@kibibit/configit 2.12.2 → 2.13.0

package/lib/vault/vault-integration.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-integration.js","sourceRoot":"","sources":["../../src/vault/vault-integration.ts"],"names":[],"mappings":";;;AAKA,6CAAmD;AACnD,qEAAgE;AAOhE,+CAA2C;AAC3C,qDAAiD;AAKjD,MAAa,gBAAgB;IAU3B,YAAY,MAA2B;QAN/B,gBAAW,GAAG,KAAK,CAAC;QAEpB,WAAM,GAAkF,EAAE,CAAC;QAE3F,kBAAa,GAA0C,EAAE,CAAC;QAGhE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,IAAI,8BAAa,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,wBAAU,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC;QAClD,IAAI,CAAC,cAAc,GAAG,IAAI,6CAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC3F,CAAC;IAMD,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW,EAAE;YACpB,OAAO;SACR;QAED,IAAI;YACF,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;SACzB;QAAC,OAAO,KAAU,EAAE;YACnB,MAAM,YAAY,GAAG,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,KAAI,eAAe,CAAC;YACvD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC;SACb;IACH,CAAC;IAMD,KAAK,CAAC,WAAW,CAAmB,aAAgC;;QAClE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACrB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;SAC/E;QAGD,MAAM,OAAO,GAAG,OAAO,aAAa,KAAK,UAAU,CAAC;QACpD,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAE,aAAa,CAAC,WAA2B,CAAC;QACzF,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAGtD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,IAAA,gCAAmB,EAAC,WAAW,CAAC,CAAC;QAEtD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;YAChD,OAAO;SACR;QAGD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAG5D,KAAK,MAAM,CAAE,QAAQ,EAAE,UAAU,CAAE,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE;YAC3D,IAAI;gBACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAGlD,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE;oBAEjC,MAAM,oBAAoB,mCACrB,QAAQ,KAEX,aAAa,EAAE,MAAA,QAAQ,CAAC,aAAa,mCAAI,IAAI,CAAC,MAAM,CAAC,aAAa,GACnE,CAAC;oBAEF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;oBAG9E,IAAI,cAAc,EAAE;wBAClB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,YAAY,CAAC;wBAClD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAC9B,cAAsB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC;qBACxD;oBAGD,IAAI,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE;wBAC5B,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,QAAQ,CAAC,YAAY,EAAE,oBAAoB,EAAE,cAAc,CAAC,CAAC;qBAClG;iBACF;aACF;YAAC,OAAO,KAAU,EAAE;gBACnB,MAAM,YAAY,GAAG,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,KAAI,eAAe,CAAC;gBACvD,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBACxD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;gBAGzE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACtC,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,MAAK,KAAK,EAAE;oBAEhC,MAAM,IAAI,KAAK,CAAC,uCAAwC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAE,KAAM,cAAe,EAAE,CAAC,CAAC;iBAC9G;gBAGD,OAAO,CAAC,IAAI,CAAC,uCAAwC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAE,KAAM,cAAe,EAAE,CAAC,CAAC;aAC3G;SACF;IACH,CAAC;IAMD,SAAS,CAAC,YAAoB;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAKD,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAOD,sBAAsB,CAAmB,QAAW;;QAClD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;YAEhD,OAAO;SACR;QAGD,KAAK,MAAM,CAAE,YAAY,EAAE,QAAQ,CAAE,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;YAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,EAAE;gBACV,SAAS;aACV;YAGD,MAAM,oBAAoB,mCACrB,QAAQ,KACX,aAAa,EAAE,MAAA,QAAQ,CAAC,aAAa,mCAAI,IAAI,CAAC,MAAM,CAAC,aAAa,GACnE,CAAC;YAGF,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE;gBAClC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,YAAY,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;aACnF;SACF;IACH,CAAC;IAKD,SAAS;QACP,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC;QAC7D,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YACtD,CAAC,CAAC;QAEJ,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE;YAC9D,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE;YAC9C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAC5B,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM;YACjE,eAAe;YACf,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;SAC/B,CAAC;IACJ,CAAC;IAKD,gBAAgB;QACd,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC;QAE7D,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE;YAC9D,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE;YAC9C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAC5B,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM;YACjE,eAAe,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACzC,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBACtD,CAAC;YACH,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9B,aAAa;SACd,CAAC;IACJ,CAAC;IAKD,eAAe,CAAC,SAAiB;QAC/B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAEjC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC9D,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE;YACrC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;SACjD;IACH,CAAC;IAKD,kBAAkB,CAAC,YAAoB;QACrC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAKD,QAAQ;QACN,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;IAC3B,CAAC;IAKO,WAAW,CAAC,QAA+C;QACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;QAE1D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;YAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;gBACrB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;aACtB;YACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAClC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAKO,eAAe,CAAC,QAA+C;QACrE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;QAE1D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;gBACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;aAC1B;YACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SACtC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAKO,iBAAiB,CAAC,IAAY,EAAE,MAAc;QACpD,QAAQ,MAAM,EAAE;YACd,KAAK,KAAK,CAAC;YACX,KAAK,OAAO;gBACV,OAAO,UAAW,IAAK,EAAE,CAAC;YAC5B,KAAK,KAAK,CAAC;YACX,KAAK,OAAO;gBACV,OAAO,eAAgB,IAAK,EAAE,CAAC;YACjC,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAa,IAAK,EAAE,CAAC;YACpE;gBACE,OAAO,IAAI,CAAC;SACf;IACH,CAAC;IAKO,WAAW,CAAC,IAAY,EAAE,KAAa,EAAE,SAAkB;QACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAC7B,KAAK;YACL,SAAS;SACV,CAAC,CAAC;QAGH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;SACrB;IACH,CAAC;IAKO,gBAAgB,CAAC,KAAU;;QACjC,MAAM,YAAY,GAAG,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,KAAI,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,KAAI,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,UAAU,MAAI,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,UAAU,CAAA,CAAC;QAEpE,MAAM,iBAAiB,GAAG,CAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,CAAE,CAAC;QAE9E,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE;YACvC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE;gBACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;gBAClD,IAAI,YAAY,KAAK,UAAU,EAAE;oBAC/B,OAAO,IAAI,CAAC;iBACb;aACF;iBAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE;gBACxE,OAAO,IAAI,CAAC;aACb;SACF;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAKO,aAAa,CAAC,OAAe;QACnC,MAAM,iBAAiB,GAAG,CAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAE,CAAC;QACtF,IAAI,SAAS,GAAG,OAAO,CAAC;QAExB,iBAAiB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACpC,SAAS,GAAG,SAAS,CAAC,OAAO,CAC3B,IAAI,MAAM,CAAC,GAAI,OAAO,CAAC,MAAO,mBAAmB,EAAE,IAAI,CAAC,EACxD,GAAI,OAAO,CAAC,MAAO,OAAO,CAC3B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAKO,YAAY,CAAC,IAAY;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;YACvB,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAClD,MAAM,iBAAiB,GAAG,CAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAE,CAAC;YACtF,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE;gBAClE,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;aACvC;SACF;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;CACF;AA1VD,4CA0VC"}
+{"version":3,"file":"vault-integration.js","sourceRoot":"","sources":["../../src/vault/vault-integration.ts"],"names":[],"mappings":";;;AAKA,6CAAmD;AACnD,qEAAgE;AAQhE,+CAA2C;AAC3C,qDAAiD;AAKjD,MAAa,gBAAgB;IAU3B,YAAY,MAA2B;QAN/B,gBAAW,GAAG,KAAK,CAAC;QAEpB,WAAM,GAAkF,EAAE,CAAC;QAE3F,kBAAa,GAA0C,EAAE,CAAC;QAGhE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,IAAI,8BAAa,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,wBAAU,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC;QAClD,IAAI,CAAC,cAAc,GAAG,IAAI,6CAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAEzF,IAAI,MAAM,CAAC,iBAAiB,EAAE;YAC5B,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;SACjE;IACH,CAAC;IAMD,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW,EAAE;YACpB,OAAO;SACR;QAED,IAAI;YACF,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;SACzB;QAAC,OAAO,KAAU,EAAE;YACnB,MAAM,YAAY,GAAG,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,KAAI,eAAe,CAAC;YACvD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC;SACb;IACH,CAAC;IAMD,KAAK,CAAC,WAAW,CAAmB,aAAgC;;QAClE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACrB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;SAC/E;QAGD,MAAM,OAAO,GAAG,OAAO,aAAa,KAAK,UAAU,CAAC;QACpD,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAE,aAAa,CAAC,WAA2B,CAAC;QACzF,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAGtD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,IAAA,gCAAmB,EAAC,WAAW,CAAC,CAAC;QAEtD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;YAChD,OAAO;SACR;QAGD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAG5D,KAAK,MAAM,CAAE,QAAQ,EAAE,UAAU,CAAE,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE;YAC3D,IAAI;gBACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAGlD,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE;oBAEjC,MAAM,oBAAoB,mCACrB,QAAQ,KAEX,aAAa,EAAE,MAAA,QAAQ,CAAC,aAAa,mCAAI,IAAI,CAAC,MAAM,CAAC,aAAa,GACnE,CAAC;oBAEF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;oBAG9E,IAAI,cAAc,EAAE;wBAClB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,YAAY,CAAC;wBAClD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAC9B,cAAsB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC;qBACxD;oBAGD,IAAI,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE;wBAC5B,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,QAAQ,CAAC,YAAY,EAAE,oBAAoB,EAAE,cAAc,CAAC,CAAC;qBAClG;iBACF;aACF;YAAC,OAAO,KAAU,EAAE;gBACnB,MAAM,YAAY,GAAG,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,KAAI,eAAe,CAAC;gBACvD,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBACxD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;gBAGzE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACtC,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,MAAK,KAAK,EAAE;oBAEhC,MAAM,IAAI,KAAK,CAAC,uCAAwC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAE,KAAM,cAAe,EAAE,CAAC,CAAC;iBAC9G;gBAGD,OAAO,CAAC,IAAI,CAAC,uCAAwC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAE,KAAM,cAAe,EAAE,CAAC,CAAC;aAC3G;SACF;IACH,CAAC;IAMD,SAAS,CAAC,YAAoB;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAKD,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAOD,sBAAsB,CAAmB,QAAW;;QAClD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;YAEhD,OAAO;SACR;QAGD,KAAK,MAAM,CAAE,YAAY,EAAE,QAAQ,CAAE,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;YAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,EAAE;gBACV,SAAS;aACV;YAGD,MAAM,oBAAoB,mCACrB,QAAQ,KACX,aAAa,EAAE,MAAA,QAAQ,CAAC,aAAa,mCAAI,IAAI,CAAC,MAAM,CAAC,aAAa,GACnE,CAAC;YAGF,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE;gBAClC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,YAAY,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;aACnF;SACF;IACH,CAAC;IAMD,iBAAiB,CAAC,QAA+B;QAC/C,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAKD,SAAS;QACP,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC;QAC7D,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YACtD,CAAC,CAAC;QAEJ,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE;YAC9D,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE;YAC9C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAC5B,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM;YACjE,eAAe;YACf,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;SAC/B,CAAC;IACJ,CAAC;IAKD,gBAAgB;QACd,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC;QAE7D,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE;YAC9D,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE;YAC9C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAC5B,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM;YACjE,eAAe,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACzC,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBACtD,CAAC;YACH,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9B,aAAa;SACd,CAAC;IACJ,CAAC;IAKD,eAAe,CAAC,SAAiB;QAC/B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAEjC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC9D,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE;YACrC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;SACjD;IACH,CAAC;IAKD,kBAAkB,CAAC,YAAoB;QACrC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAKD,QAAQ;QACN,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;IAC3B,CAAC;IAKO,WAAW,CAAC,QAA+C;QACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;QAE1D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;YAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;gBACrB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;aACtB;YACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAClC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAKO,eAAe,CAAC,QAA+C;QACrE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;QAE1D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;gBACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;aAC1B;YACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SACtC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAKO,iBAAiB,CAAC,IAAY,EAAE,MAAc;QACpD,QAAQ,MAAM,EAAE;YACd,KAAK,KAAK,CAAC;YACX,KAAK,OAAO;gBACV,OAAO,UAAW,IAAK,EAAE,CAAC;YAC5B,KAAK,KAAK,CAAC;YACX,KAAK,OAAO;gBACV,OAAO,eAAgB,IAAK,EAAE,CAAC;YACjC,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAa,IAAK,EAAE,CAAC;YACpE;gBACE,OAAO,IAAI,CAAC;SACf;IACH,CAAC;IAKO,WAAW,CAAC,IAAY,EAAE,KAAa,EAAE,SAAkB;QACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAC7B,KAAK;YACL,SAAS;SACV,CAAC,CAAC;QAGH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;SACrB;IACH,CAAC;IAKO,gBAAgB,CAAC,KAAU;;QACjC,MAAM,YAAY,GAAG,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,KAAI,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,KAAI,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,UAAU,MAAI,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,UAAU,CAAA,CAAC;QAEpE,MAAM,iBAAiB,GAAG,CAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,CAAE,CAAC;QAE9E,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE;YACvC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE;gBACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;gBAClD,IAAI,YAAY,KAAK,UAAU,EAAE;oBAC/B,OAAO,IAAI,CAAC;iBACb;aACF;iBAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE;gBACxE,OAAO,IAAI,CAAC;aACb;SACF;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAKO,aAAa,CAAC,OAAe;QACnC,MAAM,iBAAiB,GAAG,CAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAE,CAAC;QACtF,IAAI,SAAS,GAAG,OAAO,CAAC;QAExB,iBAAiB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACpC,SAAS,GAAG,SAAS,CAAC,OAAO,CAC3B,IAAI,MAAM,CAAC,GAAI,OAAO,CAAC,MAAO,mBAAmB,EAAE,IAAI,CAAC,EACxD,GAAI,OAAO,CAAC,MAAO,OAAO,CAC3B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAKO,YAAY,CAAC,IAAY;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;YACvB,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAClD,MAAM,iBAAiB,GAAG,CAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAE,CAAC;YACtF,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE;gBAClE,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;aACvC;SACF;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;CACF;AAtWD,4CAsWC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kibibit/configit",
-  "version": "2.12.2",
+  "version": "2.13.0",
   "description": "a general typescript configuration service",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/src/config.service.ts

@@ -22,7 +22,7 @@ import * as nconfJsoncFormat from '@kibibit/nconf-jsonc';
 import { ConfigValidationError } from './config.errors';
 import { BaseConfig } from './config.model';
 import { getEnvironment, setEnvironment } from './environment.service';
-import { IVaultConfigOptions, VaultHealth, VaultIntegration } from './vault';
+import { IVaultConfigOptions, SecretRefreshCallback, VaultHealth, VaultIntegration } from './vault';
 
 type INconfKibibitFormats = IFormats & {
   yaml: nconfYamlFormat;
@@ -299,6 +299,26 @@ export class ConfigService<T extends BaseConfig> {
     }
   }
 
+  /**
+   * Register a callback for when Vault secrets are refreshed.
+   * Fired once per Vault path after all properties from that path are updated.
+   * Config values are already set when the callback fires.
+   *
+   * Can be called before or after initializeVault().
+   *
+   * @example
+   * configService.onSecretRefreshed((event) => {
+   *   if (event.properties.includes('DB_PASSWORD')) {
+   *     // Reconnect database pool with fresh credentials
+   *   }
+   * });
+   */
+  onSecretRefreshed(callback: SecretRefreshCallback): void {
+    if (this.vaultIntegration) {
+      this.vaultIntegration.onSecretRefreshed(callback);
+    }
+  }
+
   /**
    * Shutdown Vault integration gracefully
    */

package/src/config.service.vault.spec.ts

@@ -77,7 +77,8 @@ describe('ConfigService + Vault Integration', () => {
       invalidateProperty: jest.fn(),
       shutdown: jest.fn(),
       isInitialized: jest.fn().mockReturnValue(true),
-      getSecret: jest.fn().mockReturnValue(null)
+      getSecret: jest.fn().mockReturnValue(null),
+      onSecretRefreshed: jest.fn()
     } as unknown as jest.Mocked<VaultIntegration>;
 
     // Ensure the mock implementation returns our mock instance
@@ -858,4 +859,49 @@ describe('ConfigService + Vault Integration', () => {
       await expect(configService.initializeVault()).rejects.toThrow('Failed to load secrets');
     });
   });
+
+  describe('onSecretRefreshed', () => {
+    it('should delegate callback registration to vaultIntegration', async () => {
+      const vaultConfig: IVaultConfigOptions = {
+        endpoint: 'http://localhost:8200',
+        auth: {
+          methods: [
+            {
+              type: 'token',
+              config: {
+                type: 'token',
+                token: 'test-token'
+              }
+            }
+          ]
+        }
+      };
+
+      const configService = new ConfigService(TestVaultConfig, {
+        NODE_ENV: 'test',
+        REGULAR_CONFIG: 'regular'
+      } as any, {
+        vault: vaultConfig
+      });
+
+      await configService.initializeVault();
+
+      const callback = jest.fn();
+      configService.onSecretRefreshed(callback);
+
+      expect(mockVaultIntegration.onSecretRefreshed).toHaveBeenCalledWith(callback);
+    });
+
+    it('should be a no-op when vault is not configured', () => {
+      const configService = new ConfigService(TestRegularConfig, {
+        NODE_ENV: 'test',
+        REGULAR_CONFIG: 'test-value'
+      } as any);
+
+      const callback = jest.fn();
+      configService.onSecretRefreshed(callback);
+
+      expect(mockVaultIntegration.onSecretRefreshed).not.toHaveBeenCalled();
+    });
+  });
 });

package/src/vault/__tests__/build-vault-config.spec.ts

@@ -0,0 +1,116 @@
+/**
+ * Unit tests for buildVaultConfigFromEnv helper.
+ * These are pure unit tests — no running Vault instance required.
+ */
+
+import { buildVaultConfigFromEnv } from '../build-vault-config';
+
+describe('buildVaultConfigFromEnv', () => {
+  const ENV_KEYS = ['VAULT_ADDR', 'VAULT_TOKEN', 'VAULT_GCP_ROLE'] as const;
+  const savedEnv: Record<string, string | undefined> = {};
+
+  beforeEach(() => {
+    for (const key of ENV_KEYS) {
+      savedEnv[key] = process.env[key];
+      delete process.env[key];
+    }
+  });
+
+  afterEach(() => {
+    for (const key of ENV_KEYS) {
+      if (savedEnv[key] !== undefined) {
+        process.env[key] = savedEnv[key];
+      } else {
+        delete process.env[key];
+      }
+    }
+  });
+
+  it('should return undefined when VAULT_ADDR is not set', () => {
+    expect(buildVaultConfigFromEnv()).toBeUndefined();
+  });
+
+  it('should return undefined when VAULT_ADDR is set but no auth env var is present', () => {
+    process.env.VAULT_ADDR = 'http://127.0.0.1:8200';
+    expect(buildVaultConfigFromEnv()).toBeUndefined();
+  });
+
+  describe('token auth (VAULT_TOKEN)', () => {
+    beforeEach(() => {
+      process.env.VAULT_ADDR = 'https://vault.example.com';
+      process.env.VAULT_TOKEN = 'my-dev-token';
+    });
+
+    it('should build config with token auth', () => {
+      const config = buildVaultConfigFromEnv();
+
+      expect(config).toBeDefined();
+      expect(config!.endpoint).toBe('https://vault.example.com');
+      expect(config!.auth).toEqual({ method: 'token', token: 'my-dev-token' });
+    });
+
+    it('should default refreshBuffer to 10 for token auth', () => {
+      const config = buildVaultConfigFromEnv();
+      expect(config!.refreshBuffer).toBe(10);
+    });
+
+    it('should allow overriding refreshBuffer', () => {
+      const config = buildVaultConfigFromEnv({ refreshBuffer: 45 });
+      expect(config!.refreshBuffer).toBe(45);
+    });
+
+    it('should apply default fallback config', () => {
+      const config = buildVaultConfigFromEnv();
+
+      expect(config!.fallback).toEqual({
+        required: false,
+        useCacheOnFailure: true,
+        maxCacheAge: 3600000,
+        failFast: false
+      });
+    });
+
+    it('should allow overriding fallback config', () => {
+      const customFallback = { required: true, useCacheOnFailure: false, maxCacheAge: 0, failFast: true };
+      const config = buildVaultConfigFromEnv({ fallback: customFallback });
+      expect(config!.fallback).toEqual(customFallback);
+    });
+
+    it('should wire through onSecretRefreshed callback', () => {
+      const callback = jest.fn();
+      const config = buildVaultConfigFromEnv({ onSecretRefreshed: callback });
+      expect(config!.onSecretRefreshed).toBe(callback);
+    });
+
+    it('should prefer VAULT_TOKEN over VAULT_GCP_ROLE when both are set', () => {
+      process.env.VAULT_GCP_ROLE = 'my-gcp-role';
+      const config = buildVaultConfigFromEnv();
+      expect((config!.auth as any).method).toBe('token');
+    });
+  });
+
+  describe('GCP auth (VAULT_GCP_ROLE)', () => {
+    beforeEach(() => {
+      process.env.VAULT_ADDR = 'https://vault.prod.example.com';
+      process.env.VAULT_GCP_ROLE = 'my-gcp-role';
+    });
+
+    it('should build config with GCP auth', () => {
+      const config = buildVaultConfigFromEnv();
+
+      expect(config).toBeDefined();
+      expect(config!.endpoint).toBe('https://vault.prod.example.com');
+      expect(config!.auth).toEqual({ method: 'gcp', role: 'my-gcp-role' });
+    });
+
+    it('should default refreshBuffer to 60 for GCP auth', () => {
+      const config = buildVaultConfigFromEnv();
+      expect(config!.refreshBuffer).toBe(60);
+    });
+
+    it('should allow overriding refreshBuffer', () => {
+      const config = buildVaultConfigFromEnv({ refreshBuffer: 120 });
+      expect(config!.refreshBuffer).toBe(120);
+    });
+  });
+});

package/src/vault/__tests__/secret-refresh-manager.spec.ts

@@ -0,0 +1,328 @@
+/**
+ * Unit tests for SecretRefreshManager
+ * Uses mocked VaultProvider and VaultCache — no running Vault required.
+ */
+
+import { SecretRefreshManager } from '../secret-refresh-manager';
+import { VaultCache } from '../vault-cache';
+import { VaultProvider } from '../vault-provider';
+import { IVaultSecret, SecretRefreshEvent, VaultCacheEntry, VaultPropertyMetadata } from '../types';
+
+jest.mock('../vault-provider');
+jest.mock('../vault-cache');
+
+function makeMetadata(overrides: Partial<VaultPropertyMetadata> = {}): VaultPropertyMetadata {
+  return {
+    propertyName: 'PROP',
+    propertyType: 'string',
+    path: 'test/path',
+    key: 'value',
+    engine: 'kv-v2',
+    required: true,
+    ...overrides
+  };
+}
+
+function makeSecret(data: Record<string, string>, leaseDuration = 60): IVaultSecret {
+  return {
+    data,
+    leaseDuration,
+    leaseId: leaseDuration > 0 ? 'lease-123' : '',
+    renewable: leaseDuration > 0
+  };
+}
+
+function makeCacheEntry(vaultPath: string, refreshAtOffset = 30000): VaultCacheEntry {
+  const now = Date.now();
+  const secret = makeSecret({ value: 'cached' });
+  return {
+    value: 'cached',
+    secret,
+    vaultPath,
+    propertyName: 'PROP',
+    cachedAt: now,
+    expiresAt: now + 60000,
+    refreshAt: now + refreshAtOffset
+  };
+}
+
+describe('SecretRefreshManager', () => {
+  let manager: SecretRefreshManager;
+  let mockProvider: jest.Mocked<VaultProvider>;
+  let mockCache: jest.Mocked<VaultCache>;
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+
+    mockProvider = new VaultProvider({} as any) as jest.Mocked<VaultProvider>;
+    mockCache = new VaultCache() as jest.Mocked<VaultCache>;
+
+    manager = new SecretRefreshManager(mockProvider, mockCache, 30);
+  });
+
+  afterEach(() => {
+    manager.shutdown();
+    jest.useRealTimers();
+  });
+
+  describe('onSecretRefreshed', () => {
+    it('should register a callback', () => {
+      const callback = jest.fn();
+      manager.onSecretRefreshed(callback);
+      expect(callback).not.toHaveBeenCalled();
+    });
+
+    it('should support multiple callbacks', () => {
+      const cb1 = jest.fn();
+      const cb2 = jest.fn();
+      manager.onSecretRefreshed(cb1);
+      manager.onSecretRefreshed(cb2);
+      expect(cb1).not.toHaveBeenCalled();
+      expect(cb2).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('scheduleRefresh', () => {
+    it('should not schedule when cache entry is missing', () => {
+      mockCache.getEntry.mockReturnValue(null as any);
+      manager.scheduleRefresh('PROP', makeMetadata());
+      expect(mockCache.getEntry).toHaveBeenCalledWith('PROP');
+    });
+
+    it('should schedule a timer when cache entry has future refreshAt', () => {
+      mockCache.getEntry.mockReturnValue(makeCacheEntry('secret/data/test/path', 5000));
+      mockProvider.read.mockResolvedValue(makeSecret({ value: 'new' }));
+
+      manager.scheduleRefresh('PROP', makeMetadata());
+
+      expect(mockCache.getEntry).toHaveBeenCalledWith('PROP');
+    });
+
+    it('should execute immediately when refreshAt is in the past', () => {
+      mockCache.getEntry.mockReturnValue(makeCacheEntry('secret/data/test/path', -1000));
+      mockProvider.read.mockResolvedValue(makeSecret({ value: 'new' }));
+
+      manager.scheduleRefresh('PROP', makeMetadata());
+    });
+  });
+
+  describe('path-level atomic refresh', () => {
+    const SHARED_PATH = 'database/creds/my-role';
+
+    beforeEach(() => {
+      mockProvider.read.mockResolvedValue(makeSecret({
+        username: 'new-user',
+        password: 'new-pass'
+      }, 60));
+    });
+
+    it('should refresh all sibling properties from a single Vault read', async () => {
+      const entry = makeCacheEntry(SHARED_PATH, 100);
+      mockCache.getEntry.mockReturnValue(entry);
+
+      const metaUser = makeMetadata({ propertyName: 'DB_USERNAME', key: 'username', engine: 'database', path: 'creds/my-role' });
+      const metaPass = makeMetadata({ propertyName: 'DB_PASSWORD', key: 'password', engine: 'database', path: 'creds/my-role' });
+
+      const target = { DB_USERNAME: 'old-user', DB_PASSWORD: 'old-pass' };
+
+      manager.scheduleRefresh('DB_USERNAME', metaUser, target);
+      manager.scheduleRefresh('DB_PASSWORD', metaPass, target);
+
+      await jest.advanceTimersByTimeAsync(200);
+
+      expect(mockProvider.read).toHaveBeenCalledTimes(1);
+      expect(mockProvider.read).toHaveBeenCalledWith(SHARED_PATH);
+    });
+
+    it('should update target instance properties from the single read', async () => {
+      const entry = makeCacheEntry(SHARED_PATH, 100);
+      mockCache.getEntry.mockReturnValue(entry);
+
+      const metaUser = makeMetadata({ propertyName: 'DB_USERNAME', key: 'username', engine: 'database', path: 'creds/my-role' });
+      const metaPass = makeMetadata({ propertyName: 'DB_PASSWORD', key: 'password', engine: 'database', path: 'creds/my-role' });
+
+      const target = { DB_USERNAME: 'old-user', DB_PASSWORD: 'old-pass' };
+
+      manager.scheduleRefresh('DB_USERNAME', metaUser, target);
+      manager.scheduleRefresh('DB_PASSWORD', metaPass, target);
+
+      await jest.advanceTimersByTimeAsync(200);
+
+      expect(target.DB_USERNAME).toBe('new-user');
+      expect(target.DB_PASSWORD).toBe('new-pass');
+    });
+
+    it('should fire one callback per path with all affected properties', async () => {
+      const events: SecretRefreshEvent[] = [];
+      manager.onSecretRefreshed((e) => { events.push(e); });
+
+      const entry = makeCacheEntry(SHARED_PATH, 100);
+      mockCache.getEntry.mockReturnValue(entry);
+
+      const metaUser = makeMetadata({ propertyName: 'DB_USERNAME', key: 'username', engine: 'database', path: 'creds/my-role' });
+      const metaPass = makeMetadata({ propertyName: 'DB_PASSWORD', key: 'password', engine: 'database', path: 'creds/my-role' });
+
+      manager.scheduleRefresh('DB_USERNAME', metaUser);
+      manager.scheduleRefresh('DB_PASSWORD', metaPass);
+
+      await jest.advanceTimersByTimeAsync(200);
+
+      expect(events).toHaveLength(1);
+      expect(events[0].vaultPath).toBe(SHARED_PATH);
+      expect(events[0].properties).toContain('DB_USERNAME');
+      expect(events[0].properties).toContain('DB_PASSWORD');
+      expect(events[0].engine).toBe('database');
+      expect(events[0].refreshCount).toBe(1);
+      expect(events[0].timestamp).toBeDefined();
+    });
+
+    it('should increment refreshCount on subsequent refreshes', async () => {
+      const events: SecretRefreshEvent[] = [];
+      manager.onSecretRefreshed((e) => { events.push(e); });
+
+      const entry = makeCacheEntry(SHARED_PATH, -100);
+      mockCache.getEntry.mockReturnValue(entry);
+
+      const meta = makeMetadata({ propertyName: 'DB_USERNAME', key: 'username', engine: 'database', path: 'creds/my-role' });
+
+      manager.scheduleRefresh('DB_USERNAME', meta);
+      await jest.advanceTimersByTimeAsync(0);
+
+      manager.scheduleRefresh('DB_USERNAME', meta);
+      await jest.advanceTimersByTimeAsync(0);
+
+      expect(events).toHaveLength(2);
+      expect(events[0].refreshCount).toBe(1);
+      expect(events[1].refreshCount).toBe(2);
+    });
+  });
+
+  describe('callback error handling', () => {
+    it('should not throw when a sync callback throws', async () => {
+      const consoleSpy = jest.spyOn(console, 'error').mockImplementation();
+
+      manager.onSecretRefreshed(() => { throw new Error('callback boom'); });
+
+      const entry = makeCacheEntry('secret/data/test', -100);
+      mockCache.getEntry.mockReturnValue(entry);
+      mockProvider.read.mockResolvedValue(makeSecret({ value: 'new' }));
+
+      manager.scheduleRefresh('PROP', makeMetadata());
+      await jest.advanceTimersByTimeAsync(0);
+
+      expect(consoleSpy).toHaveBeenCalledWith(
+        expect.stringContaining('callback boom')
+      );
+
+      consoleSpy.mockRestore();
+    });
+
+    it('should not throw when an async callback rejects', async () => {
+      const consoleSpy = jest.spyOn(console, 'error').mockImplementation();
+
+      manager.onSecretRefreshed(async () => { throw new Error('async boom'); });
+
+      const entry = makeCacheEntry('secret/data/test', -100);
+      mockCache.getEntry.mockReturnValue(entry);
+      mockProvider.read.mockResolvedValue(makeSecret({ value: 'new' }));
+
+      manager.scheduleRefresh('PROP', makeMetadata());
+      await jest.advanceTimersByTimeAsync(0);
+
+      // Give the rejected promise a tick to log
+      await Promise.resolve();
+
+      expect(consoleSpy).toHaveBeenCalledWith(
+        expect.stringContaining('async boom')
+      );
+
+      consoleSpy.mockRestore();
+    });
+  });
+
+  describe('Vault read failure', () => {
+    it('should log error and schedule retry on read failure', async () => {
+      const consoleSpy = jest.spyOn(console, 'error').mockImplementation();
+
+      const entry = makeCacheEntry('secret/data/test', -100);
+      mockCache.getEntry.mockReturnValue(entry);
+      mockProvider.read.mockRejectedValue(new Error('Vault unavailable'));
+
+      manager.scheduleRefresh('PROP', makeMetadata());
+      await jest.advanceTimersByTimeAsync(0);
+
+      expect(consoleSpy).toHaveBeenCalledWith(
+        expect.stringContaining('Failed to refresh secrets')
+      );
+
+      consoleSpy.mockRestore();
+    });
+  });
+
+  describe('cancelRefresh', () => {
+    it('should cancel a scheduled refresh', () => {
+      mockCache.getEntry.mockReturnValue(makeCacheEntry('secret/data/test', 30000));
+      manager.scheduleRefresh('PROP', makeMetadata());
+      manager.cancelRefresh('PROP');
+      // No error thrown, timer cleared
+    });
+
+    it('should be a no-op for non-existent property', () => {
+      manager.cancelRefresh('NON_EXISTENT');
+    });
+  });
+
+  describe('getRefreshStatus', () => {
+    it('should return empty array when nothing is cached', () => {
+      mockCache.getCachedProperties.mockReturnValue([]);
+      expect(manager.getRefreshStatus()).toEqual([]);
+    });
+
+    it('should return status for cached properties', () => {
+      const entry = makeCacheEntry('secret/data/test', 30000);
+      mockCache.getCachedProperties.mockReturnValue(['PROP']);
+      mockCache.getEntry.mockReturnValue(entry);
+
+      manager.scheduleRefresh('PROP', makeMetadata());
+
+      const statuses = manager.getRefreshStatus();
+      expect(statuses).toHaveLength(1);
+      expect(statuses[0].propertyName).toBe('PROP');
+      expect(statuses[0].vaultPath).toBe('secret/data/test');
+      expect(statuses[0].scheduled).toBe(true);
+    });
+  });
+
+  describe('getRefreshStatusForProperty', () => {
+    it('should return null for uncached property', () => {
+      mockCache.getEntry.mockReturnValue(null as any);
+      expect(manager.getRefreshStatusForProperty('MISSING')).toBeNull();
+    });
+
+    it('should return status for a cached property', () => {
+      const entry = makeCacheEntry('secret/data/test', 30000);
+      mockCache.getEntry.mockReturnValue(entry);
+
+      manager.scheduleRefresh('PROP', makeMetadata());
+
+      const status = manager.getRefreshStatusForProperty('PROP');
+      expect(status).toBeDefined();
+      expect(status!.propertyName).toBe('PROP');
+      expect(status!.scheduled).toBe(true);
+      expect(status!.refreshCount).toBe(0);
+    });
+  });
+
+  describe('shutdown', () => {
+    it('should clear all timers and callbacks', () => {
+      const cb = jest.fn();
+      manager.onSecretRefreshed(cb);
+
+      mockCache.getEntry.mockReturnValue(makeCacheEntry('secret/data/test', 30000));
+      manager.scheduleRefresh('PROP', makeMetadata());
+
+      manager.shutdown();
+      // After shutdown, advancing time should not trigger anything
+    });
+  });
+});

package/src/vault/__tests__/vault-integration-callback.spec.ts

@@ -0,0 +1,73 @@
+/**
+ * Unit tests for VaultIntegration callback wiring.
+ * Mocks VaultProvider, VaultCache, and SecretRefreshManager — no Vault required.
+ */
+
+import { SecretRefreshManager } from '../secret-refresh-manager';
+import { VaultIntegration } from '../vault-integration';
+import { VaultCache } from '../vault-cache';
+import { VaultProvider } from '../vault-provider';
+import { IVaultConfigOptions } from '../types';
+
+jest.mock('../vault-provider');
+jest.mock('../vault-cache');
+jest.mock('../secret-refresh-manager');
+
+const BASE_CONFIG: IVaultConfigOptions = {
+  endpoint: 'http://127.0.0.1:8200',
+  auth: { method: 'token' as const, token: 'test-token' }
+};
+
+describe('VaultIntegration callback wiring', () => {
+  let mockRefreshManager: jest.Mocked<SecretRefreshManager>;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    mockRefreshManager = {
+      onSecretRefreshed: jest.fn(),
+      scheduleRefresh: jest.fn(),
+      cancelRefresh: jest.fn(),
+      getRefreshStatus: jest.fn().mockReturnValue([]),
+      getRefreshStatusForProperty: jest.fn().mockReturnValue(null),
+      shutdown: jest.fn()
+    } as unknown as jest.Mocked<SecretRefreshManager>;
+
+    (SecretRefreshManager as jest.MockedClass<typeof SecretRefreshManager>)
+      .mockImplementation(() => mockRefreshManager);
+  });
+
+  it('should register onSecretRefreshed from config in constructor', () => {
+    const callback = jest.fn();
+    new VaultIntegration({ ...BASE_CONFIG, onSecretRefreshed: callback });
+
+    expect(mockRefreshManager.onSecretRefreshed).toHaveBeenCalledWith(callback);
+  });
+
+  it('should not call onSecretRefreshed when not provided in config', () => {
+    new VaultIntegration(BASE_CONFIG);
+
+    expect(mockRefreshManager.onSecretRefreshed).not.toHaveBeenCalled();
+  });
+
+  it('should delegate runtime onSecretRefreshed to refreshManager', () => {
+    const integration = new VaultIntegration(BASE_CONFIG);
+    const runtimeCallback = jest.fn();
+
+    integration.onSecretRefreshed(runtimeCallback);
+
+    expect(mockRefreshManager.onSecretRefreshed).toHaveBeenCalledWith(runtimeCallback);
+  });
+
+  it('should support both constructor and runtime callbacks', () => {
+    const constructorCb = jest.fn();
+    const runtimeCb = jest.fn();
+
+    const integration = new VaultIntegration({ ...BASE_CONFIG, onSecretRefreshed: constructorCb });
+    integration.onSecretRefreshed(runtimeCb);
+
+    expect(mockRefreshManager.onSecretRefreshed).toHaveBeenCalledTimes(2);
+    expect(mockRefreshManager.onSecretRefreshed).toHaveBeenCalledWith(constructorCb);
+    expect(mockRefreshManager.onSecretRefreshed).toHaveBeenCalledWith(runtimeCb);
+  });
+});