRIPE_KEY');
|
|
42
75
|
```
|
|
43
76
|
|
|
44
|
-
|
|
77
|
+
<a id="forgezero-vault-schema"></a>
|
|
78
|
+
## @forgezero/vault/schema
|
|
45
79
|
|
|
46
|
-
|
|
80
|
+
Where an entry’s shape comes from: pulled from the platform when ForgeZero has to render it, declared locally when only the tenant needs it. Named value imports: localSchemas, managedSchemas, preferManaged. Named type imports: SchemaRef, SchemaSource. Import only the names used by this file.
|
|
47
81
|
|
|
48
82
|
```text
|
|
49
|
-
import
|
|
83
|
+
import { localSchemas, managedSchemas, preferManaged } from '@forgezero/vault/schema';
|
|
84
|
+
import type { SchemaRef, SchemaSource } from '@forgezero/vault/schema';
|
|
50
85
|
```
|
|
51
86
|
|
|
52
|
-
## @forgezero/vault/
|
|
87
|
+
## @forgezero/vault/schema — Managed schema with a local fallback
|
|
53
88
|
|
|
54
|
-
|
|
89
|
+
Managed schemas let ForgeZero render and validate a provider form. Local schemas keep tenant-owned extensions independent. Managed wins when both define the same name; the version travels with the shape and no credential value is stored in the schema.
|
|
55
90
|
|
|
56
91
|
```text
|
|
57
|
-
import
|
|
92
|
+
import { managedSchemas, localSchemas, preferManaged } from '@forgezero/vault/schema';
|
|
93
|
+
import { createVault } from '@forgezero/vault';
|
|
94
|
+
|
|
95
|
+
const vault = createVault({ project: 'payments', environment: 'production' });
|
|
96
|
+
const schemas = preferManaged(
|
|
97
|
+
managedSchemas(vault),
|
|
98
|
+
localSchemas({
|
|
99
|
+
postmark: { version: 1, schema: {
|
|
100
|
+
type: 'object', additionalProperties: false,
|
|
101
|
+
properties: { apiKey: { type: 'string', title: 'API key', writeOnly: true } },
|
|
102
|
+
required: ['apiKey']
|
|
103
|
+
} }
|
|
104
|
+
})
|
|
105
|
+
);
|
|
106
|
+
const { schema, version } = await schemas.get('postmark');
|
|
58
107
|
```
|
|
59
108
|
|
|
60
|
-
|
|
109
|
+
<a id="forgezero-vault-config"></a>
|
|
110
|
+
## @forgezero/vault/config
|
|
61
111
|
|
|
62
|
-
|
|
112
|
+
Read `.fz/config.json` — which project, which environment, which secrets, and what to call them. Named value imports: CONFIG_PATHS, ConfigError, assertNoSecrets, bindingsOf, exampleConfig, loadConfig, parseConfig, resolveConfig. Named type imports: FzConfig, LoadOptions, SecretBinding. Import only the names used by this file.
|
|
63
113
|
|
|
64
114
|
```text
|
|
65
|
-
import
|
|
115
|
+
import { CONFIG_PATHS, ConfigError, assertNoSecrets, bindingsOf, exampleConfig, loadConfig } from '@forgezero/vault/config';
|
|
116
|
+
import { parseConfig, resolveConfig } from '@forgezero/vault/config';
|
|
117
|
+
import type { FzConfig, LoadOptions, SecretBinding } from '@forgezero/vault/config';
|
|
66
118
|
```
|
|
67
119
|
|
|
68
|
-
|
|
120
|
+
<a id="forgezero-vault-env"></a>
|
|
121
|
+
## @forgezero/vault/env
|
|
69
122
|
|
|
70
|
-
|
|
123
|
+
Envless: fill `process.env` from the vault at boot, refusing to run during a build. Named value imports: EnvError, clearEnv, describeReport, hydrateEnv, isBuildTime. Named type imports: HydrateOptions, HydrateReport, SecretReader. Import only the names used by this file.
|
|
71
124
|
|
|
72
125
|
```text
|
|
73
|
-
import
|
|
126
|
+
import { EnvError, clearEnv, describeReport, hydrateEnv, isBuildTime } from '@forgezero/vault/env';
|
|
127
|
+
import type { HydrateOptions, HydrateReport, SecretReader } from '@forgezero/vault/env';
|
|
74
128
|
```
|
|
75
129
|
|
|
76
|
-
|
|
130
|
+
<a id="forgezero-vault-frameworks"></a>
|
|
131
|
+
## @forgezero/vault/frameworks
|
|
77
132
|
|
|
78
|
-
|
|
133
|
+
SvelteKit and Next.js wiring, attached at the one place that runs once, on the server, before any request. Named value imports: bootstrapEnv, forgeZeroHandle, forgeZeroInit, forgeZeroRegister, resetHydration, setupEnv. Named type imports: SetupOptions, SvelteKitHandleEvent. Import only the names used by this file.
|
|
79
134
|
|
|
80
135
|
```text
|
|
81
|
-
import {
|
|
136
|
+
import { bootstrapEnv, forgeZeroHandle, forgeZeroInit, forgeZeroRegister, resetHydration, setupEnv } from '@forgezero/vault/frameworks';
|
|
137
|
+
import type { SetupOptions, SvelteKitHandleEvent } from '@forgezero/vault/frameworks';
|
|
138
|
+
```
|
|
82
139
|
|
|
83
|
-
|
|
84
|
-
|
|
140
|
+
<a id="forgezero-vault-providers"></a>
|
|
141
|
+
## @forgezero/vault/providers
|
|
142
|
+
|
|
143
|
+
Adapters that make Vault a provider-configuration and credential source without coupling the providers package to ForgeZero. Named value imports: vaultConfig, vaultCredentials. Named type imports: StoredProviderInstance, StoredServiceMethodAttachment, VaultConfigOptions. Import only the names used by this file.
|
|
144
|
+
|
|
145
|
+
```text
|
|
146
|
+
import { vaultConfig, vaultCredentials } from '@forgezero/vault/providers';
|
|
147
|
+
import type { StoredProviderInstance, StoredServiceMethodAttachment, VaultConfigOptions } from '@forgezero/vault/providers';
|
|
85
148
|
```
|
|
86
149
|
|
|
87
150
|
## Three paths, and why they stay explicit
|
package/dist/index.d.ts
CHANGED
|
@@ -282,4 +282,4 @@ export declare function systemdCredentials(options?: SystemdCredentialOptions):
|
|
|
282
282
|
readonly name: 'systemd';
|
|
283
283
|
get(reference: string, field: string): Promise<string>;
|
|
284
284
|
};
|
|
285
|
-
export declare const VERSION = "0.1.
|
|
285
|
+
export declare const VERSION = "0.1.12";
|
package/dist/index.js
CHANGED
package/dist/providers.js
CHANGED
package/dist/schema.js
CHANGED
package/package.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@forgezero/vault",
|
|
3
|
-
|
|
3
|
+
"version": "0.1.12",
|
|
4
4
|
"type": "module",
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
5
|
+
"publishConfig": {
|
|
6
|
+
"access": "public",
|
|
7
|
+
"provenance": false
|
|
8
8
|
},
|
|
9
9
|
"exports": {
|
|
10
10
|
".": {
|
|
@@ -32,18 +32,17 @@
|
|
|
32
32
|
"default": "./dist/providers.js"
|
|
33
33
|
}
|
|
34
34
|
},
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
"
|
|
39
|
-
"prepublishOnly": "bun run check && bun run build"
|
|
35
|
+
"scripts": {
|
|
36
|
+
"check": "tsc --noEmit",
|
|
37
|
+
"build": "bun ../tools/package-task.ts build vault",
|
|
38
|
+
"prepublishOnly": "bun ../tools/package-task.ts prepublish vault"
|
|
40
39
|
},
|
|
41
40
|
"devDependencies": {
|
|
42
41
|
"typescript": "^5.6.0",
|
|
43
42
|
"@types/bun": "latest"
|
|
44
43
|
},
|
|
45
44
|
"dependencies": {
|
|
46
|
-
|
|
45
|
+
"@forgezero/runtime": "^0.1.8"
|
|
47
46
|
},
|
|
48
47
|
"peerDependencies": {
|
|
49
48
|
"@noble/curves": "^2.2.0",
|