vaultkeeper 0.5.0 → 0.5.2

package/dist/index.cjs

@@ -1617,7 +1617,13 @@ function validateConfig(config) {
   if (typeof config.defaults.ttlMinutes !== "number" || config.defaults.ttlMinutes <= 0) {
     throw new Error("Config defaults.ttlMinutes must be a positive number");
   }
-  const tier = config.defaults.trustTier;
+  let tier = config.defaults.trustTier;
+  if (typeof tier === "string") {
+    const parsed = Number(tier);
+    if (!Number.isNaN(parsed)) {
+      tier = parsed;
+    }
+  }
   if (tier !== 1 && tier !== 2 && tier !== 3) {
     throw new Error("Config defaults.trustTier must be 1, 2, or 3");
   }
@@ -2019,7 +2025,6 @@ var SecretAccessorTarget = class {
 };
 function createSecretAccessor(secretValue) {
   let consumed = false;
-  const revokeHolder = { fn: void 0 };
   function readImpl(callback) {
     if (consumed) {
       throw new Error("SecretAccessor has already been consumed \u2014 call getSecret() again to obtain a new accessor");
@@ -2030,7 +2035,6 @@ function createSecretAccessor(secretValue) {
       callback(buf);
     } finally {
       buf.fill(0);
-      revokeHolder.fn?.();
     }
   }
   function inspectImpl() {
@@ -2088,9 +2092,7 @@ function createSecretAccessor(secretValue) {
       return ["read", INSPECT_CUSTOM];
     }
   };
-  const { proxy, revoke } = Proxy.revocable(target, handler);
-  revokeHolder.fn = revoke;
-  return proxy;
+  return new Proxy(target, handler);
 }
 
 // src/access/sign-util.ts
@@ -2273,7 +2275,17 @@ function currentPlatform() {
 
 // src/doctor/runner.ts
 async function runDoctor(options) {
-  const platform = currentPlatform();
+  let platform;
+  try {
+    platform = options?.platform ?? currentPlatform();
+  } catch {
+    return {
+      checks: [],
+      ready: false,
+      warnings: [],
+      nextSteps: ["Unsupported platform. vaultkeeper supports macOS, Linux, and Windows."]
+    };
+  }
   const entries = buildCheckList(platform);
   const resolved = await Promise.all(
     entries.map(async ({ check, required }) => {
@@ -2326,6 +2338,7 @@ function buildCheckList(platform) {
 
 // src/vault.ts
 var usageCounts = /* @__PURE__ */ new Map();
+var USAGE_MAP_MAX_SIZE = 1e4;
 var VaultKeeper = class _VaultKeeper {
   #config;
   #keyManager;
@@ -2362,7 +2375,7 @@ var VaultKeeper = class _VaultKeeper {
     return runDoctor();
   }
   /**
-   * Store a secret and return a JWE token that encapsulates it.
+   * Retrieve a secret from the backend and return a JWE token that encapsulates it.
    *
    * @param secretName - Identifier for the secret
    * @param options - Setup options
@@ -2421,12 +2434,16 @@ var VaultKeeper = class _VaultKeeper {
     const jti = claims.jti;
     const currentCount = usageCounts.get(jti) ?? 0;
     validateClaims(claims, currentCount);
-    const newCount = currentCount + 1;
-    if (claims.use !== null && newCount >= claims.use) {
-      usageCounts.delete(jti);
-      blockToken(jti);
-    } else {
+    if (claims.use !== null) {
+      const newCount = currentCount + 1;
       usageCounts.set(jti, newCount);
+      if (usageCounts.size > USAGE_MAP_MAX_SIZE) {
+        const oldest = usageCounts.keys().next().value;
+        if (oldest !== void 0) {
+          usageCounts.delete(oldest);
+          blockToken(oldest);
+        }
+      }
     }
     const token = createCapabilityToken(claims);
     const response = { keyStatus };
@@ -2682,5 +2699,6 @@ exports.UsageLimitExceededError = UsageLimitExceededError;
 exports.VaultError = VaultError;
 exports.VaultKeeper = VaultKeeper;
 exports.isListableBackend = isListableBackend;
+exports.runDoctor = runDoctor;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map