{ pkgs, lib, ... }:

pkgs.writeShellApplication {
  name = "vault-fetch";

  runtimeInputs = with pkgs; [
    curl      # Vault API calls
    jq        # JSON parsing
    coreutils # File operations
  ];

  text = builtins.readFile ./vault-fetch.sh;

  meta = with lib; {
    description = "Fetch secrets from OpenBao/Vault and write to filesystem";
    license = licenses.mit;
  };
}