Vault

protected knowledge — Secrets, config, and environment with typed contracts — protected knowledge, not a loose bag of env vars.

Vault is the element for protected knowledge.

Secrets, config, and environment with typed contracts — protected knowledge, not a loose bag of env vars.

Governing rule

Secrets are write-only in the Console — set and rotate, never reveal. Flows read via fx.vault.

At a glance

Essence: protected knowledge. Replaces: secrets · config · environment.

Drivers available

.env.local

Dev default — local files, no invented format.

sops / age

Prod default — existing standard.

Example from the teaching apps

Claimed fence from provisions — same source the doc-drift gate checks:

`examples/provisions/src/vault.ts`

import { vault } from "okengine";
import { z } from "zod";

// A declaration is a CONTRACT, not a value.
// Resolution: process.env → .env.local → .env.stack → vault driver → dev fallback
export const stripeKey = vault.secret("STRIPE_KEY", {
  schema: z.string().startsWith("sk_"),
  description: "Payments gateway key",
  rotate: "90d",
  dev: "sk_test_local",
});

export const dbUrl = vault.secret("DATABASE_URL", {
  schema: z.string().url(),
  dev: vault.fromStack("store.sql"),     // generated by `oke dev --stack` — zero manual setup
});