okengine 0.10.2 → 0.11.0

package/src/elements/vault/types.ts

@@ -0,0 +1,288 @@
+/**
+ * Vault value/adapter/config shapes shared by every backend.
+ *
+ * These types describe the *encrypted-at-rest* Vault (secrets stored by
+ * path, wrapped by a KEK derived from a master key) — distinct from the
+ * boot-time contract declarations in `declare.ts`.
+ */
+
+import type { VaultErrorCode } from "./errors.ts";
+
+/** Content-encryption algorithm identifier persisted alongside every row. */
+export type VaultAlgorithm = "aes-256-gcm";
+
+/** Who performed a Vault operation (audit + policy). */
+export type VaultActorType = "flow" | "operator" | "system" | "cli" | "unknown";
+
+/** Caller identity attached to a mutation for audit purposes. */
+export interface VaultActor {
+  /** Actor class. */
+  readonly type: VaultActorType;
+  /** Stable id within the actor class (flow name, operator id, …). */
+  readonly id?: string;
+  /** Correlation id for the enclosing request/run. */
+  readonly requestId?: string;
+}
+
+/** A decrypted secret as returned to a caller. */
+export interface VaultSecret {
+  /** Canonical path (`prod/api/stripe`). */
+  readonly path: string;
+  /** Cleartext value — never log, never serialize. */
+  readonly value: string;
+  /** Monotonic version, starting at 1. */
+  readonly version: number;
+  /** Non-sensitive metadata stored beside the ciphertext. */
+  readonly metadata?: Readonly<Record<string, unknown>>;
+  /** Algorithm used for this version. */
+  readonly algorithm: VaultAlgorithm;
+  /** KEK generation that wrapped this version's DEK. */
+  readonly kekVersion: number;
+  /** First-write timestamp for the path. */
+  readonly createdAt: Date;
+  /** Last-write timestamp for this version. */
+  readonly updatedAt: Date;
+  /** Absolute expiry; reads past it fail with `EXPIRED`. */
+  readonly expiresAt?: Date;
+}
+
+/** Options for {@link VaultAdapter.set} / {@link VaultAdapter.rotate}. */
+export interface VaultSetOptions {
+  /** Non-sensitive metadata stored beside the ciphertext. */
+  readonly metadata?: Readonly<Record<string, unknown>>;
+  /** Absolute expiry. Takes precedence over {@link ttlMs}. */
+  readonly expiresAt?: Date;
+  /** Relative expiry from now, in milliseconds. */
+  readonly ttlMs?: number;
+  /** Caller identity recorded in the audit chain. */
+  readonly actor?: VaultActor;
+}
+
+/** Options for read-side operations. */
+export interface VaultGetOptions {
+  /** Read a specific version instead of the latest. */
+  readonly version?: number;
+  /** Return expired secrets instead of failing with `EXPIRED`. */
+  readonly allowExpired?: boolean;
+  /** Caller identity recorded in the audit chain. */
+  readonly actor?: VaultActor;
+}
+
+/** One entry in a {@link VaultAdapter.list} result (never a value). */
+export interface VaultListEntry {
+  /** Canonical path. */
+  readonly path: string;
+  /** Latest version for the path. */
+  readonly version: number;
+  /** Last-write timestamp. */
+  readonly updatedAt: Date;
+  /** Absolute expiry, when set. */
+  readonly expiresAt?: Date;
+}
+
+/** Options for {@link VaultAdapter.list}. */
+export interface VaultListOptions {
+  /** Canonical path prefix filter (`prod/api`). */
+  readonly prefix?: string;
+  /** Maximum entries to return. */
+  readonly limit?: number;
+  /** Include soft-deleted paths. */
+  readonly includeDeleted?: boolean;
+  /** Caller identity recorded in the audit chain. */
+  readonly actor?: VaultActor;
+}
+
+/** Operational state of a Vault backend. */
+export interface VaultStatus {
+  /** Whether the master key is currently unavailable in memory. */
+  readonly sealed: boolean;
+  /** Whether {@link VaultAdapter.initialize} has run. */
+  readonly initialized: boolean;
+  /** Whether a master-key record exists in the backend. */
+  readonly masterKeyPresent: boolean;
+  /** Current KEK generation new writes use. */
+  readonly kekVersion: number;
+  /** Number of live (non-deleted) paths. */
+  readonly secretCount: number;
+  /** Last transition into sealed state. */
+  readonly lastSealedAt?: Date;
+  /** Last transition out of sealed state. */
+  readonly lastUnsealedAt?: Date;
+  /** How many times the Vault has been sealed since initialization. */
+  readonly sealCount: number;
+  /** Resume cursor for an in-flight KEK rewrap. */
+  readonly rewrapCheckpoint?: string;
+  /** KEK generation an in-flight rewrap is migrating toward. */
+  readonly rewrapTargetKekVersion?: number;
+}
+
+/** Result of a one-time {@link VaultAdapter.initialize}. */
+export interface VaultInitResult {
+  /**
+   * Base64 master key — returned exactly once, never persisted in cleartext.
+   * The operator is responsible for storing it out of band.
+   */
+  readonly masterKey: string;
+  /** Verification hash persisted so later unseals can reject a wrong key. */
+  readonly verifyHash: string;
+  /** KEK generation the Vault starts at. */
+  readonly kekVersion: number;
+}
+
+/**
+ * Backend-agnostic Vault surface.
+ *
+ * `seal` / `unseal` / `initialize` are optional: pass-through backends
+ * (managed KMS, remote providers) own their own key lifecycle.
+ */
+export interface VaultAdapter {
+  /** Backend id (`sql`, `memory`, `vault`, …). */
+  readonly id: string;
+  /**
+   * Read the latest (or pinned) version of a path.
+   *
+   * @param path - Canonical path
+   * @param options - Version pin / expiry policy / actor
+   */
+  get(path: string, options?: VaultGetOptions): Promise<VaultSecret | undefined>;
+  /**
+   * Write a new version of a path (creates it when absent).
+   *
+   * @param path - Canonical path
+   * @param value - Cleartext value
+   * @param options - Metadata / expiry / actor
+   */
+  set(path: string, value: string, options?: VaultSetOptions): Promise<VaultSecret>;
+  /**
+   * Crypto-shred a path. Returns whether anything was removed.
+   *
+   * @param path - Canonical path
+   * @param options - Actor
+   */
+  delete(path: string, options?: { readonly actor?: VaultActor }): Promise<boolean>;
+  /**
+   * Write a new version with a fresh DEK, retiring the previous one.
+   *
+   * @param path - Canonical path
+   * @param value - New cleartext value
+   * @param options - Metadata / expiry / actor
+   */
+  rotate(path: string, value: string, options?: VaultSetOptions): Promise<VaultSecret>;
+  /**
+   * Enumerate paths (never values).
+   *
+   * @param options - Prefix / limit / actor
+   */
+  list(options?: VaultListOptions): Promise<readonly VaultListEntry[]>;
+  /** Operational state for Console and health checks. */
+  status(): Promise<VaultStatus>;
+  /** Drop the in-memory master key; subsequent reads fail with `SEALED`. */
+  seal?(): Promise<void>;
+  /**
+   * Restore the in-memory master key.
+   *
+   * @param masterKey - Base64 or raw 32-byte master key
+   */
+  unseal?(masterKey: string | Uint8Array): Promise<void>;
+  /** Generate the master key and persist backend state exactly once. */
+  initialize?(): Promise<VaultInitResult>;
+}
+
+/** Where the master key comes from at boot. */
+export type MasterKeySource =
+  | {
+      /** Read a base64 master key from an environment variable. */
+      readonly kind: "env";
+      /** Variable name (e.g. `OKE_VAULT_MASTER_KEY`). */
+      readonly name: string;
+    }
+  | {
+      /** Read a raw 32-byte or base64 master key from disk. */
+      readonly kind: "file";
+      /** Absolute or project-relative file path. */
+      readonly path: string;
+    }
+  | {
+      /** Unwrap the master key through an external KMS. */
+      readonly kind: "kms";
+      /** Provider-specific key identifier. */
+      readonly keyId: string;
+      /** Provider id (`aws`, `gcp`, …). */
+      readonly provider?: string;
+    }
+  | {
+      /** Hold the master key in process memory only (tests / dev). */
+      readonly kind: "memory";
+    };
+
+/** Encryption block of {@link VaultElementConfig}. */
+export interface VaultEncryptionConfig {
+  /** Content-encryption algorithm. Defaults to `aes-256-gcm`. */
+  readonly algorithm?: VaultAlgorithm;
+  /** Master-key provider. Defaults to `{ kind: "env", name: "OKE_VAULT_MASTER_KEY" }`. */
+  readonly masterKey?: MasterKeySource;
+  /** KEK generation new writes use. Defaults to `1`. */
+  readonly kekVersion?: number;
+  /**
+   * Rows re-wrapped per transaction during a KEK rotation. Bounded so a
+   * rewrap never holds a long transaction open. Defaults to `100`.
+   */
+  readonly kekRewrapBatchSize?: number;
+}
+
+/** Where audit rows are written. */
+export type VaultAuditSinkKind = "db" | "stdout" | "webhook";
+
+/** Audit block of {@link VaultElementConfig}. */
+export interface VaultAuditConfig {
+  /** Whether auditing is on. Defaults to `true`. */
+  readonly enabled?: boolean;
+  /** Sink kind. Defaults to `db`. */
+  readonly sink?: VaultAuditSinkKind;
+  /** Destination for the `webhook` sink. */
+  readonly webhookUrl?: string;
+  /** Days of audit history to keep; older rows are purgeable. */
+  readonly retainDays?: number;
+  /** Whether each row links to its predecessor by hash. Defaults to `true`. */
+  readonly hashChain?: boolean;
+}
+
+/** Seal block of {@link VaultElementConfig}. */
+export interface VaultSealConfig {
+  /** Auto-seal after this many idle milliseconds. `0` disables. */
+  readonly autoSealAfterMs?: number;
+  /** Start sealed and require an explicit unseal. Defaults to `false`. */
+  readonly sealOnBoot?: boolean;
+  /** Reject reads while sealed rather than lazily unsealing. Defaults to `true`. */
+  readonly requireUnsealForRead?: boolean;
+}
+
+/** Managed (hosted) backend block of {@link VaultElementConfig}. */
+export interface VaultManagedConfig {
+  /** Whether the managed backend is used instead of local SQL. */
+  readonly enabled?: boolean;
+  /** Managed service endpoint. */
+  readonly endpoint?: string;
+  /** Tenant / namespace within the managed service. */
+  readonly namespace?: string;
+}
+
+/** Manifest-facing `vault` element configuration. */
+export interface VaultElementConfig {
+  /** Algorithm + master-key + KEK settings. */
+  readonly encryption?: VaultEncryptionConfig;
+  /** Audit sink + retention settings. */
+  readonly audit?: VaultAuditConfig;
+  /** Seal lifecycle settings. */
+  readonly seal?: VaultSealConfig;
+  /** Managed backend settings. */
+  readonly managed?: VaultManagedConfig;
+}
+
+/** Failure detail surfaced to Console without leaking material. */
+export interface VaultFailure {
+  /** Machine-readable reason. */
+  readonly code: VaultErrorCode;
+  /** Safe, secret-free description. */
+  readonly message: string;
+}

package/src/elements/vault/unseal.ts

@@ -0,0 +1,150 @@
+/**
+ * Unsealers — the only objects allowed to hold master-key material.
+ *
+ * A master key lives in a closure, never on an exported object and never
+ * on `globalThis`. {@link Unsealer.seal} overwrites the buffer and flips
+ * the instance permanently sealed; every later derivation fails with
+ * `SEALED`. Restoring service after a seal requires a fresh unsealer built
+ * from the key source again.
+ */
+
+import {
+  deriveBackupKek,
+  deriveKek,
+  deriveVerifyHash,
+  MASTER_KEY_BYTES,
+  masterKeyFromBase64,
+  zeroBytes,
+} from "./crypto.ts";
+import { VaultError } from "./errors.ts";
+
+/** Holder of master-key material with a one-way seal. */
+export interface Unsealer {
+  /** Whether the master key has been zeroed. */
+  readonly sealed: boolean;
+  /** Derive the key-encryption key that wraps per-secret DEKs. */
+  unwrapKek(): Promise<CryptoKey>;
+  /** Derive the backup key-encryption key used for export bundles. */
+  unwrapBackupKek(): Promise<CryptoKey>;
+  /** Derive the persisted verification hash for this master key. */
+  verifyHash(): Promise<string>;
+  /** Zero the master key. Idempotent and irreversible for this instance. */
+  seal(): void;
+}
+
+/**
+ * Build an unsealer over a copy of `key`.
+ *
+ * The caller's buffer is copied, so the caller remains responsible for
+ * zeroing its own copy.
+ *
+ * @param key - Raw 32-byte master key
+ * @throws VaultError `INVALID_KEY` when the key is not 32 bytes
+ */
+function createUnsealer(key: Uint8Array): Unsealer {
+  if (key.byteLength !== MASTER_KEY_BYTES) {
+    throw new VaultError("INVALID_KEY", `vault: master key must be ${MASTER_KEY_BYTES} bytes`);
+  }
+  let sealed = false;
+  const material = new Uint8Array(MASTER_KEY_BYTES);
+  material.set(key);
+
+  /** Master key or `SEALED`. */
+  function requireKey(): Uint8Array {
+    if (sealed) {
+      throw new VaultError("SEALED", "vault: sealed — master key is not available");
+    }
+    return material;
+  }
+
+  return {
+    get sealed() {
+      return sealed;
+    },
+    async unwrapKek() {
+      return deriveKek(requireKey());
+    },
+    async unwrapBackupKek() {
+      return deriveBackupKek(requireKey());
+    },
+    async verifyHash() {
+      return deriveVerifyHash(requireKey());
+    },
+    seal() {
+      sealed = true;
+      zeroBytes(material);
+    },
+  };
+}
+
+/**
+ * Unsealer from a raw key already in memory (tests, `memory` key source).
+ *
+ * @param key - Raw 32-byte master key
+ */
+export function createMemoryUnsealer(key: Uint8Array): Unsealer {
+  return createUnsealer(key);
+}
+
+/**
+ * Unsealer from an environment-supplied key.
+ *
+ * @param key - Raw 32-byte master key decoded from the environment
+ */
+export function createEnvUnsealer(key: Uint8Array): Unsealer {
+  return createUnsealer(key);
+}
+
+/**
+ * Unsealer from a base64 master key (environment variables, CLI flags).
+ *
+ * @param encoded - Base64 master key
+ */
+export function createUnsealerFromBase64(encoded: string): Unsealer {
+  const key = masterKeyFromBase64(encoded);
+  try {
+    return createUnsealer(key);
+  } finally {
+    zeroBytes(key);
+  }
+}
+
+/**
+ * Unsealer from a key file.
+ *
+ * The file holds either exactly 32 raw bytes or base64 text (with optional
+ * surrounding whitespace).
+ *
+ * @param path - Key file path
+ * @throws VaultError `NOT_INITIALIZED` when the file is missing or unreadable
+ * @throws VaultError `INVALID_KEY` when the contents are not a 32-byte key
+ */
+export async function createFileUnsealer(path: string): Promise<Unsealer> {
+  let raw: Uint8Array;
+  try {
+    raw = new Uint8Array(await Bun.file(path).arrayBuffer());
+  } catch {
+    // Never surface the filesystem error: its message may echo the path chain.
+    throw new VaultError("NOT_INITIALIZED", "vault: master key file is missing or unreadable");
+  }
+
+  if (raw.byteLength === MASTER_KEY_BYTES) {
+    try {
+      return createUnsealer(raw);
+    } finally {
+      zeroBytes(raw);
+    }
+  }
+
+  const text = new TextDecoder().decode(raw).trim();
+  zeroBytes(raw);
+  if (text.length === 0) {
+    throw new VaultError("INVALID_KEY", "vault: master key file is empty");
+  }
+  const decoded = masterKeyFromBase64(text);
+  try {
+    return createUnsealer(decoded);
+  } finally {
+    zeroBytes(decoded);
+  }
+}

package/src/elements/vault.test.ts

@@ -6,13 +6,15 @@
  * - resolution chain (first hit wins)
  */
 
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 import { envVaultDriver, memoryVaultDriver } from "../drivers/index.ts";
 import { createFx } from "../kernel/fx.ts";
 import { REDACTED_PLACEHOLDER, Redacted } from "../kernel/redacted.ts";
 import {
   createVaultRuntime,
   fingerprintSecretSync,
+  listRequiredEnvNames,
+  resetRequiredEnvNames,
   SECRET_MASK,
   vault,
   VaultBootError,
@@ -189,6 +191,72 @@ describe("resolution chain", () => {
   });
 });
 
+describe("vault.env", () => {
+  const NAME = "OKE_TEST_VAULT_ENV";
+
+  afterEach(() => {
+    delete process.env[NAME];
+    resetRequiredEnvNames();
+  });
+
+  test("reads, coerces, and treats an empty value as unset", () => {
+    expect(vault.env(NAME)).toBeUndefined();
+    process.env[NAME] = "";
+    expect(vault.env(NAME)).toBeUndefined();
+
+    process.env[NAME] = "42";
+    expect(vault.env(NAME)).toBe("42");
+    expect(vault.env.int(NAME)).toBe(42);
+
+    process.env[NAME] = "YES";
+    expect(vault.env.bool(NAME)).toBe(true);
+    process.env[NAME] = "off";
+    expect(vault.env.bool(NAME)).toBe(false);
+
+    process.env[NAME] = '{"a":1}';
+    expect(vault.env.json<{ a: number }>(NAME)).toEqual({ a: 1 });
+
+    delete process.env[NAME];
+    expect(vault.env.int(NAME, 7)).toBe(7);
+    expect(vault.env.bool(NAME, true)).toBe(true);
+    expect(vault.env.json(NAME)).toBeUndefined();
+  });
+
+  test("malformed values and missing defaults throw TypeError", () => {
+    process.env[NAME] = "not-a-number";
+    expect(() => vault.env.int(NAME)).toThrow(TypeError);
+    process.env[NAME] = "maybe";
+    expect(() => vault.env.bool(NAME)).toThrow(TypeError);
+    process.env[NAME] = "{";
+    expect(() => vault.env.json(NAME)).toThrow(TypeError);
+    delete process.env[NAME];
+    expect(() => vault.env.int(NAME)).toThrow(TypeError);
+  });
+
+  test("required registers the name and throws when unset", () => {
+    expect(() => vault.env.required(NAME)).toThrow(TypeError);
+    expect(listRequiredEnvNames()).toContain(NAME);
+
+    process.env[NAME] = "present";
+    expect(vault.env.required(NAME)).toBe("present");
+    expect(listRequiredEnvNames().filter((n) => n === NAME)).toHaveLength(1);
+  });
+
+  test("a missing required env var joins the secret gaps in one boot failure", async () => {
+    const runtime = createVaultRuntime({
+      secrets: [vault("STRIPE_KEY")],
+      requiredEnv: [NAME],
+      chain: [{ driver: memoryVaultDriver, options: { secrets: {} } }],
+    });
+    const error = await runtime.boot().then(
+      () => undefined,
+      (e: unknown) => e as VaultBootError,
+    );
+    expect(error).toBeInstanceOf(VaultBootError);
+    expect(error?.gaps.map((g) => g.name).sort()).toEqual([NAME, "STRIPE_KEY"]);
+  });
+});
+
 describe("redaction + fingerprints", () => {
   test("secret value never appears in fx.log even when passed explicitly", async () => {
     const secret = "sk_live_super_secret_value_do_not_leak";
@@ -201,7 +269,7 @@ describe("redaction + fingerprints", () => {
     const lines: Array<{ message: string; data?: Record<string, unknown> }> = [];
     const { fx } = createFxContextWithVault(runtime, lines);
 
-    const wrapped = fx.vault("STRIPE_KEY");
+    const wrapped = await fx.vault.get("STRIPE_KEY");
     expect(wrapped.reveal()).toBe(secret);
 
     fx.log.info(`charging with ${wrapped}`, { key: wrapped, nested: { k: wrapped } });
@@ -216,7 +284,7 @@ describe("redaction + fingerprints", () => {
     expect(lines[1]!.message).toContain(SECRET_MASK);
   });
 
-  test("Redacted from fx.vault is masked in fx.log without a vault runtime", () => {
+  test("Redacted from fx.vault is masked in fx.log without a vault runtime", async () => {
     const secret = "sk_no_vault_runtime";
     const lines: Array<{ message: string; data?: Record<string, unknown> }> = [];
     const fx = createFx({
@@ -225,7 +293,7 @@ describe("redaction + fingerprints", () => {
       onLog: (_level, message, data) => lines.push({ message, data }),
     });
 
-    const wrapped = fx.vault("STRIPE_KEY");
+    const wrapped = await fx.vault.get("STRIPE_KEY");
     expect(wrapped).toBeInstanceOf(Redacted);
     expect(String(wrapped)).toBe(REDACTED_PLACEHOLDER);
     expect(`${wrapped}`).toBe(REDACTED_PLACEHOLDER);

package/src/elements/vault.ts

@@ -2,7 +2,7 @@
  * Vault element — protected knowledge.
  *
  * Physics: secrets · config · environment.
- * Drivers: `env` · `openbao` · `managed`.
+ * Drivers: `env` · `vault` · `managed` · `memory`.
  *
  * A declaration is a contract, never a value. Boot validates every contract
  * and lists all gaps at once. Logs/traces receive fingerprints and redaction
@@ -12,17 +12,22 @@
 
 export {
   vault,
+  vaultEnvApi,
   fromDocker,
   FROM_DOCKER_PREFIX,
   isFromDocker,
   fromDockerRole,
+  listRequiredEnvNames,
+  readEnv,
+  resetRequiredEnvNames,
 } from "./vault/declare.ts";
-export type { VaultSecretDecl, VaultSecretOptions } from "./vault/declare.ts";
+export type { VaultEnvApi, VaultSecretDecl, VaultSecretOptions } from "./vault/declare.ts";
 
 export {
   createVaultRuntime,
   VaultBootError,
   SECRET_MASK,
+  requiredEnvGaps,
   resolveLayerSource,
 } from "./vault/runtime.ts";
 export type {
@@ -36,6 +41,90 @@ export type {
 
 export { COMPOSE_ENV_REL, resolveComposeEnvPath } from "./vault/chain.ts";
 
+export { VaultError, isVaultError } from "./vault/errors.ts";
+export type { VaultErrorCode } from "./vault/errors.ts";
+
+export { canonicalizePath, MAX_VAULT_PATH_LENGTH } from "./vault/path.ts";
+export type {
+  MasterKeySource,
+  VaultActor,
+  VaultActorType,
+  VaultAdapter,
+  VaultAlgorithm,
+  VaultAuditConfig,
+  VaultAuditSinkKind,
+  VaultElementConfig,
+  VaultEncryptionConfig,
+  VaultGetOptions,
+  VaultInitResult,
+  VaultListEntry,
+  VaultListOptions,
+  VaultManagedConfig,
+  VaultSealConfig,
+  VaultSecret,
+  VaultSetOptions,
+  VaultStatus,
+} from "./vault/types.ts";
+
+export {
+  BACKUP_MAGIC,
+  createBuiltinVaultAdapter,
+  DEFAULT_KEK_REWRAP_BATCH_SIZE,
+  sqlConnectionAsExec,
+} from "./vault/builtin-adapter.ts";
+export type {
+  BuiltinVaultAdapter,
+  CreateBuiltinVaultOptions,
+  VaultRotateMasterResult,
+} from "./vault/builtin-adapter.ts";
+
+export {
+  createAuditSink,
+  createNullAuditSink,
+  computeAuditRowHash,
+  AUDIT_GENESIS_HASH,
+} from "./vault/audit.ts";
+export type { AuditAction, AuditEntry, AuditSink, AuditWriter } from "./vault/audit.ts";
+
+export {
+  createSqlAuditWriter,
+  ensureVaultTables,
+  purgeAuditBefore,
+  purgeExpiredSecrets,
+  readAuditPage,
+  verifyAuditChain,
+  VAULT_DDL_STATEMENTS,
+} from "./vault/storage.ts";
+export type {
+  AuditChainResult,
+  AuditPageOptions,
+  PurgeExpiredResult,
+  SqlExec,
+  VaultAuditRecord,
+} from "./vault/storage.ts";
+
+export {
+  createResilientSqlExec,
+  DEFAULT_RETRY,
+  isRetryableError,
+  withResilience,
+} from "./vault/resilience.ts";
+export type { RetryConfig } from "./vault/resilience.ts";
+
+export {
+  createEnvUnsealer,
+  createFileUnsealer,
+  createMemoryUnsealer,
+  createUnsealerFromBase64,
+} from "./vault/unseal.ts";
+export type { Unsealer } from "./vault/unseal.ts";
+
+export { createAwsKmsUnsealer, wrapMasterWithAwsKms } from "./vault/kms-unseal.ts";
+export type {
+  CreateAwsKmsUnsealerOptions,
+  WrapMasterWithAwsKmsOptions,
+} from "./vault/kms-unseal.ts";
+
 export { fingerprintSecret, fingerprintSecretSync } from "./vault/fingerprint.ts";
 
 export { createSecretRedactor } from "./vault/redact.ts";