Secure vaulting behaviour and utilities for the SIGIL protocol.

Provides an interface for encrypting, decrypting, and managing sensitive values (API keys, tokens, credentials) that should never appear in logs or tool call parameters.

Behaviour

Implement SigilGuard.Vault to provide a custom storage backend:

defmodule MyApp.KmsVault do
  @behaviour SigilGuard.Vault

  @impl true
  def encrypt(plaintext, description) do
    # Encrypt via AWS KMS / GCP KMS / HashiCorp Vault
    {:ok, vault_id}
  end

  @impl true
  def decrypt(vault_id) do
    {:ok, plaintext}
  end

  @impl true
  def exists?(vault_id) do
    true
  end
end

Built-in Backend

SigilGuard.Vault.InMemory provides an ETS-backed implementation using AES-256-GCM encryption. Suitable for development and testing.