Module keyvault 

BYO-key vault + egress governance (gateway L2).

The security wedge: clients authenticate with a virtual key; the real provider key (the upstream’s sk-… secret) lives only on the edge and is injected into the upstream request on the way out. A client — or a compromised one — never sees a provider key, and a leaked virtual key is revoked by deleting one vault entry without rotating the provider credential.

Two controls per key:

• key swap — the presented virtual key is replaced by its mapped provider key in the upstream Authorization, so the provider secret never appears in the client surface or logs;
• egress allowlist — an optional set of model names the key may reach; a request for any other model is denied 403 (fail-closed once a list is set).

Virtual keys are matched by a constant-time comparison that scans every entry (mirroring the API-key gate in crate::auth), so the match time doesn’t reveal which key — if any — was hit. Provider keys are held in memory as configured (encryption-at-rest is a property of wherever the config/secret is stored, e.g. the control-plane secret store that pushes them).

When any [[llm.keys]] is configured the vault is enabled for all proxied traffic: a request without a known virtual key is rejected 401 before it reaches the upstream.

Structs

KeyVault

The configured vault entries. Built once per config (re)load and carried on the proxy Runtime.

VaultEntry

One resolved vault entry: the provider secret to inject and the model egress policy.