agentvault 1.0.2 → 1.0.5

package/dist/src/vault/config.js

@@ -0,0 +1,265 @@
+/**
+ * Vault configuration management
+ *
+ * Handles loading, saving, and validating Vault connection configs
+ * from the AgentVault config directory (~/.agentvault/vault/).
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+/** Default Vault configuration directory */
+const VAULT_CONFIG_DIR = path.join(os.homedir(), '.agentvault', 'vault');
+/** Default Vault config file name */
+const VAULT_CONFIG_FILE = 'vault.json';
+/** Agent policies file name */
+const AGENT_POLICIES_FILE = 'agent-policies.json';
+/**
+ * Get the Vault configuration directory path
+ */
+export function getVaultConfigDir() {
+    return VAULT_CONFIG_DIR;
+}
+/**
+ * Ensure the Vault configuration directory exists
+ */
+export function ensureVaultConfigDir() {
+    if (!fs.existsSync(VAULT_CONFIG_DIR)) {
+        fs.mkdirSync(VAULT_CONFIG_DIR, { recursive: true });
+    }
+}
+/**
+ * Load Vault connection configuration from disk
+ *
+ * Configuration is read from:
+ * 1. ~/.agentvault/vault/vault.json (file config)
+ * 2. Environment variables (override file config)
+ *
+ * Environment variables:
+ * - VAULT_ADDR: Vault server address
+ * - VAULT_TOKEN: Vault token
+ * - VAULT_NAMESPACE: Vault namespace
+ * - VAULT_CACERT: CA cert path
+ * - VAULT_SKIP_VERIFY: Skip TLS verification
+ * - VAULT_ROLE_ID: AppRole role ID
+ * - VAULT_SECRET_ID: AppRole secret ID
+ *
+ * @returns Vault configuration or null if not configured
+ */
+export function loadVaultConfig() {
+    let config = {};
+    // Try loading from file
+    const configPath = path.join(VAULT_CONFIG_DIR, VAULT_CONFIG_FILE);
+    if (fs.existsSync(configPath)) {
+        try {
+            const content = fs.readFileSync(configPath, 'utf-8');
+            config = JSON.parse(content);
+        }
+        catch {
+            // Ignore parse errors, fall through to env vars
+        }
+    }
+    // Override with environment variables
+    if (process.env.AGENTVAULT_VAULT_BACKEND) {
+        const backend = process.env.AGENTVAULT_VAULT_BACKEND.toLowerCase();
+        if (backend === 'bitwarden' || backend === 'hashicorp') {
+            config.backend = backend;
+        }
+    }
+    if (process.env.VAULT_ADDR) {
+        config.address = process.env.VAULT_ADDR;
+    }
+    if (process.env.VAULT_TOKEN) {
+        config.token = process.env.VAULT_TOKEN;
+        config.authMethod = 'token';
+    }
+    if (process.env.VAULT_NAMESPACE) {
+        config.namespace = process.env.VAULT_NAMESPACE;
+    }
+    if (process.env.VAULT_CACERT) {
+        config.caCertPath = process.env.VAULT_CACERT;
+    }
+    if (process.env.VAULT_SKIP_VERIFY === 'true') {
+        config.tlsSkipVerify = true;
+    }
+    if (process.env.VAULT_ROLE_ID) {
+        config.roleId = process.env.VAULT_ROLE_ID;
+        config.authMethod = 'approle';
+    }
+    if (process.env.VAULT_SECRET_ID) {
+        config.secretId = process.env.VAULT_SECRET_ID;
+    }
+    if (!config.backend) {
+        config.backend = 'hashicorp';
+    }
+    if (config.backend === 'bitwarden') {
+        if (!config.authMethod) {
+            config.authMethod = 'token';
+        }
+        if (!config.address) {
+            config.address = 'bitwarden://local';
+        }
+        return config;
+    }
+    // Validate minimum config
+    if (!config.address) {
+        return null;
+    }
+    if (!config.authMethod) {
+        config.authMethod = config.token ? 'token' : 'token';
+    }
+    return config;
+}
+/**
+ * Save Vault connection configuration to disk
+ *
+ * @param config - Vault configuration to save
+ */
+export function saveVaultConfig(config) {
+    ensureVaultConfigDir();
+    // Never persist tokens or passwords to disk
+    const safeConfig = {
+        backend: config.backend ?? 'hashicorp',
+        address: config.address,
+        authMethod: config.authMethod,
+        namespace: config.namespace,
+        caCertPath: config.caCertPath,
+        tlsSkipVerify: config.tlsSkipVerify,
+        timeoutMs: config.timeoutMs,
+    };
+    // Only persist non-sensitive auth config
+    if (config.authMethod === 'approle') {
+        safeConfig.roleId = config.roleId;
+    }
+    if (config.authMethod === 'kubernetes') {
+        safeConfig.k8sRole = config.k8sRole;
+    }
+    if (config.authMethod === 'userpass') {
+        safeConfig.username = config.username;
+    }
+    const configPath = path.join(VAULT_CONFIG_DIR, VAULT_CONFIG_FILE);
+    fs.writeFileSync(configPath, JSON.stringify(safeConfig, null, 2), 'utf-8');
+}
+/**
+ * Load agent Vault policies from disk
+ *
+ * @returns Map of agent ID to policy
+ */
+export function loadAgentPolicies() {
+    const policiesPath = path.join(VAULT_CONFIG_DIR, AGENT_POLICIES_FILE);
+    const policies = new Map();
+    if (!fs.existsSync(policiesPath)) {
+        return policies;
+    }
+    try {
+        const content = fs.readFileSync(policiesPath, 'utf-8');
+        const parsed = JSON.parse(content);
+        for (const [agentId, policy] of Object.entries(parsed)) {
+            policies.set(agentId, policy);
+        }
+    }
+    catch {
+        // Return empty map on parse errors
+    }
+    return policies;
+}
+/**
+ * Save agent Vault policies to disk
+ *
+ * @param policies - Map of agent ID to policy
+ */
+export function saveAgentPolicies(policies) {
+    ensureVaultConfigDir();
+    const record = {};
+    for (const [agentId, policy] of policies.entries()) {
+        record[agentId] = policy;
+    }
+    const policiesPath = path.join(VAULT_CONFIG_DIR, AGENT_POLICIES_FILE);
+    fs.writeFileSync(policiesPath, JSON.stringify(record, null, 2), 'utf-8');
+}
+/**
+ * Get or create a policy for an agent
+ *
+ * @param agentId - Agent identifier
+ * @param engine - Secret engine type
+ * @returns Agent Vault policy
+ */
+export function getOrCreateAgentPolicy(agentId, engine = 'kv-v2') {
+    const policies = loadAgentPolicies();
+    const existing = policies.get(agentId);
+    if (existing) {
+        return existing;
+    }
+    const policy = {
+        agentId,
+        secretPath: `agents/${agentId}/secrets`,
+        engine,
+        allowCreate: true,
+        allowUpdate: true,
+        allowDelete: false,
+        allowList: true,
+    };
+    policies.set(agentId, policy);
+    saveAgentPolicies(policies);
+    return policy;
+}
+/**
+ * Validate a Vault configuration
+ *
+ * @param config - Configuration to validate
+ * @returns Array of validation errors (empty if valid)
+ */
+export function validateVaultConfig(config) {
+    const errors = [];
+    const backend = config.backend ?? 'hashicorp';
+    if (backend === 'hashicorp') {
+        if (!config.address) {
+            errors.push('Vault address is required');
+        }
+        else {
+            try {
+                new URL(config.address);
+            }
+            catch {
+                errors.push(`Invalid Vault address URL: ${config.address}`);
+            }
+        }
+    }
+    if (!config.authMethod) {
+        errors.push('Authentication method is required');
+    }
+    switch (config.authMethod) {
+        case 'token':
+            if (backend === 'hashicorp' && !config.token) {
+                errors.push('Vault token is required for token authentication');
+            }
+            break;
+        case 'approle':
+            if (!config.roleId) {
+                errors.push('Role ID is required for AppRole authentication');
+            }
+            if (!config.secretId) {
+                errors.push('Secret ID is required for AppRole authentication');
+            }
+            break;
+        case 'kubernetes':
+            if (!config.k8sRole) {
+                errors.push('Kubernetes role is required for Kubernetes authentication');
+            }
+            break;
+        case 'userpass':
+            if (!config.username) {
+                errors.push('Username is required for userpass authentication');
+            }
+            if (!config.password) {
+                errors.push('Password is required for userpass authentication');
+            }
+            break;
+        default:
+            errors.push(`Unknown authentication method: ${config.authMethod}`);
+    }
+    if (config.timeoutMs !== undefined && config.timeoutMs <= 0) {
+        errors.push('Timeout must be a positive number');
+    }
+    return errors;
+}
+//# sourceMappingURL=config.js.map

package/dist/src/vault/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/vault/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAG9B,4CAA4C;AAC5C,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AAEzE,qCAAqC;AACrC,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAEvC,+BAA+B;AAC/B,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAElD;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrC,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,MAAM,GAAyB,EAAE,CAAC;IAEtC,wBAAwB;IACxB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IAClE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAyB,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,WAAW,EAAE,CAAC;QACnE,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YACvD,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACvC,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,EAAE,CAAC;QAC7C,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAC1C,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,OAAO,GAAG,WAAW,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,GAAG,mBAAmB,CAAC;QACvC,CAAC;QACD,OAAO,MAAqB,CAAC;IAC/B,CAAC;IAED,0BAA0B;IAC1B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACvD,CAAC;IAED,OAAO,MAAqB,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB;IACjD,oBAAoB,EAAE,CAAC;IAEvB,4CAA4C;IAC5C,MAAM,UAAU,GAAyB;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,WAAW;QACtC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IAEF,yCAAyC;IACzC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACvC,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,UAAU,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACxC,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IAClE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IAErD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAqC,CAAC;QAEvE,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAuC;IACvE,oBAAoB,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAqC,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;IAC3B,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IACtE,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,SAA4B,OAAO;IAEnC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAqB;QAC/B,OAAO;QACP,UAAU,EAAE,UAAU,OAAO,UAAU;QACvC,MAAM;QACN,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAE5B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC;IAE9C,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,8BAA8B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IAED,QAAQ,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1B,KAAK,OAAO;YACV,IAAI,OAAO,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAClE,CAAC;YACD,MAAM;QACR,KAAK,SAAS;YACZ,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAClE,CAAC;YACD,MAAM;QACR,KAAK,YAAY;YACf,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM;QACR,KAAK,UAAU;YACb,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAClE,CAAC;YACD,MAAM;QACR;YACE,MAAM,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/vault/encrypted-memory-store.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Encrypted in-memory secret store
+ *
+ * Secrets are encrypted with an ephemeral AES-256-GCM key that exists only in
+ * process memory.  The store provides:
+ *
+ * - Automatic expiry (TTL per entry)
+ * - Read-count limits
+ * - Periodic wipe of expired entries
+ * - Secure zeroization on dispose
+ *
+ * This module is intentionally self-contained – it uses only Node.js builtins.
+ */
+export declare class EncryptedMemoryStore {
+    /** Ephemeral encryption key – never leaves process memory */
+    private readonly ephemeralKey;
+    /** Encrypted entries keyed by secret name */
+    private readonly entries;
+    /** Periodic wipe timer */
+    private wipeTimer;
+    /** Default TTL in ms (0 = no expiry) */
+    private readonly defaultTtlMs;
+    /** Maximum entries allowed */
+    private readonly maxEntries;
+    constructor(options?: {
+        defaultTtlMs?: number;
+        maxEntries?: number;
+        autoWipeIntervalMs?: number;
+    });
+    /**
+     * Store a secret value.  The plaintext is encrypted immediately and the
+     * original buffer is zeroed.
+     */
+    set(key: string, plaintext: string, options?: {
+        ttlMs?: number;
+        maxReads?: number;
+    }): void;
+    /**
+     * Retrieve and decrypt a secret.  Returns `null` if the key does not exist,
+     * has expired, or has exceeded its read limit.
+     */
+    get(key: string): string | null;
+    /**
+     * Check whether a key exists and is still valid (not expired, not exhausted).
+     */
+    has(key: string): boolean;
+    /**
+     * Securely delete a single entry.
+     */
+    delete(key: string): boolean;
+    /**
+     * Return all stored keys (without values).
+     */
+    keys(): string[];
+    /**
+     * Number of entries currently stored (including potentially expired ones).
+     */
+    get size(): number;
+    /**
+     * Purge all expired or read-exhausted entries.
+     * Returns the number of entries removed.
+     */
+    purgeExpired(): number;
+    /**
+     * Securely wipe every entry and destroy the ephemeral key.
+     * After calling this, the store is no longer usable.
+     */
+    dispose(): void;
+    /**
+     * Return read-only metadata about entries (no values).
+     */
+    inspect(): Array<{
+        key: string;
+        cachedAt: number;
+        ttlMs: number;
+        readCount: number;
+        maxReads: number;
+    }>;
+}
+//# sourceMappingURL=encrypted-memory-store.d.ts.map

package/dist/src/vault/encrypted-memory-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-memory-store.d.ts","sourceRoot":"","sources":["../../../src/vault/encrypted-memory-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,qBAAa,oBAAoB;IAC/B,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IAEtC,6CAA6C;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2C;IAEnE,0BAA0B;IAC1B,OAAO,CAAC,SAAS,CAA+C;IAEhE,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IAEtC,8BAA8B;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE;IAmBjG;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IA2B1F;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAqC/B;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAQzB;;OAEG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI5B;;OAEG;IACH,IAAI,IAAI,MAAM,EAAE;IAIhB;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;;OAGG;IACH,YAAY,IAAI,MAAM;IAiBtB;;;OAGG;IACH,OAAO,IAAI,IAAI;IAUf;;OAEG;IACH,OAAO,IAAI,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CASxG"}

package/dist/src/vault/encrypted-memory-store.js

@@ -0,0 +1,175 @@
+/**
+ * Encrypted in-memory secret store
+ *
+ * Secrets are encrypted with an ephemeral AES-256-GCM key that exists only in
+ * process memory.  The store provides:
+ *
+ * - Automatic expiry (TTL per entry)
+ * - Read-count limits
+ * - Periodic wipe of expired entries
+ * - Secure zeroization on dispose
+ *
+ * This module is intentionally self-contained – it uses only Node.js builtins.
+ */
+import * as crypto from 'node:crypto';
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const KEY_LENGTH = 32;
+export class EncryptedMemoryStore {
+    /** Ephemeral encryption key – never leaves process memory */
+    ephemeralKey;
+    /** Encrypted entries keyed by secret name */
+    entries = new Map();
+    /** Periodic wipe timer */
+    wipeTimer = null;
+    /** Default TTL in ms (0 = no expiry) */
+    defaultTtlMs;
+    /** Maximum entries allowed */
+    maxEntries;
+    constructor(options) {
+        this.ephemeralKey = crypto.randomBytes(KEY_LENGTH);
+        this.defaultTtlMs = options?.defaultTtlMs ?? 0;
+        this.maxEntries = options?.maxEntries ?? 1000;
+        const wipeInterval = options?.autoWipeIntervalMs ?? 30_000;
+        if (wipeInterval > 0) {
+            this.wipeTimer = setInterval(() => this.purgeExpired(), wipeInterval);
+            // Allow the process to exit even if the timer is still running
+            if (this.wipeTimer.unref) {
+                this.wipeTimer.unref();
+            }
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Public API
+    // -----------------------------------------------------------------------
+    /**
+     * Store a secret value.  The plaintext is encrypted immediately and the
+     * original buffer is zeroed.
+     */
+    set(key, plaintext, options) {
+        if (this.entries.size >= this.maxEntries && !this.entries.has(key)) {
+            throw new Error(`EncryptedMemoryStore: max entries (${this.maxEntries}) reached`);
+        }
+        const iv = crypto.randomBytes(IV_LENGTH);
+        const cipher = crypto.createCipheriv(ALGORITHM, this.ephemeralKey, iv);
+        const ptBuf = Buffer.from(plaintext, 'utf-8');
+        const encrypted = Buffer.concat([cipher.update(ptBuf), cipher.final()]);
+        const authTag = cipher.getAuthTag();
+        // Zeroize plaintext buffer
+        ptBuf.fill(0);
+        this.entries.set(key, {
+            key,
+            ciphertext: encrypted.toString('base64'),
+            iv: iv.toString('base64'),
+            authTag: authTag.toString('base64'),
+            cachedAt: Date.now(),
+            ttlMs: options?.ttlMs ?? this.defaultTtlMs,
+            readCount: 0,
+            maxReads: options?.maxReads ?? 0,
+        });
+    }
+    /**
+     * Retrieve and decrypt a secret.  Returns `null` if the key does not exist,
+     * has expired, or has exceeded its read limit.
+     */
+    get(key) {
+        const entry = this.entries.get(key);
+        if (!entry)
+            return null;
+        // Check TTL
+        if (entry.ttlMs > 0 && Date.now() - entry.cachedAt > entry.ttlMs) {
+            this.delete(key);
+            return null;
+        }
+        // Check read limit
+        if (entry.maxReads > 0 && entry.readCount >= entry.maxReads) {
+            this.delete(key);
+            return null;
+        }
+        // Decrypt
+        const decipher = crypto.createDecipheriv(ALGORITHM, this.ephemeralKey, Buffer.from(entry.iv, 'base64'));
+        decipher.setAuthTag(Buffer.from(entry.authTag, 'base64'));
+        const decrypted = Buffer.concat([
+            decipher.update(Buffer.from(entry.ciphertext, 'base64')),
+            decipher.final(),
+        ]);
+        // Increment read count
+        entry.readCount++;
+        const result = decrypted.toString('utf-8');
+        decrypted.fill(0);
+        return result;
+    }
+    /**
+     * Check whether a key exists and is still valid (not expired, not exhausted).
+     */
+    has(key) {
+        const entry = this.entries.get(key);
+        if (!entry)
+            return false;
+        if (entry.ttlMs > 0 && Date.now() - entry.cachedAt > entry.ttlMs)
+            return false;
+        if (entry.maxReads > 0 && entry.readCount >= entry.maxReads)
+            return false;
+        return true;
+    }
+    /**
+     * Securely delete a single entry.
+     */
+    delete(key) {
+        return this.entries.delete(key);
+    }
+    /**
+     * Return all stored keys (without values).
+     */
+    keys() {
+        return [...this.entries.keys()];
+    }
+    /**
+     * Number of entries currently stored (including potentially expired ones).
+     */
+    get size() {
+        return this.entries.size;
+    }
+    /**
+     * Purge all expired or read-exhausted entries.
+     * Returns the number of entries removed.
+     */
+    purgeExpired() {
+        const now = Date.now();
+        let purged = 0;
+        for (const [key, entry] of this.entries) {
+            const expired = entry.ttlMs > 0 && now - entry.cachedAt > entry.ttlMs;
+            const exhausted = entry.maxReads > 0 && entry.readCount >= entry.maxReads;
+            if (expired || exhausted) {
+                this.entries.delete(key);
+                purged++;
+            }
+        }
+        return purged;
+    }
+    /**
+     * Securely wipe every entry and destroy the ephemeral key.
+     * After calling this, the store is no longer usable.
+     */
+    dispose() {
+        if (this.wipeTimer) {
+            clearInterval(this.wipeTimer);
+            this.wipeTimer = null;
+        }
+        this.entries.clear();
+        this.ephemeralKey.fill(0);
+    }
+    /**
+     * Return read-only metadata about entries (no values).
+     */
+    inspect() {
+        return [...this.entries.values()].map(e => ({
+            key: e.key,
+            cachedAt: e.cachedAt,
+            ttlMs: e.ttlMs,
+            readCount: e.readCount,
+            maxReads: e.maxReads,
+        }));
+    }
+}
+//# sourceMappingURL=encrypted-memory-store.js.map

package/dist/src/vault/encrypted-memory-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-memory-store.js","sourceRoot":"","sources":["../../../src/vault/encrypted-memory-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAGtC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,MAAM,OAAO,oBAAoB;IAC/B,6DAA6D;IAC5C,YAAY,CAAS;IAEtC,6CAA6C;IAC5B,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEnE,0BAA0B;IAClB,SAAS,GAA0C,IAAI,CAAC;IAEhE,wCAAwC;IACvB,YAAY,CAAS;IAEtC,8BAA8B;IACb,UAAU,CAAS;IAEpC,YAAY,OAAqF;QAC/F,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC;QAE9C,MAAM,YAAY,GAAG,OAAO,EAAE,kBAAkB,IAAI,MAAM,CAAC;QAC3D,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,+DAA+D;YAC/D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,aAAa;IACb,0EAA0E;IAE1E;;;OAGG;IACH,GAAG,CAAC,GAAW,EAAE,SAAiB,EAAE,OAA+C;QACjF,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,UAAU,WAAW,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAEvE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,2BAA2B;QAC3B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;YACpB,GAAG;YACH,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACxC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,YAAY;YAC1C,SAAS,EAAE,CAAC;YACZ,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,GAAG,CAAC,GAAW;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,YAAY;QACZ,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,UAAU;QACV,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,SAAS,EACT,IAAI,CAAC,YAAY,EACjB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAChC,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAE1D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACxD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,uBAAuB;QACvB,KAAK,CAAC,SAAS,EAAE,CAAC;QAElB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,GAAW;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAC/E,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,YAAY;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;YACtE,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC;YAE1E,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1C,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/src/vault/hashicorp-provider.d.ts

@@ -0,0 +1,22 @@
+/**
+ * HashiCorp Vault implementation of `SecretProvider`
+ *
+ * Wraps `VaultClient` to satisfy the unified `SecretProvider` interface.
+ * All reads return plain string values; no value is written to disk or
+ * canister state.
+ */
+import { VaultClient } from './client.js';
+import type { SecretProvider, SecretProviderHealth } from './provider.js';
+export declare class HashiCorpVaultProvider implements SecretProvider {
+    private readonly client;
+    readonly name = "HashiCorp Vault";
+    constructor(client: VaultClient);
+    /** Create a provider for the given agent using the configured Vault. */
+    static forAgent(agentId: string): HashiCorpVaultProvider;
+    getSecret(key: string): Promise<string | null>;
+    storeSecret(key: string, value: string): Promise<void>;
+    listSecrets(): Promise<string[]>;
+    deleteSecret(key: string): Promise<void>;
+    healthCheck(): Promise<SecretProviderHealth>;
+}
+//# sourceMappingURL=hashicorp-provider.d.ts.map

package/dist/src/vault/hashicorp-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashicorp-provider.d.ts","sourceRoot":"","sources":["../../../src/vault/hashicorp-provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE1E,qBAAa,sBAAuB,YAAW,cAAc;IAG/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,QAAQ,CAAC,IAAI,qBAAqB;gBAEL,MAAM,EAAE,WAAW;IAEhD,wEAAwE;IACxE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB;IAKlD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAW9C,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAMhC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxC,WAAW,IAAI,OAAO,CAAC,oBAAoB,CAAC;CAUnD"}

package/dist/src/vault/hashicorp-provider.js

@@ -0,0 +1,63 @@
+/**
+ * HashiCorp Vault implementation of `SecretProvider`
+ *
+ * Wraps `VaultClient` to satisfy the unified `SecretProvider` interface.
+ * All reads return plain string values; no value is written to disk or
+ * canister state.
+ */
+import { VaultClient } from './client.js';
+export class HashiCorpVaultProvider {
+    client;
+    name = 'HashiCorp Vault';
+    constructor(client) {
+        this.client = client;
+    }
+    /** Create a provider for the given agent using the configured Vault. */
+    static forAgent(agentId) {
+        const client = VaultClient.create(agentId);
+        return new HashiCorpVaultProvider(client);
+    }
+    async getSecret(key) {
+        const result = await this.client.getSecret(key);
+        if (!result.success || !result.data)
+            return null;
+        const { value } = result.data;
+        // VaultClient stores strings as { value: "..." } maps; unwrap here
+        if (typeof value === 'string')
+            return value;
+        if (typeof value === 'object' && 'value' in value)
+            return value.value ?? null;
+        return null;
+    }
+    async storeSecret(key, value) {
+        const result = await this.client.putSecret(key, value);
+        if (!result.success) {
+            throw new Error(result.error ?? `Failed to store secret "${key}"`);
+        }
+    }
+    async listSecrets() {
+        const result = await this.client.listSecrets();
+        if (!result.success || !result.data)
+            return [];
+        return result.data.map((e) => e.key);
+    }
+    async deleteSecret(key) {
+        const result = await this.client.deleteSecret(key);
+        if (!result.success) {
+            throw new Error(result.error ?? `Failed to delete secret "${key}"`);
+        }
+    }
+    async healthCheck() {
+        const result = await this.client.health();
+        if (!result.success || !result.data) {
+            return { healthy: false, message: result.error ?? 'Vault unreachable' };
+        }
+        const { initialized, sealed, version } = result.data;
+        if (!initialized)
+            return { healthy: false, message: 'Vault not initialized', version };
+        if (sealed)
+            return { healthy: false, message: 'Vault is sealed', version };
+        return { healthy: true, message: 'Vault is healthy', version };
+    }
+}
+//# sourceMappingURL=hashicorp-provider.js.map

package/dist/src/vault/hashicorp-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashicorp-provider.js","sourceRoot":"","sources":["../../../src/vault/hashicorp-provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,OAAO,sBAAsB;IAGJ;IAFpB,IAAI,GAAG,iBAAiB,CAAC;IAElC,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,wEAAwE;IACxE,MAAM,CAAC,QAAQ,CAAC,OAAe;QAC7B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEjD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC9B,mEAAmE;QACnE,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK;YAAE,OAAQ,KAAgC,CAAC,KAAK,IAAI,IAAI,CAAC;QAC1G,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,KAAa;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,2BAA2B,GAAG,GAAG,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,4BAA4B,GAAG,GAAG,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QACrD,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,CAAC;QACvF,IAAI,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;CACF"}