@forgezero/vault 0.1.23 → 0.1.25

package/dist/index.d.ts

@@ -35,7 +35,7 @@ export declare class VaultError extends Error {
     readonly code: string;
     constructor(code: string, message: string);
 }
-export type CredentialMode = 'managed' | 'external';
+export type CredentialMode = 'managed' | 'external' | 'local';
 export interface Credential {
     mode: CredentialMode;
     /** MANAGED only — the agent socket serving the environment's RAM replica. */
@@ -43,6 +43,11 @@ export interface Credential {
     /** EXTERNAL only — a seed, never transmitted; a keypair derives from it. */
     apiKey?: string;
 }
+export interface LocalVaultStorage {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
 export interface DiscoveryEnvironment {
     env?: Record<string, string | undefined>;
     socketPath?: string;
@@ -142,6 +147,10 @@ export interface VaultOptions {
     runtimeRequest?: RuntimeRequest;
     credential?: Credential;
     discovery?: DiscoveryEnvironment;
+    /** Browser-compatible persistence used only by explicit `local` development mode. */
+    localStorage?: LocalVaultStorage;
+    /** Separates multiple local applications that intentionally share one Storage implementation. */
+    localNamespace?: string;
 }
 export interface EntryMeta {
     name: string;
@@ -168,9 +177,15 @@ export declare class ForgeZero {
     private readonly requestTimeoutMs;
     private readonly project;
     private readonly environment;
+    private readonly localStorage?;
+    private readonly localNamespace;
     constructor(options?: VaultOptions);
     private scope;
     private request;
+    private localStorageKey;
+    private localValues;
+    private saveLocalValues;
+    private localRequest;
     private managedRequest;
     /** One value, current version unless asked otherwise. */
     get(name: string, options?: {
@@ -258,6 +273,8 @@ export declare class ForgeZero {
  * constructor that happens to do I/O-adjacent work.
  */
 export declare const createVault: (options?: VaultOptions) => ForgeZero;
+/** Explicit isolated laptop/browser development. This mode never performs HTTP. */
+export declare const createLocalVault: (options?: Omit<VaultOptions, "credential">) => ForgeZero;
 export declare function vaultCredentials(vault: ForgeZero): {
     readonly name: string;
     get(reference: string, field: string): Promise<string>;
@@ -296,4 +313,4 @@ export declare function systemdCredentials(options?: SystemdCredentialOptions):
     readonly name: 'systemd';
     get(reference: string, field: string): Promise<string>;
 };
-export declare const VERSION = "0.1.23";
+export declare const VERSION = "0.1.25";

package/dist/index.js

@@ -22,8 +22,8 @@ class VaultRuntime {
     this.transport = transport;
   }
   available() {
-    if (this.transport === "managed-read-only") {
-      throw new VaultRuntimeClientError("MANAGED_RUNTIME_DELEGATION_REQUIRED", "Vault runtime operations require a separately granted external API key; the managed Agent replica is read-only.");
+    if (this.transport === "managed-read-only" || this.transport === "local-read-only") {
+      throw new VaultRuntimeClientError("MANAGED_RUNTIME_DELEGATION_REQUIRED", this.transport === "local-read-only" ? "Local Vault mode stores development values only; master-seed runtime operations require a separately granted live API key." : "Vault runtime operations require a separately granted external API key; the managed Agent replica is read-only.");
     }
   }
   async create(options) {
@@ -156,7 +156,9 @@ function discover(environment = {}) {
   const apiKey = env.FORGEZERO_API_KEY;
   if (apiKey)
     return { mode: "external", apiKey };
-  throw new VaultError("NO_CREDENTIAL", `No credential found. On managed compute the agent socket at ${socketPath} provides one; ` + "elsewhere set FORGEZERO_API_KEY.");
+  if (env.FORGEZERO_LOCAL_VAULT === "1")
+    return { mode: "local" };
+  throw new VaultError("NO_CREDENTIAL", `No credential found. On managed compute the agent socket at ${socketPath} provides one; ` + "elsewhere set FORGEZERO_API_KEY, or explicitly set FORGEZERO_LOCAL_VAULT=1 for isolated local development.");
 }
 var unbase64url = (encoded) => {
   const padded = encoded.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - encoded.length % 4) % 4);
@@ -264,6 +266,8 @@ class ForgeZero {
   requestTimeoutMs;
   project;
   environment;
+  localStorage;
+  localNamespace;
   constructor(options = {}) {
     const credential = options.credential ?? discover(options.discovery);
     this.credential = credential.mode === "managed" && !credential.socketPath ? { ...credential, socketPath: DEFAULT_SOCKET } : credential;
@@ -277,8 +281,13 @@ class ForgeZero {
     }
     this.project = options.project ?? "default";
     this.environment = options.environment ?? "production";
+    this.localStorage = options.localStorage ?? (this.credential.mode === "local" && typeof globalThis.localStorage !== "undefined" ? globalThis.localStorage : undefined);
+    this.localNamespace = options.localNamespace?.trim() || "fz.local.vault.v1";
+    if (this.credential.mode === "local" && !this.localStorage) {
+      throw new VaultError("LOCAL_STORAGE_UNAVAILABLE", "Local Vault mode requires browser localStorage or an injected LocalVaultStorage adapter.");
+    }
     const runtimeRequest = options.runtimeRequest ?? ((path, init) => this.request(`/v1/vault/${this.scope()}/runtime${path}`, init));
-    this.runtime = new VaultRuntime(runtimeRequest, this.credential.mode === "external" ? "external" : options.runtimeRequest ? "managed-delegated" : "managed-read-only");
+    this.runtime = new VaultRuntime(runtimeRequest, this.credential.mode === "external" ? "external" : options.runtimeRequest ? "managed-delegated" : this.credential.mode === "local" ? "local-read-only" : "managed-read-only");
   }
   scope() {
     return `${encodeURIComponent(this.project)}/${encodeURIComponent(this.environment)}`;
@@ -286,6 +295,8 @@ class ForgeZero {
   async request(path, init = {}) {
     if (this.credential.mode === "managed")
       return this.managedRequest(path, init);
+    if (this.credential.mode === "local")
+      return this.localRequest(path, init);
     const body = typeof init.body === "string" ? init.body : "";
     const target = new URL(path, this.apiUrl);
     const headers = {
@@ -326,6 +337,46 @@ class ForgeZero {
     }
     return payload;
   }
+  localStorageKey() {
+    return `${this.localNamespace}:${encodeURIComponent(this.project)}:${encodeURIComponent(this.environment)}`;
+  }
+  localValues() {
+    const raw = this.localStorage.getItem(this.localStorageKey());
+    if (raw === null)
+      return {};
+    try {
+      const parsed = JSON.parse(raw);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || Object.entries(parsed).some(([key, value]) => !key || typeof value !== "string"))
+        throw new Error("invalid");
+      return parsed;
+    } catch {
+      throw new VaultError("LOCAL_STORE_MALFORMED", "The local Vault store is malformed. Clear it before continuing.");
+    }
+  }
+  saveLocalValues(values) {
+    this.localStorage.setItem(this.localStorageKey(), JSON.stringify(values));
+  }
+  async localRequest(path, init) {
+    const method = init.method ?? "GET";
+    const target = new URL(path, "https://vault.local.invalid");
+    const values = this.localValues();
+    const entry = /\/entries\/([^/]+)$/.exec(target.pathname);
+    if (method === "GET" && entry) {
+      const name = decodeURIComponent(entry[1]);
+      if (!(name in values))
+        throw new VaultError("NOT_FOUND", `No local Vault value named ${name}.`);
+      return { value: values[name] };
+    }
+    if (method === "GET" && target.pathname.endsWith("/list")) {
+      return { entries: Object.keys(values).sort().map((name) => ({ name })) };
+    }
+    if (method === "GET" && target.pathname.endsWith("/entries"))
+      return { values: { ...values } };
+    if (method === "GET" && target.pathname.endsWith("/changes")) {
+      return { version: 0, changed: [] };
+    }
+    throw new VaultError("LOCAL_OPERATION_UNSUPPORTED", "This operation is unavailable in isolated local Vault mode.");
+  }
   async managedRequest(path, init) {
     const socketPath = this.credential.socketPath;
     const method = init.method ?? "GET";
@@ -406,7 +457,7 @@ class ForgeZero {
     return result.value;
   }
   async getAll() {
-    if (this.credential.mode !== "managed") {
+    if (this.credential.mode !== "managed" && this.credential.mode !== "local") {
       throw new VaultError("MANAGED_ONLY", "getAll is available on managed compute only. Read entries by name with an API key.");
     }
     const result = await this.request(`/v1/vault/${this.scope()}/entries`);
@@ -441,9 +492,24 @@ class ForgeZero {
     return result.entries;
   }
   async set(name, value) {
+    if (this.credential.mode === "local") {
+      if (!/^[A-Za-z0-9_.:/-]{1,256}$/.test(name) || !value) {
+        throw new VaultError("LOCAL_VALUE_INVALID", "Local Vault names and values must be non-empty and bounded.");
+      }
+      const values = this.localValues();
+      values[name] = value;
+      this.saveLocalValues(values);
+      return 1;
+    }
     throw new VaultError("APPLICATION_READ_ONLY", "Application vault credentials cannot write secrets; use the authenticated platform vault UI.");
   }
   async remove(name) {
+    if (this.credential.mode === "local") {
+      const values = this.localValues();
+      delete values[name];
+      this.saveLocalValues(values);
+      return;
+    }
     throw new VaultError("APPLICATION_READ_ONLY", "Application vault credentials cannot delete secrets; use the authenticated platform vault UI.");
   }
   async* watch(options = {}) {
@@ -463,6 +529,7 @@ class ForgeZero {
   }
 }
 var createVault = (options = {}) => new ForgeZero(options);
+var createLocalVault = (options = {}) => new ForgeZero({ ...options, credential: { mode: "local" } });
 function vaultCredentials(vault) {
   return {
     name: "vault",
@@ -505,7 +572,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.23";
+var VERSION = "0.1.25";
 export {
   vaultCredentials,
   systemdCredentials,
@@ -514,6 +581,7 @@ export {
   discover,
   directCredentials,
   createVault,
+  createLocalVault,
   VaultRuntime,
   VaultError,
   VERSION,

package/dist/providers.js

@@ -22,8 +22,8 @@ class VaultRuntime {
     this.transport = transport;
   }
   available() {
-    if (this.transport === "managed-read-only") {
-      throw new VaultRuntimeClientError("MANAGED_RUNTIME_DELEGATION_REQUIRED", "Vault runtime operations require a separately granted external API key; the managed Agent replica is read-only.");
+    if (this.transport === "managed-read-only" || this.transport === "local-read-only") {
+      throw new VaultRuntimeClientError("MANAGED_RUNTIME_DELEGATION_REQUIRED", this.transport === "local-read-only" ? "Local Vault mode stores development values only; master-seed runtime operations require a separately granted live API key." : "Vault runtime operations require a separately granted external API key; the managed Agent replica is read-only.");
     }
   }
   async create(options) {
@@ -156,7 +156,9 @@ function discover(environment = {}) {
   const apiKey = env.FORGEZERO_API_KEY;
   if (apiKey)
     return { mode: "external", apiKey };
-  throw new VaultError("NO_CREDENTIAL", `No credential found. On managed compute the agent socket at ${socketPath} provides one; ` + "elsewhere set FORGEZERO_API_KEY.");
+  if (env.FORGEZERO_LOCAL_VAULT === "1")
+    return { mode: "local" };
+  throw new VaultError("NO_CREDENTIAL", `No credential found. On managed compute the agent socket at ${socketPath} provides one; ` + "elsewhere set FORGEZERO_API_KEY, or explicitly set FORGEZERO_LOCAL_VAULT=1 for isolated local development.");
 }
 var unbase64url = (encoded) => {
   const padded = encoded.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - encoded.length % 4) % 4);
@@ -264,6 +266,8 @@ class ForgeZero {
   requestTimeoutMs;
   project;
   environment;
+  localStorage;
+  localNamespace;
   constructor(options = {}) {
     const credential = options.credential ?? discover(options.discovery);
     this.credential = credential.mode === "managed" && !credential.socketPath ? { ...credential, socketPath: DEFAULT_SOCKET } : credential;
@@ -277,8 +281,13 @@ class ForgeZero {
     }
     this.project = options.project ?? "default";
     this.environment = options.environment ?? "production";
+    this.localStorage = options.localStorage ?? (this.credential.mode === "local" && typeof globalThis.localStorage !== "undefined" ? globalThis.localStorage : undefined);
+    this.localNamespace = options.localNamespace?.trim() || "fz.local.vault.v1";
+    if (this.credential.mode === "local" && !this.localStorage) {
+      throw new VaultError("LOCAL_STORAGE_UNAVAILABLE", "Local Vault mode requires browser localStorage or an injected LocalVaultStorage adapter.");
+    }
     const runtimeRequest = options.runtimeRequest ?? ((path, init) => this.request(`/v1/vault/${this.scope()}/runtime${path}`, init));
-    this.runtime = new VaultRuntime(runtimeRequest, this.credential.mode === "external" ? "external" : options.runtimeRequest ? "managed-delegated" : "managed-read-only");
+    this.runtime = new VaultRuntime(runtimeRequest, this.credential.mode === "external" ? "external" : options.runtimeRequest ? "managed-delegated" : this.credential.mode === "local" ? "local-read-only" : "managed-read-only");
   }
   scope() {
     return `${encodeURIComponent(this.project)}/${encodeURIComponent(this.environment)}`;
@@ -286,6 +295,8 @@ class ForgeZero {
   async request(path, init = {}) {
     if (this.credential.mode === "managed")
       return this.managedRequest(path, init);
+    if (this.credential.mode === "local")
+      return this.localRequest(path, init);
     const body = typeof init.body === "string" ? init.body : "";
     const target = new URL(path, this.apiUrl);
     const headers = {
@@ -326,6 +337,46 @@ class ForgeZero {
     }
     return payload;
   }
+  localStorageKey() {
+    return `${this.localNamespace}:${encodeURIComponent(this.project)}:${encodeURIComponent(this.environment)}`;
+  }
+  localValues() {
+    const raw = this.localStorage.getItem(this.localStorageKey());
+    if (raw === null)
+      return {};
+    try {
+      const parsed = JSON.parse(raw);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || Object.entries(parsed).some(([key, value]) => !key || typeof value !== "string"))
+        throw new Error("invalid");
+      return parsed;
+    } catch {
+      throw new VaultError("LOCAL_STORE_MALFORMED", "The local Vault store is malformed. Clear it before continuing.");
+    }
+  }
+  saveLocalValues(values) {
+    this.localStorage.setItem(this.localStorageKey(), JSON.stringify(values));
+  }
+  async localRequest(path, init) {
+    const method = init.method ?? "GET";
+    const target = new URL(path, "https://vault.local.invalid");
+    const values = this.localValues();
+    const entry = /\/entries\/([^/]+)$/.exec(target.pathname);
+    if (method === "GET" && entry) {
+      const name = decodeURIComponent(entry[1]);
+      if (!(name in values))
+        throw new VaultError("NOT_FOUND", `No local Vault value named ${name}.`);
+      return { value: values[name] };
+    }
+    if (method === "GET" && target.pathname.endsWith("/list")) {
+      return { entries: Object.keys(values).sort().map((name) => ({ name })) };
+    }
+    if (method === "GET" && target.pathname.endsWith("/entries"))
+      return { values: { ...values } };
+    if (method === "GET" && target.pathname.endsWith("/changes")) {
+      return { version: 0, changed: [] };
+    }
+    throw new VaultError("LOCAL_OPERATION_UNSUPPORTED", "This operation is unavailable in isolated local Vault mode.");
+  }
   async managedRequest(path, init) {
     const socketPath = this.credential.socketPath;
     const method = init.method ?? "GET";
@@ -406,7 +457,7 @@ class ForgeZero {
     return result.value;
   }
   async getAll() {
-    if (this.credential.mode !== "managed") {
+    if (this.credential.mode !== "managed" && this.credential.mode !== "local") {
       throw new VaultError("MANAGED_ONLY", "getAll is available on managed compute only. Read entries by name with an API key.");
     }
     const result = await this.request(`/v1/vault/${this.scope()}/entries`);
@@ -441,9 +492,24 @@ class ForgeZero {
     return result.entries;
   }
   async set(name, value) {
+    if (this.credential.mode === "local") {
+      if (!/^[A-Za-z0-9_.:/-]{1,256}$/.test(name) || !value) {
+        throw new VaultError("LOCAL_VALUE_INVALID", "Local Vault names and values must be non-empty and bounded.");
+      }
+      const values = this.localValues();
+      values[name] = value;
+      this.saveLocalValues(values);
+      return 1;
+    }
     throw new VaultError("APPLICATION_READ_ONLY", "Application vault credentials cannot write secrets; use the authenticated platform vault UI.");
   }
   async remove(name) {
+    if (this.credential.mode === "local") {
+      const values = this.localValues();
+      delete values[name];
+      this.saveLocalValues(values);
+      return;
+    }
     throw new VaultError("APPLICATION_READ_ONLY", "Application vault credentials cannot delete secrets; use the authenticated platform vault UI.");
   }
   async* watch(options = {}) {
@@ -463,6 +529,7 @@ class ForgeZero {
   }
 }
 var createVault = (options = {}) => new ForgeZero(options);
+var createLocalVault = (options = {}) => new ForgeZero({ ...options, credential: { mode: "local" } });
 function vaultCredentials(vault) {
   return {
     name: "vault",
@@ -505,7 +572,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.23";
+var VERSION = "0.1.25";
 
 // src/providers.ts
 var MISSING = new Set(["ENTRY_NOT_FOUND", "VERSION_NOT_FOUND"]);

package/dist/runtime.d.ts

@@ -48,7 +48,7 @@ export declare class VaultRuntimeClientError extends Error {
  * explicit prevents membership of the local Vault-reader group from silently
  * granting signing, decryption or certificate authority.
  */
-export type VaultRuntimeTransport = 'external' | 'managed-read-only' | 'managed-delegated';
+export type VaultRuntimeTransport = 'external' | 'managed-read-only' | 'managed-delegated' | 'local-read-only';
 /**
  * Explicit non-exporting cryptographic capabilities.
  *

package/dist/runtime.js

@@ -22,8 +22,8 @@ class VaultRuntime {
     this.transport = transport;
   }
   available() {
-    if (this.transport === "managed-read-only") {
-      throw new VaultRuntimeClientError("MANAGED_RUNTIME_DELEGATION_REQUIRED", "Vault runtime operations require a separately granted external API key; the managed Agent replica is read-only.");
+    if (this.transport === "managed-read-only" || this.transport === "local-read-only") {
+      throw new VaultRuntimeClientError("MANAGED_RUNTIME_DELEGATION_REQUIRED", this.transport === "local-read-only" ? "Local Vault mode stores development values only; master-seed runtime operations require a separately granted live API key." : "Vault runtime operations require a separately granted external API key; the managed Agent replica is read-only.");
     }
   }
   async create(options) {

package/dist/schema.js

@@ -22,8 +22,8 @@ class VaultRuntime {
     this.transport = transport;
   }
   available() {
-    if (this.transport === "managed-read-only") {
-      throw new VaultRuntimeClientError("MANAGED_RUNTIME_DELEGATION_REQUIRED", "Vault runtime operations require a separately granted external API key; the managed Agent replica is read-only.");
+    if (this.transport === "managed-read-only" || this.transport === "local-read-only") {
+      throw new VaultRuntimeClientError("MANAGED_RUNTIME_DELEGATION_REQUIRED", this.transport === "local-read-only" ? "Local Vault mode stores development values only; master-seed runtime operations require a separately granted live API key." : "Vault runtime operations require a separately granted external API key; the managed Agent replica is read-only.");
     }
   }
   async create(options) {
@@ -156,7 +156,9 @@ function discover(environment = {}) {
   const apiKey = env.FORGEZERO_API_KEY;
   if (apiKey)
     return { mode: "external", apiKey };
-  throw new VaultError("NO_CREDENTIAL", `No credential found. On managed compute the agent socket at ${socketPath} provides one; ` + "elsewhere set FORGEZERO_API_KEY.");
+  if (env.FORGEZERO_LOCAL_VAULT === "1")
+    return { mode: "local" };
+  throw new VaultError("NO_CREDENTIAL", `No credential found. On managed compute the agent socket at ${socketPath} provides one; ` + "elsewhere set FORGEZERO_API_KEY, or explicitly set FORGEZERO_LOCAL_VAULT=1 for isolated local development.");
 }
 var unbase64url = (encoded) => {
   const padded = encoded.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - encoded.length % 4) % 4);
@@ -264,6 +266,8 @@ class ForgeZero {
   requestTimeoutMs;
   project;
   environment;
+  localStorage;
+  localNamespace;
   constructor(options = {}) {
     const credential = options.credential ?? discover(options.discovery);
     this.credential = credential.mode === "managed" && !credential.socketPath ? { ...credential, socketPath: DEFAULT_SOCKET } : credential;
@@ -277,8 +281,13 @@ class ForgeZero {
     }
     this.project = options.project ?? "default";
     this.environment = options.environment ?? "production";
+    this.localStorage = options.localStorage ?? (this.credential.mode === "local" && typeof globalThis.localStorage !== "undefined" ? globalThis.localStorage : undefined);
+    this.localNamespace = options.localNamespace?.trim() || "fz.local.vault.v1";
+    if (this.credential.mode === "local" && !this.localStorage) {
+      throw new VaultError("LOCAL_STORAGE_UNAVAILABLE", "Local Vault mode requires browser localStorage or an injected LocalVaultStorage adapter.");
+    }
     const runtimeRequest = options.runtimeRequest ?? ((path, init) => this.request(`/v1/vault/${this.scope()}/runtime${path}`, init));
-    this.runtime = new VaultRuntime(runtimeRequest, this.credential.mode === "external" ? "external" : options.runtimeRequest ? "managed-delegated" : "managed-read-only");
+    this.runtime = new VaultRuntime(runtimeRequest, this.credential.mode === "external" ? "external" : options.runtimeRequest ? "managed-delegated" : this.credential.mode === "local" ? "local-read-only" : "managed-read-only");
   }
   scope() {
     return `${encodeURIComponent(this.project)}/${encodeURIComponent(this.environment)}`;
@@ -286,6 +295,8 @@ class ForgeZero {
   async request(path, init = {}) {
     if (this.credential.mode === "managed")
       return this.managedRequest(path, init);
+    if (this.credential.mode === "local")
+      return this.localRequest(path, init);
     const body = typeof init.body === "string" ? init.body : "";
     const target = new URL(path, this.apiUrl);
     const headers = {
@@ -326,6 +337,46 @@ class ForgeZero {
     }
     return payload;
   }
+  localStorageKey() {
+    return `${this.localNamespace}:${encodeURIComponent(this.project)}:${encodeURIComponent(this.environment)}`;
+  }
+  localValues() {
+    const raw = this.localStorage.getItem(this.localStorageKey());
+    if (raw === null)
+      return {};
+    try {
+      const parsed = JSON.parse(raw);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || Object.entries(parsed).some(([key, value]) => !key || typeof value !== "string"))
+        throw new Error("invalid");
+      return parsed;
+    } catch {
+      throw new VaultError("LOCAL_STORE_MALFORMED", "The local Vault store is malformed. Clear it before continuing.");
+    }
+  }
+  saveLocalValues(values) {
+    this.localStorage.setItem(this.localStorageKey(), JSON.stringify(values));
+  }
+  async localRequest(path, init) {
+    const method = init.method ?? "GET";
+    const target = new URL(path, "https://vault.local.invalid");
+    const values = this.localValues();
+    const entry = /\/entries\/([^/]+)$/.exec(target.pathname);
+    if (method === "GET" && entry) {
+      const name = decodeURIComponent(entry[1]);
+      if (!(name in values))
+        throw new VaultError("NOT_FOUND", `No local Vault value named ${name}.`);
+      return { value: values[name] };
+    }
+    if (method === "GET" && target.pathname.endsWith("/list")) {
+      return { entries: Object.keys(values).sort().map((name) => ({ name })) };
+    }
+    if (method === "GET" && target.pathname.endsWith("/entries"))
+      return { values: { ...values } };
+    if (method === "GET" && target.pathname.endsWith("/changes")) {
+      return { version: 0, changed: [] };
+    }
+    throw new VaultError("LOCAL_OPERATION_UNSUPPORTED", "This operation is unavailable in isolated local Vault mode.");
+  }
   async managedRequest(path, init) {
     const socketPath = this.credential.socketPath;
     const method = init.method ?? "GET";
@@ -406,7 +457,7 @@ class ForgeZero {
     return result.value;
   }
   async getAll() {
-    if (this.credential.mode !== "managed") {
+    if (this.credential.mode !== "managed" && this.credential.mode !== "local") {
       throw new VaultError("MANAGED_ONLY", "getAll is available on managed compute only. Read entries by name with an API key.");
     }
     const result = await this.request(`/v1/vault/${this.scope()}/entries`);
@@ -441,9 +492,24 @@ class ForgeZero {
     return result.entries;
   }
   async set(name, value) {
+    if (this.credential.mode === "local") {
+      if (!/^[A-Za-z0-9_.:/-]{1,256}$/.test(name) || !value) {
+        throw new VaultError("LOCAL_VALUE_INVALID", "Local Vault names and values must be non-empty and bounded.");
+      }
+      const values = this.localValues();
+      values[name] = value;
+      this.saveLocalValues(values);
+      return 1;
+    }
     throw new VaultError("APPLICATION_READ_ONLY", "Application vault credentials cannot write secrets; use the authenticated platform vault UI.");
   }
   async remove(name) {
+    if (this.credential.mode === "local") {
+      const values = this.localValues();
+      delete values[name];
+      this.saveLocalValues(values);
+      return;
+    }
     throw new VaultError("APPLICATION_READ_ONLY", "Application vault credentials cannot delete secrets; use the authenticated platform vault UI.");
   }
   async* watch(options = {}) {
@@ -463,6 +529,7 @@ class ForgeZero {
   }
 }
 var createVault = (options = {}) => new ForgeZero(options);
+var createLocalVault = (options = {}) => new ForgeZero({ ...options, credential: { mode: "local" } });
 function vaultCredentials(vault) {
   return {
     name: "vault",
@@ -505,7 +572,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.23";
+var VERSION = "0.1.25";
 
 // src/schema.ts
 function managedSchemas(vault, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/vault",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "type": "module",
   "publishConfig": {
     "access": "public",
@@ -46,12 +46,14 @@
     "@types/bun": "latest"
   },
   "dependencies": {
-    "@forgezero/runtime": "^0.1.18"
+    "@forgezero/runtime": "^0.1.19"
   },
   "peerDependencies": {
+    "@noble/ciphers": "^2.2.0",
     "@noble/curves": "^2.2.0",
     "@noble/post-quantum": "^0.6.1",
-    "@noble/hashes": "^2.2.0"
+    "@noble/hashes": "^2.2.0",
+    "@scure/base": "^2.2.0"
   },
   "description": "ForgeZero vault client. Credential discovery and versioned secrets through one stable API origin.",
   "keywords": [