Module vault 

HashiCorp Vault server, KV version 2: what vault status and vault kv get/put/list/ metadata get need.

The CLI’s first request for any kv command is GET /v1/sys/internal/ui/mounts/<path>; the options.version it finds there decides whether it uses KV v1 paths or v2’s <mount>/data/… and <mount>/metadata/…. NetGet answers that preflight, seal status, health and leader deterministically from its configuration, and raises vault_read, vault_write or vault_list for everything that touches a secret. NetGet stores nothing: the model (or its memory, or the SQLite facility) holds the secrets.

X-Vault-Token reaches the model only as booleans — present, matches the configured token, a token is configured — never the token itself. See src/server/vault/CLAUDE.md.

Modules

actions

Vault KV v2 actions.

api

Routing and rendering. Public so it can be tested without a socket. Vault HTTP API routing and response rendering, KV version 2 only.

Structs

VaultConfig

Per-server configuration.

VaultServer

Vault server.

Constants

DEFAULT_VAULT_VERSION

Version reported by sys/seal-status and sys/health when vault_version is absent.

MAX_REQUEST_BODY_BYTES

Largest request body this server will buffer, in bytes.