vault

Reads the environment variable name. Returns the string value if set, or nil if the variable does not exist. Use require_env when the variable is mandatory.

use plugin vault::{get_env}

let db_url = get_env("DATABASE_URL")
if db_url == nil {
  print("DATABASE_URL is not set")
}

Reads the environment variable name and errors at runtime if it is not set. Use this at startup to fail fast for required configuration.

use plugin vault::{require_env}

let api_key = require_env("API_KEY")
print("Key loaded")

Reads the environment variable name, returning default if it is not set.

use plugin vault::{get_env_or}

let port = get_env_or("PORT", "8080")
print("Listening on port {port}")

Masks a secret string for display — shows the first 2 and last 2 characters and replaces the middle with asterisks. Strings of 4 characters or fewer become "****".

use plugin vault::{get_env, mask}

let token = get_env("API_TOKEN")
print("Token: {mask(token)}")

Parses a .env file at path into a table of key-value string pairs. Blank lines and # comments are skipped. Surrounding single or double quotes are stripped from values.

use plugin vault::{load_env_file}

let env = load_env_file(".env")
print(env["DATABASE_URL"])

Returns a list of all environment variable names currently set in the process. Values are not included.

use plugin vault::{env_names}

let names = env_names()
print(names[1])

Encrypts plaintext using AES-256-GCM with a 32-byte key supplied as 64 hex characters. Returns a hex string containing the 12-byte nonce prepended to the ciphertext. Use generate_key to create a key.

use plugin vault::{encrypt_value, decrypt_value, generate_key}

let key = generate_key()
let ct = encrypt_value("my secret", key)
let pt = decrypt_value(ct, key)
print(pt)

Decrypts a hex-encoded AES-256-GCM ciphertext (as produced by encrypt_value) back to the original plaintext string.

use plugin vault::{decrypt_value}

let plain = decrypt_value(stored_ciphertext, require_env("ENCRYPTION_KEY"))
print(plain)

Generates a cryptographically random 32-byte AES key and returns it as 64 lowercase hex characters. Store this key securely — it is required for decryption.

use plugin vault::{generate_key}

let key = generate_key()
print("Save this key: {key}")

Computes the SHA-256 digest of value and returns it as a 64-character lowercase hex string.

use plugin vault::{hash_value}

let digest = hash_value("password123")
print(digest)

Sets the environment variable name to value for the current process.

use plugin vault::{set_env, get_env}

set_env("MY_VAR", "hello")
print(get_env("MY_VAR"))

Removes the environment variable name from the current process environment.

use plugin vault::{set_env, unset_env, get_env}

set_env("TEMP_VAR", "x")
unset_env("TEMP_VAR")
print(get_env("TEMP_VAR"))

Compares two strings in constant time to prevent timing-based side-channel attacks. Always use this instead of == when comparing secret tokens or hashes.

use plugin vault::{hash_value, constant_time_eq}

let expected = hash_value("correct-password")
let provided = hash_value(user_input)
if constant_time_eq(expected, provided) {
  print("Authenticated")
}

Encodes a string as standard base64 (with padding).

use plugin vault::{encode_base64, decode_base64}

let encoded = encode_base64("Hello, World!")
let decoded = decode_base64(encoded)
print(decoded)

Decodes a base64 string back to its original UTF-8 string value.

use plugin vault::{decode_base64}

let raw = decode_base64("SGVsbG8sIFdvcmxkIQ==")
print(raw)