From 81999dcbb33c669371a6302d033ddb58112c50a9 Mon Sep 17 00:00:00 2001
From: saravanakumardb1 <saravanakumardb1@users.noreply.github.com>
Date: Sat, 14 Feb 2026 22:18:01 -0800
Subject: [PATCH] feat(services): wire AKV secret resolution in
 platform-service and extraction-service startup

---
 services/extraction-service/src/server.ts |  9 +++++++++
 services/platform-service/src/server.ts   | 13 +++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/services/extraction-service/src/server.ts b/services/extraction-service/src/server.ts
index c129b40b..d9df2f05 100644
--- a/services/extraction-service/src/server.ts
+++ b/services/extraction-service/src/server.ts
@@ -8,6 +8,15 @@
  * Depends on a Python sidecar running LangExtract (default port 4006).
  */
 
+// Resolve secrets from Azure Key Vault BEFORE config parsing
+import { resolveKeyVaultSecrets, LYSNR_SECRETS } from '@bytelyst/config';
+await resolveKeyVaultSecrets([
+  LYSNR_SECRETS.COSMOS_KEY,
+  LYSNR_SECRETS.COSMOS_ENDPOINT,
+  LYSNR_SECRETS.JWT_SECRET,
+  LYSNR_SECRETS.GEMINI_API_KEY,
+]);
+
 import { createServiceApp, startService } from '@bytelyst/fastify-core';
 import { extractRoutes } from './modules/extract/routes.js';
 import { taskRoutes } from './modules/tasks/routes.js';
diff --git a/services/platform-service/src/server.ts b/services/platform-service/src/server.ts
index 523493f8..7bc72cf1 100644
--- a/services/platform-service/src/server.ts
+++ b/services/platform-service/src/server.ts
@@ -8,6 +8,19 @@
  * Port: 4003 (configurable via PORT env var).
  */
 
+// Resolve secrets from Azure Key Vault BEFORE config parsing
+import { resolveKeyVaultSecrets, LYSNR_SECRETS } from '@bytelyst/config';
+await resolveKeyVaultSecrets([
+  LYSNR_SECRETS.COSMOS_KEY,
+  LYSNR_SECRETS.COSMOS_ENDPOINT,
+  LYSNR_SECRETS.JWT_SECRET,
+  LYSNR_SECRETS.STRIPE_SECRET_KEY,
+  LYSNR_SECRETS.STRIPE_WEBHOOK_SECRET,
+  LYSNR_SECRETS.BILLING_INTERNAL_KEY,
+  LYSNR_SECRETS.AZURE_BLOB_CONNECTION_STRING,
+  LYSNR_SECRETS.AZURE_BLOB_ACCOUNT_KEY,
+]);
+
 import { createServiceApp, startService } from '@bytelyst/fastify-core';
 import { authRoutes } from './modules/auth/routes.js';
 import { auditRoutes } from './modules/audit/routes.js';