isolated NATS logic

ci/scripts/common/ensure_env_version.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 set -eu
 
-echo "[fx-pipeline] rewriting .env.version" >&2
+echo "[build pipeline] rewriting .env.version" >&2
 
 if [ -f ./.env.version ]; then
   while IFS= read -r line || [ -n "$line" ]; do

ci/scripts/common/nats_env.sh

@@ -0,0 +1,20 @@
+# Helper for loading NATS credentials and URL in deploy scripts.
+load_nats_env() {
+  : "${NATS_HOST:?missing NATS_HOST}"
+  : "${NATS_PORT:?missing NATS_PORT}"
+
+  nats_secret_path="${NATS_SECRET_PATH:-sendico/nats}"
+  export NATS_USER="$(./ci/vlt kv_get kv "${nats_secret_path}" user)"
+  export NATS_PASSWORD="$(./ci/vlt kv_get kv "${nats_secret_path}" password)"
+
+  nats_url_var="${NATS_URL_VAR:-NATS_URL}"
+  nats_url_scheme="${NATS_URL_SCHEME:-nats}"
+  case "${nats_url_var}" in
+    ''|[!A-Za-z_]*|*[!A-Za-z0-9_]*)
+      echo "[nats-env] invalid NATS_URL_VAR: ${nats_url_var}" >&2
+      exit 1
+      ;;
+  esac
+
+  export "${nats_url_var}=${nats_url_scheme}://${NATS_HOST}:${NATS_PORT}"
+}