@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/dist/backends/vault/secrets-vault.impl.js

@@ -0,0 +1,141 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { createRuntimeImplementation } from '@vibesdotdev/kernel/factory/implementation';
+import { assertSecretKey } from "../../domain/kinds/secret-key.js";
+import {} from "../../schemas/backends/bootstrap.schema.js";
+import {} from "../../schemas/backends/unseal.schema.js";
+import { assertSecretValue } from "../../support/secret-value.js";
+import { VAULT_PATH_KIND, deleteKVKey, readKVSecret, writeKVSecret } from "./secrets-vault.client.js";
+import { VaultBootstrap } from "./vault-bootstrap.js";
+import { pathsForDescriptor, writePathForDescriptor } from "./vault-config.js";
+export {} from "../../schemas/backends/bootstrap.schema.js";
+export { UnsealKeyBundleSchema, UnsealSourceSchema, UnsealSourcesSchema } from "../../schemas/backends/unseal.schema.js";
+export { bool, invalidUnsealSources, mountForEnvironment, parseCsv, parseUnsealSources, pathsForDescriptor, writePathForDescriptor } from "./vault-config.js";
+export const UNSEAL_KEYS = Array.from({ length: 10 }, (_, i) => `VAULT_UNSEAL_KEY_${i + 1}`);
+/** The service-account token is one short JWT; a larger file is not one. */
+export const SERVICE_ACCOUNT_TOKEN_MAX_BYTES = 16 * 1024;
+export class VaultStore extends VaultBootstrap {
+    id = 'vault';
+    async list(environment, operationContext) {
+        const config = await this.ensureReady(environment, operationContext);
+        const entries = [];
+        for (const path of pathsForDescriptor(this.descriptor)) {
+            const data = await this.readPathIfPresent(config, path);
+            if (!data)
+                continue;
+            for (const key of Object.keys(data)) {
+                entries.push({ key, hasValue: data[key] !== '', source: `vault/${path}` });
+            }
+        }
+        return entries;
+    }
+    async get(environment, key, operationContext) {
+        assertSecretKey(key);
+        const config = await this.ensureReady(environment, operationContext);
+        for (const path of pathsForDescriptor(this.descriptor)) {
+            const data = await this.readPathIfPresent(config, path);
+            if (data && Object.hasOwn(data, key))
+                return data[key];
+        }
+        return undefined;
+    }
+    async set(environment, key, value, operationContext) {
+        assertSecretKey(key);
+        assertSecretValue(value);
+        const config = await this.ensureReady(environment, operationContext);
+        const located = await this.locate(config, key);
+        const paths = pathsForDescriptor(this.descriptor);
+        const targetPath = located?.path ?? writePathForDescriptor(this.descriptor, paths);
+        const current = located?.data ?? (await this.readPathIfPresent(config, targetPath)) ?? {};
+        await writeKVSecret(config, targetPath, { ...current, [key]: value });
+    }
+    async unset(environment, key, operationContext) {
+        assertSecretKey(key);
+        const config = await this.ensureReady(environment, operationContext);
+        const located = await this.locate(config, key);
+        if (located) {
+            await deleteKVKey(config, located.path, key);
+        }
+    }
+    async getAll(environment, operationContext) {
+        const config = await this.ensureReady(environment, operationContext);
+        // The first path to hold a key wins, exactly as `get` answers it.
+        const all = new Map();
+        for (const path of pathsForDescriptor(this.descriptor)) {
+            const data = await this.readPathIfPresent(config, path);
+            if (!data)
+                continue;
+            for (const [key, value] of Object.entries(data)) {
+                if (!all.has(key))
+                    all.set(key, value);
+            }
+        }
+        return Object.fromEntries(all);
+    }
+    async setAll(environment, secrets, operationContext) {
+        const entries = Object.entries(secrets);
+        for (const [key, value] of entries) {
+            assertSecretKey(key);
+            assertSecretValue(value);
+        }
+        const config = await this.ensureReady(environment, operationContext);
+        const existing = new Map();
+        const paths = pathsForDescriptor(this.descriptor);
+        for (const path of paths) {
+            const data = await this.readPathIfPresent(config, path);
+            if (data)
+                existing.set(path, data);
+        }
+        // Each key is written where it already lives (the path `get` reads it from), else the write path.
+        const writePath = writePathForDescriptor(this.descriptor, paths);
+        const updates = new Map();
+        for (const [key, value] of entries) {
+            const path = paths.find((candidate) => {
+                const data = existing.get(candidate);
+                return data !== undefined && Object.hasOwn(data, key);
+            }) ?? writePath;
+            const base = updates.get(path) ?? existing.get(path) ?? {};
+            updates.set(path, { ...base, [key]: value });
+        }
+        for (const [path, data] of updates) {
+            await writeKVSecret(config, path, data);
+        }
+    }
+    /** The first path that holds `key` (as its own property), with its data. */
+    async locate(config, key) {
+        for (const path of pathsForDescriptor(this.descriptor)) {
+            const data = await this.readPathIfPresent(config, path);
+            if (data && Object.hasOwn(data, key))
+                return { path, data };
+        }
+        return undefined;
+    }
+    /** One path's data, or `undefined` for the typed absence of that path; any other failure propagates. */
+    async readPathIfPresent(config, path) {
+        try {
+            return await readKVSecret(config, path);
+        }
+        catch (error) {
+            if (error instanceof Error && CapabilityError.isAbsenceOf(error, VAULT_PATH_KIND, path)) {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+}
+export function invalidUnsealBundle(problem) {
+    return new CapabilityError('The Vault unseal key bundle is not a JSON array of strings.', 'INVALID_INPUT', {
+        reason: 'vault-unseal-keys-invalid',
+        retryable: false,
+        details: { problem }
+    });
+}
+export function createVaultStore(runtime, desc, resolveOtherStores) {
+    const store = new VaultStore(runtime, desc, resolveOtherStores);
+    return createRuntimeImplementation({
+        id: 'vault',
+        kind: 'secrets/store',
+        priority: 30,
+        implementation: store
+    });
+}
+//# sourceMappingURL=secrets-vault.impl.js.map

package/dist/backends/vault/secrets-vault.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-vault.impl.js","sourceRoot":"","sources":["../../../src/backends/vault/secrets-vault.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AAOzF,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAA2B,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAA0B,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACP,eAAe,EACf,WAAW,EACX,YAAY,EACZ,aAAa,EAEZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAC,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAkD,MAAM,4CAA4C,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAC,kBAAkB,EAAC,mBAAmB,EAAyB,MAAM,yCAAyC,CAAC;AAC9I,OAAO,EAAE,IAAI,EAAC,oBAAoB,EAAC,mBAAmB,EAAC,QAAQ,EAAC,kBAAkB,EAAC,kBAAkB,EAAC,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACxJ,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC7F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,MAAM,OAAO,UAAW,SAAQ,cAAc;IACpC,EAAE,GAAG,OAAO,CAAC;IAEtB,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,gBAAwC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACrE,MAAM,OAAO,GAAkB,EAAE,CAAC;QAElC,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5E,CAAC;QACF,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CACR,WAAmB,EACnB,GAAW,EACX,gBAAwC;QAExC,eAAe,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACrE,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxD,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,GAAG,CACR,WAAmB,EACnB,GAAW,EACX,KAAa,EACb,gBAAwC;QAExC,eAAe,CAAC,GAAG,CAAC,CAAC;QACrB,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,OAAO,EAAE,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,OAAO,EAAE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1F,MAAM,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAmB,EAAE,GAAW,EAAE,gBAAwC;QACrF,eAAe,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC/C,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;IACF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,gBAAwC;QACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACrE,kEAAkE;QAClE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxC,CAAC;QACF,CAAC;QACD,OAAO,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CACX,WAAmB,EACnB,OAA+B,EAC/B,gBAAwC;QAExC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,eAAe,CAAC,GAAG,CAAC,CAAC;YACrB,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAErE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;QAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxD,IAAI,IAAI;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,kGAAkG;QAClG,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;QAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;gBACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACrC,OAAO,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC,CAAC,IAAI,SAAS,CAAC;YAChB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;IAED,4EAA4E;IACpE,KAAK,CAAC,MAAM,CACnB,MAAyB,EACzB,GAAW;QAEX,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxD,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC7D,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,wGAAwG;IAChG,KAAK,CAAC,iBAAiB,CAC9B,MAAyB,EACzB,IAAY;QAEZ,IAAI,CAAC;YACJ,OAAO,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,KAAK,IAAI,eAAe,CAAC,WAAW,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;gBACzF,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;CACD;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe;IAClD,OAAO,IAAI,eAAe,CAAC,6DAA6D,EAAE,eAAe,EAAE;QAC1G,MAAM,EAAE,2BAA2B;QACnC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE;KACpB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC/B,OAA0B,EAC1B,IAA4B,EAC5B,kBAAuC;IAEvC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAChE,OAAO,2BAA2B,CAAC;QAClC,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,KAAK;KACrB,CAAC,CAAC;AACJ,CAAC"}

package/dist/backends/vault/vault-bootstrap.d.ts

@@ -0,0 +1,24 @@
+import type { SecretsStoreDescriptor } from '@vibesdotdev/secrets/kinds/store.schema';
+import type { StoreOperationContext } from '../../domain/kinds/schemas/store.types.ts';
+import type { OtherStoreResolver, UnsealStoreGetter } from '../../schemas/backends/bootstrap.schema.ts';
+import { type VaultStoreRuntime } from "../../schemas/backends/unseal.schema.ts";
+import { type VaultClientConfig } from './secrets-vault.client.ts';
+export declare class VaultBootstrap {
+    protected readonly runtime: VaultStoreRuntime;
+    protected readonly resolveOtherStores?: OtherStoreResolver | undefined;
+    readonly descriptor: SecretsStoreDescriptor;
+    constructor(runtime: VaultStoreRuntime, desc: SecretsStoreDescriptor, resolveOtherStores?: OtherStoreResolver | undefined);
+    protected resolveStoreCandidates(environment: string): Promise<UnsealStoreGetter[]>;
+    protected resolveCredentialReference(environment: string, referenceKey: string | undefined, operationContext?: StoreOperationContext): Promise<string | undefined>;
+    /**
+     * The client config for `environment`. The address and Kubernetes role are the
+     * descriptor's own values unless the descriptor names a credential key for them
+     * (`addressCredentialKey`, `k8sRoleCredentialKey`); a named key is resolved
+     * through the credential stores, and a value found there takes precedence. The
+     * token is resolved the same way, lazily, when a request needs it.
+     */
+    configForEnvironment(environment: string, operationContext?: StoreOperationContext): Promise<VaultClientConfig>;
+    /** The resolved client config, once the Vault it names is unsealed (or needs no unseal). */
+    protected ensureReady(environment: string, operationContext?: StoreOperationContext): Promise<VaultClientConfig>;
+}
+//# sourceMappingURL=vault-bootstrap.d.ts.map

package/dist/backends/vault/vault-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-bootstrap.d.ts","sourceRoot":"","sources":["../../../src/backends/vault/vault-bootstrap.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AACxG,OAAO,EAAwB,KAAK,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAIvG,OAAO,EAIP,KAAK,iBAAiB,EACrB,MAAM,2BAA2B,CAAC;AAInC,qBAAa,cAAc;IAMzB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,iBAAiB;IAE7C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB;IAN3D,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;gBAIxB,OAAO,EAAE,iBAAiB,EAC7C,IAAI,EAAE,sBAAsB,EACT,kBAAkB,CAAC,EAAE,kBAAkB,YAAA;cAM3C,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;cAuBzE,0BAA0B,CACzC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,gBAAgB,CAAC,EAAE,qBAAqB,GACtC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAkB9B;;;;;;OAMG;IACG,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA2CrH,4FAA4F;cAC5E,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CA4DtH"}

package/dist/backends/vault/vault-bootstrap.js

@@ -0,0 +1,147 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { UnsealKeyBundleSchema } from "../../schemas/backends/unseal.schema.js";
+import { readHostTextFile } from "../../transport/host-file.js";
+import { parseJsonBody } from "../../transport/json-body.js";
+import { isDevelopmentHost } from "../../transport/secure-url.js";
+import { K8S_TOKEN_PATH, collectStoredUnsealKeys, ensureVaultUnsealed } from "./secrets-vault.client.js";
+import { SERVICE_ACCOUNT_TOKEN_MAX_BYTES, invalidUnsealBundle } from "./secrets-vault.impl.js";
+import { bool, mountForEnvironment, parseUnsealSources } from "./vault-config.js";
+export class VaultBootstrap {
+    runtime;
+    resolveOtherStores;
+    descriptor;
+    constructor(runtime, desc, resolveOtherStores) {
+        this.runtime = runtime;
+        this.resolveOtherStores = resolveOtherStores;
+        this.descriptor = desc;
+    }
+    async resolveStoreCandidates(environment) {
+        if (this.resolveOtherStores) {
+            return await this.resolveOtherStores(environment);
+        }
+        if (!this.runtime.hasKind?.('secrets/store'))
+            return [];
+        const descriptors = this.runtime
+            .query('secrets/store')
+            .descriptors()
+            .filter((d) => d.backend !== 'vault' && d.id !== this.descriptor.id)
+            .sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+        return descriptors.map((d) => ({
+            id: d.id,
+            get: async (env, key, operationContext) => {
+                const impl = await this.runtime
+                    .query('secrets/store')
+                    .withId(d.id)
+                    .resolve();
+                return await impl.get(env, key, operationContext);
+            }
+        }));
+    }
+    async resolveCredentialReference(environment, referenceKey, operationContext) {
+        if (!referenceKey)
+            return undefined;
+        const stores = await this.resolveStoreCandidates(environment);
+        for (const store of stores) {
+            try {
+                const value = (await store.get(environment, referenceKey, operationContext))?.trim();
+                if (value && value.length > 0)
+                    return value;
+            }
+            catch (error) {
+                if (error instanceof Error && CapabilityError.isAbsenceOf(error, 'secrets/store', store.id)) {
+                    continue;
+                }
+                throw error;
+            }
+        }
+        return undefined;
+    }
+    /**
+     * The client config for `environment`. The address and Kubernetes role are the
+     * descriptor's own values unless the descriptor names a credential key for them
+     * (`addressCredentialKey`, `k8sRoleCredentialKey`); a named key is resolved
+     * through the credential stores, and a value found there takes precedence. The
+     * token is resolved the same way, lazily, when a request needs it.
+     */
+    async configForEnvironment(environment, operationContext) {
+        const config = this.descriptor.config ?? {};
+        const tokenEnvVar = config.tokenCredentialKey ?? config.tokenEnvVar;
+        const explicitToken = config.token?.trim();
+        const referencedAddress = await this.resolveCredentialReference(environment, config.addressCredentialKey, operationContext);
+        const address = referencedAddress ?? config.address;
+        // Absent is unconfigured; an empty descriptor value flows to the client's parse (vault-address-invalid).
+        if (address === undefined) {
+            throw new CapabilityError('The Vault backend has no address: set `address` on the vault descriptor.', 'UNAVAILABLE', { reason: 'vault-address-unconfigured', retryable: false });
+        }
+        const k8sRole = config.k8sRole ??
+            (await this.resolveCredentialReference(environment, config.k8sRoleCredentialKey, operationContext));
+        return {
+            address,
+            // The address is parsed at the client, before any request: a token, JWT or unseal key
+            // is never sent to plain `http` (loopback excepted on a development host).
+            allowLoopbackHttp: isDevelopmentHost(this.runtime),
+            mount: mountForEnvironment(this.descriptor, environment),
+            token: explicitToken,
+            tokenEnvVar,
+            resolveToken: () => explicitToken !== undefined
+                ? Promise.resolve(explicitToken)
+                : this.resolveCredentialReference(environment, tokenEnvVar, operationContext),
+            k8sRole,
+            readServiceAccountToken: () => readHostTextFile(this.runtime, K8S_TOKEN_PATH, { label: 'kubernetes-token' }, SERVICE_ACCOUNT_TOKEN_MAX_BYTES)
+        };
+    }
+    /** The resolved client config, once the Vault it names is unsealed (or needs no unseal). */
+    async ensureReady(environment, operationContext) {
+        const config = await this.configForEnvironment(environment, operationContext);
+        const unsealSourcesKey = this.descriptor.config?.unsealSourcesCredentialKey ?? this.descriptor.config?.unsealSourcesEnvVar;
+        const rawUnsealSources = await this.resolveCredentialReference(environment, unsealSourcesKey, operationContext);
+        const sourceSpecs = parseUnsealSources(this.descriptor, rawUnsealSources);
+        const resolveAdditionalKeys = async () => {
+            const additionalKeys = [];
+            const stores = await this.resolveStoreCandidates(environment);
+            for (const store of stores) {
+                // A store that answers absence for a key simply does not hold it.
+                const readKey = async (keyName) => {
+                    try {
+                        return await store.get(environment, keyName, operationContext);
+                    }
+                    catch (error) {
+                        if (error instanceof Error && CapabilityError.isAbsenceOf(error, 'secrets/store', store.id)) {
+                            return undefined;
+                        }
+                        throw error;
+                    }
+                };
+                additionalKeys.push(...await collectStoredUnsealKeys(readKey));
+                try {
+                    const jsonBundle = await store.get(environment, 'VAULT_UNSEAL_KEYS_JSON', operationContext);
+                    if (jsonBundle) {
+                        const parsed = parseJsonBody(jsonBundle, UnsealKeyBundleSchema);
+                        // The parser's error quotes the bundle, which is unseal key material.
+                        if (!parsed.ok)
+                            throw invalidUnsealBundle(parsed.problem);
+                        for (const value of parsed.data) {
+                            if (value.length > 0)
+                                additionalKeys.push(value);
+                        }
+                    }
+                }
+                catch (error) {
+                    if (error instanceof Error && CapabilityError.isAbsenceOf(error, 'secrets/store', store.id)) {
+                        continue;
+                    }
+                    throw error;
+                }
+            }
+            return additionalKeys;
+        };
+        await ensureVaultUnsealed(config, {
+            autoUnseal: bool(this.descriptor.config?.autoUnseal, true),
+            allowPrompt: bool(this.descriptor.config?.unsealAllowPrompt, false),
+            resolveAdditionalKeys,
+            sourceSpecs
+        });
+        return config;
+    }
+}
+//# sourceMappingURL=vault-bootstrap.js.map

package/dist/backends/vault/vault-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-bootstrap.js","sourceRoot":"","sources":["../../../src/backends/vault/vault-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAItD,OAAO,EAAE,qBAAqB,EAAyB,MAAM,yCAAyC,CAAC;AACvG,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACP,cAAc,EACd,uBAAuB,EACvB,mBAAmB,EAElB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,+BAA+B,EAAC,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9F,OAAO,EAAE,IAAI,EAAC,mBAAmB,EAAC,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEhF,MAAM,OAAO,cAAc;IAMN;IAEA;IANX,UAAU,CAAyB;IAG5C,YACoB,OAA0B,EAC7C,IAA4B,EACT,kBAAuC;QAFvC,YAAO,GAAP,OAAO,CAAmB;QAE1B,uBAAkB,GAAlB,kBAAkB,CAAqB;QAE1D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACxB,CAAC;IAGS,KAAK,CAAC,sBAAsB,CAAC,WAAmB;QACzD,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC;YAAE,OAAO,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO;aAC9B,KAAK,CAA4C,eAAe,CAAC;aACjE,WAAW,EAAE;aACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;aACnE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,GAAG,EAAE,KAAK,EAAE,GAAW,EAAE,GAAW,EAAE,gBAAwC,EAAE,EAAE;gBACjF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO;qBAC7B,KAAK,CAA4C,eAAe,CAAC;qBACjE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;qBACZ,OAAO,EAAE,CAAC;gBACZ,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACnD,CAAC;SACD,CAAC,CAAC,CAAC;IACL,CAAC;IAGS,KAAK,CAAC,0BAA0B,CACzC,WAAmB,EACnB,YAAgC,EAChC,gBAAwC;QAExC,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAC9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACJ,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBACrF,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,KAAK,IAAI,eAAe,CAAC,WAAW,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7F,SAAS;gBACV,CAAC;gBACD,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAGD;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CAAC,WAAmB,EAAE,gBAAwC;QACvF,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,WAAW,CAAC;QACpE,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QAE3C,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAC9D,WAAW,EACX,MAAM,CAAC,oBAAoB,EAC3B,gBAAgB,CAChB,CAAC;QACF,MAAM,OAAO,GAAG,iBAAiB,IAAI,MAAM,CAAC,OAAO,CAAC;QACpD,yGAAyG;QACzG,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,eAAe,CACxB,0EAA0E,EAC1E,aAAa,EACb,EAAE,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,KAAK,EAAE,CAC1D,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GACZ,MAAM,CAAC,OAAO;YACd,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,MAAM,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAErG,OAAO;YACN,OAAO;YACP,sFAAsF;YACtF,2EAA2E;YAC3E,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;YACxD,KAAK,EAAE,aAAa;YACpB,WAAW;YACX,YAAY,EAAE,GAAG,EAAE,CAClB,aAAa,KAAK,SAAS;gBAC1B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;gBAChC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,CAAC;YAC/E,OAAO;YACP,uBAAuB,EAAE,GAAG,EAAE,CAC7B,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,+BAA+B,CAAC;SAC/G,CAAC;IACH,CAAC;IAGD,4FAA4F;IAClF,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,gBAAwC;QACxF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC9E,MAAM,gBAAgB,GACrB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,0BAA0B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,mBAAmB,CAAC;QACnG,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAC7D,WAAW,EACX,gBAAgB,EAChB,gBAAgB,CAChB,CAAC;QACF,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC1E,MAAM,qBAAqB,GAAG,KAAK,IAAuB,EAAE;YAC3D,MAAM,cAAc,GAAa,EAAE,CAAC;YAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAC9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC5B,kEAAkE;gBAClE,MAAM,OAAO,GAAG,KAAK,EAAE,OAAe,EAA+B,EAAE;oBACtE,IAAI,CAAC;wBACJ,OAAO,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;oBAChE,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAChB,IAAI,KAAK,YAAY,KAAK,IAAI,eAAe,CAAC,WAAW,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;4BAC7F,OAAO,SAAS,CAAC;wBAClB,CAAC;wBACD,MAAM,KAAK,CAAC;oBACb,CAAC;gBACF,CAAC,CAAC;gBACF,cAAc,CAAC,IAAI,CAAC,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC/D,IAAI,CAAC;oBACJ,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,CACjC,WAAW,EACX,wBAAwB,EACxB,gBAAgB,CAChB,CAAC;oBACF,IAAI,UAAU,EAAE,CAAC;wBAChB,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;wBAChE,sEAAsE;wBACtE,IAAI,CAAC,MAAM,CAAC,EAAE;4BAAE,MAAM,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;wBAC1D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;4BACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gCAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAClD,CAAC;oBACF,CAAC;gBACF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,KAAK,YAAY,KAAK,IAAI,eAAe,CAAC,WAAW,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;wBAC7F,SAAS;oBACV,CAAC;oBACD,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC;YAED,OAAO,cAAc,CAAC;QACvB,CAAC,CAAC;QAEF,MAAM,mBAAmB,CAAC,MAAM,EAAE;YACjC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC;YAC1D,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,CAAC;YACnE,qBAAqB;YACrB,WAAW;SACX,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IACf,CAAC;CACD"}

package/dist/backends/vault/vault-config.d.ts

@@ -0,0 +1,26 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import type { SecretsStoreDescriptor } from '@vibesdotdev/secrets/kinds/store.schema';
+import { type VaultUnsealSourceSpec } from './secrets-vault.client.ts';
+/**
+ * The KV paths one store spans, in ONE order, from the descriptor's `paths`
+ * (comma-separated): a read answers from the first path that holds the key, a
+ * write goes to the path that already holds it (else the write path), so `get`,
+ * `getAll`, `set` and `setAll` always agree on which copy wins. The layout is
+ * the composition's own: this package ships no default set of paths.
+ */
+export declare function pathsForDescriptor(desc: SecretsStoreDescriptor): string[];
+/** Where a key with no copy yet is written: the descriptor's `writePath`, else the first path. */
+export declare function writePathForDescriptor(desc: SecretsStoreDescriptor, paths: string[]): string;
+export declare function bool(value: string | undefined, fallback?: boolean): boolean;
+export declare function parseCsv(value: string | undefined): string[] | undefined;
+/**
+ * The KV mount an environment is served from. `staging` and `production` have
+ * their own mounts. `local` and `dev` have none of their own, and are NEVER
+ * answered from the staging mount by default: a descriptor that really serves
+ * one declares it as `config['mount.<environment>']`. Anything else is refused
+ * `INVALID_INPUT vault-environment-unsupported`.
+ */
+export declare function mountForEnvironment(desc: SecretsStoreDescriptor, environment: string): string;
+export declare function parseUnsealSources(desc: SecretsStoreDescriptor, rawFromStores?: string): VaultUnsealSourceSpec[];
+export declare function invalidUnsealSources(envVarName: string, problem: string): CapabilityError;
+//# sourceMappingURL=vault-config.d.ts.map

package/dist/backends/vault/vault-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-config.d.ts","sourceRoot":"","sources":["../../../src/backends/vault/vault-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAGtF,OAAO,EACP,KAAK,qBAAqB,EACzB,MAAM,2BAA2B,CAAC;AAEnC;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAUzE;AAED,kGAAkG;AAClG,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAE5F;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,UAAQ,GAAG,OAAO,CAGzE;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAOxE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAe7F;AAID,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,sBAAsB,EAC5B,aAAa,CAAC,EAAE,MAAM,GACpB,qBAAqB,EAAE,CA0BzB;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,eAAe,CAMzF"}

package/dist/backends/vault/vault-config.js

@@ -0,0 +1,93 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { UnsealSourcesSchema } from "../../schemas/backends/unseal.schema.js";
+import { parseJsonBody } from "../../transport/json-body.js";
+import {} from "./secrets-vault.client.js";
+/**
+ * The KV paths one store spans, in ONE order, from the descriptor's `paths`
+ * (comma-separated): a read answers from the first path that holds the key, a
+ * write goes to the path that already holds it (else the write path), so `get`,
+ * `getAll`, `set` and `setAll` always agree on which copy wins. The layout is
+ * the composition's own: this package ships no default set of paths.
+ */
+export function pathsForDescriptor(desc) {
+    const paths = parseCsv(desc.config?.paths);
+    if (!paths) {
+        throw new CapabilityError('The Vault backend declares no KV paths: set `paths` on the vault descriptor.', 'INVALID_INPUT', { reason: 'vault-paths-undeclared', retryable: false });
+    }
+    return paths;
+}
+/** Where a key with no copy yet is written: the descriptor's `writePath`, else the first path. */
+export function writePathForDescriptor(desc, paths) {
+    return desc.config?.writePath ?? paths[0];
+}
+export function bool(value, fallback = false) {
+    if (value === undefined)
+        return fallback;
+    return value === 'true' || value === '1' || value === 'yes';
+}
+export function parseCsv(value) {
+    if (!value)
+        return undefined;
+    const parts = value
+        .split(',')
+        .map((p) => p.trim())
+        .filter((p) => p.length > 0);
+    return parts.length > 0 ? parts : undefined;
+}
+/**
+ * The KV mount an environment is served from. `staging` and `production` have
+ * their own mounts. `local` and `dev` have none of their own, and are NEVER
+ * answered from the staging mount by default: a descriptor that really serves
+ * one declares it as `config['mount.<environment>']`. Anything else is refused
+ * `INVALID_INPUT vault-environment-unsupported`.
+ */
+export function mountForEnvironment(desc, environment) {
+    const declared = desc.config?.[`mount.${environment}`];
+    if (declared)
+        return declared;
+    if (environment === 'production')
+        return 'production';
+    if (environment === 'staging')
+        return 'staging';
+    throw new CapabilityError(`The Vault backend does not serve environment '${environment}': it has no mount for it.`, 'INVALID_INPUT', {
+        reason: 'vault-environment-unsupported',
+        retryable: false,
+        recoveryHint: `Use --environment staging or production, or declare config['mount.${environment}'] on the vault descriptor.`,
+        details: { environment }
+    });
+}
+// The vault backend resolves unseal sources from its descriptor and the JSON the
+// non-Vault credential stores resolved, never from ambient environment variables.
+export function parseUnsealSources(desc, rawFromStores) {
+    const config = desc.config ?? {};
+    const sources = [];
+    const envVarName = config.unsealSourcesCredentialKey ?? config.unsealSourcesEnvVar;
+    if (rawFromStores && rawFromStores.length > 0) {
+        const parsed = parseJsonBody(rawFromStores, UnsealSourcesSchema);
+        // The parser's error quotes the text, and the sources carry tokens: the refusal names the variable only.
+        if (!parsed.ok)
+            throw invalidUnsealSources(envVarName ?? 'unsealSources', parsed.problem);
+        sources.push(...parsed.data);
+    }
+    const singleAddress = config.unsealSourceAddress;
+    const singleMount = config.unsealSourceMount;
+    const singlePath = config.unsealSourcePath;
+    if (singleAddress && singleMount && singlePath) {
+        sources.push({
+            address: singleAddress,
+            mount: singleMount,
+            path: singlePath,
+            tokenEnvVar: config.unsealSourceTokenEnvVar,
+            keyFields: parseCsv(config.unsealSourceKeyFields)
+        });
+    }
+    return sources;
+}
+export function invalidUnsealSources(envVarName, problem) {
+    return new CapabilityError(`Vault unseal sources JSON in ${envVarName} is invalid`, 'INVALID_INPUT', {
+        reason: 'vault-unseal-sources-invalid',
+        retryable: false,
+        details: { variable: envVarName, problem }
+    });
+}
+//# sourceMappingURL=vault-config.js.map

package/dist/backends/vault/vault-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-config.js","sourceRoot":"","sources":["../../../src/backends/vault/vault-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAEN,MAAM,2BAA2B,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA4B;IAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,eAAe,CACxB,8EAA8E,EAC9E,eAAe,EACf,EAAE,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,KAAK,EAAE,CACtD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,sBAAsB,CAAC,IAA4B,EAAE,KAAe;IACnF,OAAO,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAyB,EAAE,QAAQ,GAAG,KAAK;IAC/D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,KAAK,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA4B,EAAE,WAAmB;IACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IACvD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,WAAW,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IACtD,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,IAAI,eAAe,CACxB,iDAAiD,WAAW,4BAA4B,EACxF,eAAe,EACf;QACC,MAAM,EAAE,+BAA+B;QACvC,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,qEAAqE,WAAW,6BAA6B;QAC3H,OAAO,EAAE,EAAE,WAAW,EAAE;KACxB,CACD,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CACjC,IAA4B,EAC5B,aAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,MAAM,OAAO,GAA4B,EAAE,CAAC;IAE5C,MAAM,UAAU,GAAG,MAAM,CAAC,0BAA0B,IAAI,MAAM,CAAC,mBAAmB,CAAC;IACnF,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QACjE,yGAAyG;QACzG,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,oBAAoB,CAAC,UAAU,IAAI,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1F,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,mBAAmB,CAAC;IACjD,MAAM,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAC3C,IAAI,aAAa,IAAI,WAAW,IAAI,UAAU,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,aAAa;YACtB,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,MAAM,CAAC,uBAAuB;YAC3C,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC;SACjD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,OAAe;IACvE,OAAO,IAAI,eAAe,CAAC,gCAAgC,UAAU,aAAa,EAAE,eAAe,EAAE;QACpG,MAAM,EAAE,8BAA8B;QACtC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE;KAC1C,CAAC,CAAC;AACJ,CAAC"}

package/dist/backends/vault/vault-failures.d.ts

@@ -0,0 +1,15 @@
+import { CapabilityError, type CapabilityErrorCode, type CaughtFailure } from '@vibesdotdev/kernel';
+/** The `kind` a Vault path absence names, so `CapabilityError.isAbsenceOf(error, VAULT_PATH_KIND, path)` matches. */
+export declare const VAULT_PATH_KIND = "secrets/vault";
+export declare function failure(message: string, code: CapabilityErrorCode, reason: string, options?: {
+    retryable?: boolean;
+    details?: Record<string, string | number | boolean>;
+    cause?: CaughtFailure;
+}): CapabilityError;
+/** The typed absence of one KV path: what `CapabilityError.isAbsenceOf(error, 'secrets/vault', path)` matches. */
+export declare function vaultPathAbsent(path: string): CapabilityError;
+/** A refusal for a response status alone: the body is never part of the error. */
+export declare function statusFailure(operation: string, status: number): CapabilityError;
+/** The refusal for a Vault address a token, a JWT or an unseal key may not be sent to: it names the problem, never the address. */
+export declare function addressInvalid(problem: string): CapabilityError;
+//# sourceMappingURL=vault-failures.d.ts.map

package/dist/backends/vault/vault-failures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-failures.d.ts","sourceRoot":"","sources":["../../../src/backends/vault/vault-failures.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACjB,MAAM,qBAAqB,CAAC;AAE7B,qHAAqH;AACrH,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,wBAAgB,OAAO,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,aAAa,CAAA;CAAO,GAC/G,eAAe,CAOjB;AAED,kHAAkH;AAClH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAK7D;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAOhF;AAED,mIAAmI;AACnI,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAO/D"}

package/dist/backends/vault/vault-failures.js

@@ -0,0 +1,36 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+/** The `kind` a Vault path absence names, so `CapabilityError.isAbsenceOf(error, VAULT_PATH_KIND, path)` matches. */
+export const VAULT_PATH_KIND = 'secrets/vault';
+export function failure(message, code, reason, options = {}) {
+    return new CapabilityError(message, code, {
+        reason,
+        retryable: options.retryable,
+        details: options.details,
+        cause: options.cause
+    });
+}
+/** The typed absence of one KV path: what `CapabilityError.isAbsenceOf(error, 'secrets/vault', path)` matches. */
+export function vaultPathAbsent(path) {
+    return failure('The Vault path does not exist.', 'NOT_FOUND', 'vault-path-absent', {
+        retryable: false,
+        details: { kind: VAULT_PATH_KIND, id: path }
+    });
+}
+/** A refusal for a response status alone: the body is never part of the error. */
+export function statusFailure(operation, status) {
+    const details = { status };
+    if (status === 401)
+        return failure(`${operation} was not authenticated.`, 'AUTH_REQUIRED', 'vault-unauthenticated', { details });
+    if (status === 403)
+        return failure(`${operation} was forbidden.`, 'PERMISSION_DENIED', 'vault-forbidden', { details });
+    if (status === 429)
+        return failure(`${operation} was rate limited.`, 'RATE_LIMITED', 'vault-rate-limited', { details });
+    if (status >= 500)
+        return failure(`${operation} failed: HTTP ${status}.`, 'UNAVAILABLE', 'vault-unavailable', { retryable: true, details });
+    return failure(`${operation} was rejected: HTTP ${status}.`, 'INVALID_INPUT', 'vault-rejected', { retryable: false, details });
+}
+/** The refusal for a Vault address a token, a JWT or an unseal key may not be sent to: it names the problem, never the address. */
+export function addressInvalid(problem) {
+    return failure('The Vault address must be https (or http to loopback on a development host), with no userinfo, query or fragment; nothing was sent.', 'INVALID_INPUT', 'vault-address-invalid', { retryable: false, details: { problem } });
+}
+//# sourceMappingURL=vault-failures.js.map

package/dist/backends/vault/vault-failures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-failures.js","sourceRoot":"","sources":["../../../src/backends/vault/vault-failures.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,eAAe,EAGd,MAAM,qBAAqB,CAAC;AAE7B,qHAAqH;AACrH,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAE/C,MAAM,UAAU,OAAO,CACtB,OAAe,EACf,IAAyB,EACzB,MAAc,EACd,UAA+G,EAAE;IAEjH,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE;QACzC,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;KACpB,CAAC,CAAC;AACJ,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,OAAO,OAAO,CAAC,gCAAgC,EAAE,WAAW,EAAE,mBAAmB,EAAE;QAClF,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE;KAC5C,CAAC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,MAAc;IAC9D,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC;IAC3B,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,SAAS,yBAAyB,EAAE,eAAe,EAAE,uBAAuB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACjI,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,SAAS,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvH,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,SAAS,oBAAoB,EAAE,cAAc,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACxH,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,SAAS,iBAAiB,MAAM,GAAG,EAAE,aAAa,EAAE,mBAAmB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5I,OAAO,OAAO,CAAC,GAAG,SAAS,uBAAuB,MAAM,GAAG,EAAE,eAAe,EAAE,gBAAgB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAChI,CAAC;AAED,mIAAmI;AACnI,MAAM,UAAU,cAAc,CAAC,OAAe;IAC7C,OAAO,OAAO,CACb,qIAAqI,EACrI,eAAe,EACf,uBAAuB,EACvB,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,CAC1C,CAAC;AACH,CAAC"}

package/dist/backends/vault/vault-kv.d.ts

@@ -0,0 +1,22 @@
+import { type VaultClientConfig } from "../../schemas/backends/vault.schema.ts";
+export declare const K8S_AUTH_MOUNT = "kubernetes";
+export declare function timeoutOf(config: {
+    requestTimeoutMs?: number;
+}): number;
+export declare function getVaultToken(config: VaultClientConfig): Promise<string>;
+export declare function vaultFetchResponse(config: VaultClientConfig, path: string, operation: string, init?: RequestInit): Promise<Response>;
+/**
+ * The key/value data at one KV path, as own properties. A missing path is the
+ * typed absence (`isAbsenceOf(error, 'secrets/vault', path)`); every other
+ * failure is typed with its own reason.
+ */
+export declare function readKVSecret(config: VaultClientConfig, path: string): Promise<Record<string, string>>;
+export declare function writeKVSecret(config: VaultClientConfig, path: string, data: Record<string, string>): Promise<void>;
+export declare function deleteKVKey(config: VaultClientConfig, path: string, key: string): Promise<void>;
+/**
+ * The child keys under one KV metadata path. A path with no metadata lists as
+ * empty (confirmed absence); every other failure is typed and propagates, never
+ * an empty list.
+ */
+export declare function listKVPaths(config: VaultClientConfig, path: string): Promise<string[]>;
+//# sourceMappingURL=vault-kv.d.ts.map

package/dist/backends/vault/vault-kv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-kv.d.ts","sourceRoot":"","sources":["../../../src/backends/vault/vault-kv.ts"],"names":[],"mappings":"AAGA,OAAO,EAAwC,KAAK,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAKtH,eAAO,MAAM,cAAc,eAAe,CAAC;AAE3C,wBAAgB,SAAS,CAAC,MAAM,EAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEvE;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiC9E;AAED,wBAAsB,kBAAkB,CACvC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,WAAW,GAChB,OAAO,CAAC,QAAQ,CAAC,CAWnB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAc3G;AAED,wBAAsB,aAAa,CAClC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,WAAW,CAChC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAa5F"}