@shambay/vault-manager 1.0.1

package/dist/vault/database/index.d.ts

@@ -0,0 +1,2 @@
+export { getPostgresUrl } from './postgres-url.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/vault/database/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/vault/database/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/vault/database/index.js

@@ -0,0 +1,2 @@
+export { getPostgresUrl } from './postgres-url.js';
+//# sourceMappingURL=index.js.map

package/dist/vault/database/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/vault/database/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/vault/database/postgres-url.d.ts

@@ -0,0 +1,16 @@
+import type { RequestResolver } from '@shambay/cached-http-resolver';
+import type { DatabaseCredsOptions } from '../../types/request.js';
+/**
+ * Fetches dynamic PostgreSQL credentials from Vault and builds a connection URL.
+ *
+ * @param resolver      - RequestResolver used to perform the HTTP request
+ * @param vaultAddress  - Vault base address
+ * @param token         - Vault access token
+ * @param databaseRole  - Name of the database role in Vault
+ * @param host          - Database host
+ * @param port          - Database port
+ * @param databaseName  - Database name
+ * @param options       - Optional per-call overrides (buffer, fallback TTL, hooks)
+ */
+export declare function getPostgresUrl(resolver: RequestResolver, vaultAddress: string, token: string, databaseRole: string, host: string, port: number, databaseName: string, options?: DatabaseCredsOptions): Promise<string>;
+//# sourceMappingURL=postgres-url.d.ts.map

package/dist/vault/database/postgres-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-url.d.ts","sourceRoot":"","sources":["../../../src/vault/database/postgres-url.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AA0BnE;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,eAAe,EACzB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,oBAAyB,GAChC,OAAO,CAAC,MAAM,CAAC,CA8BjB"}

package/dist/vault/database/postgres-url.js

@@ -0,0 +1,53 @@
+import { DEFAULT_FALLBACK_TTL_SECONDS, DEFAULT_REFRESH_BUFFER_SECONDS } from '../constants.js';
+import { createLogger } from '../../shared/logger.js';
+const log = createLogger('Vault');
+/**
+ * Default hooks and fallback values used when the caller
+ * does not provide any per-call options.
+ */
+const defaultOptions = {
+    refreshBufferSeconds: DEFAULT_REFRESH_BUFFER_SECONDS,
+    fallbackTtlSeconds: DEFAULT_FALLBACK_TTL_SECONDS,
+    onBefore: () => { },
+    onAfter: () => { },
+    onError: (error, attempt) => {
+        log.error(`[DB] Attempt ${attempt} failed:`, error.message);
+    }
+};
+/**
+ * Fetches dynamic PostgreSQL credentials from Vault and builds a connection URL.
+ *
+ * @param resolver      - RequestResolver used to perform the HTTP request
+ * @param vaultAddress  - Vault base address
+ * @param token         - Vault access token
+ * @param databaseRole  - Name of the database role in Vault
+ * @param host          - Database host
+ * @param port          - Database port
+ * @param databaseName  - Database name
+ * @param options       - Optional per-call overrides (buffer, fallback TTL, hooks)
+ */
+export async function getPostgresUrl(resolver, vaultAddress, token, databaseRole, host, port, databaseName, options = {}) {
+    const { refreshBufferSeconds, fallbackTtlSeconds, onBefore, onAfter, onError } = {
+        ...defaultOptions,
+        ...options
+    };
+    const url = `${vaultAddress}/v1/database/creds/${databaseRole}`;
+    const cacheKey = `db_creds_${databaseRole}`;
+    const data = await resolver.request(url, { headers: { 'X-Vault-Token': token } }, {
+        cacheKey,
+        requestKey: cacheKey,
+        refreshBufferSeconds,
+        ttlResolver: (responseData) => {
+            const lease = responseData?.lease_duration;
+            if (typeof lease === 'number' && lease > 0) {
+                return lease;
+            }
+            return fallbackTtlSeconds;
+        },
+        onBefore,
+        onAfter,
+        onError
+    });
+    return `postgresql://${data.data.username}:${data.data.password}@${host}:${port}/${databaseName}`;
+}
+//# sourceMappingURL=postgres-url.js.map

package/dist/vault/database/postgres-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-url.js","sourceRoot":"","sources":["../../../src/vault/database/postgres-url.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AAQlC;;;GAGG;AACH,MAAM,cAAc,GAAmC;IACtD,oBAAoB,EAAE,8BAA8B;IACpD,kBAAkB,EAAE,4BAA4B;IAChD,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;IAClB,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;IACjB,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3B,GAAG,CAAC,KAAK,CAAC,gBAAgB,OAAO,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;CACD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,QAAyB,EACzB,YAAoB,EACpB,KAAa,EACb,YAAoB,EACpB,IAAY,EACZ,IAAY,EACZ,YAAoB,EACpB,UAAgC,EAAE;IAElC,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG;QAChF,GAAG,cAAc;QACjB,GAAG,OAAO;KACV,CAAC;IAEF,MAAM,GAAG,GAAG,GAAG,YAAY,sBAAsB,YAAY,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,YAAY,YAAY,EAAE,CAAC;IAE5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAClC,GAAG,EACH,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,EACvC;QACC,QAAQ;QACR,UAAU,EAAE,QAAQ;QACpB,oBAAoB;QACpB,WAAW,EAAE,CAAC,YAAY,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAI,YAAkD,EAAE,cAAc,CAAC;YAClF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACd,CAAC;YACD,OAAO,kBAAkB,CAAC;QAC3B,CAAC;QACD,QAAQ;QACR,OAAO;QACP,OAAO;KACP,CACD,CAAC;IAEF,OAAO,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,IAAI,IAAI,YAAY,EAAE,CAAC;AACnG,CAAC"}

package/dist/vault/index.d.ts

@@ -0,0 +1,4 @@
+export { getVaultToken } from './approle/index.js';
+export { getPostgresUrl } from './database/index.js';
+export { getValueByKey } from './kv/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/vault/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/vault/index.js

@@ -0,0 +1,4 @@
+export { getVaultToken } from './approle/index.js';
+export { getPostgresUrl } from './database/index.js';
+export { getValueByKey } from './kv/index.js';
+//# sourceMappingURL=index.js.map

package/dist/vault/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/vault/kv/index.d.ts

@@ -0,0 +1,2 @@
+export { getValueByKey } from './secret.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/vault/kv/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/vault/kv/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/vault/kv/index.js

@@ -0,0 +1,2 @@
+export { getValueByKey } from './secret.js';
+//# sourceMappingURL=index.js.map

package/dist/vault/kv/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/vault/kv/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/vault/kv/secret.d.ts

@@ -0,0 +1,13 @@
+import type { RequestResolver } from '@shambay/cached-http-resolver';
+import type { KvSecretOptions } from '../../types/request.js';
+/**
+ * Reads a secret from Vault KV v2 by path.
+ *
+ * @param resolver     - RequestResolver used to perform the HTTP request
+ * @param vaultAddress - Vault base address
+ * @param token        - Vault access token
+ * @param path         - Secret path (e.g. `myapp/config`)
+ * @param options      - Optional per-call overrides (cache, TTL, hooks)
+ */
+export declare function getValueByKey<T>(resolver: RequestResolver, vaultAddress: string, token: string, path: string, options?: KvSecretOptions): Promise<T>;
+//# sourceMappingURL=secret.d.ts.map

package/dist/vault/kv/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../../../src/vault/kv/secret.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AA6B9D;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACpC,QAAQ,EAAE,eAAe,EACzB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,eAAoB,GAC3B,OAAO,CAAC,CAAC,CAAC,CAyBZ"}

package/dist/vault/kv/secret.js

@@ -0,0 +1,46 @@
+import { DEFAULT_REFRESH_BUFFER_SECONDS } from '../constants.js';
+import { createLogger } from '../../shared/logger.js';
+const log = createLogger('KV');
+/**
+ * Default hooks and fallback values used when the caller
+ * does not provide any per-call options.
+ *
+ * Note: `useCache` and `cacheTTL` are handled separately below,
+ * since they depend on whether caching is enabled at all.
+ */
+const defaultOptions = {
+    useCache: true,
+    refreshBufferSeconds: DEFAULT_REFRESH_BUFFER_SECONDS,
+    onBefore: (url) => log.debug(`Fetching ${url}`),
+    onAfter: () => { },
+    onError: (error, attempt) => log.error(`Attempt ${attempt} failed:`, error.message)
+};
+/**
+ * Reads a secret from Vault KV v2 by path.
+ *
+ * @param resolver     - RequestResolver used to perform the HTTP request
+ * @param vaultAddress - Vault base address
+ * @param token        - Vault access token
+ * @param path         - Secret path (e.g. `myapp/config`)
+ * @param options      - Optional per-call overrides (cache, TTL, hooks)
+ */
+export async function getValueByKey(resolver, vaultAddress, token, path, options = {}) {
+    const { useCache, cacheTTL, refreshBufferSeconds, onBefore, onAfter, onError } = {
+        ...defaultOptions,
+        ...options
+    };
+    const url = `${vaultAddress}/v1/kv/data/${path}`;
+    const rawResponse = await resolver.request(url, { headers: { 'X-Vault-Token': token } }, {
+        ...(useCache && {
+            cacheKey: `vault_kv_${path}`,
+            requestKey: `vault_kv_${path}`,
+            cacheTTL,
+            refreshBufferSeconds
+        }),
+        onBefore,
+        onAfter,
+        onError
+    });
+    return rawResponse.data.data;
+}
+//# sourceMappingURL=secret.js.map

package/dist/vault/kv/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../../src/vault/kv/secret.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;AAS/B;;;;;;GAMG;AACH,MAAM,cAAc,GAC0C;IAC7D,QAAQ,EAAE,IAAI;IACd,oBAAoB,EAAE,8BAA8B;IACpD,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,GAAG,EAAE,CAAC;IAC/C,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;IACjB,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,OAAO,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;CACnF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,QAAyB,EACzB,YAAoB,EACpB,KAAa,EACb,IAAY,EACZ,UAA2B,EAAE;IAE7B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG;QAChF,GAAG,cAAc;QACjB,GAAG,OAAO;KACV,CAAC;IAEF,MAAM,GAAG,GAAG,GAAG,YAAY,eAAe,IAAI,EAAE,CAAC;IAEjD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,OAAO,CACzC,GAAG,EACH,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,EACvC;QACC,GAAG,CAAC,QAAQ,IAAI;YACf,QAAQ,EAAE,YAAY,IAAI,EAAE;YAC5B,UAAU,EAAE,YAAY,IAAI,EAAE;YAC9B,QAAQ;YACR,oBAAoB;SACpB,CAAC;QACF,QAAQ;QACR,OAAO;QACP,OAAO;KACP,CACD,CAAC;IAEF,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;AAC9B,CAAC"}

package/package.json

@@ -0,0 +1,76 @@
+{
+	"name": "@shambay/vault-manager",
+	"version": "1.0.1",
+	"description": "Vault client with built-in caching, deduplication, and proactive data refresh",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/sham-bay/ts-vault-manager.git"
+	},
+	"bugs": {
+		"url": "https://github.com/sham-bay/ts-vault-manager/issues"
+	},
+	"homepage": "https://github.com/sham-bay/ts-vault-manager",
+	"license": "Apache-2.0",
+	"author": "Sham Bay <sham.bay@use_social_to_contact.me>",
+	"publishConfig": {
+		"access": "public"
+	},
+	"engines": {
+		"node": ">=22.0.0"
+	},
+	"sideEffects": false,
+	"files": [
+		"dist"
+	],
+	"type": "module",
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"import": "./dist/index.js",
+			"default": "./dist/index.js"
+		}
+	},
+	"scripts": {
+		"build": "tsc -p tsconfig.build.json",
+		"prepublishOnly": "pnpm run build",
+		"lint": "prettier --check . && eslint .",
+		"format": "prettier --write .",
+		"test": "vitest run",
+		"test:watch": "vitest",
+		"test:coverage": "vitest run --coverage"
+	},
+	"peerDependencies": {
+		"ioredis": "^6.0.0",
+		"dotenv": "^17.4.0"
+	},
+	"peerDependenciesMeta": {
+		"ioredis": {
+			"optional": true
+		},
+		"dotenv": {
+			"optional": true
+		}
+	},
+	"dependencies": {
+		"@shambay/cached-http-resolver": "^1.1.0"
+	},
+	"devDependencies": {
+		"@eslint/js": "^10.0.1",
+		"@types/node": "^22",
+		"@vitest/coverage-v8": "^4.1.11",
+		"eslint": "^10.4.1",
+		"eslint-config-prettier": "^10.1.8",
+		"prettier": "^3.8.3",
+		"typescript": "^6.0.3",
+		"typescript-eslint": "^8.60.1",
+		"vitest": "^4.1.11"
+	},
+	"keywords": [
+		"vault-manager",
+		"vault",
+		"hashicorp"
+	],
+	"packageManager": "pnpm@11.21.0"
+}