@frontiercompute/shieldedvault-zodl

ShieldedVault adapters for ZODL wallets, mobile clients, and finalizer operators.

This package moves sensitive app credentials out of device keychains and into shielded-note custody with an audit trail. The default build is local-staging friendly: encrypted notes live in an in-memory store, every mutation can emit a ZAP1-style leaf, and threshold signing can be attached through an injected Ika-compatible signer when you are ready.

No partnership or endorsement is implied. This package is an integration layer for teams building on the ZODL ecosystem.

60-second start

npm install @frontiercompute/shieldedvault-zodl

import { ShieldedVault } from "@frontiercompute/shieldedvault-zodl";

const vault = new ShieldedVault({
  defaultViewingKey: process.env.ZODL_VIEWING_KEY!,
  dashboardBaseUrl: process.env.ZAP1_DASHBOARD_BASE_URL,
});

const receipt = await vault.store("jwt:flexa-api", {
  token: process.env.LEGACY_BEARER!,
  audience: "https://api.example.invalid",
  expiresAt: "2026-05-01T00:00:00.000Z",
});

const current = await vault.retrieve("jwt:flexa-api");
const audit = await vault.audit_trail("jwt:flexa-api");

console.log(receipt.commitment, receipt.leaf);
console.log(current);
console.log(audit.map((entry) => entry.dashboardUrl ?? entry.leaf));

What it ships

• ShieldedVault: encrypted note storage, retrieval, rotation, optional threshold signing, and audit history.
• ZashiKeychain: get / set / delete replacement with a shielded backend.
• FinalizerBondVault: stores bond private keys and emits per-transaction attestations.
• FlexaSessionVault: binds sessions to a single account and rejects cross-account replay.
• JwtVault: replaces hardcoded long-lived bearer tokens with rotatable note-backed secrets.

API sketch

const vault = new ShieldedVault(options);

await vault.store(keyId, payload, { viewingKey, metadata });
await vault.retrieve(keyId, viewingKey);
await vault.rotate(keyId, nextPayload, { viewingKey });
await vault.threshold_sign(message, keyId);
await vault.audit_trail(keyId);

Examples

• replace-jwt-bearer.ts
• finalizer-bond-custody.ts
• zodl-integration.md

Local verification

npm install
npm run build
npm test
npm publish --dry-run