@griffin-app/griffin-executor 0.1.4 → 0.1.6

package/src/secrets/resolver.ts

@@ -1,7 +1,7 @@
 /**
  * Secret resolution utilities for test monitors.
  */
-import { type MonitorV1 } from "@griffin-app/griffin-hub-sdk";
+import { SecretOrString, type MonitorV1 } from "@griffin-app/griffin-hub-sdk";
 import type { SecretProvider } from "./types.js";
 import type { SecretRef, SecretRefData } from "./types.js";
 import {
@@ -10,6 +10,29 @@ import {
   SecretResolutionError,
 } from "./types.js";
 
+interface TemplateRef {
+  $template: {
+    strings: string[];
+    values: unknown[];
+  };
+}
+
+function isTemplateRef(value: unknown): value is TemplateRef {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const obj = value as Record<string, unknown>;
+  if (
+    !("$template" in obj) ||
+    typeof obj.$template !== "object" ||
+    obj.$template === null
+  ) {
+    return false;
+  }
+  const tmpl = obj.$template as Record<string, unknown>;
+  return Array.isArray(tmpl.strings) && Array.isArray(tmpl.values);
+}
+
 /**
  * Collected secret references and literals from a monitor.
  */
@@ -26,6 +49,10 @@ interface CollectedSecrets {
     path: (string | number)[];
     value: string;
   }>;
+  /** Paths to templates containing secrets (for partial resolution) */
+  templatePaths: Array<{
+    path: (string | number)[];
+  }>;
 }
 
 /**
@@ -60,6 +87,20 @@ function collectSecretsFromValue(
     return;
   }
 
+  if (isTemplateRef(value)) {
+    let hasSecrets = false;
+    for (const val of value.$template.values) {
+      if (isSecretRef(val)) {
+        collected.refs.push(val.$secret);
+        hasSecrets = true;
+      }
+    }
+    if (hasSecrets) {
+      collected.templatePaths.push({ path: [...currentPath] });
+    }
+    return;
+  }
+
   if (Array.isArray(value)) {
     for (let i = 0; i < value.length; i++) {
       collectSecretsFromValue(value[i], [...currentPath, i], collected);
@@ -85,6 +126,7 @@ export function collectSecretsFromMonitor(
     refs: [],
     paths: [],
     literalPaths: [],
+    templatePaths: [],
   };
 
   for (let nodeIndex = 0; nodeIndex < monitor.nodes.length; nodeIndex++) {
@@ -95,7 +137,17 @@ export function collectSecretsFromMonitor(
       continue;
     }
 
-    //const endpoint = node;
+    // Scan path and base (may contain templates with secrets)
+    collectSecretsFromValue(
+      node.path,
+      ["nodes", nodeIndex, "path"],
+      collected,
+    );
+    collectSecretsFromValue(
+      node.base,
+      ["nodes", nodeIndex, "base"],
+      collected,
+    );
 
     // Scan headers
     if (node.headers) {
@@ -182,15 +234,21 @@ function deepClone<T>(value: T): T {
 export async function resolveSecretsInMonitor(
   monitor: MonitorV1,
   provider: SecretProvider | null,
-): Promise<MonitorV1> {
+): Promise<{ monitor: MonitorV1; hadSecrets: boolean }> {
   // Collect all secret references and string literals
   const collected = collectSecretsFromMonitor(monitor);
 
-  if (collected.refs.length === 0 && collected.literalPaths.length === 0) {
-    // No secrets or literals to resolve
-    return monitor;
+  if (
+    collected.refs.length === 0 &&
+    collected.literalPaths.length === 0 &&
+    collected.templatePaths.length === 0
+  ) {
+    // No secrets, literals, or templates to resolve
+    return { monitor, hadSecrets: false };
   }
 
+  const hadSecrets = collected.refs.length > 0 || collected.templatePaths.length > 0;
+
   // Resolve secrets when we have refs (provider required)
   if (collected.refs.length > 0 && !provider) {
     throw new SecretResolutionError(
@@ -218,56 +276,62 @@ export async function resolveSecretsInMonitor(
     setAtPath(resolvedMonitor, path, value);
   }
 
-  return resolvedMonitor;
-}
-
-/**
- * Check if a monitor contains any secret references or string literals that need resolution.
- * Useful for short-circuiting resolution when no secrets or literals are present.
- */
-export function planHasSecrets(monitor: MonitorV1): boolean {
-  for (const node of monitor.nodes) {
-    if (node.type !== "HTTP_REQUEST") {
-      continue;
-    }
-
-    // Check headers
-    if (node.headers) {
-      for (const headerValue of Object.values(node.headers)) {
-        if (isSecretRef(headerValue) || isStringLiteral(headerValue)) {
-          return true;
-        }
-      }
-    }
+  // Resolve templates that contain secrets
+  for (const { path } of collected.templatePaths) {
+    const tmpl = getAtPath(resolvedMonitor, path) as TemplateRef;
+    if (!isTemplateRef(tmpl)) continue;
 
-    // Check body (recursive check)
-    if (node.body !== undefined && containsSecretOrLiteral(node.body)) {
-      return true;
-    }
+    const resolved = await resolveTemplateSecrets(tmpl, provider!);
+    setAtPath(resolvedMonitor, path, resolved);
   }
 
-  return false;
+  return { monitor: resolvedMonitor, hadSecrets };
 }
 
 /**
- * Recursively check if a value contains any secret references or string literals.
+ * Get a value at a path in an object.
  */
-function containsSecretOrLiteral(value: unknown): boolean {
-  if (value === null || value === undefined) {
-    return false;
-  }
-
-  if (isSecretRef(value) || isStringLiteral(value)) {
-    return true;
+function getAtPath(obj: unknown, path: (string | number)[]): unknown {
+  let current: any = obj;
+  for (const key of path) {
+    if (current === undefined || current === null) return undefined;
+    current = current[key];
   }
+  return current;
+}
 
-  if (Array.isArray(value)) {
-    return value.some(containsSecretOrLiteral);
+/**
+ * Resolve secrets in a template using partial application.
+ * Returns a plain string if all values resolved, or a reduced $template.
+ */
+async function resolveTemplateSecrets(
+  tmpl: TemplateRef,
+  provider: SecretProvider,
+): Promise<string | TemplateRef> {
+  const { strings, values } = tmpl.$template;
+  const newStrings: string[] = [strings[0]];
+  const newValues: unknown[] = [];
+
+  for (let i = 0; i < values.length; i++) {
+    const val = values[i];
+    if (isSecretRef(val)) {
+      const resolved = await provider.resolve(val.$secret.ref, {
+        version: val.$secret.version,
+        field: val.$secret.field,
+      });
+      newStrings[newStrings.length - 1] += resolved + strings[i + 1];
+    } else if (isStringLiteral(val)) {
+      newStrings[newStrings.length - 1] += val.$literal + strings[i + 1];
+    } else {
+      newValues.push(val);
+      newStrings.push(strings[i + 1]);
+    }
   }
 
-  if (typeof value === "object") {
-    return Object.values(value).some(containsSecretOrLiteral);
+  if (newValues.length === 0) {
+    return newStrings[0];
   }
 
-  return false;
+  return { $template: { strings: newStrings, values: newValues } };
 }
+

package/src/secrets/secrets.test.ts

@@ -5,7 +5,6 @@ import { SecretResolutionError } from "./types.js";
 import {
   resolveSecretsInMonitor,
   collectSecretsFromMonitor,
-  planHasSecrets,
 } from "./resolver.js";
 import { MonitorV1 } from "@griffin-app/griffin-hub-sdk";
 
@@ -104,8 +103,8 @@ describe("Monitor Secret Resolution", () => {
           id: "endpoint-1",
           type: "HTTP_REQUEST",
           method: "GET",
-          path: "/api/test",
-          base: "https://api.example.com",
+          path: { $literal: "/api/test" },
+          base: { $literal: "https://api.example.com" },
           response_format: "JSON",
           headers,
           body,
@@ -117,41 +116,6 @@ describe("Monitor Secret Resolution", () => {
       ],
     }) as MonitorV1;
 
-  describe("planHasSecrets", () => {
-    it("should return false for monitors without secrets or literals", () => {
-      const monitor = createTestMonitor({ "Content-Type": "application/json" });
-      expect(planHasSecrets(monitor)).toBe(false);
-    });
-
-    it("should return true for monitors with secret refs in headers", () => {
-      const monitor = createTestMonitor({
-        Authorization: createSecretRef("API_KEY"),
-      });
-      expect(planHasSecrets(monitor)).toBe(true);
-    });
-
-    it("should return true for monitors with secret refs in body", () => {
-      const monitor = createTestMonitor(undefined, {
-        token: createSecretRef("TOKEN"),
-      });
-      expect(planHasSecrets(monitor)).toBe(true);
-    });
-
-    it("should return true for monitors with string literals in headers", () => {
-      const monitor = createTestMonitor({
-        "Content-Type": createStringLiteral("application/json"),
-      });
-      expect(planHasSecrets(monitor)).toBe(true);
-    });
-
-    it("should return true for monitors with string literals in body", () => {
-      const monitor = createTestMonitor(undefined, {
-        type: createStringLiteral("test"),
-      });
-      expect(planHasSecrets(monitor)).toBe(true);
-    });
-  });
-
   describe("collectSecretsFromMonitor", () => {
     it("should collect secrets from headers", () => {
       const monitor = createTestMonitor({
@@ -202,7 +166,7 @@ describe("Monitor Secret Resolution", () => {
       const collected = collectSecretsFromMonitor(monitor);
 
       expect(collected.refs).toHaveLength(0);
-      expect(collected.literalPaths).toHaveLength(2);
+      expect(collected.literalPaths).toHaveLength(4);
       expect(collected.literalPaths).toContainEqual({
         path: ["nodes", 0, "headers", "Content-Type"],
         value: "application/json",
@@ -223,7 +187,7 @@ describe("Monitor Secret Resolution", () => {
 
       expect(collected.refs).toHaveLength(1);
       expect(collected.refs).toContainEqual({ ref: "API_KEY" });
-      expect(collected.literalPaths).toHaveLength(1);
+      expect(collected.literalPaths).toHaveLength(3);
       expect(collected.literalPaths).toContainEqual({
         path: ["nodes", 0, "headers", "Content-Type"],
         value: "application/json",
@@ -242,7 +206,7 @@ describe("Monitor Secret Resolution", () => {
         env: { API_KEY: "Bearer secret-token" },
       });
 
-      const resolved = await resolveSecretsInMonitor(monitor, provider);
+      const { monitor: resolved } = await resolveSecretsInMonitor(monitor, provider);
 
       const endpoint = resolved.nodes[0];
       if (endpoint.type !== "HTTP_REQUEST") {
@@ -262,7 +226,7 @@ describe("Monitor Secret Resolution", () => {
         env: { TOKEN: "resolved-token" },
       });
 
-      const resolved = await resolveSecretsInMonitor(monitor, provider);
+      const { monitor: resolved } = await resolveSecretsInMonitor(monitor, provider);
 
       const endpoint = resolved.nodes[0];
       if (endpoint.type !== "HTTP_REQUEST") {
@@ -281,7 +245,7 @@ describe("Monitor Secret Resolution", () => {
         env: { API_KEY: "secret" },
       });
 
-      const resolved = await resolveSecretsInMonitor(monitor, provider);
+      const { monitor: resolved, hadSecrets } = await resolveSecretsInMonitor(monitor, provider);
 
       // Original should still have secret ref
       const originalEndpoint = monitor.nodes[0];
@@ -328,7 +292,7 @@ describe("Monitor Secret Resolution", () => {
         Accept: createStringLiteral("application/xml"),
       });
 
-      const resolved = await resolveSecretsInMonitor(monitor, null);
+      const { monitor: resolved } = await resolveSecretsInMonitor(monitor, null);
 
       const endpoint = resolved.nodes[0];
       if (endpoint.type !== "HTTP_REQUEST") {
@@ -344,7 +308,7 @@ describe("Monitor Secret Resolution", () => {
         data: "plain-value",
       });
 
-      const resolved = await resolveSecretsInMonitor(monitor, null);
+      const { monitor: resolved } = await resolveSecretsInMonitor(monitor, null);
 
       const endpoint = resolved.nodes[0];
       if (endpoint.type !== "HTTP_REQUEST") {
@@ -364,7 +328,7 @@ describe("Monitor Secret Resolution", () => {
         env: { API_KEY: "Bearer secret-token" },
       });
 
-      const resolved = await resolveSecretsInMonitor(monitor, provider);
+      const { monitor: resolved } = await resolveSecretsInMonitor(monitor, provider);
 
       const endpoint = resolved.nodes[0];
       if (endpoint.type !== "HTTP_REQUEST") {
@@ -379,7 +343,7 @@ describe("Monitor Secret Resolution", () => {
         "Content-Type": createStringLiteral("application/json"),
       });
 
-      const resolved = await resolveSecretsInMonitor(monitor, null);
+      const { monitor: resolved } = await resolveSecretsInMonitor(monitor, null);
 
       // Original should still have literal wrapper
       const originalEndpoint = monitor.nodes[0];

package/src/secrets/types.ts

@@ -1,4 +1,3 @@
-import { StringLiteral } from "@griffin-app/griffin-hub-sdk";
 
 /**
  * Data structure for a secret reference as it appears in a monitor.
@@ -96,7 +95,7 @@ export function isSecretRef(value: unknown): value is SecretRef {
 /**
  * Type guard to check if a value is a string literal.
  */
-export function isStringLiteral(value: unknown): value is StringLiteral {
+export function isStringLiteral(value: unknown): value is { $literal: string } {
   if (typeof value !== "object" || value === null) {
     return false;
   }

package/dist/secrets/providers/aws.d.ts

@@ -1,61 +0,0 @@
-/**
- * AWS Secrets Manager secret provider.
- *
- * Resolves secrets from a single consolidated AWS Secrets Manager secret
- * whose value is a JSON KV map. The secret is identified by `secretId`
- * (e.g. "orgId/environment") and individual secret names are keys in that map.
- *
- * Usage in DSL:
- *   secret("aws:MY_SECRET")
- */
-import type { SecretProvider, SecretResolveOptions } from "../types.js";
-/**
- * Interface for AWS Secrets Manager client.
- * This allows dependency injection of the actual AWS SDK client.
- */
-export interface AwsSecretsManagerClient {
-    getSecretValue(params: {
-        SecretId: string;
-        VersionStage?: string;
-    }): Promise<{
-        SecretString?: string;
-        SecretBinary?: Uint8Array;
-    }>;
-}
-export interface AwsSecretsManagerProviderOptions {
-    /**
-     * AWS Secrets Manager client instance.
-     * Should be pre-configured with region and credentials.
-     */
-    client: AwsSecretsManagerClient;
-    /**
-     * The full Secrets Manager secret ID (e.g. "orgId/environment").
-     * All secrets for this org+env are stored as a JSON KV map in this single secret.
-     */
-    secretId: string;
-    /**
-     * Default version stage to use if not specified.
-     * Defaults to "AWSCURRENT".
-     */
-    defaultVersionStage?: string;
-}
-export declare class AwsSecretsManagerProvider implements SecretProvider {
-    readonly name = "aws";
-    private readonly client;
-    private readonly secretId;
-    private readonly defaultVersionStage;
-    private cache;
-    private readonly cacheTtlMs;
-    constructor(options: AwsSecretsManagerProviderOptions);
-    resolve(ref: string, options?: SecretResolveOptions): Promise<string>;
-    /**
-     * Fetch and cache the entire KV map from the consolidated SM secret.
-     */
-    private fetchKvMap;
-    validate(): Promise<void>;
-    /**
-     * Clear the cache. Useful for testing or forced refresh.
-     */
-    clearCache(): void;
-}
-//# sourceMappingURL=aws.d.ts.map

package/dist/secrets/providers/aws.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/secrets/providers/aws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGxE;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,cAAc,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,UAAU,CAAC;KAC3B,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,gCAAgC;IAC/C;;;OAGG;IACH,MAAM,EAAE,uBAAuB,CAAC;IAEhC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,qBAAa,yBAA0B,YAAW,cAAc;IAC9D,QAAQ,CAAC,IAAI,SAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAG7C,OAAO,CAAC,KAAK,CACN;IACP,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;gBAEhC,OAAO,EAAE,gCAAgC;IAM/C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB3E;;OAEG;YACW,UAAU;IAoElB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAI/B;;OAEG;IACH,UAAU,IAAI,IAAI;CAGnB"}

package/dist/secrets/providers/aws.js

@@ -1,96 +0,0 @@
-/**
- * AWS Secrets Manager secret provider.
- *
- * Resolves secrets from a single consolidated AWS Secrets Manager secret
- * whose value is a JSON KV map. The secret is identified by `secretId`
- * (e.g. "orgId/environment") and individual secret names are keys in that map.
- *
- * Usage in DSL:
- *   secret("aws:MY_SECRET")
- */
-import { SecretResolutionError } from "../types.js";
-export class AwsSecretsManagerProvider {
-    name = "aws";
-    client;
-    secretId;
-    defaultVersionStage;
-    // Cache the entire KV map with TTL
-    cache = null;
-    cacheTtlMs = 5 * 60 * 1000; // 5 minutes
-    constructor(options) {
-        this.client = options.client;
-        this.secretId = options.secretId;
-        this.defaultVersionStage = options.defaultVersionStage ?? "AWSCURRENT";
-    }
-    async resolve(ref, options) {
-        const kvMap = await this.fetchKvMap(options?.version ?? this.defaultVersionStage);
-        const value = kvMap[ref];
-        if (value === undefined) {
-            throw new SecretResolutionError(`Secret key "${ref}" not found in consolidated secret "${this.secretId}"`, { ref });
-        }
-        return value;
-    }
-    /**
-     * Fetch and cache the entire KV map from the consolidated SM secret.
-     */
-    async fetchKvMap(versionStage) {
-        if (this.cache && this.cache.expires > Date.now()) {
-            return this.cache.value;
-        }
-        try {
-            const response = await this.client.getSecretValue({
-                SecretId: this.secretId,
-                VersionStage: versionStage,
-            });
-            if (!response.SecretString) {
-                throw new SecretResolutionError(`Secret "${this.secretId}" does not contain a string value (binary secrets are not supported)`, { ref: this.secretId });
-            }
-            let parsed;
-            try {
-                parsed = JSON.parse(response.SecretString);
-            }
-            catch {
-                throw new SecretResolutionError(`Secret "${this.secretId}" is not valid JSON`, { ref: this.secretId });
-            }
-            if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-                throw new SecretResolutionError(`Secret "${this.secretId}" is not a JSON object`, { ref: this.secretId });
-            }
-            const kvMap = parsed;
-            this.cache = {
-                value: kvMap,
-                expires: Date.now() + this.cacheTtlMs,
-            };
-            return kvMap;
-        }
-        catch (error) {
-            if (error instanceof SecretResolutionError) {
-                throw error;
-            }
-            const awsError = error;
-            let message = `Failed to retrieve secret "${this.secretId}"`;
-            if (awsError.name === "ResourceNotFoundException") {
-                message = `Secret "${this.secretId}" not found in AWS Secrets Manager`;
-            }
-            else if (awsError.name === "AccessDeniedException") {
-                message = `Access denied to secret "${this.secretId}". Check IAM permissions.`;
-            }
-            else if (awsError.message) {
-                message = `${message}: ${awsError.message}`;
-            }
-            throw new SecretResolutionError(message, {
-                ref: this.secretId,
-                cause: error,
-            });
-        }
-    }
-    async validate() {
-        // Validation happens on first secret access
-    }
-    /**
-     * Clear the cache. Useful for testing or forced refresh.
-     */
-    clearCache() {
-        this.cache = null;
-    }
-}
-//# sourceMappingURL=aws.js.map

package/dist/secrets/providers/aws.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/secrets/providers/aws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAiCpD,MAAM,OAAO,yBAAyB;IAC3B,IAAI,GAAG,KAAK,CAAC;IACL,MAAM,CAA0B;IAChC,QAAQ,CAAS;IACjB,mBAAmB,CAAS;IAE7C,mCAAmC;IAC3B,KAAK,GACX,IAAI,CAAC;IACU,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;IAEzD,YAAY,OAAyC;QACnD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,YAAY,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,OAA8B;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CACjC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,mBAAmB,CAC7C,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,qBAAqB,CAC7B,eAAe,GAAG,uCAAuC,IAAI,CAAC,QAAQ,GAAG,EACzE,EAAE,GAAG,EAAE,CACR,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,UAAU,CACtB,YAAoB;QAEpB,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;gBAChD,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,YAAY,EAAE,YAAY;aAC3B,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;gBAC3B,MAAM,IAAI,qBAAqB,CAC7B,WAAW,IAAI,CAAC,QAAQ,sEAAsE,EAC9F,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CACvB,CAAC;YACJ,CAAC;YAED,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,qBAAqB,CAC7B,WAAW,IAAI,CAAC,QAAQ,qBAAqB,EAC7C,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CACvB,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,qBAAqB,CAC7B,WAAW,IAAI,CAAC,QAAQ,wBAAwB,EAChD,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CACvB,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAgC,CAAC;YAE/C,IAAI,CAAC,KAAK,GAAG;gBACX,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU;aACtC,CAAC;YAEF,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG,KAA4C,CAAC;YAC9D,IAAI,OAAO,GAAG,8BAA8B,IAAI,CAAC,QAAQ,GAAG,CAAC;YAE7D,IAAI,QAAQ,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBAClD,OAAO,GAAG,WAAW,IAAI,CAAC,QAAQ,oCAAoC,CAAC;YACzE,CAAC;iBAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;gBACrD,OAAO,GAAG,4BAA4B,IAAI,CAAC,QAAQ,2BAA2B,CAAC;YACjF,CAAC;iBAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAC5B,OAAO,GAAG,GAAG,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC9C,CAAC;YAED,MAAM,IAAI,qBAAqB,CAAC,OAAO,EAAE;gBACvC,GAAG,EAAE,IAAI,CAAC,QAAQ;gBAClB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,4CAA4C;IAC9C,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;CACF"}

package/dist/secrets/providers/vault.d.ts

@@ -1,75 +0,0 @@
-/**
- * HashiCorp Vault secret provider.
- *
- * Reads secrets from HashiCorp Vault KV secrets engine (v1 and v2).
- * Supports field extraction from JSON secrets.
- *
- * Usage in DSL:
- *   secret("vault:secret/data/myapp/config")
- *   secret("vault:secret/data/myapp/config", { field: "api_key" })
- *   secret("vault:secret/data/myapp/config", { version: "2" })
- */
-import type { SecretProvider, SecretResolveOptions } from "../types.js";
-/**
- * HTTP client interface for Vault API calls.
- * This allows dependency injection without requiring a specific HTTP library.
- */
-export interface VaultHttpClient {
-    get(url: string, options: {
-        headers: Record<string, string>;
-    }): Promise<{
-        status: number;
-        data: unknown;
-    }>;
-}
-export interface VaultProviderOptions {
-    /**
-     * Vault server address (e.g., "https://vault.example.com:8200").
-     */
-    address: string;
-    /**
-     * Authentication token.
-     */
-    token: string;
-    /**
-     * HTTP client for making requests to Vault.
-     */
-    httpClient: VaultHttpClient;
-    /**
-     * Optional namespace for Vault Enterprise.
-     */
-    namespace?: string;
-    /**
-     * KV secrets engine version (1 or 2).
-     * Defaults to 2.
-     */
-    kvVersion?: 1 | 2;
-    /**
-     * Optional prefix for secret paths.
-     */
-    prefix?: string;
-}
-export declare class VaultProvider implements SecretProvider {
-    readonly name = "vault";
-    private readonly address;
-    private readonly token;
-    private readonly httpClient;
-    private readonly namespace?;
-    private readonly kvVersion;
-    private readonly prefix;
-    private cache;
-    private readonly cacheTtlMs;
-    constructor(options: VaultProviderOptions);
-    resolve(ref: string, options?: SecretResolveOptions): Promise<string>;
-    /**
-     * Extract a field from the secret data.
-     * If no field is specified, returns the entire data as JSON string.
-     */
-    private extractField;
-    validate(): Promise<void>;
-    /**
-     * Clear the cache. Useful for testing or forced refresh.
-     */
-    clearCache(): void;
-}
-//# sourceMappingURL=vault.d.ts.map

package/dist/secrets/providers/vault.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../../src/secrets/providers/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGxE;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CACD,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC3C,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,OAAO,CAAC;KACf,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,UAAU,EAAE,eAAe,CAAC;IAE5B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAElB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,aAAc,YAAW,cAAc;IAClD,QAAQ,CAAC,IAAI,WAAW;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAGhC,OAAO,CAAC,KAAK,CAGT;IACJ,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;gBAEhC,OAAO,EAAE,oBAAoB;IASnC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC;IAoG3E;;;OAGG;IACH,OAAO,CAAC,YAAY;IAuBd,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC/B;;OAEG;IACH,UAAU,IAAI,IAAI;CAGnB"}