@forgezero/vault 0.1.7 → 0.1.9

package/dist/config.d.ts

@@ -11,7 +11,7 @@
  * A YAML parser is a third-party dependency, and this package claims to have
  * none — it ends up inside a tenant's production application, where every edge
  * in its dependency graph is one they did not choose. JSON is in the runtime.
- * (`.fz/deploy.yaml` is a different file read by a different tool on our side of
+ * (`.fz/deploy.json` is a different file read by a different tool on our side of
  * the wire, where the dependency is ours to carry.)
  *
  * ## What is deliberately NOT in here

package/dist/index.d.ts

@@ -282,4 +282,4 @@ export declare function systemdCredentials(options?: SystemdCredentialOptions):
     readonly name: 'systemd';
     get(reference: string, field: string): Promise<string>;
 };
-export declare const VERSION = "0.1.7";
+export declare const VERSION = "0.1.9";

package/dist/index.js

@@ -382,7 +382,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.7";
+var VERSION = "0.1.9";
 export {
   vaultCredentials,
   systemdCredentials,

package/dist/providers.d.ts

@@ -1,15 +1,18 @@
 import { ForgeZero } from './index';
-/** Mirrors `ProviderConfig` in `@forgezero/providers`, matched structurally. */
-export interface StoredProvider {
+/** Mirrors a provider identity in `@forgezero/providers`, matched structurally. */
+export interface StoredProviderInstance {
+    instanceKey: string;
     providerId: string;
-    /** Names one instance when a provider is configured more than once. */
-    instanceKey?: string;
-    /** 1 is tried first. */
-    priority: number;
     enabled: boolean;
     config: Record<string, unknown>;
-    /** Names the vault entry holding the secret. Never the secret. */
     secretRef: string;
+}
+/** Mirrors one service-method attachment in `@forgezero/providers`. */
+export interface StoredServiceMethodAttachment {
+    instanceKey: string;
+    providerMethod: string;
+    priority: number;
+    enabled: boolean;
     health?: {
         strikes: number;
         status: 'ok' | 'degraded' | 'offline';
@@ -18,12 +21,14 @@ export interface StoredProvider {
 }
 export interface VaultConfigOptions {
     /**
-     * Entry name for a service's provider list. `email` → `providers.email`.
+     * Entry containing provider identities, independent of services.
      *
      * Overridable because a tenant already using `providers.*` for something else
      * should not have to rename it to adopt this.
      */
-    entryFor?: (serviceKey: string) => string;
+    providersEntry?: string;
+    /** Entry containing one service method's ordered attachments. */
+    serviceEntryFor?: (serviceKey: string, methodKey: string) => string;
     /**
      * Persist health back to the vault.
      *
@@ -50,8 +55,9 @@ export interface VaultConfigOptions {
  */
 export declare function vaultConfig(vault: ForgeZero, options?: VaultConfigOptions): {
     name: string;
-    list(serviceKey: string): Promise<readonly StoredProvider[]>;
-    recordHealth(serviceKey: string, providerId: string, health: NonNullable<StoredProvider["health"]>): Promise<void>;
+    provider(instanceKey: string): Promise<StoredProviderInstance | undefined>;
+    list(serviceKey: string, methodKey: string): Promise<readonly StoredServiceMethodAttachment[]>;
+    recordHealth(serviceKey: string, methodKey: string, instanceKey: string, providerMethod: string, health: NonNullable<StoredServiceMethodAttachment["health"]>): Promise<void>;
 };
 /**
  * Credentials out of the vault, by the reference a provider config names.

package/dist/providers.js

@@ -382,14 +382,14 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.7";
+var VERSION = "0.1.9";
 
 // src/providers.ts
 var MISSING = new Set(["ENTRY_NOT_FOUND", "VERSION_NOT_FOUND"]);
 function vaultConfig(vault, options = {}) {
-  const entryFor = options.entryFor ?? ((serviceKey) => `providers.${serviceKey}`);
-  const read = async (serviceKey) => {
-    const name = entryFor(serviceKey);
+  const providersEntry = options.providersEntry ?? "providers.instances";
+  const serviceEntryFor = options.serviceEntryFor ?? ((serviceKey, methodKey) => `services.${serviceKey}.${methodKey}`);
+  const readArray = async (name) => {
     let raw;
     try {
       raw = await vault.get(name);
@@ -405,21 +405,26 @@ function vaultConfig(vault, options = {}) {
       throw new VaultError("INVALID", `Vault entry "${name}" is not valid JSON.`);
     }
     if (!Array.isArray(parsed)) {
-      throw new VaultError("INVALID", `Vault entry "${name}" must be an array of providers.`);
+      throw new VaultError("INVALID", `Vault entry "${name}" must be an array.`);
     }
     return parsed;
   };
   return {
     name: "vault",
-    async list(serviceKey) {
-      return (await read(serviceKey)).slice().sort((a, b) => a.priority - b.priority);
+    async provider(instanceKey) {
+      const instances = await readArray(providersEntry);
+      return instances.find((instance) => instance.instanceKey === instanceKey);
     },
-    async recordHealth(serviceKey, providerId, health) {
+    async list(serviceKey, methodKey) {
+      return (await readArray(serviceEntryFor(serviceKey, methodKey))).slice().sort((a, b) => a.priority - b.priority);
+    },
+    async recordHealth(serviceKey, methodKey, instanceKey, providerMethod, health) {
       if (!options.persistHealth)
         return;
-      const providers = await read(serviceKey);
-      const next = providers.map((entry) => entry.providerId === providerId ? { ...entry, health } : entry);
-      await vault.set(entryFor(serviceKey), JSON.stringify(next));
+      const entry = serviceEntryFor(serviceKey, methodKey);
+      const attachments = await readArray(entry);
+      const next = attachments.map((attachment) => attachment.instanceKey === instanceKey && attachment.providerMethod === providerMethod ? { ...attachment, health } : attachment);
+      await vault.set(entry, JSON.stringify(next));
     }
   };
 }

package/dist/schema.js

@@ -382,7 +382,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.7";
+var VERSION = "0.1.9";
 
 // src/schema.ts
 function managedSchemas(vault, options = {}) {

package/package.json

@@ -1,10 +1,10 @@
 {
-  "//": "Publishing happens from an operator's machine, not CI \u2014 CLAUDE.md records that the absence of CI is deliberate. npm's `provenance` attests a tarball was built by a recognised CI provider from a named commit, so it cannot be produced here: it was set, and the first publish failed with `Automatic provenance generation not supported for provider: null`. A setting that can never be satisfied is worse than none, because it reads as a guarantee nobody is getting. Restore it the day this publishes from CI, and not before.",
   "name": "@forgezero/vault",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "type": "module",
-  "publishConfig": {
-    "access": "public"
+	"publishConfig": {
+		"access": "public",
+		"provenance": true
   },
   "exports": {
     ".": {
@@ -43,7 +43,7 @@
     "@types/bun": "latest"
   },
   "dependencies": {
-    "@forgezero/runtime": "^0.1.3"
+	"@forgezero/runtime": "^0.1.6"
   },
   "peerDependencies": {
     "@noble/curves": "^2.2.0",
@@ -68,7 +68,7 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/forgezero-net/packages.git",
-    "directory": "packages/vault"
+    "directory": "vault"
   },
   "bugs": "https://github.com/forgezero-net/packages/issues",
   "sideEffects": false,