@subactor/credential-vault

Encrypted credential storage and a bounded HTTP lease client for Subactor.

The package owns the reusable vault domain logic. It does not grant authority, run an HTTP server, or expose a bulk secret export. A host service must enforce authentication and AQL before calling reveal; normal consumers should use VaultLeaseClient with an exact entry, origin, field, actor, purpose, ticket, and grant.

Properties:

• AES-256-GCM envelopes with a key derived by SHA-256;
• origin-bound reads;
• typed operation and target scopes;
• masked list results;
• atomic mode-0600 persistence;
• bounded lease and metadata client;
• no credentials in URLs, errors, metadata, or serialized receipts.

import {CredentialVault} from "@subactor/credential-vault";
import {VaultLeaseClient} from "@subactor/credential-vault/client";

Python consumers use the same bounded client contract:

from subactor_credential_vault import VaultLeaseClient

The current service host is Subactor browser-agent. Existing credentials.json files remain compatible and require no migration.

Licensed under Apache-2.0.