@vellumai/credential-executor 0.10.7-dev.202607082034.5ac40b3 → 0.10.7-dev.202607082203.bf32263

package/Dockerfile

@@ -80,4 +80,4 @@ EXPOSE 8090
 ENV CES_MODE=managed
 ENV CES_HEALTH_PORT=8090
 
-CMD ["bun", "run", "src/managed-main.ts"]
+CMD ["bun", "run", "src/main.ts"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/credential-executor",
-  "version": "0.10.7-dev.202607082034.5ac40b3",
+  "version": "0.10.7-dev.202607082203.bf32263",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -8,12 +8,11 @@
   },
   "bin": {
     "credential-executor": "./src/main.ts",
-    "credential-executor-managed": "./src/managed-main.ts",
     "ces": "./src/cli.ts"
   },
   "scripts": {
     "dev": "bun run src/main.ts",
-    "dev:managed": "CES_MODE=managed bun run src/managed-main.ts",
+    "dev:managed": "CES_MODE=managed bun run src/main.ts",
     "lint": "eslint",
     "lint:unused": "knip --include files,dependencies,unlisted",
     "typecheck": "bunx tsc --noEmit",

package/src/__tests__/bulk-set-credentials.test.ts

@@ -16,7 +16,7 @@ import type { SecureKeyBackend } from "@vellumai/credential-storage";
 
 /**
  * Build a minimal BulkSetCredentials handler using the same logic as
- * main.ts / managed-main.ts, backed by the given SecureKeyBackend.
+ * main.ts, backed by the given SecureKeyBackend.
  */
 function buildBulkSetHandler(secureKeyBackend: SecureKeyBackend) {
   return async (req: { credentials: Array<{ account: string; value: string }> }) => {

package/src/__tests__/managed-integration.test.ts

@@ -116,7 +116,7 @@ function buildMinimalHandlers(dataDir: string): RpcHandlerRegistry {
  * Build an RPC handler registry with credential CRUD handlers backed by
  * a real SecureKeyBackend using a temp directory for credential storage.
  *
- * Mirrors the handler registration in managed-main.ts.
+ * Mirrors the handler registration in main.ts.
  */
 function buildCredentialHandlers(vellumRoot: string): RpcHandlerRegistry {
   const secureKeyBackend = createLocalSecureKeyBackend(vellumRoot);
@@ -149,7 +149,7 @@ function buildCredentialHandlers(vellumRoot: string): RpcHandlerRegistry {
  * Accept a single connection on a Unix socket and return
  * readable/writable streams plus cleanup helpers.
  *
- * Replicates the same accept-one-connection pattern from managed-main.ts
+ * Replicates the same accept-one-connection pattern from main.ts
  * but in a test-friendly form.
  */
 function acceptOneConnection(socketPath: string, signal: AbortSignal): Promise<{
@@ -367,7 +367,7 @@ describe("managed CES integration (real Unix socket)", () => {
 
     // -- Start health server ---------------------------------------------------
     // NOTE: This uses a local Bun.serve mock rather than the production
-    // `startHealthServer()` from managed-main.ts. The production function is
+    // `startHealthServer()` from main.ts. The production function is
     // not exported and depends on module-level mutable state (the
     // `rpcConnected` flag) that cannot be controlled from tests.
     //
@@ -377,7 +377,7 @@ describe("managed CES integration (real Unix socket)", () => {
     //   - End-to-end socket + RPC + health plumbing in one integration flow.
     //
     // What this does NOT cover:
-    //   - The actual `startHealthServer()` implementation in managed-main.ts,
+    //   - The actual `startHealthServer()` implementation in main.ts,
     //     including the `rpcConnected` field in the /readyz response. If the
     //     production health handler drifts (changes routes, status codes, or
     //     response shape), this test will not catch it. To close that gap,

package/src/__tests__/managed-lazy-getters.test.ts

@@ -228,7 +228,7 @@ describe("managed lazy getters — lazy resolution timing", () => {
         apiKeyRef,
       });
 
-    // Build a deps object with getters, mirroring managed-main.ts httpDeps
+    // Build a deps object with getters, mirroring main.ts httpDeps
     const httpDeps = {
       get managedSubjectOptions() {
         return getManagedSubjectOptions();

package/src/__tests__/managed-reconnect.test.ts

@@ -1,7 +1,7 @@
 /**
  * Managed CES reconnection test (real entrypoint subprocess).
  *
- * Spawns the actual `managed-main.ts` entrypoint and verifies that the CES
+ * Spawns the actual `main.ts` entrypoint and verifies that the CES
  * sidecar survives the assistant disconnecting and accepts a reconnection,
  * rather than shutting down when the RPC stream ends.
  *
@@ -179,7 +179,7 @@ describe("managed CES reconnection (real entrypoint)", () => {
     mkdirSync(join(assistantDataMount, ".vellum"), { recursive: true });
 
     const healthPort = await pickFreePort();
-    const managedMain = resolve(__dirname, "..", "managed-main.ts");
+    const managedMain = resolve(__dirname, "..", "main.ts");
 
     proc = Bun.spawn({
       cmd: [process.execPath, managedMain],

package/src/__tests__/managed-rejection.test.ts

@@ -2,7 +2,7 @@
  * Managed-mode local_static handle rejection contract tests.
  *
  * Validates that the MANAGED_LOCAL_STATIC_REJECTION_ERROR constant used by
- * managed-main.ts contains the expected contract fragments. These tests
+ * main.ts contains the expected contract fragments. These tests
  * import the actual production constant (not a test-local copy), so they
  * will fail if the error message drifts away from the expected contract.
  */

package/src/__tests__/transport.test.ts

@@ -125,39 +125,28 @@ function createTestServer(handlers: RpcHandlerRegistry = {}) {
 // ---------------------------------------------------------------------------
 
 describe("managed entrypoint transport isolation", () => {
-  test("managed-main.ts does not call Bun.serve for RPC (only health)", () => {
+  test("main.ts uses Bun.serve only for health probes (managed mode)", () => {
     const src = readFileSync(
-      resolve(__dirname, "..", "managed-main.ts"),
+      resolve(__dirname, "..", "main.ts"),
       "utf-8",
     );
-    // Bun.serve calls in managed-main should only be in startHealthServer
+    // Bun.serve is used for the health server in managed mode
     const bunServeMatches = src.match(/Bun\.serve\(/g);
     expect(bunServeMatches).not.toBeNull();
     // There should be exactly 1 Bun.serve call — for health probes only
     expect(bunServeMatches!.length).toBe(1);
   });
 
-  test("managed-main.ts uses createNetServer for Unix socket, not Bun.serve", () => {
+  test("main.ts uses createNetServer for Unix socket transport", () => {
     const src = readFileSync(
-      resolve(__dirname, "..", "managed-main.ts"),
+      resolve(__dirname, "..", "main.ts"),
       "utf-8",
     );
-    // Uses node:net createServer for the bootstrap socket
+    // Uses node:net createServer for the socket transport (both modes)
     expect(src).toMatch(/createNetServer/);
     // The net server never listens on a TCP port (only a socket path)
     expect(src).not.toMatch(/netServer\.listen\(\d+/);
   });
-
-  test("managed-main.ts unlinks socket after accepting one connection", () => {
-    const src = readFileSync(
-      resolve(__dirname, "..", "managed-main.ts"),
-      "utf-8",
-    );
-    // Should unlink the socket path after connection
-    expect(src).toMatch(/unlinkSync\(socketPath\)/);
-    // Should close the net server after one connection
-    expect(src).toMatch(/netServer\.close\(\)/);
-  });
 });
 
 // ---------------------------------------------------------------------------
@@ -165,9 +154,9 @@ describe("managed entrypoint transport isolation", () => {
 // ---------------------------------------------------------------------------
 
 describe("health probes", () => {
-  test("managed-main.ts serves /healthz and /readyz on a separate port", () => {
+  test("main.ts serves /healthz and /readyz in managed mode", () => {
     const src = readFileSync(
-      resolve(__dirname, "..", "managed-main.ts"),
+      resolve(__dirname, "..", "main.ts"),
       "utf-8",
     );
     expect(src).toMatch(/\/healthz/);
@@ -212,9 +201,16 @@ describe("local entrypoint transport isolation", () => {
     // Socket transport only — no stdio-child transport.
     expect(src).not.toMatch(/process\.stdin/);
     expect(src).not.toMatch(/process\.stdout/);
-    // Listens on a Unix socket path only — never a numeric TCP port — and
-    // never opens an HTTP server.
-    expect(src).not.toMatch(/Bun\.serve\(/);
+    // Bun.serve is only used inside the managed-mode health server block
+    // (startHealthServer), never for RPC transport. The RPC transport uses
+    // node:net createServer listening on a Unix socket path.
+    const bunServeMatches = src.match(/Bun\.serve\(/g);
+    expect(bunServeMatches).not.toBeNull();
+    expect(bunServeMatches!.length).toBe(1);
+    // The Bun.serve call must be inside the startHealthServer function, which
+    // is only invoked in managed mode.
+    expect(src).toMatch(/function startHealthServer/);
+    // Never listens on a numeric TCP port for RPC transport.
     expect(src).not.toMatch(/\.listen\(\d+/);
   });
 

package/src/cli.ts

@@ -25,7 +25,7 @@ import { homedir } from "node:os";
 import { createLocalSecureKeyBackend } from "./materializers/local-secure-key-backend.js";
 
 // ---------------------------------------------------------------------------
-// Path resolution (mirrors managed-main.ts)
+// Path resolution (mirrors the managed-mode path in main.ts)
 // ---------------------------------------------------------------------------
 
 function resolveVellumRoot(): string {

package/src/index.ts

@@ -8,9 +8,9 @@
  * from the local credential store, executes the requested operation through
  * the egress proxy, and returns sanitised results.
  *
- * This module re-exports the public API surface. For entrypoints see:
- * - `main.ts` — local mode (stdio transport, child process)
- * - `managed-main.ts` — managed mode (Unix socket transport, sidecar)
+ * This module re-exports the public API surface. For the entrypoint see
+ * `main.ts` — unified for both local (bare-metal sibling) and managed
+ * (Kubernetes sidecar) modes, selected by `getCesMode()`.
  */
 
 export {