Secrets & Security

Vault access, secret generation, hashing and encryption. Each function lists its parameters, defaults and return value.

Vault Namespace

Vault secret management functions using the service’s pre-initialized vault client.

Scope: Network

Note: The vault namespace is NOT included in the default namespace set. Enable it explicitly via namespaces: "http,vault" or namespaces: "all" in your script task config.

How It Works

Unlike the vault task (which requires full TLS/infrastructure parameters to create its own vault client), the vault namespace uses the vault client already initialized during service boot. Scripts just provide secret names — no need for datacenter, cluster, certificate, or URL parameters.

The vault client is resolved from the service container at call time. If the service was not initialized with a vault client (e.g., running locally without vault), the functions return {success: false, error: "vault client not available"}.

Functions

Function	Description
vault.get()	Retrieve a secret by name
vault.save()	Save a secret to vault
vault.exists()	Check if a secret exists
vault.delete()	Delete a secret
vault.serviceJwt()	Get a service JWT token for internal service auth

vault.get()

Retrieve a secret value from vault by name.

Parameters

Accepts either a string or a map:

Input	Type	Description
(string)	string	Secret name (shorthand: vault.get("name"))
name	string	Secret name (map form: vault.get({name: "name"}))

Returns

Field	Type	Description
success	bool	Whether the operation succeeded
value	string	The secret value
error	string	Error message if failed

Examples

// String shorthand
var result = vault.get("database-password");
if (result.success) {
  log("Password: " + result.value.substring(0, 3) + "***");
}

// Map form
var result = vault.get({name: "stripe-api-key"});
log("API key retrieved: " + result.success);

// Error handling
var result = vault.get("nonexistent-key");
if (!result.success) {
  log("Error: " + result.error);
}

vault.save()

Save a secret to vault.

Parameters

Parameter	Type	Required	Default	Description
name	string	Yes	-	Secret name
value	string	Yes	-	Secret value
startdate	string	No	""	Validity start date
enddate	string	No	""	Validity end date
indefinite	bool	No	false	If true, secret has no expiry

Returns

Field	Type	Description
success	bool	Whether the operation succeeded
error	string	Error message if failed

Examples

// Save a simple secret
var result = vault.save({
  name: "api-key",
  value: "sk_live_abc123def456"
});

// Save with date range
vault.save({
  name: "temp-token",
  value: "tok-xyz",
  startdate: "2026-01-01",
  enddate: "2026-12-31"
});

// Save with no expiry
vault.save({
  name: "master-key",
  value: "mk-permanent",
  indefinite: true
});

// Generate and save
var newKey = "sk_" + id.generate({pattern: "hex", length: 32}).id;
vault.save({name: "generated-key", value: newKey, indefinite: true});

vault.exists()

Check if a secret exists in vault.

Parameters

Accepts either a string or a map:

Input	Type	Description
(string)	string	Secret name (shorthand: vault.exists("name"))
name	string	Secret name (map form: vault.exists({name: "name"}))

Returns

Field	Type	Description
success	bool	Whether the operation succeeded
exists	bool	Whether the secret exists
error	string	Error message if failed

Examples

// Check before reading
var check = vault.exists("database-password");
if (check.success && check.exists) {
  var secret = vault.get("database-password");
  // use secret.value
} else {
  log("Secret not found, creating default...");
  vault.save({name: "database-password", value: "default-pass", indefinite: true});
}

// Map form
var check = vault.exists({name: "api-key"});
log("Exists: " + check.exists);

vault.delete()

Delete a secret from vault.

Parameters

Accepts either a string or a map:

Input	Type	Description
(string)	string	Secret name (shorthand: vault.delete("name"))
name	string	Secret name (map form: vault.delete({name: "name"}))

Returns

Field	Type	Description
success	bool	Whether the operation succeeded
deleted	bool	Whether the secret was deleted
error	string	Error message if failed

Examples

// Delete by name
var result = vault.delete("old-api-key");
log("Deleted: " + result.deleted);

// Rotate: delete old, save new
vault.delete("service-token");
vault.save({
  name: "service-token",
  value: "new-token-value",
  indefinite: true
});

vault.serviceJwt()

Obtain a service JWT token from vault for authenticating with other internal services. The JWT is signed by the vault and can be used as a Bearer token in Authorization headers.

Parameters

Accepts zero arguments, a string, or a map:

Input	Type	Description
(none)	—	Uses the current service name (auto-detected)
(string)	string	Service name to authenticate as
service	string	Service name (map form)

Returns

Field	Type	Description
success	bool	Whether the operation succeeded
token	string	The JWT token string
error	string	Error message if failed

Examples

// Get JWT for the current service (auto-detected name)
var auth = vault.serviceJwt();
if (auth.success) {
  // Use token in HTTP requests to internal services
  var resp = http.get({
    url: "https://internal-api.example.com/data",
    headers: {"Authorization": auth.token}
  });
}

// Get JWT for a specific service name
var auth = vault.serviceJwt("jobs");

// Map form
var auth = vault.serviceJwt({service: "vulcan"});

Full Workflow Example

name: secret-rotation
tasks:
  - name: rotate-secrets
    script:
      language: javascript
      namespaces: http,vault,id
      code: |
        // Check if current key exists
        var existing = vault.exists("service-api-key");

        if (existing.exists) {
          // Back up old key
          var old = vault.get("service-api-key");
          vault.save({
            name: "service-api-key-backup",
            value: old.value,
            startdate: "2026-01-01",
            enddate: "2026-03-01"
          });
        }

        // Generate and store new key
        var newKey = "sk_" + id.generate({pattern: "hex", length: 32}).id;
        vault.save({name: "service-api-key", value: newKey, indefinite: true});

        // Verify
        var verify = vault.get("service-api-key");
        if (verify.value !== newKey) {
          throw new Error("Key rotation verification failed");
        }
      setvar: rotation_result

Vault Task vs Vault Namespace

Feature	vault task	vault namespace
Vault client	Creates new per-execution	Uses service’s pre-initialized client
Parameters	Full (URL, cert, DC, cluster, …)	Just secret name/value
Use case	Cross-cluster or custom vault access	Same-service secret operations
Config needed	All infrastructure params in YAML	namespaces: "vault" in script task
Available in	Any workflow task	Script tasks only
JWT auth	Not available	vault.serviceJwt() for internal service calls

Secret Namespace

Secret generation and encoding functions.

Scope: System

Functions

Function	Description
secret.generate()	Generate random secrets and passwords
secret.encode()	Encode data using various encoding schemes
secret.decode()	Decode encoded data
secret.hash()	Hash a secret value using bcrypt
secret.validate()	Validate password strength

secret.generate()

Generate random secrets and passwords with configurable patterns and character sets.

Parameters

Parameter	Type	Default	Description
pattern	string	"alphanumeric"	Secret pattern (see table below)
length	int	32	Secret length
prefix	string	—	Prefix to add to generated secret
uppercase	bool	false	Include uppercase letters
lowercase	bool	false	Include lowercase letters
digits	bool	false	Include digits
special	bool	false	Include special characters
charset	string	—	Custom character set
hash	bool	false	Also return hash of the secret
separator	string	"-"	Separator for passphrase pattern
words	int	—	Number of words for passphrase pattern

Patterns

Pattern	Description
alphanumeric	Letters and digits
hex	Hexadecimal characters
base64	Base64 characters
passphrase	Word-based passphrase
numeric	Digits only
alpha	Letters only
special	Special characters only
url	URL-safe characters
custom	Custom character set (use charset)
apikey	API key format

Returns

Field	Type	Description
success	bool	Whether generation succeeded
secret	string	Generated secret
hash	string	Hash of the secret (if hash: true)

Examples

// Generate alphanumeric secret (default)
let result = secret.generate({})
log("Secret: " + result.secret)

// Generate hex secret
let result = secret.generate({
  pattern: "hex",
  length: 64
})
log("Hex: " + result.secret)

// Generate API key with prefix
let result = secret.generate({
  pattern: "apikey",
  prefix: "sk_live_"
})
log("API Key: " + result.secret)

// Generate passphrase
let result = secret.generate({
  pattern: "passphrase",
  words: 4,
  separator: "-"
})
log("Passphrase: " + result.secret)

// Generate with hash
let result = secret.generate({
  pattern: "alphanumeric",
  length: 16,
  hash: true
})
log("Secret: " + result.secret)
log("Hash: " + result.hash)

// Custom character set
let result = secret.generate({
  charset: "ABCDEF0123456789",
  length: 8
})
log("Custom: " + result.secret)

secret.encode()

Encode data using various encoding schemes.

Parameters

Parameter	Type	Default	Description
data	string	—	String data to encode (required)
encoding	string	"base64"	Encoding scheme: "base64", "base32", "hex"

Returns

Field	Type	Description
success	bool	Whether encoding succeeded
encoded	string	Encoded string

Examples

// Base64 encode
let result = secret.encode({
  data: "Hello, World!",
  encoding: "base64"
})
log("Base64: " + result.encoded)

// Hex encode
let result = secret.encode({
  data: "secret data",
  encoding: "hex"
})
log("Hex: " + result.encoded)

secret.decode()

Decode encoded data.

Parameters

Parameter	Type	Default	Description
data	string	—	Encoded string to decode (required)
encoding	string	"base64"	Encoding scheme: "base64", "base32", "hex"

Returns

Field	Type	Description
success	bool	Whether decoding succeeded
decoded	string	Decoded string

Examples

// Base64 decode
let result = secret.decode({
  data: "SGVsbG8sIFdvcmxkIQ==",
  encoding: "base64"
})
log("Decoded: " + result.decoded)

// Hex decode
let result = secret.decode({
  data: "48656c6c6f",
  encoding: "hex"
})
log("Decoded: " + result.decoded)

secret.hash()

Hash a secret value using bcrypt for secure password storage.

Parameters

Parameter	Type	Default	Description
value	string	—	Secret value to hash (required)

Returns

Field	Type	Description
success	bool	Whether hashing succeeded
hash	string	Bcrypt hash

Examples

// Hash a password
let result = secret.hash({ value: "my-password-123" })
log("Bcrypt hash: " + result.hash)

// Store hash in database
let hashed = secret.hash({ value: userPassword })
db.exec({
  connectionId: conn.connectionId,
  sql: "UPDATE users SET password_hash = $1 WHERE id = $2",
  args: [hashed.hash, userId]
})

secret.validate()

Validate a secret against password strength requirements.

Parameters

Parameter	Type	Default	Description
value	string	—	Secret value to validate (required)

Returns

Field	Type	Description
success	bool	true if the password meets strength requirements
error	string	Validation error message if requirements not met

Examples

// Validate password strength
let result = secret.validate({ value: "weak" })
if (!result.success) {
  log("Password too weak: " + result.error)
}

// Validate a strong password
let result = secret.validate({ value: "C0mpl3x!P@ssw0rd" })
if (result.success) {
  log("Password meets requirements")
}

Crypt Namespace

Encryption and decryption functions.

Scope: System

Functions

Function	Description
crypt.encryptFile()	Encrypt a file using AES encryption
crypt.decryptFile()	Decrypt a file using AES decryption
crypt.encrypt()	Encrypt data in memory
crypt.decrypt()	Decrypt data in memory

Supported Algorithms

Algorithm	Description
aes-256-gcm	AES-256 in GCM mode (default, authenticated encryption)
aes-256-cbc	AES-256 in CBC mode
aes-128-gcm	AES-128 in GCM mode

crypt.encryptFile()

Encrypt a file using AES encryption with PBKDF2 key derivation.

Parameters

Parameter	Type	Default	Description
secret	string	—	Encryption key/passphrase (required)
source	string	—	Source file path (required)
destination	string	—	Destination file path (required)
algorithm	string	"aes-256-gcm"	Encryption algorithm
overwrite	bool	false	Overwrite existing destination file
iterations	int	100000	PBKDF2 iterations for key derivation

Returns

Field	Type	Description
success	bool	Whether encryption succeeded
destination	string	Output file path

Examples

// Encrypt a file
crypt.encryptFile({
  secret: "my-encryption-key",
  source: "/data/sensitive.json",
  destination: "/data/sensitive.json.enc"
})

// Encrypt with specific algorithm
crypt.encryptFile({
  secret: "my-key",
  source: "/data/backup.tar.gz",
  destination: "/data/backup.tar.gz.enc",
  algorithm: "aes-256-cbc",
  overwrite: true
})

crypt.decryptFile()

Decrypt a file using AES decryption.

Parameters

Parameter	Type	Default	Description
secret	string	—	Decryption key/passphrase (required)
source	string	—	Source file path (required)
destination	string	—	Destination file path (required)
algorithm	string	"aes-256-gcm"	Decryption algorithm
overwrite	bool	false	Overwrite existing destination file
iterations	int	100000	PBKDF2 iterations for key derivation

Returns

Field	Type	Description
success	bool	Whether decryption succeeded
destination	string	Output file path

Examples

// Decrypt a file
crypt.decryptFile({
  secret: "my-encryption-key",
  source: "/data/sensitive.json.enc",
  destination: "/data/sensitive.json"
})

// Decrypt with overwrite
crypt.decryptFile({
  secret: "my-key",
  source: "/data/backup.tar.gz.enc",
  destination: "/data/backup.tar.gz",
  overwrite: true
})

crypt.encrypt()

Encrypt data in memory using AES encryption. Returns encrypted data as a base64-encoded string.

Parameters

Parameter	Type	Default	Description
secret	string	—	Encryption key/passphrase (required)
data	string	—	String data to encrypt (required)
algorithm	string	"aes-256-gcm"	Encryption algorithm
iterations	int	100000	PBKDF2 iterations

Returns

Field	Type	Description
success	bool	Whether encryption succeeded
encrypted	string	Base64-encoded encrypted data

Examples

// Encrypt a string
let result = crypt.encrypt({
  secret: "my-key",
  data: "sensitive information"
})
log("Encrypted: " + result.encrypted)

// Store encrypted value
let encrypted = crypt.encrypt({
  secret: "app-secret",
  data: JSON.stringify({ apiKey: "sk-123", dbPass: "secret" })
})
file.write({
  path: "/config/secrets.enc",
  content: encrypted.encrypted
})

crypt.decrypt()

Decrypt data in memory. Accepts base64-encoded encrypted data.

Parameters

Parameter	Type	Default	Description
secret	string	—	Decryption key/passphrase (required)
data	string	—	Base64-encoded encrypted data (required)
algorithm	string	"aes-256-gcm"	Decryption algorithm
iterations	int	100000	PBKDF2 iterations

Returns

Field	Type	Description
success	bool	Whether decryption succeeded
decrypted	string	Decrypted string

Examples

// Decrypt a string
let result = crypt.decrypt({
  secret: "my-key",
  data: encryptedBase64String
})
log("Decrypted: " + result.decrypted)

// Round-trip encryption/decryption
let encrypted = crypt.encrypt({
  secret: "my-key",
  data: "hello world"
})

let decrypted = crypt.decrypt({
  secret: "my-key",
  data: encrypted.encrypted
})
log(decrypted.decrypted) // "hello world"

// Read and decrypt stored secrets
let encData = file.read({ path: "/config/secrets.enc" })
let secrets = crypt.decrypt({
  secret: "app-secret",
  data: encData.content
})
let config = JSON.parse(secrets.decrypted)
log("API Key: " + config.apiKey)

Hash Namespace

Cryptographic hashing functions.

Scope: System

Functions

Function	Description
hash.string()	Compute a hash of a string value
hash.file()	Compute a hash of a file
hash.bytes()	Compute a hash of byte data

Supported Algorithms

Algorithm	Description
sha256	SHA-256 (default)
sha512	SHA-512
sha1	SHA-1
md5	MD5
blake2b	BLAKE2b
xxhash	xxHash (fast, non-cryptographic)

hash.string()

Compute a hash of a string value.

Parameters

Parameter	Type	Default	Description
data	string	—	String data to hash (required)
algorithm	string	"sha256"	Hash algorithm
length	int	0	Truncate hash to specified length (0 = full hash)

Returns

Field	Type	Description
success	bool	Whether hashing succeeded
hash	string	Hex-encoded hash value
algorithm	string	Algorithm used

Examples

// SHA-256 hash (default)
let result = hash.string({ data: "hello world" })
log("SHA-256: " + result.hash)

// MD5 hash
let result = hash.string({
  data: "hello world",
  algorithm: "md5"
})
log("MD5: " + result.hash)

// Truncated hash
let result = hash.string({
  data: "hello world",
  algorithm: "sha256",
  length: 8
})
log("Short hash: " + result.hash)

// xxHash for fast non-crypto hashing
let result = hash.string({
  data: "large content here",
  algorithm: "xxhash"
})
log("xxHash: " + result.hash)

hash.file()

Compute a hash of a file.

Parameters

Parameter	Type	Default	Description
path	string	—	Path to file to hash (required)
algorithm	string	"sha256"	Hash algorithm
length	int	0	Truncate hash to specified length

Returns

Field	Type	Description
success	bool	Whether hashing succeeded
hash	string	Hex-encoded hash value
algorithm	string	Algorithm used

Examples

// Hash a file
let result = hash.file({ path: "/tmp/release.tar.gz" })
log("File SHA-256: " + result.hash)

// Verify file integrity
let expected = "abc123..."
let result = hash.file({
  path: "/tmp/download.bin",
  algorithm: "sha256"
})
if (result.hash === expected) {
  log("File integrity verified")
}

// Quick hash for comparison
let result = hash.file({
  path: "/data/large-file.bin",
  algorithm: "xxhash"
})
log("Fast hash: " + result.hash)

hash.bytes()

Compute a hash of byte data (passed as string).

Parameters

Parameter	Type	Default	Description
data	string	—	Byte data as string (required)
algorithm	string	"sha256"	Hash algorithm
length	int	0	Truncate hash to specified length

Returns

Field	Type	Description
success	bool	Whether hashing succeeded
hash	string	Hex-encoded hash value
algorithm	string	Algorithm used

Examples

// Hash byte data
let result = hash.bytes({
  data: "binary content",
  algorithm: "blake2b"
})
log("BLAKE2b: " + result.hash)

ID Namespace

Identifier generation functions.

Scope: System

Functions

Function	Description
id.generate()	Generate unique identifiers (ULID, UUID, NanoID, KSUID, XID)

id.generate()

Generate unique identifiers of various types.

Parameters

Parameter	Type	Default	Description
type	string	"ulid"	ID type: "ulid", "uuid", "nanoid", "ksuid", "xid"
count	int	1	Number of IDs to generate

ID Types

Type	Description	Example
ulid	Universally Unique Lexicographically Sortable Identifier	01ARZ3NDEKTSV4RRFFQ69G5FAV
uuid	UUID v4 (random)	550e8400-e29b-41d4-a716-446655440000
nanoid	Compact URL-safe identifier	V1StGXR8_Z5jdHi6B-myT
ksuid	K-Sortable Unique Identifier	1HCpXwx2EK9oYluGXoYAtlFNRpk
xid	Globally unique, sortable, compact	9m4e2mr0ui3e8a215n4g

Returns

Field	Type	Description
success	bool	Whether generation succeeded
id	string	Generated ID (when count is 1)
ids	array	Array of generated IDs

Examples

// Generate a ULID (default)
let result = id.generate({})
log("ID: " + result.id)

// Generate a UUID
let result = id.generate({ type: "uuid" })
log("UUID: " + result.id)

// Generate a NanoID
let result = id.generate({ type: "nanoid" })
log("NanoID: " + result.id)

// Generate multiple IDs
let result = id.generate({ type: "ulid", count: 5 })
for (let id of result.ids) {
  log("ID: " + id)
}

// Generate a KSUID
let result = id.generate({ type: "ksuid" })
log("KSUID: " + result.id)