Skill: macterra/archon-vault (version 0.1.0)

--- name: archon-vault description: Encrypted distributed storage using Archon DID vaults. Manage vaults, backup and restore workspace/config/memory with multi-party access control. Use for creating/managing DID vaults, backing up files, restoring from vault, disaster recovery, or managing vault contents and membership. metadata: openclaw: requires: env: - ARCHON_WALLET_PATH - ARCHON_PASSPHRASE bins: - node - npx - tar anyBins: - zip - unzip - sha256sum primaryEnv: ARCHON_PASSPHRASE emoji: "💾" --- # Archon Vault - Encrypted Distributed Storage Manage DID vaults and backup/restore files. Data is encrypted client-side before transmission — only you (or vault members) can decrypt. ## Prerequisites - Archon identity configured (`~/.archon.env` with wallet path and passphrase) - Run `archon-keymaster` first to create your DID if you don't have one ## Backup Operations ### Backup Workspace to Vault ```bash ./scripts/backup/backup-to-vault.sh [vault-did] ``` Archives `~/clawd` and `~/.openclaw` to your encrypted vault. Respects `.backup-ignore` files. ### Restore from Vault ```bash ./scripts/backup/restore-from-vault.sh <backup-did> [target-dir] ``` ### Verify Backup Integrity ```bash ./scripts/backup/verify-backup.sh <backup-did> ``` ### Disaster Recovery ```bash ./scripts/backup/disaster-recovery.sh ``` Full recovery procedure with mnemonic. ## Vault Management ### Create Vault ```bash ./scripts/vaults/create-vault.sh <vault-name> ``` ### Add/Remove Items ```bash ./scripts/vaults/add-vault-item.sh <vault-did> <item-did> ./scripts/vaults/remove-vault-item.sh <vault-did> <item-did> ./scripts/vaults/get-vault-item.sh <vault-did> <item-did> ./scripts/vaults/list-vault-items.sh <vault-did> ``` ### Manage Vault Members (Multi-Party Access) ```bash ./scripts/vaults/add-vault-member.sh <vault-did> <member-did> ./scripts/vaults/remove-vault-member.sh <vault-did> <member-did> ./scripts/vaults/list-vault-members.sh <vault-did> ``` ## Security Notes 1. **Backup scope**: Archives `~/clawd` and `~/.openclaw` by default. Review `.backup-ignore` to exclude sensitive items. 2. **Encryption**: All data encrypted before transmission to Archon gatekeeper/hyperswarm. 3. **Vault members**: Adding a member grants them decrypt access to vault contents. 4. **Recovery**: Your 12-word mnemonic is the master key. Store it offline.

path: README.md
content: # Archon Vault

Encrypted distributed storage using Archon DID vaults.

## Features

- **Vault Management** — Create vaults, manage items and members
- **Multi-Party Access** — Share vaults with other DIDs
- **Encrypted Backups** — Backup workspace/config to your vault
- **Disaster Recovery** — Restore everything from your 12-word mnemonic

## Requirements

- Node.js (for `npx @didcid/keymaster`)
- Archon identity configured (`~/.archon.env`)
- `tar` (required), `zip`/`unzip`/`sha256sum` (optional)

## Quick Start

```bash
# Create a vault
./scripts/vaults/create-vault.sh --alias my-vault

# Add files
./scripts/vaults/add-vault-item.sh my-vault document.pdf

# Backup workspace
./scripts/backup/backup-to-vault.sh

# Restore from backup
./scripts/backup/restore-from-vault.sh
```

## Scripts

### Vault Management (`scripts/vaults/`)
- `create-vault.sh` — Create new vault
- `add-vault-item.sh` — Add file to vault
- `get-vault-item.sh` — Retrieve file from vault
- `list-vault-items.sh` — List vault contents
- `remove-vault-item.sh` — Remove file from vault
- `add-vault-member.sh` — Grant access to another DID
- `list-vault-members.sh` — List vault members
- `remove-vault-member.sh` — Revoke member access

### Backup Operations (`scripts/backup/`)
- `backup-to-vault.sh` — Backup workspace and config
- `restore-from-vault.sh` — Restore from vault
- `verify-backup.sh` — Verify backup integrity
- `disaster-recovery.sh` — Full recovery from mnemonic

## Security

- All data encrypted client-side before transmission
- Only you (and vault members) can decrypt
- Respects `.backup-ignore` files for exclusions
- Uses Archon gatekeeper + hyperswarm DHT for storage

## Related Skills

- `archon-keymaster` — Core DID identity and credentials
- `archon-cashu` — Cashu ecash operations


path: scripts/backup/backup-to-vault.sh
content: #!/bin/bash
# Backup workspace, config, and hexmem to DID vault
# Run during heartbeat checks (daily)

set -e

# Load environment
if [ -f ~/.archon.env ]; then
    source ~/.archon.env
    export ARCHON_PASSPHRASE  # Must explicitly export for npx subprocesses
else
    echo "ERROR: ~/.archon.env not found"
    exit 1
fi

# Require ARCHON_WALLET_PATH
if [ -z "$ARCHON_WALLET_PATH" ]; then
    echo "Error: ARCHON_WALLET_PATH not set in ~/.archon.env"
    exit 1
fi

# Use public Gatekeeper by default (10MB limit)
# Override with local if needed: export ARCHON_GATEKEEPER_URL="http://localhost:4224"
export ARCHON_GATEKEEPER_URL="${ARCHON_GATEKEEPER_URL:-https://archon.technology}"

echo "=== DID Vault Backup $(date) ==="

# Backup workspace (excludes .git, node_modules, etc per .backup-ignore)
echo "Backing up workspace..."
WORKSPACE_DIR="$PWD"

# Sanity check: abort if workspace is $HOME or / (likely misconfigured)
if [ "$WORKSPACE_DIR" = "$HOME" ] || [ "$WORKSPACE_DIR" = "/" ]; then
    echo "ERROR: Workspace appears to be \$HOME or /. This would backup too much."
    echo "Run this script from your agent workspace directory."
    exit 1
fi

cd /tmp
rm -f workspace.zip
zip -q -r workspace.zip "$WORKSPACE_DIR" -x@"$WORKSPACE_DIR/.backup-ignore" 2>/dev/null || \
    zip -q -r workspace.zip "$WORKSPACE_DIR"
npx @didcid/keymaster add-vault-item backup /tmp/workspace.zip
echo "✓ workspace.zip ($(du -h workspace.zip | cut -f1))"

# Backup config (excludes sessions, cache, logs per patterns)
echo "Backing up config..."
cd ~/.openclaw
rm -f /tmp/config.zip
zip -q -r /tmp/config.zip . \
  -x 'agents/*/sessions/*' \
  -x 'agents/*/cache/*' \
  -x 'logs/*' \
  -x '*.log' \
  -x 'browser/*' \
  -x 'media/*' \
  -x 'canvas/*'
npx @didcid/keymaster add-vault-item backup /tmp/config.zip
echo "✓ config.zip ($(du -h /tmp/config.zip | cut -f1))"

# Backup hexmem database if it exists
HEXMEM_PATH="$WORKSPACE_DIR/hexmem/hexmem.db"
if [ -f "$HEXMEM_PATH" ]; then
    echo "Backing up hexmem..."
    npx @didcid/keymaster add-vault-item backup "$HEXMEM_PATH"
    echo "✓ hexmem.db ($(du -h "$HEXMEM_PATH" | cut -f1))"
fi

# Verify
echo ""
echo "=== Vault Contents ==="
npx @didcid/keymaster list-vault-items backup | jq -r 'to_entries[] | "\(.key): \(.value.bytes / 1024 / 1024 | floor)MB (\(.value.added))"'

echo ""
echo "Backup complete."


path: scripts/backup/disaster-recovery.sh
content: #!/bin/bash
# Complete disaster recovery from mnemonic only
# Usage: disaster-recovery.sh <mnemonic> [target-dir]
#
# Recovers everything from just your 12-word mnemonic:
# 1. Creates wallet from mnemonic
# 2. Recovers wallet data (identities, aliases) from seed bank
# 3. Restores workspace, config, and memory from vault

set -e

if [ $# -lt 1 ]; then
    echo "Usage: $0 \"word1 word2 ... word12\" [target-dir]"
    echo ""
    echo "Performs complete disaster recovery from your 12-word mnemonic."
    echo "Requires ARCHON_PASSPHRASE and ARCHON_GATEKEEPER_URL to be set."
    exit 1
fi

MNEMONIC="$1"
TARGET_DIR="${2:-.}"

# Validate mnemonic word count
WORD_COUNT=$(echo "$MNEMONIC" | wc -w)
if [ "$WORD_COUNT" -ne 12 ]; then
    echo "Error: Mnemonic must be exactly 12 words (got $WORD_COUNT)"
    exit 1
fi

# Check required environment
if [ -z "$ARCHON_PASSPHRASE" ]; then
    echo "Error: ARCHON_PASSPHRASE must be set"
    exit 1
fi

# Set defaults
export ARCHON_GATEKEEPER_URL="${ARCHON_GATEKEEPER_URL:-https://archon.technology}"
export ARCHON_WALLET_PATH="${ARCHON_WALLET_PATH:-./wallet.json}"

echo "=== Archon Disaster Recovery ==="
echo ""
echo "Gatekeeper: $ARCHON_GATEKEEPER_URL"
echo "Wallet: $ARCHON_WALLET_PATH"
echo "Target: $TARGET_DIR"
echo ""

# Step 1: Import wallet from mnemonic
echo "Step 1/3: Creating wallet from mnemonic..."
if [ -f "$ARCHON_WALLET_PATH" ]; then
    echo "Warning: Wallet already exists at $ARCHON_WALLET_PATH"
    read -p "Overwrite? (y/N) " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        echo "Aborted."
        exit 1
    fi
    rm "$ARCHON_WALLET_PATH"
fi
npx @didcid/keymaster import-wallet "$MNEMONIC" > /dev/null
echo "✅ Wallet created"
echo ""

# Step 2: Recover from seed bank
echo "Step 2/3: Recovering wallet data from seed bank..."
npx @didcid/keymaster recover-wallet-did > /dev/null
echo "✅ Wallet data recovered"

# Show recovered identities
echo ""
echo "Recovered identities:"
npx @didcid/keymaster list-ids 2>/dev/null | sed 's/^/  /'
echo ""

# Check for backup alias
if ! npx @didcid/keymaster get-alias backup > /dev/null 2>&1; then
    echo "Warning: No 'backup' vault alias found in recovered wallet."
    echo "Cannot restore from vault without backup alias."
    echo ""
    echo "Wallet recovery complete, but vault restore skipped."
    exit 0
fi

# Step 3: Restore from vault
echo "Step 3/3: Restoring from vault..."
echo ""

# Create restore directory
RESTORE_DIR="$TARGET_DIR/restore-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$RESTORE_DIR"

# List available backups
echo "Available backups:"
npx @didcid/keymaster list-vault-items backup 2>/dev/null | jq -r 'keys[] | "  - \(.)"' || echo "  (none)"
echo ""
echo "Restoring to: $RESTORE_DIR"
echo ""

# Restore workspace
if npx @didcid/keymaster list-vault-items backup 2>/dev/null | jq -e '.["workspace.zip"]' >/dev/null 2>&1; then
    echo "Downloading workspace.zip..."
    npx @didcid/keymaster get-vault-item backup workspace.zip "$RESTORE_DIR/workspace.zip"
    unzip -q "$RESTORE_DIR/workspace.zip" -d "$RESTORE_DIR/workspace"
    rm "$RESTORE_DIR/workspace.zip"
    echo "✅ Workspace restored"
else
    echo "⚠️  workspace.zip not found"
fi

# Restore config
if npx @didcid/keymaster list-vault-items backup 2>/dev/null | jq -e '.["config.zip"]' >/dev/null 2>&1; then
    echo "Downloading config.zip..."
    npx @didcid/keymaster get-vault-item backup config.zip "$RESTORE_DIR/config.zip"
    unzip -q "$RESTORE_DIR/config.zip" -d "$RESTORE_DIR/openclaw"
    rm "$RESTORE_DIR/config.zip"
    echo "✅ Config restored"
else
    echo "⚠️  config.zip not found"
fi

# Restore hexmem
if npx @didcid/keymaster list-vault-items backup 2>/dev/null | jq -e '.["hexmem.db"]' >/dev/null 2>&1; then
    echo "Downloading hexmem.db..."
    npx @didcid/keymaster get-vault-item backup hexmem.db "$RESTORE_DIR/hexmem.db"
    echo "✅ Memory database restored"
else
    echo "⚠️  hexmem.db not found"
fi

echo ""
echo "=== Disaster Recovery Complete ==="
echo ""
echo "Wallet: $ARCHON_WALLET_PATH"
echo "Files:  $RESTORE_DIR"
echo ""
echo "To finish setup:"
echo "  mv $RESTORE_DIR/workspace/* ~/clawd/"
echo "  mv $RESTORE_DIR/openclaw/* ~/.openclaw/"
echo "  mv $RESTORE_DIR/hexmem.db ~/clawd/hexmem/"


path: scripts/backup/restore-from-vault.sh
content: #!/bin/bash
# Restore workspace, config, and hexmem from DID vault backup
# Usage: restore-from-vault.sh [target-dir]
#
# If starting from scratch with only a mnemonic:
#   npx @didcid/keymaster import-wallet "word1 word2 ... word12"
#   npx @didcid/keymaster recover-wallet-did
#   ./scripts/restore-from-vault.sh

set -e

# Load environment
if [ -f ~/.archon.env ]; then
    source ~/.archon.env
fi

TARGET_DIR="${1:-.}"

echo "=== Archon Backup Restore ==="
echo ""

# Check if wallet exists
if ! npx @didcid/keymaster show-wallet >/dev/null 2>&1; then
    echo "No wallet found. To restore from mnemonic:"
    echo ""
    echo "  npx @didcid/keymaster import-wallet \"word1 word2 ... word12\""
    echo "  npx @didcid/keymaster recover-wallet-did"
    echo "  ./scripts/restore-from-vault.sh"
    echo ""
    exit 1
fi

# Check for vault alias
if ! npx @didcid/keymaster get-alias backup >/dev/null 2>&1; then
    echo "Error: 'backup' vault alias not found in wallet."
    echo ""
    echo "If you restored from mnemonic, run:"
    echo "  npx @didcid/keymaster recover-wallet-did"
    echo ""
    echo "This retrieves your wallet data (including aliases) from the seed bank."
    exit 1
fi

echo "Target directory: $TARGET_DIR"
echo ""

# List available backups
echo "Available backups in vault:"
npx @didcid/keymaster list-vault-items backup 2>/dev/null | jq -r 'to_entries[] | "  \(.key)"' || echo "  (none)"
echo ""

# Create restore directory
RESTORE_DIR="$TARGET_DIR/restore-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$RESTORE_DIR"
echo "Restoring to: $RESTORE_DIR"
echo ""

# Restore workspace
if npx @didcid/keymaster list-vault-items backup 2>/dev/null | jq -e '.["workspace.zip"]' >/dev/null 2>&1; then
    echo "Downloading workspace.zip..."
    npx @didcid/keymaster get-vault-item backup workspace.zip "$RESTORE_DIR/workspace.zip"
    echo "Extracting workspace..."
    unzip -q "$RESTORE_DIR/workspace.zip" -d "$RESTORE_DIR/workspace"
    rm "$RESTORE_DIR/workspace.zip"
    echo "✅ Workspace restored to $RESTORE_DIR/workspace/"
else
    echo "⚠️  workspace.zip not found in vault"
fi
echo ""

# Restore config
if npx @didcid/keymaster list-vault-items backup 2>/dev/null | jq -e '.["config.zip"]' >/dev/null 2>&1; then
    echo "Downloading config.zip..."
    npx @didcid/keymaster get-vault-item backup config.zip "$RESTORE_DIR/config.zip"
    echo "Extracting config..."
    unzip -q "$RESTORE_DIR/config.zip" -d "$RESTORE_DIR/openclaw"
    rm "$RESTORE_DIR/config.zip"
    echo "✅ Config restored to $RESTORE_DIR/openclaw/"
else
    echo "⚠️  config.zip not found in vault"
fi
echo ""

# Restore hexmem
if npx @didcid/keymaster list-vault-items backup 2>/dev/null | jq -e '.["hexmem.db"]' >/dev/null 2>&1; then
    echo "Downloading hexmem.db..."
    npx @didcid/keymaster get-vault-item backup hexmem.db "$RESTORE_DIR/hexmem.db"
    echo "✅ Memory database restored to $RESTORE_DIR/hexmem.db"
else
    echo "⚠️  hexmem.db not found in vault"
fi
echo ""

echo "=== Restore Complete ==="
echo ""
echo "Files restored to: $RESTORE_DIR"
echo ""
echo "To use restored files:"
echo "  mv $RESTORE_DIR/workspace/* ~/clawd/"
echo "  mv $RESTORE_DIR/openclaw/* ~/.openclaw/"
echo "  mv $RESTORE_DIR/hexmem.db ~/clawd/hexmem/"


path: scripts/backup/verify-backup.sh
content: #!/bin/bash
# Verify backup integrity by retrieving and testing vault items
# Run periodically to ensure backups are actually recoverable

set -e

# Load environment
if [ -f ~/.archon.env ]; then
    source ~/.archon.env
    export ARCHON_PASSPHRASE
else
    echo "ERROR: ~/.archon.env not found"
    exit 1
fi

# Require ARCHON_WALLET_PATH
if [ -z "$ARCHON_WALLET_PATH" ]; then
    echo "Error: ARCHON_WALLET_PATH not set in ~/.archon.env"
    exit 1
fi

# Use public Gatekeeper by default (10MB limit)
# Override with local if needed: export ARCHON_GATEKEEPER_URL="http://localhost:4224"
export ARCHON_GATEKEEPER_URL="${ARCHON_GATEKEEPER_URL:-https://archon.technology}"

echo "=== Backup Verification $(date) ==="
echo ""

# Create temp directory for test downloads
VERIFY_DIR="/tmp/backup-verify-$$"
mkdir -p "$VERIFY_DIR"
cd "$VERIFY_DIR"

ERRORS=0

# Function to verify a backup item
verify_item() {
    local item_name="$1"
    local test_command="$2"
    
    echo "Verifying $item_name..."
    
    # Try to retrieve from vault
    if ! npx @didcid/keymaster get-vault-item backup "$item_name" "$VERIFY_DIR/$item_name" 2>&1; then
        echo "  ✗ FAILED: Could not retrieve $item_name from vault"
        ERRORS=$((ERRORS + 1))
        return 1
    fi
    
    # Check file exists and has size
    if [ ! -f "$VERIFY_DIR/$item_name" ]; then
        echo "  ✗ FAILED: $item_name not found after retrieval"
        ERRORS=$((ERRORS + 1))
        return 1
    fi
    
    local size=$(du -h "$VERIFY_DIR/$item_name" | cut -f1)
    echo "  Retrieved: $size"
    
    # Run test command if provided
    if [ -n "$test_command" ]; then
        if eval "$test_command" > /dev/null 2>&1; then
            echo "  ✓ Integrity check passed"
        else
            echo "  ✗ FAILED: Integrity check failed"
            ERRORS=$((ERRORS + 1))
            return 1
        fi
    else
        echo "  ✓ Retrieved successfully"
    fi
    
    return 0
}

# Verify workspace backup
verify_item "workspace.zip" "unzip -t '$VERIFY_DIR/workspace.zip'"

echo ""

# Verify config backup
verify_item "config.zip" "unzip -t '$VERIFY_DIR/config.zip'"

echo ""

# Verify hexmem database
verify_item "hexmem.db" "sqlite3 '$VERIFY_DIR/hexmem.db' 'SELECT COUNT(*) FROM memory_log;'"

echo ""
echo "=== Verification Summary ==="

if [ $ERRORS -eq 0 ]; then
    echo "✓ All backups verified successfully"
    echo ""
    echo "Your backups are recoverable. You can restore from:"
    echo "  - workspace.zip ($VERIFY_DIR/workspace.zip)"
    echo "  - config.zip ($VERIFY_DIR/config.zip)"
    echo "  - hexmem.db ($VERIFY_DIR/hexmem.db)"
else
    echo "✗ $ERRORS backup(s) failed verification"
    echo ""
    echo "ACTION REQUIRED: Re-run backup-to-vault.sh to fix failed backups"
fi

echo ""
echo "Cleanup: rm -rf $VERIFY_DIR"


path: scripts/vaults/add-vault-item.sh
content: #!/bin/bash
# Add an item (file) to a vault

set -e

# Ensure environment is loaded
if [ -z "$ARCHON_PASSPHRASE" ]; then
    if [ -f ~/.archon.env ]; then
        source ~/.archon.env
    else
        echo "Error: ARCHON_PASSPHRASE not set. Run create-id.sh first."
        exit 1
    fi
fi

# Set wallet path
if [ -z "$ARCHON_WALLET_PATH" ]; then
    echo "Error: ARCHON_WALLET_PATH not set in ~/.archon.env"
    exit 1
fi

# Check arguments
if [ $# -ne 2 ]; then
    echo "Usage: $0 <vault-id> <file-path>"
    exit 1
fi

VAULT_ID="$1"
FILE_PATH="$2"

if [ ! -f "$FILE_PATH" ]; then
    echo "Error: File not found: $FILE_PATH"
    exit 1
fi

# Add item to vault
npx @didcid/keymaster add-vault-item "$VAULT_ID" "$FILE_PATH"


path: scripts/vaults/add-vault-member.sh
content: #!/bin/bash
# Add a member to a vault

set -e

# Ensure environment is loaded
if [ -z "$ARCHON_PASSPHRASE" ]; then
    if [ -f ~/.archon.env ]; then
        source ~/.archon.env
    else
        echo "Error: ARCHON_PASSPHRASE not set. Run create-id.sh first."
        exit 1
    fi
fi

# Set wallet path
if [ -z "$ARCHON_WALLET_PATH" ]; then
    echo "Error: ARCHON_WALLET_PATH not set in ~/.archon.env"
    exit 1
fi

# Check arguments
if [ $# -ne 2 ]; then
    echo "Usage: $0 <vault-id> <member-did>"
    exit 1
fi

VAULT_ID="$1"
MEMBER_DID="$2"

# Add member to vault
npx @didcid/keymaster add-vault-member "$VAULT_ID" "$MEMBER_DID"


path: scripts/vaults/create-vault.sh
content: #!/bin/bash
# Create a new vault

set -e

# Ensure environment is loaded
if [ -z "$ARCHON_PASSPHRASE" ]; then
    if [ -f ~/.archon.env ]; then
        source ~/.archon.env
    else
        echo "Error: ARCHON_PASSPHRASE not set. Run create-id.sh first."
        exit 1
    fi
fi

# Set wallet path
if [ -z "$ARCHON_WALLET_PATH" ]; then
    echo "Error: ARCHON_WALLET_PATH not set in ~/.archon.env"
    exit 1
fi

# Parse arguments
VAULT_ALIAS=""
SECRET_MEMBERS=""
while [[ $# -gt 0 ]]; do
    case $1 in
        -a|--alias)
            VAULT_ALIAS="$2"
            shift 2
            ;;
        -s|--secret-members)
            SECRET_MEMBERS="--secretMembers"
            shift
            ;;
        *)
            echo "Unknown option: $1"
            echo "Usage: $0 [-a|--alias <vault-alias>] [-s|--secret-members]"
            exit 1
            ;;
    esac
done

# Create vault
if [ -n "$VAULT_ALIAS" ]; then
    npx @didcid/keymaster create-vault --alias "$VAULT_ALIAS" $SECRET_MEMBERS
else
    npx @didcid/keymaster create-vault $SECRET_MEMBERS
fi


path: scripts/vaults/get-vault-item.sh
content: #!/bin/bash
# Get an item from a vault and save to file

set -e

# Ensure environment is loaded
if [ -z "$ARCHON_PASSPHRASE" ]; then
    if [ -f ~/.archon.env ]; then
        source ~/.archon.env
    else
        echo "Error: ARCHON_PASSPHRASE not set. Run create-id.sh first."
        exit 1
    fi
fi

# Set wallet path
if [ -z "$ARCHON_WALLET_PATH" ]; then
    echo "Error: ARCHON_WALLET_PATH not set in ~/.archon.env"
    exit 1
fi

# Check arguments
if [ $# -ne 3 ]; then
    echo "Usage: $0 <vault-id> <item-name> <output-file>"
    exit 1
fi

VAULT_ID="$1"
ITEM_NAME="$2"
OUTPUT_FILE="$3"

# Get item from vault
npx @didcid/keymaster get-vault-item "$VAULT_ID" "$ITEM_NAME" "$OUTPUT_FILE"


path: scripts/vaults/list-vault-items.sh
content: #!/bin/bash
# List all items in a vault

set -e

# Ensure environment is loaded
if [ -z "$ARCHON_PASSPHRASE" ]; then
    if [ -f ~/.archon.env ]; then
        source ~/.archon.env
    else
        echo "Error: ARCHON_PASSPHRASE not set. Run create-id.sh first."
        exit 1
    fi
fi

# Set wallet path
if [ -z "$ARCHON_WALLET_PATH" ]; then
    echo "Error: ARCHON_WALLET_PATH not set in ~/.archon.env"
    exit 1
fi

# Check arguments
if [ $# -ne 1 ]; then
    echo "Usage: $0 <vault-id>"
    exit 1
fi

VAULT_ID="$1"

# List items in vault
npx @didcid/keymaster list-vault-items "$VAULT_ID"


path: scripts/vaults/list-vault-members.sh
content: #!/bin/bash
# List all members of a vault

set -e

# Ensure environment is loaded
if [ -z "$ARCHON_PASSPHRASE" ]; then
    if [ -f ~/.archon.env ]; then
        source ~/.archon.env
    else
        echo "Error: ARCHON_PASSPHRASE not set. Run create-id.sh first."
        exit 1
    fi
fi

# Set wallet path
if [ -z "$ARCHON_WALLET_PATH" ]; then
    echo "Error: ARCHON_WALLET_PATH not set in ~/.archon.env"
    exit 1
fi

# Check arguments
if [ $# -ne 1 ]; then
    echo "Usage: $0 <vault-id>"
    exit 1
fi

VAULT_ID="$1"

# List vault members
npx @didcid/keymaster list-vault-members "$VAULT_ID"


path: scripts/vaults/remove-vault-item.sh
content: #!/bin/bash
# Remove an item from a vault

set -e

# Ensure environment is loaded
if [ -z "$ARCHON_PASSPHRASE" ]; then
    if [ -f ~/.archon.env ]; then
        source ~/.archon.env
    else
        echo "Error: ARCHON_PASSPHRASE not set. Run create-id.sh first."
        exit 1
    fi
fi

# Set wallet path
if [ -z "$ARCHON_WALLET_PATH" ]; then
    echo "Error: ARCHON_WALLET_PATH not set in ~/.archon.env"
    exit 1
fi

# Check arguments
if [ $# -ne 2 ]; then
    echo "Usage: $0 <vault-id> <item-name>"
    exit 1
fi

VAULT_ID="$1"
ITEM_NAME="$2"

# Remove item from vault
npx @didcid/keymaster remove-vault-item "$VAULT_ID" "$ITEM_NAME"


path: scripts/vaults/remove-vault-member.sh
content: #!/bin/bash
# Remove a member from a vault

set -e

# Ensure environment is loaded
if [ -z "$ARCHON_PASSPHRASE" ]; then
    if [ -f ~/.archon.env ]; then
        source ~/.archon.env
    else
        echo "Error: ARCHON_PASSPHRASE not set. Run create-id.sh first."
        exit 1
    fi
fi

# Set wallet path
if [ -z "$ARCHON_WALLET_PATH" ]; then
    echo "Error: ARCHON_WALLET_PATH not set in ~/.archon.env"
    exit 1
fi

# Check arguments
if [ $# -ne 2 ]; then
    echo "Usage: $0 <vault-id> <member-did>"
    exit 1
fi

VAULT_ID="$1"
MEMBER_DID="$2"

# Remove member from vault
npx @didcid/keymaster remove-vault-member "$VAULT_ID" "$MEMBER_DID"


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)