@sentroy-co/client-sdk 2.9.0 → 2.13.0

package/AGENTS.md

@@ -767,6 +767,35 @@ function ConfigPanel() {
 | `apiKey` | `string` | `process.env.NEXT_PUBLIC_SENTROY_ENV_API_KEY` | Bearer token for browser polling |
 | `refreshIntervalMs` | `number` | `300000` (5 min) | `0` to disable polling |
 
+### Debug logging (`SENTROY_ENV_DEBUG`)
+
+Set `SENTROY_ENV_DEBUG=1` (or `true`) on the consuming app to surface every fetch, cache hit, and fallback through `console.log`. Sample output:
+
+```
+[env-vault] fetching https://sentroy.com/api/env-vault/fetch
+[env-vault] fetched 7 var(s) from sentroy-core/prod in 234ms
+[env-vault] BETTER_AUTH_TURNSTILE_SECRET: vault hit
+[env-vault] IPINFO_TOKEN: vault miss → process.env fallback
+[env-vault] AI_GATEWAY_API_KEY: vault error (...) → process.env fallback
+```
+
+Default is off — turn on temporarily after a deploy to verify migrations are reading from the right source, then turn off to keep prod logs clean.
+
+### Migration helper: `getEnvWithFallback(key)`
+
+For codebases moving from `process.env` to vault gradually, use `getEnvWithFallback` — it tries vault first, falls back to `process.env[key]` on cache miss / fetch failure / missing token. The point is *zero downtime*: deploy the code change before populating the vault, and nothing breaks; fill the vault later, and the same code starts reading from there.
+
+```ts
+import { getEnvWithFallback } from "@sentroy-co/client-sdk/vault"
+
+// Old:                     process.env.STRIPE_SECRET_KEY
+const stripeKey = await getEnvWithFallback("STRIPE_SECRET_KEY")
+```
+
+After the value is in the vault and you've verified it's being read, swap the call to `getEnv` (or `getEnvOrThrow`) so a future `process.env` re-introduction doesn't silently shadow the vault value.
+
+Bootstrap path (no `SENTROY_ENV_API_KEY` set) skips the fetch entirely and goes straight to `process.env` — so an app deployed without vault credentials still boots and reads its envs the legacy way. This is intentional: the vault is opt-in, not a hard requirement.
+
 ### Security notes
 
 - `useEnv()` only ever returns variables marked `public: true` in the dashboard. Server-only secrets stay server-side.
@@ -774,6 +803,51 @@ function ConfigPanel() {
 - The bootstrap token is per-(project, environment). A `prod` token cannot read `staging` and vice versa.
 - Variable values are AES-256-GCM encrypted at rest in the Sentroy vault DB. Decryption happens server-side just before the fetch endpoint streams the response.
 
+### Webhooks (`createVaultWebhookHandler`)
+
+Variable changes can push directly to your app instead of waiting on the 5-min cache TTL. Configure a webhook in the dashboard under a project's **Webhooks** tab — Sentroy will POST to your URL on every `variable.create | variable.update | variable.delete`.
+
+```ts
+// app/api/sentroy/vault-webhook/route.ts
+import { createVaultWebhookHandler } from "@sentroy-co/client-sdk/vault"
+
+export const POST = createVaultWebhookHandler({
+  secret: process.env.SENTROY_VAULT_WEBHOOK_SECRET!,
+  // optional — default behaviour: await refreshEnvCache()
+  async onChange(payload) {
+    console.log("vault changed", payload.action, payload.keys)
+    // your invalidation logic, then:
+    await refreshEnvCache()
+  },
+  // optional — replay-window check, default 5 min
+  maxAgeMs: 5 * 60 * 1000,
+})
+```
+
+Payload (signed):
+```json
+{
+  "event": "vault.variable.changed",
+  "project": "<projectId>",
+  "environment": "prod",
+  "action": "create" | "update" | "delete",
+  "keys": ["DATABASE_URL", "..."],
+  "timestamp": 1731430000000
+}
+```
+
+Headers Sentroy sends: `X-Sentroy-Signature: sha256=<hex>` (HMAC over the raw body), `X-Sentroy-Event: vault.variable.changed`, `X-Sentroy-Webhook-Id: <id>`.
+
+The handler returns:
+- `200` with `{ ok: true }` after a verified signature + completed `onChange`
+- `401` for missing/malformed/invalid signature, or timestamp outside the replay window
+- `400` for an invalid JSON body
+- `500` if `onChange` throws
+
+Delivery is fire-and-forget on the Sentroy side with a 5 sec timeout; the dashboard records the last delivery's status + error string per webhook for visibility. Failed deliveries are not auto-retried (admin can flip the enabled toggle to retry manually by re-saving a variable, or we'll add a "resend" button later).
+
+The vault webhook secret namespace is `whsec_*` — distinct from access tokens (`stk_*` / `stk_env_*`).
+
 ### CLI (`sentroy env ...`)
 
 The package ships a `sentroy` binary. After `npm install` (or `npm install -g`) it's available on `PATH`; `npx sentroy ...` works without a global install.

package/README.md

@@ -84,11 +84,15 @@ Manage your env vars in the dashboard at [vault.sentroy.com](https://vault.sentr
 
 ```ts
 // server side
-import { getEnv, getEnvOrThrow, preloadEnv } from "@sentroy-co/client-sdk/vault"
+import { getEnv, getEnvOrThrow, getEnvWithFallback, preloadEnv } from "@sentroy-co/client-sdk/vault"
 
 await preloadEnv() // optional fail-fast at boot
 const dbUrl = await getEnv("DATABASE_URL")
 const turnstile = await getEnvOrThrow("BETTER_AUTH_TURNSTILE_SECRET")
+
+// Migration helper — vault'tan oku, yoksa process.env fallback.
+// Sentroy app'lerini kademeli olarak migrate ederken kullanışlı.
+const stripe = await getEnvWithFallback("STRIPE_SECRET_KEY")
 ```
 
 ```tsx
@@ -106,6 +110,21 @@ const siteKey = useEnv("TURNSTILE_SITE_KEY")
 
 Bootstrap is a single env: `SENTROY_ENV_API_KEY`. Public/private split is enforced server-side — the React hook only ever sees `public: true` variables. Full reference at [docs.sentroy.com/env-vault](https://docs.sentroy.com/env-vault).
 
+### Webhooks (real-time invalidation)
+
+Skip the 5-min cache TTL — point the vault at your app and it'll POST whenever any variable changes. The default handler verifies the HMAC-SHA256 signature and refreshes the cache:
+
+```ts
+// app/api/sentroy/vault-webhook/route.ts
+import { createVaultWebhookHandler } from "@sentroy-co/client-sdk/vault"
+
+export const POST = createVaultWebhookHandler({
+  secret: process.env.SENTROY_VAULT_WEBHOOK_SECRET!,
+})
+```
+
+Configure the receiver URL in the vault dashboard under the project's **Webhooks** tab; the secret comes back once at create-time. Provide your own `onChange` handler for custom logic.
+
 ### CLI
 
 The package ships a `sentroy` CLI for syncing local `.env` files to the vault — useful for build pipelines and onboarding.

package/dist/vault/index.d.ts

@@ -65,9 +65,69 @@ export declare function preloadEnv(): Promise<void>;
 export declare function getEnv(key: string): Promise<string | undefined>;
 /** Eksik env'i hemen patlatır — config-validation pattern'inde kullanışlı. */
 export declare function getEnvOrThrow(key: string): Promise<string>;
+/**
+ * Migration helper — vault'tan oku, yoksa `process.env` fallback.
+ *
+ * Sentroy app'lerini kademeli olarak `process.env` → vault'a çevirirken
+ * "her ikisi de çalışsın" senaryosu için. Vault doldurulmamış / token
+ * eksik / fetch fail dönerse sessizce `process.env[key]`'e döner — eski
+ * deploy ile yeni kod bir arada çalışabilir.
+ *
+ * **Migration tamamlandıktan sonra** çağrı sitelerini `getEnv()` ya da
+ * `getEnvOrThrow()`'a çevir; fallback'i bırakmak silently process.env
+ * sızıntısı riskini taşır (kullanıcı vault'tan key'i sildi sansa bile
+ * eski process.env değeri etkili olur).
+ *
+ * Bootstrap path için (`SENTROY_ENV_API_KEY` set değil) doğrudan
+ * `process.env`'e döner — vault fetch denemez. Bu önemli: Sentroy app'i
+ * vault'sız boot edilebilir.
+ */
+export declare function getEnvWithFallback(key: string): Promise<string | undefined>;
 /** Tüm env'leri map olarak döner (dump için kullanışlı). */
 export declare function getAllEnvs(): Promise<Record<string, string>>;
 /** Sadece public (`public: true`) env'ler — SSR helper için. */
 export declare function getPublicEnvs(): Promise<Record<string, string>>;
+export interface VaultWebhookPayload {
+    event: "vault.variable.changed";
+    project: string;
+    environment: string;
+    action: "create" | "update" | "delete";
+    /** Etkilenen key'ler — bulk push'ta birden fazla. */
+    keys: string[];
+    /** Unix ms. */
+    timestamp: number;
+}
+export interface CreateVaultWebhookHandlerOptions {
+    /**
+     * Sentroy vault dashboard'dan aldığın webhook secret (`whsec_...`).
+     * Receiver bu secret'la HMAC-SHA256 imzayı doğrular; hatalıysa 401 döner.
+     */
+    secret: string;
+    /**
+     * Imzayı doğruladıktan sonra çağrılır. Default davranış:
+     *   `await refreshEnvCache()` — bir sonraki getEnv() taze değerleri çeker.
+     * Custom logic için override et (örn. tek bir key'i targeted invalidate).
+     */
+    onChange?: (payload: VaultWebhookPayload) => Promise<void> | void;
+    /**
+     * Replay attack'lere karşı body'nin timestamp'i ile şu an arasındaki
+     * maksimum tolerans (ms). Default 5 dk. Sıfır ise check kapalı.
+     */
+    maxAgeMs?: number;
+}
+/**
+ * Bir Sentroy vault webhook receiver'ı için Request → Response handler
+ * üretir. Next.js App Router'da:
+ *
+ *   // app/api/sentroy/vault-webhook/route.ts
+ *   import { createVaultWebhookHandler } from "@sentroy-co/client-sdk/vault"
+ *   export const POST = createVaultWebhookHandler({
+ *     secret: process.env.SENTROY_VAULT_WEBHOOK_SECRET!,
+ *   })
+ *
+ * Default davranış: imza doğruysa cache'i invalidate eder ve 200 döner.
+ * Hatalı/eksik imza → 401, eski timestamp → 401, body parse hatası → 400.
+ */
+export declare function createVaultWebhookHandler(options: CreateVaultWebhookHandlerOptions): (request: Request) => Promise<Response>;
 export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/vault/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB;AAKD,UAAU,aAAa;IACrB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAcD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,aAAkB,GAAG,IAAI,CAYpE;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED,8EAA8E;AAC9E,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAGrD;AAED,2EAA2E;AAC3E,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAEhD;AA6DD;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAGrE;AAED,8EAA8E;AAC9E,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQhE;AAED,4DAA4D;AAC5D,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAKlE;AAED,gEAAgE;AAChE,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAOrE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB;AAsBD,UAAU,aAAa;IACrB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAcD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,aAAkB,GAAG,IAAI,CAYpE;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED,8EAA8E;AAC9E,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAGrD;AAED,2EAA2E;AAC3E,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAEhD;AAmED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAGrE;AAED,8EAA8E;AAC9E,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQhE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwB7B;AAED,4DAA4D;AAC5D,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAKlE;AAED,gEAAgE;AAChE,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAOrE;AAID,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,wBAAwB,CAAA;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACtC,qDAAqD;IACrD,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,eAAe;IACf,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,gCAAgC;IAC/C;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACjE;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AA8BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,gCAAgC,GACxC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAmDzC"}

package/dist/vault/index.js

@@ -32,10 +32,27 @@ exports.refreshEnvCache = refreshEnvCache;
 exports.preloadEnv = preloadEnv;
 exports.getEnv = getEnv;
 exports.getEnvOrThrow = getEnvOrThrow;
+exports.getEnvWithFallback = getEnvWithFallback;
 exports.getAllEnvs = getAllEnvs;
 exports.getPublicEnvs = getPublicEnvs;
+exports.createVaultWebhookHandler = createVaultWebhookHandler;
 const DEFAULT_TTL_MS = 5 * 60 * 1000;
 const DEFAULT_BASE_URL = "https://sentroy.com";
+/**
+ * Opt-in runtime logging — `SENTROY_ENV_DEBUG=1` set edilirse her fetch
+ * (success/fail), cache hit ve fallback satırı stdout'a yazılır. Default
+ * kapalı; migration verification + prod sorunu debug için.
+ */
+function isDebug() {
+    const v = readEnv("SENTROY_ENV_DEBUG");
+    return v === "1" || v === "true";
+}
+function debugLog(...parts) {
+    if (isDebug()) {
+        // eslint-disable-next-line no-console
+        console.log("[env-vault]", ...parts);
+    }
+}
 let resolvedBaseUrl = DEFAULT_BASE_URL;
 let resolvedApiKey;
 let cacheTtlMs = DEFAULT_TTL_MS;
@@ -88,12 +105,15 @@ async function fetchVariables() {
             "Set it on the platform (Coolify env) or call configureEnvClient({ apiKey: ... }) at boot.");
     }
     const url = `${resolvedBaseUrl}/api/env-vault/fetch`;
+    const started = Date.now();
+    debugLog(`fetching ${url}`);
     const res = await fetch(url, {
         headers: { Authorization: `Bearer ${resolvedApiKey}` },
         signal: AbortSignal.timeout(fetchTimeoutMs),
         cache: "no-store",
     });
     if (!res.ok) {
+        debugLog(`fetch failed: ${res.status} ${res.statusText} (${Date.now() - started}ms)`);
         throw new Error(`env-vault fetch failed: ${res.status} ${res.statusText} (url=${url})`);
     }
     const json = (await res.json());
@@ -102,6 +122,7 @@ async function fetchVariables() {
     const map = new Map();
     for (const v of json.data.variables)
         map.set(v.key, v);
+    debugLog(`fetched ${map.size} var(s) from ${json.data.project}/${json.data.environment} in ${Date.now() - started}ms`);
     return {
         fetchedAt: Date.now(),
         variables: map,
@@ -148,6 +169,47 @@ async function getEnvOrThrow(key) {
     }
     return v;
 }
+/**
+ * Migration helper — vault'tan oku, yoksa `process.env` fallback.
+ *
+ * Sentroy app'lerini kademeli olarak `process.env` → vault'a çevirirken
+ * "her ikisi de çalışsın" senaryosu için. Vault doldurulmamış / token
+ * eksik / fetch fail dönerse sessizce `process.env[key]`'e döner — eski
+ * deploy ile yeni kod bir arada çalışabilir.
+ *
+ * **Migration tamamlandıktan sonra** çağrı sitelerini `getEnv()` ya da
+ * `getEnvOrThrow()`'a çevir; fallback'i bırakmak silently process.env
+ * sızıntısı riskini taşır (kullanıcı vault'tan key'i sildi sansa bile
+ * eski process.env değeri etkili olur).
+ *
+ * Bootstrap path için (`SENTROY_ENV_API_KEY` set değil) doğrudan
+ * `process.env`'e döner — vault fetch denemez. Bu önemli: Sentroy app'i
+ * vault'sız boot edilebilir.
+ */
+async function getEnvWithFallback(key) {
+    // Token yoksa bypass — vault fetch denemeyelim, log spam etmeyelim.
+    const apiKey = resolvedApiKey ?? readEnv("SENTROY_ENV_API_KEY");
+    if (!apiKey) {
+        const pe = readEnv(key);
+        debugLog(`${key}: no-token bypass → ${pe !== undefined ? "process.env hit" : "miss"}`);
+        return pe;
+    }
+    try {
+        const v = await getEnv(key);
+        if (v !== undefined) {
+            debugLog(`${key}: vault hit`);
+            return v;
+        }
+        const pe = readEnv(key);
+        debugLog(`${key}: vault miss → ${pe !== undefined ? "process.env fallback" : "undefined"}`);
+        return pe;
+    }
+    catch (err) {
+        const pe = readEnv(key);
+        debugLog(`${key}: vault error (${err instanceof Error ? err.message : String(err)}) → ${pe !== undefined ? "process.env fallback" : "undefined"}`);
+        return pe;
+    }
+}
 /** Tüm env'leri map olarak döner (dump için kullanışlı). */
 async function getAllEnvs() {
     const c = await ensureCache();
@@ -166,4 +228,86 @@ async function getPublicEnvs() {
     }
     return out;
 }
+const DEFAULT_MAX_AGE_MS = 5 * 60 * 1000;
+async function timingSafeEqualHex(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return diff === 0;
+}
+async function hmacSha256Hex(secret, body) {
+    // Web Crypto — Node 18+ + browser ikisi de destekler.
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(body));
+    const bytes = new Uint8Array(sig);
+    let hex = "";
+    for (const b of bytes)
+        hex += b.toString(16).padStart(2, "0");
+    return hex;
+}
+/**
+ * Bir Sentroy vault webhook receiver'ı için Request → Response handler
+ * üretir. Next.js App Router'da:
+ *
+ *   // app/api/sentroy/vault-webhook/route.ts
+ *   import { createVaultWebhookHandler } from "@sentroy-co/client-sdk/vault"
+ *   export const POST = createVaultWebhookHandler({
+ *     secret: process.env.SENTROY_VAULT_WEBHOOK_SECRET!,
+ *   })
+ *
+ * Default davranış: imza doğruysa cache'i invalidate eder ve 200 döner.
+ * Hatalı/eksik imza → 401, eski timestamp → 401, body parse hatası → 400.
+ */
+function createVaultWebhookHandler(options) {
+    const maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
+    return async (request) => {
+        const sigHeader = request.headers.get("x-sentroy-signature") || "";
+        const match = sigHeader.match(/^sha256=([a-f0-9]+)$/i);
+        if (!match) {
+            return new Response("missing or malformed X-Sentroy-Signature header", {
+                status: 401,
+            });
+        }
+        const providedSig = match[1].toLowerCase();
+        const body = await request.text();
+        const expected = await hmacSha256Hex(options.secret, body);
+        if (!(await timingSafeEqualHex(providedSig, expected))) {
+            return new Response("signature mismatch", { status: 401 });
+        }
+        let payload;
+        try {
+            payload = JSON.parse(body);
+        }
+        catch {
+            return new Response("invalid JSON body", { status: 400 });
+        }
+        if (maxAgeMs > 0) {
+            const age = Date.now() - (payload.timestamp ?? 0);
+            if (!Number.isFinite(age) || age < 0 || age > maxAgeMs) {
+                return new Response("payload timestamp outside acceptable window", {
+                    status: 401,
+                });
+            }
+        }
+        try {
+            if (options.onChange) {
+                await options.onChange(payload);
+            }
+            else {
+                await refreshEnvCache();
+            }
+        }
+        catch (err) {
+            return new Response(`handler error: ${err instanceof Error ? err.message : String(err)}`, { status: 500 });
+        }
+        return new Response(JSON.stringify({ ok: true }), {
+            status: 200,
+            headers: { "Content-Type": "application/json" },
+        });
+    };
+}
 //# sourceMappingURL=index.js.map

package/dist/vault/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;AA8CH,gDAYC;AAGD,wCAEC;AAGD,0CAGC;AAGD,gCAEC;AAkED,wBAGC;AAGD,sCAQC;AAGD,gCAKC;AAGD,sCAOC;AA5JD,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AACpC,MAAM,gBAAgB,GAAG,qBAAqB,CAAA;AAa9C,IAAI,eAAe,GAAG,gBAAgB,CAAA;AACtC,IAAI,cAAkC,CAAA;AACtC,IAAI,UAAU,GAAG,cAAc,CAAA;AAC/B,IAAI,cAAc,GAAG,IAAI,CAAA;AACzB,IAAI,KAAK,GAAyB,IAAI,CAAA;AACtC,IAAI,cAAc,GAAyB,IAAI,CAAA;AAE/C,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAA;IACpD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,UAAyB,EAAE;IAC5D,IAAI,OAAO,CAAC,OAAO;QAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;;QAExE,eAAe,GAAG,CAChB,OAAO,CAAC,iCAAiC,CAAC;YAC1C,OAAO,CAAC,qBAAqB,CAAC;YAC9B,OAAO,CAAC,0BAA0B,CAAC;YACnC,gBAAgB,CACjB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACvB,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACjE,IAAI,OAAO,CAAC,UAAU;QAAE,UAAU,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAA;IAC9D,IAAI,OAAO,CAAC,SAAS;QAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAA;AAC3D,CAAC;AAED,8EAA8E;AAC9E,SAAgB,cAAc,CAAC,OAAe;IAC5C,UAAU,GAAG,OAAO,GAAG,IAAI,CAAA;AAC7B,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,eAAe;IACnC,KAAK,GAAG,IAAI,CAAA;IACZ,MAAM,WAAW,EAAE,CAAA;AACrB,CAAC;AAED,2EAA2E;AACpE,KAAK,UAAU,UAAU;IAC9B,MAAM,WAAW,EAAE,CAAA;AACrB,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,iEAAiE;QACjE,kBAAkB,EAAE,CAAA;IACtB,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,2FAA2F,CAC9F,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,eAAe,sBAAsB,CAAA;IACpD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;QACtD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC;QAC3C,KAAK,EAAE,UAAU;KAClB,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,SAAS,GAAG,GAAG,CACvE,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAM7B,CAAA;IACD,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACtD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;QAC1B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;KACnC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7D,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,cAAc,CAAA;QACpB,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;IACzB,CAAC;IACD,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;QAC3B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,cAAc,EAAE,CAAA;QAChC,CAAC;gBAAS,CAAC;YACT,cAAc,GAAG,IAAI,CAAA;QACvB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,MAAM,cAAc,CAAA;IACpB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IAC9D,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAA;IAC7B,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAA;AACpC,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,4BAA4B,KAAK,EAAE,OAAO,IAAI,GAAG,SAAS,KAAK,EAAE,WAAW,IAAI,GAAG,GAAG,CAC1H,CAAA;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,4DAA4D;AACrD,KAAK,UAAU,UAAU;IAC9B,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAA;IAC7B,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;IAClD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,gEAAgE;AACzD,KAAK,UAAU,aAAa;IACjC,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAA;IAC7B,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;IAChC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;AA+DH,gDAYC;AAGD,wCAEC;AAGD,0CAGC;AAGD,gCAEC;AAwED,wBAGC;AAGD,sCAQC;AAmBD,gDA0BC;AAGD,gCAKC;AAGD,sCAOC;AA2ED,8DAqDC;AAhWD,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AACpC,MAAM,gBAAgB,GAAG,qBAAqB,CAAA;AAE9C;;;;GAIG;AACH,SAAS,OAAO;IACd,MAAM,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACtC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,CAAA;AAClC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAG,KAAgB;IACnC,IAAI,OAAO,EAAE,EAAE,CAAC;QACd,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,CAAA;IACtC,CAAC;AACH,CAAC;AAaD,IAAI,eAAe,GAAG,gBAAgB,CAAA;AACtC,IAAI,cAAkC,CAAA;AACtC,IAAI,UAAU,GAAG,cAAc,CAAA;AAC/B,IAAI,cAAc,GAAG,IAAI,CAAA;AACzB,IAAI,KAAK,GAAyB,IAAI,CAAA;AACtC,IAAI,cAAc,GAAyB,IAAI,CAAA;AAE/C,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAA;IACpD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,UAAyB,EAAE;IAC5D,IAAI,OAAO,CAAC,OAAO;QAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;;QAExE,eAAe,GAAG,CAChB,OAAO,CAAC,iCAAiC,CAAC;YAC1C,OAAO,CAAC,qBAAqB,CAAC;YAC9B,OAAO,CAAC,0BAA0B,CAAC;YACnC,gBAAgB,CACjB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACvB,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACjE,IAAI,OAAO,CAAC,UAAU;QAAE,UAAU,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAA;IAC9D,IAAI,OAAO,CAAC,SAAS;QAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAA;AAC3D,CAAC;AAED,8EAA8E;AAC9E,SAAgB,cAAc,CAAC,OAAe;IAC5C,UAAU,GAAG,OAAO,GAAG,IAAI,CAAA;AAC7B,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,eAAe;IACnC,KAAK,GAAG,IAAI,CAAA;IACZ,MAAM,WAAW,EAAE,CAAA;AACrB,CAAC;AAED,2EAA2E;AACpE,KAAK,UAAU,UAAU;IAC9B,MAAM,WAAW,EAAE,CAAA;AACrB,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,iEAAiE;QACjE,kBAAkB,EAAE,CAAA;IACtB,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,2FAA2F,CAC9F,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,eAAe,sBAAsB,CAAA;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC1B,QAAQ,CAAC,YAAY,GAAG,EAAE,CAAC,CAAA;IAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;QACtD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC;QAC3C,KAAK,EAAE,UAAU;KAClB,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,QAAQ,CAAC,iBAAiB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,KAAK,CAAC,CAAA;QACrF,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,SAAS,GAAG,GAAG,CACvE,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAM7B,CAAA;IACD,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACtD,QAAQ,CACN,WAAW,GAAG,CAAC,IAAI,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,CAC7G,CAAA;IACD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;QAC1B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;KACnC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7D,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,cAAc,CAAA;QACpB,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;IACzB,CAAC;IACD,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;QAC3B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,cAAc,EAAE,CAAA;QAChC,CAAC;gBAAS,CAAC;YACT,cAAc,GAAG,IAAI,CAAA;QACvB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,MAAM,cAAc,CAAA;IACpB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IAC9D,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAA;IAC7B,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAA;AACpC,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,4BAA4B,KAAK,EAAE,OAAO,IAAI,GAAG,SAAS,KAAK,EAAE,WAAW,IAAI,GAAG,GAAG,CAC1H,CAAA;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,UAAU,kBAAkB,CACtC,GAAW;IAEX,oEAAoE;IACpE,MAAM,MAAM,GAAG,cAAc,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QACvB,QAAQ,CAAC,GAAG,GAAG,uBAAuB,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;QACtF,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,QAAQ,CAAC,GAAG,GAAG,aAAa,CAAC,CAAA;YAC7B,OAAO,CAAC,CAAA;QACV,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QACvB,QAAQ,CAAC,GAAG,GAAG,kBAAkB,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;QAC3F,OAAO,EAAE,CAAA;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QACvB,QAAQ,CACN,GAAG,GAAG,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,WAAW,EAAE,CACzI,CAAA;QACD,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,4DAA4D;AACrD,KAAK,UAAU,UAAU;IAC9B,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAA;IAC7B,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;IAClD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,gEAAgE;AACzD,KAAK,UAAU,aAAa;IACjC,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAA;IAC7B,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;IAChC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAkCD,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAExC,KAAK,UAAU,kBAAkB,CAAC,CAAS,EAAE,CAAS;IACpD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,IAAY;IACvD,sDAAsD;IACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACvE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,yBAAyB,CACvC,OAAyC;IAEzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAA;IACvD,OAAO,KAAK,EAAE,OAAgB,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAA;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QACtD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,iDAAiD,EAAE;gBACrE,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC1D,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC5D,CAAC;QAED,IAAI,OAA4B,CAAA;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAA;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,CAAA;YACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;gBACvD,OAAO,IAAI,QAAQ,CAAC,6CAA6C,EAAE;oBACjE,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,MAAM,eAAe,EAAE,CAAA;YACzB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CACjB,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACpE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;YAChD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentroy-co/client-sdk",
-  "version": "2.9.0",
+  "version": "2.13.0",
   "description": "TypeScript SDK + CLI for the Sentroy platform — mail, storage, env vault + React components.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/vault/index.ts

@@ -42,6 +42,23 @@ export interface EnvCacheState {
 const DEFAULT_TTL_MS = 5 * 60 * 1000
 const DEFAULT_BASE_URL = "https://sentroy.com"
 
+/**
+ * Opt-in runtime logging — `SENTROY_ENV_DEBUG=1` set edilirse her fetch
+ * (success/fail), cache hit ve fallback satırı stdout'a yazılır. Default
+ * kapalı; migration verification + prod sorunu debug için.
+ */
+function isDebug(): boolean {
+  const v = readEnv("SENTROY_ENV_DEBUG")
+  return v === "1" || v === "true"
+}
+
+function debugLog(...parts: unknown[]): void {
+  if (isDebug()) {
+    // eslint-disable-next-line no-console
+    console.log("[env-vault]", ...parts)
+  }
+}
+
 interface ClientOptions {
   /** Sentroy core URL (defaults to env or https://sentroy.com). */
   baseUrl?: string
@@ -111,12 +128,15 @@ async function fetchVariables(): Promise<EnvCacheState> {
     )
   }
   const url = `${resolvedBaseUrl}/api/env-vault/fetch`
+  const started = Date.now()
+  debugLog(`fetching ${url}`)
   const res = await fetch(url, {
     headers: { Authorization: `Bearer ${resolvedApiKey}` },
     signal: AbortSignal.timeout(fetchTimeoutMs),
     cache: "no-store",
   })
   if (!res.ok) {
+    debugLog(`fetch failed: ${res.status} ${res.statusText} (${Date.now() - started}ms)`)
     throw new Error(
       `env-vault fetch failed: ${res.status} ${res.statusText} (url=${url})`,
     )
@@ -131,6 +151,9 @@ async function fetchVariables(): Promise<EnvCacheState> {
   if (!json.data) throw new Error("env-vault fetch: malformed response")
   const map = new Map<string, EnvVariable>()
   for (const v of json.data.variables) map.set(v.key, v)
+  debugLog(
+    `fetched ${map.size} var(s) from ${json.data.project}/${json.data.environment} in ${Date.now() - started}ms`,
+  )
   return {
     fetchedAt: Date.now(),
     variables: map,
@@ -179,6 +202,51 @@ export async function getEnvOrThrow(key: string): Promise<string> {
   return v
 }
 
+/**
+ * Migration helper — vault'tan oku, yoksa `process.env` fallback.
+ *
+ * Sentroy app'lerini kademeli olarak `process.env` → vault'a çevirirken
+ * "her ikisi de çalışsın" senaryosu için. Vault doldurulmamış / token
+ * eksik / fetch fail dönerse sessizce `process.env[key]`'e döner — eski
+ * deploy ile yeni kod bir arada çalışabilir.
+ *
+ * **Migration tamamlandıktan sonra** çağrı sitelerini `getEnv()` ya da
+ * `getEnvOrThrow()`'a çevir; fallback'i bırakmak silently process.env
+ * sızıntısı riskini taşır (kullanıcı vault'tan key'i sildi sansa bile
+ * eski process.env değeri etkili olur).
+ *
+ * Bootstrap path için (`SENTROY_ENV_API_KEY` set değil) doğrudan
+ * `process.env`'e döner — vault fetch denemez. Bu önemli: Sentroy app'i
+ * vault'sız boot edilebilir.
+ */
+export async function getEnvWithFallback(
+  key: string,
+): Promise<string | undefined> {
+  // Token yoksa bypass — vault fetch denemeyelim, log spam etmeyelim.
+  const apiKey = resolvedApiKey ?? readEnv("SENTROY_ENV_API_KEY")
+  if (!apiKey) {
+    const pe = readEnv(key)
+    debugLog(`${key}: no-token bypass → ${pe !== undefined ? "process.env hit" : "miss"}`)
+    return pe
+  }
+  try {
+    const v = await getEnv(key)
+    if (v !== undefined) {
+      debugLog(`${key}: vault hit`)
+      return v
+    }
+    const pe = readEnv(key)
+    debugLog(`${key}: vault miss → ${pe !== undefined ? "process.env fallback" : "undefined"}`)
+    return pe
+  } catch (err) {
+    const pe = readEnv(key)
+    debugLog(
+      `${key}: vault error (${err instanceof Error ? err.message : String(err)}) → ${pe !== undefined ? "process.env fallback" : "undefined"}`,
+    )
+    return pe
+  }
+}
+
 /** Tüm env'leri map olarak döner (dump için kullanışlı). */
 export async function getAllEnvs(): Promise<Record<string, string>> {
   const c = await ensureCache()
@@ -196,3 +264,131 @@ export async function getPublicEnvs(): Promise<Record<string, string>> {
   }
   return out
 }
+
+// ── Webhook handler ─────────────────────────────────────────────────────
+
+export interface VaultWebhookPayload {
+  event: "vault.variable.changed"
+  project: string
+  environment: string
+  action: "create" | "update" | "delete"
+  /** Etkilenen key'ler — bulk push'ta birden fazla. */
+  keys: string[]
+  /** Unix ms. */
+  timestamp: number
+}
+
+export interface CreateVaultWebhookHandlerOptions {
+  /**
+   * Sentroy vault dashboard'dan aldığın webhook secret (`whsec_...`).
+   * Receiver bu secret'la HMAC-SHA256 imzayı doğrular; hatalıysa 401 döner.
+   */
+  secret: string
+  /**
+   * Imzayı doğruladıktan sonra çağrılır. Default davranış:
+   *   `await refreshEnvCache()` — bir sonraki getEnv() taze değerleri çeker.
+   * Custom logic için override et (örn. tek bir key'i targeted invalidate).
+   */
+  onChange?: (payload: VaultWebhookPayload) => Promise<void> | void
+  /**
+   * Replay attack'lere karşı body'nin timestamp'i ile şu an arasındaki
+   * maksimum tolerans (ms). Default 5 dk. Sıfır ise check kapalı.
+   */
+  maxAgeMs?: number
+}
+
+const DEFAULT_MAX_AGE_MS = 5 * 60 * 1000
+
+async function timingSafeEqualHex(a: string, b: string): Promise<boolean> {
+  if (a.length !== b.length) return false
+  let diff = 0
+  for (let i = 0; i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i)
+  }
+  return diff === 0
+}
+
+async function hmacSha256Hex(secret: string, body: string): Promise<string> {
+  // Web Crypto — Node 18+ + browser ikisi de destekler.
+  const encoder = new TextEncoder()
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  )
+  const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(body))
+  const bytes = new Uint8Array(sig)
+  let hex = ""
+  for (const b of bytes) hex += b.toString(16).padStart(2, "0")
+  return hex
+}
+
+/**
+ * Bir Sentroy vault webhook receiver'ı için Request → Response handler
+ * üretir. Next.js App Router'da:
+ *
+ *   // app/api/sentroy/vault-webhook/route.ts
+ *   import { createVaultWebhookHandler } from "@sentroy-co/client-sdk/vault"
+ *   export const POST = createVaultWebhookHandler({
+ *     secret: process.env.SENTROY_VAULT_WEBHOOK_SECRET!,
+ *   })
+ *
+ * Default davranış: imza doğruysa cache'i invalidate eder ve 200 döner.
+ * Hatalı/eksik imza → 401, eski timestamp → 401, body parse hatası → 400.
+ */
+export function createVaultWebhookHandler(
+  options: CreateVaultWebhookHandlerOptions,
+): (request: Request) => Promise<Response> {
+  const maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS
+  return async (request: Request) => {
+    const sigHeader = request.headers.get("x-sentroy-signature") || ""
+    const match = sigHeader.match(/^sha256=([a-f0-9]+)$/i)
+    if (!match) {
+      return new Response("missing or malformed X-Sentroy-Signature header", {
+        status: 401,
+      })
+    }
+    const providedSig = match[1].toLowerCase()
+    const body = await request.text()
+    const expected = await hmacSha256Hex(options.secret, body)
+    if (!(await timingSafeEqualHex(providedSig, expected))) {
+      return new Response("signature mismatch", { status: 401 })
+    }
+
+    let payload: VaultWebhookPayload
+    try {
+      payload = JSON.parse(body) as VaultWebhookPayload
+    } catch {
+      return new Response("invalid JSON body", { status: 400 })
+    }
+
+    if (maxAgeMs > 0) {
+      const age = Date.now() - (payload.timestamp ?? 0)
+      if (!Number.isFinite(age) || age < 0 || age > maxAgeMs) {
+        return new Response("payload timestamp outside acceptable window", {
+          status: 401,
+        })
+      }
+    }
+
+    try {
+      if (options.onChange) {
+        await options.onChange(payload)
+      } else {
+        await refreshEnvCache()
+      }
+    } catch (err) {
+      return new Response(
+        `handler error: ${err instanceof Error ? err.message : String(err)}`,
+        { status: 500 },
+      )
+    }
+
+    return new Response(JSON.stringify({ ok: true }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    })
+  }
+}