Module vault 

vault … operator/agent commands (online, via the trust-task dispatcher).

Thin wrappers over the VtaClient::vault_* methods plus the seal/open helpers. Secret-bearing operations use didcomm-authcrypt sealed envelopes and therefore require the DIDComm transport (the seal is produced with the caller’s own keys):

• upsert seals the cleartext secret to the VTA before sending.
• release opens the JWE the VTA seals back to the caller.

Capability gates (server-side): list/get → VaultRead, upsert/delete → VaultWrite, release → FillRelease, proxy-login → ProxyLogin, sign-trust-task → SignTrustTask.

Functions

cmd_vault_archive

vault archive — soft-disable an entry (restorable with vault unarchive).

cmd_vault_delete

vault delete — soft-delete (recoverable) by default; force hard-deletes irreversibly. Optional optimistic-concurrency version check + audit reason.

cmd_vault_get

vault get — a single entry’s metadata by id.

cmd_vault_list

vault list — metadata only (no secrets). filters is the wire filter object (None → all entries). status selects the lifecycle view (active default / archived / deleted / all) and is merged into the filter object.

cmd_vault_proxy_login

vault proxy-login — mint a session as the entry’s principal. payload is the full wire request (entry id + login parameters).

cmd_vault_purge

vault purge — irreversibly hard-delete an entry, skipping any grace window.

cmd_vault_release

vault release — release a secret sealed to the caller. Fetches the sealed envelope, opens it locally, and prints the cleartext VaultSecret. target is the optional site target the release is scoped to.

cmd_vault_restore

vault restore — undelete a soft-deleted entry (only within the grace window).

cmd_vault_sign_trust_task

vault sign-trust-task — sign a Trust Task envelope as the entry’s principal DID. payload is the full wire request (entry id + envelope).

cmd_vault_unarchive

vault unarchive — return an archived entry to active.

cmd_vault_upsert

vault upsert — create/update an entry. entry is the entry-fields payload (contextId, targets, label, secretKind, …); secret, when present, is the cleartext VaultSecret JSON, sealed here to the VTA before sending.