53 lines
1.4 KiB
Markdown
53 lines
1.4 KiB
Markdown
# dew_vault
|
|
|
|
Vault feature package for the [Dew](https://github.com/artificerchris/dew) project
|
|
management tool.
|
|
|
|
This package provides the `dew vault` command surface and registers Vault commands
|
|
as MCP tools through `DewToolCommand`.
|
|
|
|
## Status
|
|
|
|
This package implements encrypted secret storage, rotation-aware metadata, and
|
|
command handlers exposed as MCP tools.
|
|
|
|
## Features
|
|
|
|
- Encrypted secret storage under `.project/vault` using AES-GCM + PBKDF2.
|
|
- Vault password stored at `.project/secrets/dew.vault.password` by default.
|
|
- Configurable generators for secret rotation in `dew.vault.generators`.
|
|
- Built-in generator-backed `generate` command.
|
|
- Metadata-aware rotation and metadata persistence for rotation policy configuration.
|
|
- Rotation support:
|
|
- `vault rotate` rotates the vault password and rewraps every secret.
|
|
- `vault rotate --name <name>` regenerates a single secret value (via metadata-defined
|
|
generator when available).
|
|
|
|
## Commands
|
|
|
|
- `dew vault init`
|
|
- `dew vault get`
|
|
- `dew vault set`
|
|
- `dew vault update`
|
|
- `dew vault rename`
|
|
- `dew vault rotate`
|
|
- `dew vault generate`
|
|
- `dew vault list`
|
|
- `dew vault delete`
|
|
|
|
Run `dew vault <command> --format json` for machine-friendly output.
|
|
|
|
## License
|
|
|
|
MIT — see [LICENSE](LICENSE).
|
|
|
|
## Example metadata
|
|
|
|
```yaml
|
|
rotation:
|
|
generator: postgres_password
|
|
length: 48
|
|
include_symbols: false
|
|
```
|
|
|
|
Store it with `--metadata` or `--metadata-file` on `dew vault set`/`dew vault update`.
|