feat(vault): gate the secret store on a deployer input#183

Open

ItamarZand88 wants to merge 12 commits into

mainfrom

feat/enabled-vault

Commits on Jul 23, 2026

fix(setup): withdraw a declined vault's grants, not just its entry
ItamarZand88
committed
fix(preflights): reject a gated resource inside a sibling's secret namespace
ItamarZand88
committed
test(cloudformation): gate a vault id a customer could actually gate
ItamarZand88
committed
fix(preflights): flag family wildcard grants over a gated secret namespace
ItamarZand88
committed
test(cloudformation): pin the queue's resource-scoped grant to its gate
ItamarZand88
committed
test(terraform): snapshot the full gated module
ItamarZand88
committed
fix(setup): drop declined resources' grants from permission profiles
ItamarZand88
committed
test(deployment): assert kept grants survive the declined-resource strip
ItamarZand88
committed
fix(setup): also drop declined resources' management-profile grants
ItamarZand88
committed
test(e2e): add enabled-demo real-cloud distribution test for .enabled
ItamarZand88
committed
chore: register enabled-demo in the pnpm lockfile
ItamarZand88
committed
fix(e2e): avoid spreading untyped command params in enabled-demo
ItamarZand88
committed