# 🤖 The Bitwarden vault contract — the ONE place the scripts and the vault
# agree on item names and where each value lives. Scripts read exactly what
# this file says and fail crisply when the vault doesn't match; they never
# guess. The vault side keeps these items named exactly this way — renaming
# one is a reviewed PR here plus the vault edit, in step, never one without
# the other (the sudoers-operators rule, applied to the vault).
#
# Sourced by release-server.sh, doctor.sh, ops-dev.sh. POSIX sh; constants
# only — no logic, no side effects, nothing here is secret (names, not
# values).
# shellcheck disable=SC2034  # consumed by the sourcing scripts

# The Ed25519 seed that signs the server release feed. VALUE: a hidden custom
# field — the item has no password slot, and the field carries no agreed name
# yet, so readers pick the only >40-char field value. Naming that field (e.g.
# `credential`) and reading it exactly is the remaining half of this
# contract; doing so is a coordinated vault edit + script change.
BW_ITEM_SIGNING_KEY="Eleven Messenger server release signing key"

# The DNSimple API token (Eleven account 176940) — the tofu dnsimple provider
# and DNS-01 issuance. VALUE: the login PASSWORD slot, nothing else.
BW_ITEM_DNSIMPLE="lchat DNSimple DNS-01 token (11ch.at — Eleven Messenger acct 176940)"

# Per-operator dev agent credentials (docs/secrets.md § AWS): every operator
# holds EXACTLY ONE item whose name starts with this prefix — theirs, named
# for their revocable IAM identity (aws-dev-agent-<name>). VALUE: the sealed
# env file — KEY=VALUE lines in the secure note (or custom fields).
BW_ITEM_DEV_AGENT_PREFIX="aws-dev-agent-"