@shambay/vault-manager 1.0.1

package/dist/resolver/factory.js

@@ -0,0 +1,28 @@
+import { RequestResolver } from '@shambay/cached-http-resolver';
+import { createMemoryResolver } from './memory.js';
+import { createRedisResolver } from './redis.js';
+/**
+ * Factory that creates a RequestResolver based on the provided configuration.
+ *
+ * @example
+ * // In-memory cache (default)
+ * const resolver = createResolver({ cache: 'memory' });
+ *
+ * @example
+ * // Redis-backed cache
+ * const resolver = createResolver({
+ *   cache: 'redis',
+ *   redis: { host: 'localhost', port: 6379 },
+ *   keyPrefix: 'vault:',
+ * });
+ */
+export function createResolver(config = { cache: 'memory' }) {
+    switch (config.cache) {
+        case 'redis':
+            return createRedisResolver(config);
+        case 'memory':
+        default:
+            return createMemoryResolver(config);
+    }
+}
+//# sourceMappingURL=factory.js.map

package/dist/resolver/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/resolver/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAGjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC7B,SAAgC,EAAE,KAAK,EAAE,QAAQ,EAAE;IAEnD,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,KAAK,OAAO;YACX,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACpC,KAAK,QAAQ,CAAC;QACd;YACC,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;AACF,CAAC"}

package/dist/resolver/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Public entry point for resolver factories.
+ * Re-exports the unified factory plus the concrete memory/redis factories.
+ */
+export { createResolver } from './factory.js';
+export { createMemoryResolver } from './memory.js';
+export { createRedisResolver } from './redis.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/resolver/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resolver/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}

package/dist/resolver/index.js

@@ -0,0 +1,8 @@
+/**
+ * Public entry point for resolver factories.
+ * Re-exports the unified factory plus the concrete memory/redis factories.
+ */
+export { createResolver } from './factory.js';
+export { createMemoryResolver } from './memory.js';
+export { createRedisResolver } from './redis.js';
+//# sourceMappingURL=index.js.map

package/dist/resolver/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resolver/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}

package/dist/resolver/memory.d.ts

@@ -0,0 +1,8 @@
+import { RequestResolver } from '@shambay/cached-http-resolver';
+import type { MemoryResolverConfig } from '../types/resolver.js';
+/**
+ * Creates a RequestResolver backed by an in-memory cache.
+ * Suitable for single-process usage where the cache does not need to be shared.
+ */
+export declare function createMemoryResolver(config?: MemoryResolverConfig): RequestResolver;
+//# sourceMappingURL=memory.d.ts.map

package/dist/resolver/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/resolver/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAoB,MAAM,+BAA+B,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,MAAM,GAAE,oBAA0C,GAChD,eAAe,CAUjB"}

package/dist/resolver/memory.js

@@ -0,0 +1,15 @@
+import { RequestResolver, createCacheStore } from '@shambay/cached-http-resolver';
+/**
+ * Creates a RequestResolver backed by an in-memory cache.
+ * Suitable for single-process usage where the cache does not need to be shared.
+ */
+export function createMemoryResolver(config = { cache: 'memory' }) {
+    const { maxRetries = 3, baseDelay = 1000, useExponential = true } = config;
+    const cache = createCacheStore('memory');
+    return new RequestResolver(cache, {
+        maxRetries,
+        baseDelay,
+        useExponential
+    });
+}
+//# sourceMappingURL=memory.js.map

package/dist/resolver/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/resolver/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGlF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CACnC,SAA+B,EAAE,KAAK,EAAE,QAAQ,EAAE;IAElD,MAAM,EAAE,UAAU,GAAG,CAAC,EAAE,SAAS,GAAG,IAAI,EAAE,cAAc,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAE3E,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAEzC,OAAO,IAAI,eAAe,CAAC,KAAK,EAAE;QACjC,UAAU;QACV,SAAS;QACT,cAAc;KACd,CAAC,CAAC;AACJ,CAAC"}

package/dist/resolver/redis.d.ts

@@ -0,0 +1,10 @@
+import { RequestResolver } from '@shambay/cached-http-resolver';
+import type { RedisResolverConfig } from '../types/resolver.js';
+/**
+ * Creates a RequestResolver backed by a Redis cache.
+ * Use this when the cache must be shared across multiple processes or instances.
+ *
+ * Requires `ioredis` to be installed as a peer dependency.
+ */
+export declare function createRedisResolver(config: RedisResolverConfig): RequestResolver;
+//# sourceMappingURL=redis.d.ts.map

package/dist/resolver/redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../src/resolver/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAoB,MAAM,+BAA+B,CAAC;AAClF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,eAAe,CAahF"}

package/dist/resolver/redis.js

@@ -0,0 +1,20 @@
+import { RequestResolver, createCacheStore } from '@shambay/cached-http-resolver';
+/**
+ * Creates a RequestResolver backed by a Redis cache.
+ * Use this when the cache must be shared across multiple processes or instances.
+ *
+ * Requires `ioredis` to be installed as a peer dependency.
+ */
+export function createRedisResolver(config) {
+    const { maxRetries = 3, baseDelay = 1000, useExponential = true, redis, keyPrefix } = config;
+    const cache = createCacheStore('redis', {
+        redis,
+        ...(keyPrefix && { keyPrefix })
+    });
+    return new RequestResolver(cache, {
+        maxRetries,
+        baseDelay,
+        useExponential
+    });
+}
+//# sourceMappingURL=redis.js.map

package/dist/resolver/redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../src/resolver/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGlF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA2B;IAC9D,MAAM,EAAE,UAAU,GAAG,CAAC,EAAE,SAAS,GAAG,IAAI,EAAE,cAAc,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAE7F,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE;QACvC,KAAK;QACL,GAAG,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;KAC/B,CAAC,CAAC;IAEH,OAAO,IAAI,eAAe,CAAC,KAAK,EAAE;QACjC,UAAU;QACV,SAAS;QACT,cAAc;KACd,CAAC,CAAC;AACJ,CAAC"}

package/dist/shared/env.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Optional environment variable reading.
+ * Does not require dotenv — if the variables are already set in
+ * process.env, they will be used as-is.
+ * If you want to load a .env file, install dotenv separately
+ * and call `import 'dotenv/config'` in your application.
+ */
+export declare function getEnv(key: string, fallback?: string): string | undefined;
+/**
+ * Reads a required environment variable.
+ * Throws if the variable is missing or empty.
+ */
+export declare function getEnvRequired(key: string): string;
+//# sourceMappingURL=env.d.ts.map

package/dist/shared/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/shared/env.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMlD"}

package/dist/shared/env.js

@@ -0,0 +1,22 @@
+/**
+ * Optional environment variable reading.
+ * Does not require dotenv — if the variables are already set in
+ * process.env, they will be used as-is.
+ * If you want to load a .env file, install dotenv separately
+ * and call `import 'dotenv/config'` in your application.
+ */
+export function getEnv(key, fallback) {
+    return process.env[key] ?? fallback;
+}
+/**
+ * Reads a required environment variable.
+ * Throws if the variable is missing or empty.
+ */
+export function getEnvRequired(key) {
+    const value = getEnv(key);
+    if (!value) {
+        throw new Error(`Missing required environment variable: ${key}`);
+    }
+    return value;
+}
+//# sourceMappingURL=env.js.map

package/dist/shared/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/shared/env.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,QAAiB;IACpD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/shared/index.d.ts

@@ -0,0 +1,4 @@
+export { getEnv, getEnvRequired } from './env.js';
+export { createLogger, setLogLevel, getLogLevel } from './logger.js';
+export type { LogLevel, Logger } from './logger.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/shared/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/shared/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACrE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/shared/index.js

@@ -0,0 +1,3 @@
+export { getEnv, getEnvRequired } from './env.js';
+export { createLogger, setLogLevel, getLogLevel } from './logger.js';
+//# sourceMappingURL=index.js.map

package/dist/shared/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/shared/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/shared/logger.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Minimal dependency-free logger used across the package.
+ *
+ * Consumers can control verbosity globally via {@link setLogLevel}.
+ * Default level is `'silent'`, which matches the pre-logger behavior
+ * (console.log / console.error on Vault operations).
+ */
+/**
+ * Logging verbosity. Each level includes all levels above it:
+ * - `silent` — no output at all
+ * - `error`  — errors only
+ * - `warn`   — errors and warnings
+ * - `info`   — errors, warnings, informational messages
+ * - `debug`  — everything, including request lifecycle details
+ */
+export type LogLevel = 'silent' | 'error' | 'warn' | 'info' | 'debug';
+/**
+ * Sets the global log level for all loggers created via {@link createLogger}.
+ */
+export declare function setLogLevel(level: LogLevel): void;
+/**
+ * Returns the current global log level.
+ */
+export declare function getLogLevel(): LogLevel;
+/**
+ * Public logger interface. Each method accepts a message and
+ * optional additional arguments forwarded to the console.
+ */
+export interface Logger {
+    error(message: string, ...args: unknown[]): void;
+    warn(message: string, ...args: unknown[]): void;
+    info(message: string, ...args: unknown[]): void;
+    debug(message: string, ...args: unknown[]): void;
+}
+/**
+ * Creates a namespaced logger. The namespace is prepended to every
+ * message, e.g. `createLogger('Vault')` produces `[Vault] ...`.
+ *
+ * @example
+ * const log = createLogger('Vault');
+ * log.info('Token obtained');
+ * // → [Vault] Token obtained
+ */
+export declare function createLogger(namespace: string): Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/shared/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/shared/logger.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAYtE;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAEjD;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAEtC;AAED;;;GAGG;AACH,MAAM,WAAW,MAAM;IACtB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChD,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACjD;AAMD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAyBtD"}

package/dist/shared/logger.js

@@ -0,0 +1,65 @@
+/**
+ * Minimal dependency-free logger used across the package.
+ *
+ * Consumers can control verbosity globally via {@link setLogLevel}.
+ * Default level is `'silent'`, which matches the pre-logger behavior
+ * (console.log / console.error on Vault operations).
+ */
+const LEVEL_RANK = {
+    silent: 0,
+    error: 1,
+    warn: 2,
+    info: 3,
+    debug: 4
+};
+let currentLevel = 'silent';
+/**
+ * Sets the global log level for all loggers created via {@link createLogger}.
+ */
+export function setLogLevel(level) {
+    currentLevel = level;
+}
+/**
+ * Returns the current global log level.
+ */
+export function getLogLevel() {
+    return currentLevel;
+}
+function shouldLog(level) {
+    return LEVEL_RANK[level] <= LEVEL_RANK[currentLevel];
+}
+/**
+ * Creates a namespaced logger. The namespace is prepended to every
+ * message, e.g. `createLogger('Vault')` produces `[Vault] ...`.
+ *
+ * @example
+ * const log = createLogger('Vault');
+ * log.info('Token obtained');
+ * // → [Vault] Token obtained
+ */
+export function createLogger(namespace) {
+    const prefix = `[${namespace}]`;
+    return {
+        error: (message, ...args) => {
+            if (shouldLog('error')) {
+                console.error(prefix, message, ...args);
+            }
+        },
+        warn: (message, ...args) => {
+            if (shouldLog('warn')) {
+                console.warn(prefix, message, ...args);
+            }
+        },
+        info: (message, ...args) => {
+            if (shouldLog('info')) {
+                console.log(prefix, message, ...args);
+            }
+        },
+        debug: (message, ...args) => {
+            if (shouldLog('debug')) {
+                console.log(prefix, message, ...args);
+            }
+        }
+    };
+}
+//# sourceMappingURL=logger.js.map

package/dist/shared/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/shared/logger.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,MAAM,UAAU,GAA6B;IAC5C,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;CACR,CAAC;AAEF,IAAI,YAAY,GAAa,QAAQ,CAAC;AAEtC;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAe;IAC1C,YAAY,GAAG,KAAK,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IAC1B,OAAO,YAAY,CAAC;AACrB,CAAC;AAaD,SAAS,SAAS,CAAC,KAAkC;IACpD,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC7C,MAAM,MAAM,GAAG,IAAI,SAAS,GAAG,CAAC;IAEhC,OAAO;QACN,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE;YAC3B,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;YACzC,CAAC;QACF,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE;YAC1B,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;YACxC,CAAC;QACF,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE;YAC1B,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;YACvC,CAAC;QACF,CAAC;QACD,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE;YAC3B,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;YACvC,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/types/index.d.ts

@@ -0,0 +1,4 @@
+export type { VaultManagerActions, VaultConfig, VaultDynamicDatabaseRole } from './vault.js';
+export type { VaultRequestHooks, VaultTokenOptions, DatabaseCredsOptions, KvSecretOptions } from './request.js';
+export type { ResolverRetryOptions, MemoryResolverConfig, RedisResolverConfig, ResolverFactoryConfig } from './resolver.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AACA,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG7F,YAAY,EACX,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,MAAM,cAAc,CAAC;AAGtB,YAAY,EACX,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,MAAM,eAAe,CAAC"}

package/dist/types/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":""}

package/dist/types/request.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Hooks for observing the lifecycle of a Vault request.
+ * All hooks are optional.
+ */
+export interface VaultRequestHooks {
+    /** Called right before a request is sent. */
+    onBefore?: (url: string) => void;
+    /** Called after a successful response. */
+    onAfter?: (response: unknown, data: unknown) => void;
+    /** Called when a request attempt fails. */
+    onError?: (error: Error, attempt: number) => void;
+}
+/**
+ * Per-call options for Vault token retrieval.
+ */
+export interface VaultTokenOptions extends VaultRequestHooks {
+    /**
+     * Refresh the token this many seconds before it expires.
+     * Default: 300 (5 minutes).
+     */
+    refreshBufferSeconds?: number;
+    /**
+     * Fallback TTL in seconds used when Vault does not return
+     * a valid `lease_duration`. Default: 3300.
+     */
+    fallbackTtlSeconds?: number;
+}
+/**
+ * Per-call options for dynamic database credentials.
+ */
+export interface DatabaseCredsOptions extends VaultRequestHooks {
+    /** Refresh the credentials this many seconds before they expire. Default: 300. */
+    refreshBufferSeconds?: number;
+    /** Fallback TTL in seconds when `lease_duration` is missing. Default: 3300. */
+    fallbackTtlSeconds?: number;
+}
+/**
+ * Per-call options for KV v2 secret reads.
+ */
+export interface KvSecretOptions extends VaultRequestHooks {
+    /** Whether to cache the result. Default: true. */
+    useCache?: boolean;
+    /** Explicit cache TTL in seconds. If omitted, the cache store default is used. */
+    cacheTTL?: number;
+    /** Refresh the value this many seconds before it expires. Default: 300. */
+    refreshBufferSeconds?: number;
+}
+//# sourceMappingURL=request.d.ts.map

package/dist/types/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/types/request.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IACjC,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IACrD,2CAA2C;IAC3C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClD;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC3D;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC9D,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACzD,kDAAkD;IAClD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/types/request.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=request.js.map

package/dist/types/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/types/request.ts"],"names":[],"mappings":""}

package/dist/types/resolver.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Common retry/backoff options shared by all resolvers.
+ */
+export interface ResolverRetryOptions {
+    /** Maximum number of retry attempts (default: 3) */
+    maxRetries?: number;
+    /** Base delay between retries in milliseconds (default: 1000) */
+    baseDelay?: number;
+    /** Whether to use exponential backoff (default: true) */
+    useExponential?: boolean;
+}
+/**
+ * Configuration for an in-memory cache resolver.
+ */
+export interface MemoryResolverConfig extends ResolverRetryOptions {
+    cache: 'memory';
+}
+/**
+ * Configuration for a Redis-backed cache resolver.
+ * `redis` accepts the same options as `ioredis` (host, port, password, etc.).
+ */
+export interface RedisResolverConfig extends ResolverRetryOptions {
+    cache: 'redis';
+    /** ioredis connection options */
+    redis: {
+        host?: string;
+        port?: number;
+        password?: string;
+        db?: number;
+        [key: string]: unknown;
+    };
+    /** Optional prefix for all cache keys */
+    keyPrefix?: string;
+}
+/**
+ * Union of all supported resolver configurations.
+ * Discriminated by the `cache` field.
+ */
+export type ResolverFactoryConfig = MemoryResolverConfig | RedisResolverConfig;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/types/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/types/resolver.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,KAAK,EAAE,QAAQ,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAoB,SAAQ,oBAAoB;IAChE,KAAK,EAAE,OAAO,CAAC;IACf,iCAAiC;IACjC,KAAK,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACvB,CAAC;IACF,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,oBAAoB,GAAG,mBAAmB,CAAC"}

package/dist/types/resolver.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=resolver.js.map

package/dist/types/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/types/resolver.ts"],"names":[],"mappings":""}

package/dist/types/vault.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Supported Vault manager actions.
+ * - `pg_url`       — fetch dynamic PostgreSQL credentials and build a connection URL
+ * - `value_by_key` — read a secret from Vault KV v2 by path
+ */
+export type VaultManagerActions = 'pg_url' | 'value_by_key';
+/**
+ * Configuration required to authenticate against Vault via AppRole.
+ */
+export interface VaultConfig {
+    /** Base address of the Vault server (e.g. `https://vault.example.com:8200`) */
+    vaultAddress: string;
+    /** AppRole mount path (e.g. `approle`) */
+    rolePath: string;
+    /** AppRole Role ID */
+    roleId: string;
+    /** AppRole Secret ID */
+    secretId: string;
+}
+/**
+ * Describes a dynamic database role and the target database
+ * used to assemble a connection URL.
+ */
+export interface VaultDynamicDatabaseRole {
+    /** Name of the database role in Vault */
+    role: string;
+    /** Database host */
+    host: string;
+    /** Database port */
+    port: number;
+    /** Database name */
+    name: string;
+}
+//# sourceMappingURL=vault.d.ts.map

package/dist/types/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/types/vault.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,cAAc,CAAC;AAE5D;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACxC,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;CACb"}

package/dist/types/vault.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=vault.js.map

package/dist/types/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/types/vault.ts"],"names":[],"mappings":""}

package/dist/vault/approle/index.d.ts

@@ -0,0 +1,2 @@
+export { getVaultToken } from './token.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/vault/approle/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/vault/approle/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/vault/approle/index.js

@@ -0,0 +1,2 @@
+export { getVaultToken } from './token.js';
+//# sourceMappingURL=index.js.map

package/dist/vault/approle/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/vault/approle/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/vault/approle/token.d.ts

@@ -0,0 +1,13 @@
+import type { RequestResolver } from '@shambay/cached-http-resolver';
+import type { VaultConfig } from '../../types/vault.js';
+import type { VaultTokenOptions } from '../../types/request.js';
+/**
+ * Retrieves a Vault token via AppRole authentication.
+ * The token is cached and proactively refreshed before it expires.
+ *
+ * @param resolver - RequestResolver used to perform the HTTP request
+ * @param config   - Vault configuration (address, rolePath, roleId, secretId)
+ * @param options  - Optional per-call overrides (buffer, fallback TTL, hooks)
+ */
+export declare function getVaultToken(resolver: RequestResolver, config: VaultConfig, options?: VaultTokenOptions): Promise<string>;
+//# sourceMappingURL=token.d.ts.map

package/dist/vault/approle/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/vault/approle/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AA+BhE;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAClC,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAsCjB"}

package/dist/vault/approle/token.js

@@ -0,0 +1,60 @@
+import { DEFAULT_REFRESH_BUFFER_SECONDS, DEFAULT_FALLBACK_TTL_SECONDS } from '../constants.js';
+import { createLogger } from '../../shared/logger.js';
+const log = createLogger('Vault');
+/**
+ * Default hooks and fallback values used when the caller
+ * does not provide any per-call options.
+ */
+const defaultOptions = {
+    refreshBufferSeconds: DEFAULT_REFRESH_BUFFER_SECONDS,
+    fallbackTtlSeconds: DEFAULT_FALLBACK_TTL_SECONDS,
+    onBefore: (url) => log.debug(`Requesting token from ${url}`),
+    onAfter: (_response, data) => {
+        const lease = data?.auth?.lease_duration;
+        log.debug(`Token obtained, lease_duration: ${lease}`);
+    },
+    onError: (error, attempt) => {
+        log.error(`Attempt ${attempt} failed: ${error.message}`);
+    }
+};
+/**
+ * Retrieves a Vault token via AppRole authentication.
+ * The token is cached and proactively refreshed before it expires.
+ *
+ * @param resolver - RequestResolver used to perform the HTTP request
+ * @param config   - Vault configuration (address, rolePath, roleId, secretId)
+ * @param options  - Optional per-call overrides (buffer, fallback TTL, hooks)
+ */
+export async function getVaultToken(resolver, config, options = {}) {
+    const { refreshBufferSeconds, fallbackTtlSeconds, onBefore, onAfter, onError } = {
+        ...defaultOptions,
+        ...options
+    };
+    const { vaultAddress, rolePath, roleId, secretId } = config;
+    const url = `${vaultAddress}/v1/auth/${rolePath}/login`;
+    const data = await resolver.request(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ role_id: roleId, secret_id: secretId })
+    }, {
+        cacheKey: `vault_token_${roleId}`,
+        requestKey: `vault_token_request_${roleId}`,
+        refreshBufferSeconds,
+        ttlResolver: (responseData) => {
+            const lease = responseData?.auth?.lease_duration;
+            if (typeof lease === 'number' && lease > 0) {
+                return lease;
+            }
+            return fallbackTtlSeconds;
+        },
+        onBefore,
+        onAfter,
+        onError
+    });
+    const token = data.auth?.client_token;
+    if (!token) {
+        throw new Error('Vault response missing client_token');
+    }
+    return token;
+}
+//# sourceMappingURL=token.js.map

package/dist/vault/approle/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/vault/approle/token.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AAUlC;;;GAGG;AACH,MAAM,cAAc,GAAgC;IACnD,oBAAoB,EAAE,8BAA8B;IACpD,kBAAkB,EAAE,4BAA4B;IAChD,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC;IAC5D,OAAO,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAI,IAAuC,EAAE,IAAI,EAAE,cAAc,CAAC;QAC7E,GAAG,CAAC,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3B,GAAG,CAAC,KAAK,CAAC,WAAW,OAAO,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;CACD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,QAAyB,EACzB,MAAmB,EACnB,UAA6B,EAAE;IAE/B,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG;QAChF,GAAG,cAAc;QACjB,GAAG,OAAO;KACV,CAAC;IAEF,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,YAAY,YAAY,QAAQ,QAAQ,CAAC;IAExD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAClC,GAAG,EACH;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;KAC9D,EACD;QACC,QAAQ,EAAE,eAAe,MAAM,EAAE;QACjC,UAAU,EAAE,uBAAuB,MAAM,EAAE;QAC3C,oBAAoB;QACpB,WAAW,EAAE,CAAC,YAAY,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAI,YAA+C,EAAE,IAAI,EAAE,cAAc,CAAC;YACrF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACd,CAAC;YACD,OAAO,kBAAkB,CAAC;QAC3B,CAAC;QACD,QAAQ;QACR,OAAO;QACP,OAAO;KACP,CACD,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/vault/constants.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Default values used across the package.
+ * Consumers can override most of these via per-call options.
+ */
+/** 5 minutes */
+export declare const DEFAULT_REFRESH_BUFFER_SECONDS = 300;
+/** 55 minutes */
+export declare const DEFAULT_FALLBACK_TTL_SECONDS = 3300;
+//# sourceMappingURL=constants.d.ts.map

package/dist/vault/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/vault/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,gBAAgB;AAChB,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,iBAAiB;AACjB,eAAO,MAAM,4BAA4B,OAAO,CAAC"}

package/dist/vault/constants.js

@@ -0,0 +1,9 @@
+/**
+ * Default values used across the package.
+ * Consumers can override most of these via per-call options.
+ */
+/** 5 minutes */
+export const DEFAULT_REFRESH_BUFFER_SECONDS = 300;
+/** 55 minutes */
+export const DEFAULT_FALLBACK_TTL_SECONDS = 3300;
+//# sourceMappingURL=constants.js.map

package/dist/vault/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/vault/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,gBAAgB;AAChB,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,iBAAiB;AACjB,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC"}