@heossi/qnsi 0.5.1 → 0.5.2

package/dist/vault.d.ts

@@ -13,7 +13,26 @@ export declare class VaultClient {
     private readonly internal;
     constructor(internal: Internal);
     createSecret(req: CreateSecretRequest, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    /** Secret metadata + the ML-KEM-wrapped envelope (NOT the plaintext). */
     getSecret(secretId: string): Promise<Record<string, unknown>>;
+    /**
+     * The DECRYPTED plaintext of a secret: `{ value }`. Server-side unwrap of the
+     * ML-KEM-wrapped envelope, tenant-isolated by the API key.
+     */
+    getSecretValue(secretId: string): Promise<{
+        value: string;
+    }>;
+    /**
+     * List the tenant's secrets (metadata: id, name, versions — never the payload).
+     * The tenant is derived from the API key. Use to resolve a secret by name.
+     */
+    listSecrets(query?: RequestOptions["query"]): Promise<Record<string, unknown>>;
+    /**
+     * Resolve a secret by NAME to its decrypted plaintext string, or null if no
+     * secret with that name exists. The vault addresses secrets by id, so this
+     * lists (to map name→id) then fetches the decrypted value.
+     */
+    getSecretValueByName(name: string): Promise<string | null>;
     getSecretVersion(secretId: string, version: number): Promise<Record<string, unknown>>;
     rotateSecret(secretId: string, payloadB64: string, algorithm?: string, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
     deleteSecret(secretId: string): Promise<Record<string, unknown>>;

package/dist/vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAI/D,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,qBAAa,WAAW;IACX,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ;IAE/C,YAAY,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAYpF,SAAS,CAAC,QAAQ,EAAE,MAAM;IAI1B,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAIlD,YAAY,CACX,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAS9C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIhE,kBAAkB,CAAC,QAAQ,EAAE,MAAM;CAGnC"}
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAI/D,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,qBAAa,WAAW;IACX,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ;IAE/C,YAAY,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAYpF,yEAAyE;IACzE,SAAS,CAAC,QAAQ,EAAE,MAAM;IAI1B;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAM5D;;;OAGG;IACH,WAAW,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC;IAI3C;;;;OAIG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAShE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAIlD,YAAY,CACX,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAS9C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIhE,kBAAkB,CAAC,QAAQ,EAAE,MAAM;CAGnC"}

package/dist/vault.js

@@ -19,9 +19,38 @@ export class VaultClient {
         const body = { name: req.name, payload: req.payloadB64, metadata };
         return this.internal.request("POST", `${PATH_PREFIX}/secrets`, body, opts);
     }
+    /** Secret metadata + the ML-KEM-wrapped envelope (NOT the plaintext). */
     getSecret(secretId) {
         return this.internal.request("GET", `${PATH_PREFIX}/secrets/${secretId}`);
     }
+    /**
+     * The DECRYPTED plaintext of a secret: `{ value }`. Server-side unwrap of the
+     * ML-KEM-wrapped envelope, tenant-isolated by the API key.
+     */
+    getSecretValue(secretId) {
+        return this.internal.request("GET", `${PATH_PREFIX}/secrets/${secretId}/value`);
+    }
+    /**
+     * List the tenant's secrets (metadata: id, name, versions — never the payload).
+     * The tenant is derived from the API key. Use to resolve a secret by name.
+     */
+    listSecrets(query) {
+        return this.internal.request("GET", `${PATH_PREFIX}/secrets`, undefined, { query });
+    }
+    /**
+     * Resolve a secret by NAME to its decrypted plaintext string, or null if no
+     * secret with that name exists. The vault addresses secrets by id, so this
+     * lists (to map name→id) then fetches the decrypted value.
+     */
+    async getSecretValueByName(name) {
+        const listed = (await this.listSecrets());
+        const match = (listed?.secrets ?? []).find((s) => s["name"] === name);
+        const id = match?.["id"];
+        if (typeof id !== "string")
+            return null;
+        const { value } = await this.getSecretValue(id);
+        return value ?? null;
+    }
     getSecretVersion(secretId, version) {
         return this.internal.request("GET", `${PATH_PREFIX}/secrets/${secretId}/versions/${version}`);
     }

package/dist/vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAStC,MAAM,OAAO,WAAW;IACM;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,YAAY,CAAC,GAAwB,EAAE,IAA6C;QACnF,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,QAAQ,GAAG;YAChB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;QACF,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,SAAS,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,gBAAgB,CAAC,QAAgB,EAAE,OAAe;QACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,aAAa,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,YAAY,CACX,QAAgB,EAChB,UAAkB,EAClB,SAAkB,EAClB,IAA6C;QAE7C,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,IAAI,GAA4B,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACjE,IAAI,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,YAAY,QAAQ,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/F,CAAC;IAED,YAAY,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,WAAW,YAAY,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,kBAAkB,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,WAAW,CAAC,CAAC;IACpF,CAAC;CACD"}
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAStC,MAAM,OAAO,WAAW;IACM;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,YAAY,CAAC,GAAwB,EAAE,IAA6C;QACnF,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,QAAQ,GAAG;YAChB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;QACF,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,yEAAyE;IACzE,SAAS,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,QAAQ,CAE5E,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,KAA+B;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,UAAU,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAY;QACtC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAiD,CAAC;QAC1F,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QACtE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAChD,OAAO,KAAK,IAAI,IAAI,CAAC;IACtB,CAAC;IAED,gBAAgB,CAAC,QAAgB,EAAE,OAAe;QACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,aAAa,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,YAAY,CACX,QAAgB,EAChB,UAAkB,EAClB,SAAkB,EAClB,IAA6C;QAE7C,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,IAAI,GAA4B,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACjE,IAAI,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,YAAY,QAAQ,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/F,CAAC;IAED,YAAY,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,WAAW,YAAY,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,kBAAkB,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,QAAQ,WAAW,CAAC,CAAC;IACpF,CAAC;CACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heossi/qnsi",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "publishConfig": {
     "access": "public"
   },