feat: add treatvault block and TreatVault label constants

parser_test.go

@@ -307,6 +307,56 @@ func TestDockerSecretNamePrefixesShortReference(t *testing.T) {
 	}
 }
 
+func TestParseTreatVaultConfiguration(t *testing.T) {
+	cfg, err := Parse([]byte(`treatvault {
+ file ./secrets/treatvault.age
+ identity_secret treatvault_identity
+}
+pawsql {
+ listen :5432
+ database analytics {
+  postgres {
+   image postgres:18
+   volume analytics-data
+   password_secret analytics_password
+  }
+ }
+}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.TreatVault == nil || cfg.TreatVault.File != "./secrets/treatvault.age" || cfg.TreatVault.IdentitySecret != "treatvault_identity" {
+		t.Fatalf("TreatVault = %#v", cfg.TreatVault)
+	}
+	if err := cfg.Validate(); err != nil {
+		t.Fatalf("Validate() error = %v", err)
+	}
+}
+
+func TestValidateRejectsInvalidTreatVaultConfiguration(t *testing.T) {
+	cfg := Config{
+		Listen:     ":5432",
+		TreatVault: &TreatVaultConfig{IdentitySecret: "UPPERCASE"},
+		Databases: []DatabaseConfig{{
+			Name: "analytics",
+			Postgres: &PostgresConfig{
+				Image:          "postgres:18",
+				Volume:         "analytics-data",
+				PasswordSecret: "UPPERCASE",
+			},
+		}},
+	}
+	err := cfg.Validate()
+	if err == nil {
+		t.Fatal("Validate() error = nil")
+	}
+	for _, want := range []string{"treatvault file is required", "treatvault identity_secret", "password_secret must not reference"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("Validate() error = %q, missing %q", err, want)
+		}
+	}
+}
+
 func TestParseMalformedBlocksReportLine(t *testing.T) {
 	_, err := Parse([]byte("pawsql {\n tls {\n  cert cert.pem\n"))
 	if err == nil {