Module secrets 

Shared secret vault helpers used by the CLI and task execution

Structs

SecretConfig

VaultMeta

Metadata stored inside a vault directory that describes how the vault should be accessed. Written by mk secrets vault init --gpg-key-id so subsequent commands (store, show, export, …) pick up the GPG key automatically without flags.

Functions

encrypt_with_gpg

Encrypt plaintext using the system gpg binary for the given key ID or fingerprint. The output is ASCII-armored PGP data suitable for storing as a data.asc vault file.

list_secret_paths

load_secret_env

load_secret_value

load_secret_values

read_vault_gpg_key_id

Read the GPG key ID stored in a vault’s metadata file, if present. Returns None when the file does not exist or cannot be parsed.

write_vault_meta

Write (or overwrite) the vault’s metadata file with the supplied GPG key ID.