Implement client-wrapped project key bundles

2026-05-06 07:21:40 -03:00
parent 0f981a4b07
commit eca69ba2cf
5 changed files with 1263 additions and 247 deletions
@@ -615,12 +615,12 @@ def handle_gateway(args):
        print("  nap gateway setup                     Create or unlock the encrypted gateway vault.")
        print("  nap gateway vault                     Show gateway vault status and pending setup requests.")
        print("  nap gateway vault process             Complete pending setup requests.")
-        print("  nap gateway vault rotate-secret --kind chat|tabs|gateway")
+        print("  nap gateway vault rotate-secret --kind chat|tabs|gateway|memory")
        return 0
    if subcommand in {"vault", "vault-setup", "vault_setup", "project-vault"} and rest and rest[0] in {"help", "-h", "--help"}:
-        print("Usage: nap gateway vault [status|list|process|rotate-secret] [--kind chat|tabs|gateway] [--all] [--project-id ID]")
+        print("Usage: nap gateway vault [status|list|process|rotate-secret] [--kind chat|tabs|gateway|memory] [--all] [--project-id ID]")
        print("  status        Show configured/locked state and pending setup requests.")
-        print("  process       Generate local secret material and send encrypted envelopes only.")
+        print("  process       Upload opaque client-wrapped key bundle records for backend-owned HashiCorp storage.")
        print("  rotate-secret Rotate one encrypted project secret.")
        print("  vault-setup   Deprecated alias for vault.")
        return 0