Docs.rs

Typed secret materialization — generates and seeds secrets into SOPS / Akeyless without ever exposing plaintext to the operator. The bin half of the cofre toolchain.

墨塗り — a pleme-io-native, sops-wire-compatible encrypted-file tool. Aliasable as `sops`.

墨塗り — the sops-compatible encrypted-file wire format, as a typed border. Pure: no I/O, no key providers, no clock.

WebAssembly component runtime for lanekeep rules.

墨塗り — an ordered YAML tree plus a go-yaml-v3-byte-compatible emitter, so a re-encrypted sops file diffs as a few lines instead of a whole rewrite.

A credential type that cannot reach argv, a log line, or a format string by accident, plus the sanctioned ways to hand one to a subprocess.

Atomic secret-file creation: the mode is established at open(2), never chmod'ed afterwards. The one correct way for any pleme-io tool to write a credential to disk.

Typed secret-materialization primitives (generation policies, rotation policies, backend refs, materialization plans). The lib half of the cofre toolchain.

proc macros to embed the cargo toml data

Embedded JavaScript sandbox and host API for lanekeep rules.

tree-sitter query parsing and compilation for lanekeep.

The node arena: parsed-tree handles shared across lanekeep's rule-execution engines.

The set of languages lanekeep supports, assembled in one place.

LSP and MCP servers for lanekeep, over stdio.

Output formatting for lanekeep.