Vault lifecycle

aivault status
aivault status --verbose   # full JSON detail

# macOS Keychain (recommended on macOS)
aivault init --provider macos-keychain

# Keychain with custom service/account
aivault init --provider macos-keychain \
  --keychain-service my-app \
  --keychain-account my-account

# Passphrase
aivault init --provider passphrase --passphrase "your-passphrase"

# Environment variable
aivault init --provider env --env-var AIVAULT_KEY

# Key file
aivault init --provider file --file-path /path/to/keyfile

aivault unlock --passphrase "your-passphrase"

aivault lock

# Rotate to a new base64 key
aivault rotate-master --new-key <base64-encoded-32-byte-key>

# Rotate to a new passphrase (passphrase provider only)
aivault rotate-master --new-passphrase "new-passphrase"

aivault audit                          # last 200 events
aivault audit --limit 50               # last 50 events
aivault audit --before-ts-ms 170000000 # events before timestamp