@indigoai-us/hq-cloud 5.1.0

package/dist/types.d.ts

@@ -0,0 +1,52 @@
+/**
+ * HQ Cloud Sync Types
+ */
+export interface SyncConfig {
+    bucket: string;
+    region: string;
+    userId: string;
+    prefix: string;
+}
+export interface Credentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    expiration?: string;
+    refreshToken: string;
+    userId: string;
+    bucket: string;
+    region: string;
+    teamId?: string;
+}
+export interface JournalEntry {
+    hash: string;
+    size: number;
+    syncedAt: string;
+    direction: "up" | "down";
+}
+export interface SyncJournal {
+    version: "1";
+    lastSync: string;
+    files: Record<string, JournalEntry>;
+}
+export interface SyncStatus {
+    running: boolean;
+    lastSync: string | null;
+    fileCount: number;
+    bucket: string | null;
+    errors: string[];
+}
+export interface PushResult {
+    filesUploaded: number;
+    bytesUploaded: number;
+}
+export interface PullResult {
+    filesDownloaded: number;
+    bytesDownloaded: number;
+}
+export interface DaemonState {
+    pid: number;
+    startedAt: string;
+    hqRoot: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,GAAG,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/dist/types.js

@@ -0,0 +1,5 @@
+/**
+ * HQ Cloud Sync Types
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/vault-client.d.ts

@@ -0,0 +1,164 @@
+/**
+ * VaultClient — typed SDK for vault-service membership operations (VLT-7 US-001).
+ *
+ * Wraps vault-service HTTP API with shared auth, retry, and typed errors.
+ * Colocated with hq-cloud so /invite, /promote, /accept and future commands
+ * share one client instead of each rolling its own HTTP layer.
+ */
+import type { VaultServiceConfig } from "./types.js";
+export declare class VaultClientError extends Error {
+    readonly statusCode: number;
+    readonly body?: string | undefined;
+    constructor(message: string, statusCode: number, body?: string | undefined);
+}
+export declare class VaultAuthError extends VaultClientError {
+    constructor(message?: string);
+}
+export declare class VaultPermissionDeniedError extends VaultClientError {
+    constructor(message?: string);
+}
+export declare class VaultNotFoundError extends VaultClientError {
+    constructor(message?: string);
+}
+export declare class VaultConflictError extends VaultClientError {
+    constructor(message?: string);
+}
+export type MembershipRole = "owner" | "admin" | "member" | "guest";
+export type MembershipStatus = "pending" | "active" | "revoked";
+export interface Membership {
+    membershipKey: string;
+    personUid: string;
+    companyUid: string;
+    role: MembershipRole;
+    status: MembershipStatus;
+    allowedPrefixes?: string[];
+    inviteToken?: string;
+    invitedBy: string;
+    invitedAt: string;
+    acceptedAt?: string;
+    revokedAt?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface CreateInviteInput {
+    personUid?: string;
+    inviteeEmail?: string;
+    companyUid: string;
+    role: MembershipRole;
+    allowedPrefixes?: string[];
+    invitedBy: string;
+}
+export interface CreateInviteResult {
+    membership: Membership;
+    inviteToken: string;
+}
+export interface AcceptInviteResult {
+    membership: Membership;
+}
+export interface UpdateRoleInput {
+    membershipKey: string;
+    newRole: MembershipRole;
+    allowedPrefixes?: string[];
+    updaterUid: string;
+    /** Required so the server can authorize the caller as admin/owner of the company. */
+    companyUid: string;
+}
+export interface EntityInfo {
+    uid: string;
+    slug: string;
+    type: string;
+    bucketName?: string;
+    status: string;
+}
+export interface CreateEntityInput {
+    type: "person" | "company";
+    slug: string;
+    name: string;
+    email?: string;
+    ownerUid?: string;
+}
+export interface CreateEntityResult {
+    entity: EntityInfo;
+}
+export type TaskAction = "read" | "write";
+export interface TaskScope {
+    /** S3 key prefixes the child may access (e.g. ["drafts/"]). */
+    allowedPrefixes: string[];
+    /** Defaults to ["read", "write"]. Use ["read"] for read-only children. */
+    allowedActions?: TaskAction[];
+}
+export interface VendChildInput {
+    companyUid: string;
+    /** ULID generated by the parent task. Flows into STS session name for audit. */
+    taskId: string;
+    /** Short human-readable description (<256 chars). Logged alongside the session. */
+    taskDescription: string;
+    taskScope: TaskScope;
+    /**
+     * Child session duration in seconds. Defaults to 900 on the server — AWS STS
+     * AssumeRole enforces a 900s floor. The task-scoped policy is the security
+     * boundary, not the duration.
+     */
+    durationSeconds?: number;
+}
+export interface StsChildCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string;
+}
+export interface VendChildResult {
+    credentials: StsChildCredentials;
+    /** STS session name: `${parentPersonUid}--task--${taskId}` — used in CloudTrail.
+     *  (Dash-separated because AWS STS `roleSessionName` disallows colons.) */
+    sessionName: string;
+    /** ISO-8601 session expiration. */
+    expiresAt: string;
+}
+export declare class VaultClient {
+    private readonly apiUrl;
+    private readonly authToken;
+    constructor(config: VaultServiceConfig);
+    createInvite(input: CreateInviteInput): Promise<CreateInviteResult>;
+    acceptInvite(token: string, personUid: string): Promise<AcceptInviteResult>;
+    /**
+     * Revoke a membership. The handler needs both the membershipKey AND the
+     * companyUid so it can authorize the caller as admin/owner of the company
+     * before performing the revoke. (We can't infer companyUid from the key
+     * alone without an extra DDB read, and the caller already knows it.)
+     */
+    revokeMembership(membershipKey: string, companyUid: string): Promise<void>;
+    listMembersOfCompany(companyUid: string): Promise<Membership[]>;
+    updateRole(input: UpdateRoleInput): Promise<Membership>;
+    listPendingInvites(companyUid: string): Promise<Membership[]>;
+    readonly entity: {
+        get: (uid: string) => Promise<EntityInfo>;
+        findBySlug: (type: string, slug: string) => Promise<EntityInfo>;
+        create: (input: CreateEntityInput) => Promise<EntityInfo>;
+    };
+    provisionBucket(companyUid: string): Promise<{
+        bucketName: string;
+        kmsKeyId: string;
+    }>;
+    readonly sts: {
+        /**
+         * Vend task-scoped child credentials strictly narrower than the caller's
+         * own membership. Backed by the vault-service `POST /sts/vend-child`
+         * route (kebab-case to match the rest of the vault-service API).
+         *
+         * The child policy is intersected with the caller's membership on the
+         * server — if `taskScope.allowedPrefixes` requests anything the parent
+         * can't see, the server throws ScopeExceedsParentError before calling STS.
+         *
+         * Session name format: `${parentPersonUid}--task--${taskId}` — this lands
+         * in CloudTrail verbatim, so every child S3 action can be traced back to
+         * the parent task for incident response.
+         */
+        vendChild: (input: VendChildInput) => Promise<VendChildResult>;
+    };
+    private get;
+    private post;
+    private request;
+    private mapError;
+    private extractMessage;
+}
+//# sourceMappingURL=vault-client.d.ts.map

package/dist/vault-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-client.d.ts","sourceRoot":"","sources":["../src/vault-client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAMrD,qBAAa,gBAAiB,SAAQ,KAAK;aAGvB,UAAU,EAAE,MAAM;aAClB,IAAI,CAAC,EAAE,MAAM;gBAF7B,OAAO,EAAE,MAAM,EACC,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED,qBAAa,cAAe,SAAQ,gBAAgB;gBACtC,OAAO,SAAuD;CAI3E;AAED,qBAAa,0BAA2B,SAAQ,gBAAgB;gBAClD,OAAO,SAA4C;CAIhE;AAED,qBAAa,kBAAmB,SAAQ,gBAAgB;gBAC1C,OAAO,SAAuB;CAI3C;AAED,qBAAa,kBAAmB,SAAQ,gBAAgB;gBAC1C,OAAO,SAA+D;CAInF;AAMD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,CAAC;CACpB;AAID,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAE1C,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,SAAS,CAAC;IACrB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,mBAAmB,CAAC;IACjC;+EAC2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAqBD,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,MAAM,EAAE,kBAAkB;IAOhC,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQnE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQjF;;;;;OAKG;IACG,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1E,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAO/D,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAQvD,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IASnE,QAAQ,CAAC,MAAM;mBACI,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;2BAKpB,MAAM,QAAQ,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;wBAO7C,iBAAiB,KAAG,OAAO,CAAC,UAAU,CAAC;MAI7D;IAII,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAU5F,QAAQ,CAAC,GAAG;QACV;;;;;;;;;;;;WAYG;2BACsB,cAAc,KAAG,OAAO,CAAC,eAAe,CAAC;MAIlE;YAIY,GAAG;YAIH,IAAI;YAIJ,OAAO;IAiDrB,OAAO,CAAC,QAAQ;IAiBhB,OAAO,CAAC,cAAc;CAQvB"}

package/dist/vault-client.js

@@ -0,0 +1,209 @@
+/**
+ * VaultClient — typed SDK for vault-service membership operations (VLT-7 US-001).
+ *
+ * Wraps vault-service HTTP API with shared auth, retry, and typed errors.
+ * Colocated with hq-cloud so /invite, /promote, /accept and future commands
+ * share one client instead of each rolling its own HTTP layer.
+ */
+// ---------------------------------------------------------------------------
+// Error classes
+// ---------------------------------------------------------------------------
+export class VaultClientError extends Error {
+    statusCode;
+    body;
+    constructor(message, statusCode, body) {
+        super(message);
+        this.statusCode = statusCode;
+        this.body = body;
+        this.name = "VaultClientError";
+    }
+}
+export class VaultAuthError extends VaultClientError {
+    constructor(message = "Authentication failed — session expired or invalid") {
+        super(message, 401);
+        this.name = "VaultAuthError";
+    }
+}
+export class VaultPermissionDeniedError extends VaultClientError {
+    constructor(message = "Permission denied — admin role required") {
+        super(message, 403);
+        this.name = "VaultPermissionDeniedError";
+    }
+}
+export class VaultNotFoundError extends VaultClientError {
+    constructor(message = "Resource not found") {
+        super(message, 404);
+        this.name = "VaultNotFoundError";
+    }
+}
+export class VaultConflictError extends VaultClientError {
+    constructor(message = "Conflict — resource already exists or was already accepted") {
+        super(message, 409);
+        this.name = "VaultConflictError";
+    }
+}
+// ---------------------------------------------------------------------------
+// Retry config
+// ---------------------------------------------------------------------------
+const MAX_RETRIES = 3;
+const BASE_DELAY_MS = 500;
+function isTransient(status) {
+    return status === 429 || status >= 500;
+}
+async function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+// ---------------------------------------------------------------------------
+// VaultClient
+// ---------------------------------------------------------------------------
+export class VaultClient {
+    apiUrl;
+    authToken;
+    constructor(config) {
+        this.apiUrl = config.apiUrl.replace(/\/+$/, "");
+        this.authToken = config.authToken;
+    }
+    // -- Membership operations ------------------------------------------------
+    async createInvite(input) {
+        const data = await this.post("/membership/invite", input);
+        return data;
+    }
+    async acceptInvite(token, personUid) {
+        const data = await this.post("/membership/accept", { token, personUid });
+        return data;
+    }
+    /**
+     * Revoke a membership. The handler needs both the membershipKey AND the
+     * companyUid so it can authorize the caller as admin/owner of the company
+     * before performing the revoke. (We can't infer companyUid from the key
+     * alone without an extra DDB read, and the caller already knows it.)
+     */
+    async revokeMembership(membershipKey, companyUid) {
+        await this.post("/membership/revoke", { membershipKey, companyUid });
+    }
+    async listMembersOfCompany(companyUid) {
+        const data = await this.get(`/membership/company/${encodeURIComponent(companyUid)}`);
+        return data.members;
+    }
+    async updateRole(input) {
+        const data = await this.post("/membership/role", input);
+        return data.membership;
+    }
+    async listPendingInvites(companyUid) {
+        const data = await this.get(`/membership/company/${encodeURIComponent(companyUid)}/pending`);
+        return data.invites;
+    }
+    // -- Entity operations ----------------------------------------------------
+    entity = {
+        get: async (uid) => {
+            const data = await this.get(`/entity/${encodeURIComponent(uid)}`);
+            return data.entity;
+        },
+        findBySlug: async (type, slug) => {
+            const data = await this.get(`/entity/by-slug/${encodeURIComponent(type)}/${encodeURIComponent(slug)}`);
+            return data.entity;
+        },
+        create: async (input) => {
+            const data = await this.post("/entity", input);
+            return data.entity;
+        },
+    };
+    // -- Provisioning operations (VLT-2) -----------------------------------------
+    async provisionBucket(companyUid) {
+        const data = await this.post("/provision/bucket", { companyUid });
+        return data;
+    }
+    // -- STS operations (VLT-8) -----------------------------------------------
+    sts = {
+        /**
+         * Vend task-scoped child credentials strictly narrower than the caller's
+         * own membership. Backed by the vault-service `POST /sts/vend-child`
+         * route (kebab-case to match the rest of the vault-service API).
+         *
+         * The child policy is intersected with the caller's membership on the
+         * server — if `taskScope.allowedPrefixes` requests anything the parent
+         * can't see, the server throws ScopeExceedsParentError before calling STS.
+         *
+         * Session name format: `${parentPersonUid}--task--${taskId}` — this lands
+         * in CloudTrail verbatim, so every child S3 action can be traced back to
+         * the parent task for incident response.
+         */
+        vendChild: async (input) => {
+            const data = await this.post("/sts/vend-child", input);
+            return data;
+        },
+    };
+    // -- HTTP primitives with retry -------------------------------------------
+    async get(path) {
+        return this.request("GET", path);
+    }
+    async post(path, body) {
+        return this.request("POST", path, body);
+    }
+    async request(method, path, body) {
+        let lastError;
+        for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+            if (attempt > 0) {
+                const delay = BASE_DELAY_MS * Math.pow(2, attempt - 1);
+                await sleep(delay);
+            }
+            const headers = {
+                Authorization: `Bearer ${this.authToken}`,
+                Accept: "application/json",
+            };
+            const init = { method, headers };
+            if (body !== undefined) {
+                headers["Content-Type"] = "application/json";
+                init.body = JSON.stringify(body);
+            }
+            let res;
+            try {
+                res = await fetch(`${this.apiUrl}${path}`, init);
+            }
+            catch (err) {
+                lastError = err instanceof Error ? err : new Error(String(err));
+                if (attempt < MAX_RETRIES)
+                    continue;
+                throw lastError;
+            }
+            if (res.ok) {
+                if (res.status === 204)
+                    return undefined;
+                return (await res.json());
+            }
+            const responseBody = await res.text();
+            // Non-retryable errors → throw immediately
+            if (!isTransient(res.status)) {
+                throw this.mapError(res.status, responseBody);
+            }
+            // Retryable — store and loop
+            lastError = this.mapError(res.status, responseBody);
+        }
+        throw lastError ?? new VaultClientError("Request failed after retries", 500);
+    }
+    mapError(status, body) {
+        const message = this.extractMessage(body);
+        switch (status) {
+            case 401:
+                return new VaultAuthError(message);
+            case 403:
+                return new VaultPermissionDeniedError(message);
+            case 404:
+                return new VaultNotFoundError(message);
+            case 409:
+                return new VaultConflictError(message);
+            default:
+                return new VaultClientError(message || `Request failed with status ${status}`, status, body);
+        }
+    }
+    extractMessage(body) {
+        try {
+            const parsed = JSON.parse(body);
+            return parsed.message ?? parsed.error ?? body;
+        }
+        catch {
+            return body;
+        }
+    }
+}
+//# sourceMappingURL=vault-client.js.map

package/dist/vault-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-client.js","sourceRoot":"","sources":["../src/vault-client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAGvB;IACA;IAHlB,YACE,OAAe,EACC,UAAkB,EAClB,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,gBAAgB;IAClD,YAAY,OAAO,GAAG,oDAAoD;QACxE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,gBAAgB;IAC9D,YAAY,OAAO,GAAG,yCAAyC;QAC7D,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IACtD,YAAY,OAAO,GAAG,oBAAoB;QACxC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IACtD,YAAY,OAAO,GAAG,4DAA4D;QAChF,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAiHD,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,EAAU;IAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,OAAO,WAAW;IACL,MAAM,CAAS;IACf,SAAS,CAAS;IAEnC,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACpC,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,YAAY,CAAC,KAAwB;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAC1B,oBAAoB,EACpB,KAAK,CACN,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,SAAiB;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAC1B,oBAAoB,EACpB,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,aAAqB,EAAE,UAAkB;QAC9D,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,UAAkB;QAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CACzB,uBAAuB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CACxD,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAsB;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAC1B,kBAAkB,EAClB,KAAK,CACN,CAAC;QACF,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,UAAkB;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CACzB,uBAAuB,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAChE,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,4EAA4E;IAEnE,MAAM,GAAG;QAChB,GAAG,EAAE,KAAK,EAAE,GAAW,EAAuB,EAAE;YAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAyB,WAAW,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED,UAAU,EAAE,KAAK,EAAE,IAAY,EAAE,IAAY,EAAuB,EAAE;YACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CACzB,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAC1E,CAAC;YACF,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,KAAwB,EAAuB,EAAE;YAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAqB,SAAS,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;KACF,CAAC;IAEF,+EAA+E;IAE/E,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAC1B,mBAAmB,EACnB,EAAE,UAAU,EAAE,CACf,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAEnE,GAAG,GAAG;QACb;;;;;;;;;;;;WAYG;QACH,SAAS,EAAE,KAAK,EAAE,KAAqB,EAA4B,EAAE;YACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAkB,iBAAiB,EAAE,KAAK,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,4EAA4E;IAEpE,KAAK,CAAC,GAAG,CAAI,IAAY;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc;QAChD,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,IAAI,SAA4B,CAAC;QAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;gBACvD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YAED,MAAM,OAAO,GAA2B;gBACtC,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;gBACzC,MAAM,EAAE,kBAAkB;aAC3B,CAAC;YAEF,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAE9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;gBAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAED,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChE,IAAI,OAAO,GAAG,WAAW;oBAAE,SAAS;gBACpC,MAAM,SAAS,CAAC;YAClB,CAAC;YAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,SAAc,CAAC;gBAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;YACjC,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAEtC,2CAA2C;YAC3C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAChD,CAAC;YAED,6BAA6B;YAC7B,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,SAAS,IAAI,IAAI,gBAAgB,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC;IAEO,QAAQ,CAAC,MAAc,EAAE,IAAY;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE1C,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,GAAG;gBACN,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;YACrC,KAAK,GAAG;gBACN,OAAO,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;YACjD,KAAK,GAAG;gBACN,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACzC,KAAK,GAAG;gBACN,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACzC;gBACE,OAAO,IAAI,gBAAgB,CAAC,OAAO,IAAI,8BAA8B,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,IAAY;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyC,CAAC;YACxE,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/vault-client.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * VaultClient unit tests (VLT-7 US-001).
+ *
+ * Uses mocked fetch to assert retry behavior, error mapping, and auth header injection.
+ */
+export {};
+//# sourceMappingURL=vault-client.test.d.ts.map

package/dist/vault-client.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-client.test.d.ts","sourceRoot":"","sources":["../src/vault-client.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}