create-svc 0.1.12 → 0.1.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-svc",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Local microservice bootstrap CLI for Cloud Run and Workers services with Neon-backed data.",
   "module": "index.ts",
   "type": "module",

package/src/vault.test.ts

@@ -1,6 +1,6 @@
 import { afterEach, expect, mock, test } from "bun:test";
 import { mkdir } from "node:fs/promises";
-import { readVaultSecret, resolveNeonApiKey, upsertVaultSecretFields } from "./vault";
+import { readVaultSecret, resolveNeonApiKey } from "./vault";
 
 const originalEnv = { ...process.env };
 
@@ -97,63 +97,3 @@ test("readVaultSecret falls back to ~/.vault-token", async () => {
     })
   ).resolves.toBe("vault-token");
 });
-
-test("upsertVaultSecretFields writes merged KV v2 data", async () => {
-  process.env.VAULT_ADDR = "https://vault.example.com";
-  process.env.VAULT_TOKEN = "token-123";
-
-  const requests: Array<{ method: string; url: string; body?: unknown }> = [];
-  const fetchMock = mock(async (input: string | URL | Request, init?: RequestInit) => {
-    const url = String(input);
-    requests.push({
-      method: init?.method ?? "GET",
-      url,
-      body: init?.body ? JSON.parse(String(init.body)) : undefined,
-    });
-
-    if ((init?.method ?? "GET") === "GET") {
-      return new Response(
-        JSON.stringify({
-          data: {
-            data: {
-              existing_field: "keep-me",
-            },
-          },
-        }),
-        { status: 200 }
-      );
-    }
-
-    return new Response(JSON.stringify({}), { status: 200 });
-  });
-
-  globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-  await upsertVaultSecretFields({
-    path: "prod/providers/clerk",
-    fields: {
-      publishable_key: "pk_live_example",
-      secret_key: "sk_live_example",
-      webhook_secret: "whsec_example",
-    },
-  });
-
-  expect(requests).toEqual([
-    {
-      method: "GET",
-      url: "https://vault.example.com/v1/secret/data/prod/providers/clerk",
-    },
-    {
-      method: "POST",
-      url: "https://vault.example.com/v1/secret/data/prod/providers/clerk",
-      body: {
-        data: {
-          existing_field: "keep-me",
-          publishable_key: "pk_live_example",
-          secret_key: "sk_live_example",
-          webhook_secret: "whsec_example",
-        },
-      },
-    },
-  ]);
-});

package/src/vault.ts

@@ -13,14 +13,6 @@ type VaultSecretOptions = {
   field?: string;
 };
 
-type VaultWriteOptions = {
-  addr?: string;
-  token?: string;
-  mount?: string;
-  path: string;
-  fields: Record<string, string>;
-};
-
 export async function resolveNeonApiKey() {
   const direct = process.env.NEON_API_KEY?.trim();
   if (direct) {
@@ -34,59 +26,24 @@ export async function resolveNeonApiKey() {
 }
 
 export async function readVaultSecret(options: VaultSecretOptions = {}) {
-  const field = options.field?.trim() ?? "value";
-  const payload = await readVaultSecretData(options);
+  const addr = options.addr ?? process.env.VAULT_ADDR?.trim() ?? "";
+  const token = options.token ?? (await resolveVaultToken());
   const mount = options.mount ?? process.env.VAULT_SECRET_MOUNT?.trim() ?? DEFAULT_VAULT_SECRET_MOUNT;
   const path = options.path?.trim() ?? "";
-  const normalizedMount = mount.replace(/^\/+|\/+$/g, "");
-  const normalizedPath = path.replace(/^\/+/g, "");
-  const value = payload[field]?.trim();
-  if (!value) {
-    throw new Error(`Vault secret field ${field} is empty at ${normalizedMount}/${normalizedPath}`);
-  }
-
-  return value;
-}
-
-export async function readVaultSecretFields(options: VaultSecretOptions = {}) {
-  return readVaultSecretData(options);
-}
+  const field = options.field?.trim() ?? "value";
 
-export async function upsertVaultSecretFields(options: VaultWriteOptions) {
-  const connection = await resolveVaultConnection(options);
-  const url = vaultKv2Url(connection);
+  if (!addr || !token || !path) {
+    throw new Error("Vault secret resolution requires VAULT_ADDR, a Vault token, and a secret path");
+  }
 
-  const existing = await readVaultSecretData({ ...options, path: connection.normalizedPath }).catch((error) => {
-    if (error instanceof Error && error.message.startsWith("Vault read failed: 404")) {
-      return {};
-    }
-    throw error;
-  });
+  const normalizedAddr = addr.replace(/\/+$/g, "");
+  const normalizedMount = mount.replace(/^\/+|\/+$/g, "");
+  const normalizedPath = path.replace(/^\/+/g, "");
+  const url = `${normalizedAddr}/v1/${normalizedMount}/data/${normalizedPath}`;
 
   const response = await fetch(url, {
-    method: "POST",
     headers: {
-      "Content-Type": "application/json",
-      "X-Vault-Token": connection.token,
-    },
-    body: JSON.stringify({
-      data: {
-        ...existing,
-        ...trimFields(options.fields),
-      },
-    }),
-  });
-
-  if (!response.ok) {
-    throw new Error(`Vault write failed: ${response.status} ${response.statusText}`);
-  }
-}
-
-async function readVaultSecretData(options: VaultSecretOptions = {}) {
-  const connection = await resolveVaultConnection(options);
-  const response = await fetch(vaultKv2Url(connection), {
-    headers: {
-      "X-Vault-Token": connection.token,
+      "X-Vault-Token": token,
     },
   });
 
@@ -100,31 +57,12 @@ async function readVaultSecretData(options: VaultSecretOptions = {}) {
     };
   };
 
-  return payload.data?.data ?? {};
-}
-
-async function resolveVaultConnection(options: Omit<VaultWriteOptions, "fields"> | VaultSecretOptions) {
-  const addr = options.addr ?? process.env.VAULT_ADDR?.trim() ?? "";
-  const token = options.token ?? (await resolveVaultToken());
-  const mount = options.mount ?? process.env.VAULT_SECRET_MOUNT?.trim() ?? DEFAULT_VAULT_SECRET_MOUNT;
-  const path = options.path?.trim() ?? "";
-
-  if (!addr || !token || !path) {
-    throw new Error("Vault secret resolution requires VAULT_ADDR, a Vault token, and a secret path");
+  const value = payload.data?.data?.[field]?.trim();
+  if (!value) {
+    throw new Error(`Vault secret field ${field} is empty at ${normalizedMount}/${normalizedPath}`);
   }
 
-  const normalizedAddr = addr.replace(/\/+$/g, "");
-  const normalizedMount = mount.replace(/^\/+|\/+$/g, "");
-  const normalizedPath = path.replace(/^\/+/g, "");
-  return { normalizedAddr, normalizedMount, normalizedPath, token };
-}
-
-function vaultKv2Url(connection: Awaited<ReturnType<typeof resolveVaultConnection>>) {
-  return `${connection.normalizedAddr}/v1/${connection.normalizedMount}/data/${connection.normalizedPath}`;
-}
-
-function trimFields(fields: Record<string, string>) {
-  return Object.fromEntries(Object.entries(fields).map(([key, value]) => [key, value.trim()]));
+  return value;
 }
 
 async function resolveVaultToken() {