Skip to main content Module env Copy item path Source broker Local policy store and shared wire snapshots for SSH secret brokering. catalog commands Handlers for shine env list/set/delete/get/decrypt/export/encrypt. identity shine env secret identity init/list: generate and inspect age identities used
to decrypt age:-tagged secrets, including Secure Enclave (Touch ID)
identities minted by age-plugin-se.proxy PATH shims that inject a deliberately small allow-list of shine env values. upgrade workspace EnvConfig User-editable environment variables stored in config.toml under [env]. EnvVarSpec A validated environment declaration using the env run --with grammar:
resolve source from the active config and expose it under target. StoredValue A config environment value selected using encrypted-first lookup. resolve_stored_value Resolve KEY_SECRET first, falling back to plaintext KEY. secret_key Return the encrypted-storage key associated with an environment variable.