Crate murk_cli 

Encrypted secrets manager for developers — one file, age encryption, git-friendly.

This library provides the core functionality for murk: vault I/O, age encryption, BIP39 key recovery, and secret management. The CLI binary wraps this library.

Re-exports

pub use error::MurkError;

pub use github::GitHubError;

pub use github::fetch_keys;

pub use crypto::MurkIdentity;

pub use crypto::MurkRecipient;

Modules

crypto

error

Unified error type for the murk library.

github

GitHub SSH key fetching for murk authorize github:username.

recovery

types

vault

Structs

DiffEntry

A single entry in a secret diff.

DiscoveredKey

A key discovered from the environment or .env file.

InfoEntry

A single key entry in the vault info output.

InitStatus

Status of an existing vault relative to a given key.

MergeDriverOutput

Output of the merge driver: the merge result and whether meta was regenerated.

RecipientEntry

A single recipient entry with resolved display info.

RevokeResult

Result of revoking a recipient.

VaultInfo

Aggregated vault information for display.

Enums

DiffKind

The kind of change in a diff entry.

EnvrcStatus

Status of .envrc after writing.

MergeDriverSetupStep

A step completed during merge driver setup.

Functions

add_secret

Add or update a secret in the working state. If scoped is true, stores in scoped (encrypted to self only). Returns true if the key was new (no existing schema entry).

authorize_recipient

Add a recipient to the vault. Returns an error if the pubkey is invalid or already present.

check_init_status

Check whether a secret key is authorized in an existing vault.

create_vault

Create a new vault with a single recipient.

decrypt_value

Decrypt a base64-encoded ciphertext and return plaintext bytes.

decrypt_vault

Decrypt a vault using the given identity. Verifies integrity, decrypts all shared and scoped values, and returns the working state.

decrypt_vault_values

Decrypt all shared secret values from a vault.

describe_key

Update or create a schema entry for a key.

diff_secrets

Compare two sets of secret values and return the differences.

discover_existing_key

Try to find an existing age key: checks MURK_KEY env var first, then falls back to .env file. Returns None if neither is set.

dotenv_has_murk_key

Check whether .env already contains a MURK_KEY line.

encrypt_value

Encrypt a value and return base64-encoded ciphertext.

export_secrets

Build shell-escaped export key-value pairs for eval $(murk export). Wraps values in single quotes with embedded quote escaping.

format_diff_lines

Format diff entries as display lines. Returns plain-text lines (no ANSI colors) suitable for testing.

format_info_lines

Format vault info as plain-text lines (no ANSI colors). has_meta indicates whether scoped/tag columns should be shown.

format_recipient_lines

Group recipient entries by display name and format for display. Returns plain-text lines (no ANSI colors).

get_secret

Look up a decrypted value. Scoped overrides take priority over shared values.

import_secrets

Import multiple secrets at once.

is_valid_key_name

Check whether a key name is a valid shell identifier (safe for export KEY=...). Must start with a letter or underscore, and contain only [A-Za-z0-9_].

key_file_path

Compute the key file path for a vault: ~/.config/murk/keys/<hash>. The hash is a truncated SHA-256 of the absolute vault path.

key_type_label

Return the key type label for a pubkey string.

list_keys

Return key names from the vault schema, optionally filtered by tags.

list_recipients

List all recipients in the vault with optional name resolution.

load_vault

Resolve the key from the environment, read the vault, and decrypt it.

parse_and_decrypt_values

Parse a vault from its JSON string and decrypt all shared values.

parse_env

Parse a .env file into key-value pairs. Skips comments, blank lines, MURK_* keys, and strips quotes and export prefixes.

read_key_from_dotenv

Read MURK_KEY from .env file if present.

read_vault

Read a vault file from disk.

remove_secret

Remove a secret from the working state and schema.

resolve_key

Resolve the secret key, checking in order:

resolve_key_for_vault

Resolve the secret key for a specific vault, checking in order:

resolve_secrets

Merge scoped overrides over shared values and filter by tag. Returns raw (unescaped) values suitable for env var injection.

revoke_recipient

Remove a recipient from the vault. recipient can be a pubkey or a display name.

run_merge_driver

Run the three-way merge driver on vault contents (as strings).

save_vault

Save the vault: compare against original state and only re-encrypt changed values. Unchanged values keep their original ciphertext for minimal git diffs.

setup_merge_driver

Configure git to use murk’s custom merge driver for .murk files.

truncate_pubkey

Truncate a pubkey for display, keeping start and end.

vault_info

Compute vault info from raw vault bytes.

warn_env_permissions

Warn if .env has loose permissions (Unix only).

write_envrc

Write a .envrc file for direnv integration.

write_key_ref_to_dotenv

Write a MURK_KEY_FILE reference to .env, removing any existing MURK_KEY/MURK_KEY_FILE lines.

write_key_to_dotenv

Write a MURK_KEY to .env, removing any existing MURK_KEY lines. On Unix, sets file permissions to 600 atomically at creation time to prevent a TOCTOU window where the secret key is world-readable. On non-Unix platforms, permissions are not hardened.

write_key_to_file

Write a secret key to a file with restricted permissions.