4.19.0

Added

Adapters - Vault

• HashiCorp Vault Adapter - Added sync VaultPort / VaultAdapter for runtime KV v2, dynamic leases, and transit encrypt/decrypt via hvac.
  • KV v2: read_secret, write_secret, delete_secret, list_secrets
  • Dynamic credentials via secrets.database.generate_credentials (generic write/read fallback for other engines)
  • Lease renew/revoke through sys.renew_lease / sys.revoke_lease
  • Optional per-instance SECRET_CACHE_TTL with invalidate-on-write/delete
  • Optional AUTO_RENEW_TOKEN with renew-threshold checks

Configs - Vault

• Vault Settings Source - Added VaultSettingsSource and create_vault_client() for KV v2 secret injection at BaseConfig startup (priority after file secrets, before TOML/env).
• VaultConfig - Added VAULT on BaseConfig with connection, TLS/mTLS, timeouts/retries, cache, and token lifecycle fields.
• Auth Methods - Support for hvac auth backends: token, approle, kubernetes, userpass, ldap, okta, jwt, aws, azure, gcp, github, and cert.

Models - Vault

• VaultLeaseDTO - Added lease metadata DTO for dynamic credential responses.

Docs - Vault

• Adapter Documentation - Added Vault tutorial and API reference pages, mkdocs nav entries, and config-management coverage for settings-source priority and auth examples.

Tests

Tests - Vault

• Vault Test Container - Added VaultTestContainer (hashicorp/vault:2.0.3) with @needs-vault and .env.test wiring.
• BDD Coverage - Added vault_adapter.feature and BaseConfig Vault scenarios for secret injection, env priority, auth failure, cache invalidate, token renew, invalid args, and Postgres dynamic credentials.

Dependencies

• Added optional extra vault (hvac[parser], cachetools).
• Extended the testcontainers extra with vault support.