# Configuration Encryption Guide\n\n**Version**: 1.0.0\n**Last Updated**: 2025-10-08\n**Status**: Production Ready\n\n## Overview\n\nThe Provisioning Platform includes a comprehensive configuration encryption system that provides:\n\n- **Transparent Encryption/Decryption**: Configs are automatically decrypted on load\n- **Multiple KMS Backends**: Age, AWS KMS, HashiCorp Vault, Cosmian KMS\n- **Memory-Only Decryption**: Secrets never written to disk in plaintext\n- **SOPS Integration**: Industry-standard encryption with SOPS\n- **Sensitive Data Detection**: Automatic scanning for unencrypted sensitive data\n\n## Table of Contents\n\n1. [Prerequisites](#prerequisites)\n2. [Quick Start](#quick-start)\n3. [Configuration Encryption](#configuration-encryption)\n4. [KMS Backends](#kms-backends)\n5. [CLI Commands](#cli-commands)\n6. [Integration with Config Loader](#integration-with-config-loader)\n7. [Best Practices](#best-practices)\n8. [Troubleshooting](#troubleshooting)\n\n---\n\n## Prerequisites\n\n### Required Tools\n\n1. **SOPS** (v3.10.2+)\n\n   ```bash\n   # macOS\n   brew install sops\n\n   # Linux\n   wget https://github.com/mozilla/sops/releases/download/v3.10.2/sops-v3.10.2.linux.amd64\n   sudo mv sops-v3.10.2.linux.amd64 /usr/local/bin/sops\n   sudo chmod +x /usr/local/bin/sops\n   ```\n\n2. **Age** (for Age backend - recommended)\n\n   ```bash\n   # macOS\n   brew install age\n\n   # Linux\n   apt install age\n   ```\n\n3. **AWS CLI** (for AWS KMS backend - optional)\n\n   ```bash\n   brew install awscli\n   ```\n\n### Verify Installation\n\n```\n# Check SOPS\nsops --version\n\n# Check Age\nage --version\n\n# Check AWS CLI (optional)\naws --version\n```\n\n---\n\n## Quick Start\n\n### 1. Initialize Encryption\n\nGenerate Age keys and create SOPS configuration:\n\n```\nprovisioning config init-encryption --kms age\n```\n\nThis will:\n\n- Generate Age key pair in `~/.config/sops/age/keys.txt`\n- Display your public key (recipient)\n- Create `.sops.yaml` in your project\n\n### 2. Set Environment Variables\n\nAdd to your shell profile (`~/.zshrc` or `~/.bashrc`):\n\n```\n# Age encryption\nexport SOPS_AGE_RECIPIENTS="age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"\nexport PROVISIONING_KAGE="$HOME/.config/sops/age/keys.txt"\n```\n\nReplace the recipient with your actual public key.\n\n### 3. Validate Setup\n\n```\nprovisioning config validate-encryption\n```\n\nExpected output:\n\n```\n✅ Encryption configuration is valid\n   SOPS installed: true\n   Age backend: true\n   KMS enabled: false\n   Errors: 0\n   Warnings: 0\n```\n\n### 4. Encrypt Your First Config\n\n```\n# Create a config with sensitive data\ncat > workspace/config/secure.yaml <<EOF\ndatabase:\n  host: localhost\n  password: supersecret123\n  api_key: key_abc123\nEOF\n\n# Encrypt it\nprovisioning config encrypt workspace/config/secure.yaml --in-place\n\n# Verify it's encrypted\nprovisioning config is-encrypted workspace/config/secure.yaml\n```\n\n---\n\n## Configuration Encryption\n\n### File Naming Conventions\n\nEncrypted files should follow these patterns:\n\n- `*.enc.yaml` - Encrypted YAML files\n- `*.enc.yml` - Encrypted YAML files (alternative)\n- `*.enc.toml` - Encrypted TOML files\n- `secure.yaml` - Files in workspace/config/\n\nThe `.sops.yaml` configuration automatically applies encryption rules based on file paths.\n\n### Encrypt a Configuration File\n\n#### Basic Encryption\n\n```\n# Encrypt and create new file\nprovisioning config encrypt secrets.yaml\n\n# Output: secrets.yaml.enc\n```\n\n#### In-Place Encryption\n\n```\n# Encrypt and replace original\nprovisioning config encrypt secrets.yaml --in-place\n```\n\n#### Specify Output Path\n\n```\n# Encrypt to specific location\nprovisioning config encrypt secrets.yaml --output workspace/config/secure.enc.yaml\n```\n\n#### Choose KMS Backend\n\n```\n# Use Age (default)\nprovisioning config encrypt secrets.yaml --kms age\n\n# Use AWS KMS\nprovisioning config encrypt secrets.yaml --kms aws-kms\n\n# Use Vault\nprovisioning config encrypt secrets.yaml --kms vault\n```\n\n### Decrypt a Configuration File\n\n```\n# Decrypt to new file\nprovisioning config decrypt secrets.enc.yaml\n\n# Decrypt in-place\nprovisioning config decrypt secrets.enc.yaml --in-place\n\n# Decrypt to specific location\nprovisioning config decrypt secrets.enc.yaml --output plaintext.yaml\n```\n\n### Edit Encrypted Files\n\nThe system provides a secure editing workflow:\n\n```\n# Edit encrypted file (auto decrypt -> edit -> re-encrypt)\nprovisioning config edit-secure workspace/config/secure.enc.yaml\n```\n\nThis will:\n\n1. Decrypt the file temporarily\n2. Open in your `$EDITOR` (vim/nano/etc)\n3. Re-encrypt when you save and close\n4. Remove temporary decrypted file\n\n### Check Encryption Status\n\n```\n# Check if file is encrypted\nprovisioning config is-encrypted workspace/config/secure.yaml\n\n# Get detailed encryption info\nprovisioning config encryption-info workspace/config/secure.yaml\n```\n\n---\n\n## KMS Backends\n\n### Age (Recommended for Development)\n\n**Pros**:\n\n- Simple file-based keys\n- No external dependencies\n- Fast and secure\n- Works offline\n\n**Setup**:\n\n```\n# Initialize\nprovisioning config init-encryption --kms age\n\n# Set environment variables\nexport SOPS_AGE_RECIPIENTS="age1..."  # Your public key\nexport PROVISIONING_KAGE="$HOME/.config/sops/age/keys.txt"\n```\n\n**Encrypt/Decrypt**:\n\n```\nprovisioning config encrypt secrets.yaml --kms age\nprovisioning config decrypt secrets.enc.yaml\n```\n\n### AWS KMS (Production)\n\n**Pros**:\n\n- Centralized key management\n- Audit logging\n- IAM integration\n- Key rotation\n\n**Setup**:\n\n1. Create KMS key in AWS Console\n2. Configure AWS credentials:\n\n   ```bash\n   aws configure\n   ```\n\n1. Update `.sops.yaml`:\n\n   ```yaml\n   creation_rules:\n     - path_regex: .*\.enc\.yaml$\n       kms: "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"\n   ```\n\n**Encrypt/Decrypt**:\n\n```\nprovisioning config encrypt secrets.yaml --kms aws-kms\nprovisioning config decrypt secrets.enc.yaml\n```\n\n### HashiCorp Vault (Enterprise)\n\n**Pros**:\n\n- Dynamic secrets\n- Centralized secret management\n- Audit logging\n- Policy-based access\n\n**Setup**:\n\n1. Configure Vault address and token:\n\n   ```bash\n   export VAULT_ADDR="https://vault.example.com:8200"\n   export VAULT_TOKEN="s.xxxxxxxxxxxxxx"\n   ```\n\n1. Update configuration:\n\n   ```toml\n   # workspace/config/provisioning.yaml\n   kms:\n     enabled: true\n     mode: "remote"\n     vault:\n       address: "https://vault.example.com:8200"\n       transit_key: "provisioning"\n   ```\n\n**Encrypt/Decrypt**:\n\n```\nprovisioning config encrypt secrets.yaml --kms vault\nprovisioning config decrypt secrets.enc.yaml\n```\n\n### Cosmian KMS (Confidential Computing)\n\n**Pros**:\n\n- Confidential computing support\n- Zero-knowledge architecture\n- Post-quantum ready\n- Cloud-agnostic\n\n**Setup**:\n\n1. Deploy Cosmian KMS server\n2. Update configuration:\n\n   ```toml\n   kms:\n     enabled: true\n     mode: "remote"\n     remote:\n       endpoint: "https://kms.example.com:9998"\n       auth_method: "certificate"\n       client_cert: "/path/to/client.crt"\n       client_key: "/path/to/client.key"\n   ```\n\n**Encrypt/Decrypt**:\n\n```\nprovisioning config encrypt secrets.yaml --kms cosmian\nprovisioning config decrypt secrets.enc.yaml\n```\n\n---\n\n## CLI Commands\n\n### Configuration Encryption Commands\n\n| Command | Description |\n| --------- | ------------- |\n| `config encrypt <file>` | Encrypt configuration file |\n| `config decrypt <file>` | Decrypt configuration file |\n| `config edit-secure <file>` | Edit encrypted file securely |\n| `config rotate-keys <file> <key>` | Rotate encryption keys |\n| `config is-encrypted <file>` | Check if file is encrypted |\n| `config encryption-info <file>` | Show encryption details |\n| `config validate-encryption` | Validate encryption setup |\n| `config scan-sensitive <dir>` | Find unencrypted sensitive configs |\n| `config encrypt-all <dir>` | Encrypt all sensitive configs |\n| `config init-encryption` | Initialize encryption (generate keys) |\n\n### Examples\n\n```\n# Encrypt workspace config\nprovisioning config encrypt workspace/config/secure.yaml --in-place\n\n# Edit encrypted file\nprovisioning config edit-secure workspace/config/secure.yaml\n\n# Scan for unencrypted sensitive configs\nprovisioning config scan-sensitive workspace/config --recursive\n\n# Encrypt all sensitive configs in workspace\nprovisioning config encrypt-all workspace/config --kms age --recursive\n\n# Check encryption status\nprovisioning config is-encrypted workspace/config/secure.yaml\n\n# Get detailed info\nprovisioning config encryption-info workspace/config/secure.yaml\n\n# Validate setup\nprovisioning config validate-encryption\n```\n\n---\n\n## Integration with Config Loader\n\n### Automatic Decryption\n\nThe config loader automatically detects and decrypts encrypted files:\n\n```\n# Load encrypted config (automatically decrypted in memory)\nuse lib_provisioning/config/loader.nu\n\nlet config = (load-provisioning-config --debug)\n```\n\n**Key Features**:\n\n- **Transparent**: No code changes needed\n- **Memory-Only**: Decrypted content never written to disk\n- **Fallback**: If decryption fails, attempts to load as plain file\n- **Debug Support**: Shows decryption status with `--debug` flag\n\n### Manual Loading\n\n```\nuse lib_provisioning/config/encryption.nu\n\n# Load encrypted config\nlet secure_config = (load-encrypted-config "workspace/config/secure.enc.yaml")\n\n# Memory-only decryption (no file created)\nlet decrypted_content = (decrypt-config-memory "workspace/config/secure.enc.yaml")\n```\n\n### Configuration Hierarchy with Encryption\n\nThe system supports encrypted files at any level:\n\n```\n1. workspace/{name}/config/provisioning.yaml        ← Can be encrypted\n2. workspace/{name}/config/providers/*.toml         ← Can be encrypted\n3. workspace/{name}/config/platform/*.toml          ← Can be encrypted\n4. ~/.../provisioning/ws_{name}.yaml                ← Can be encrypted\n5. Environment variables (PROVISIONING_*)           ← Plain text\n```\n\n---\n\n## Best Practices\n\n### 1. Encrypt All Sensitive Data\n\n**Always encrypt configs containing**:\n\n- Passwords\n- API keys\n- Secret keys\n- Private keys\n- Tokens\n- Credentials\n\n**Scan for unencrypted sensitive data**:\n\n```\nprovisioning config scan-sensitive workspace --recursive\n```\n\n### 2. Use Appropriate KMS Backend\n\n| Environment | Recommended Backend |\n| ------------- | --------------------- |\n| Development | Age (file-based) |\n| Staging | AWS KMS or Vault |\n| Production | AWS KMS or Vault |\n| CI/CD | AWS KMS with IAM roles |\n\n### 3. Key Management\n\n**Age Keys**:\n\n- Store private keys securely: `~/.config/sops/age/keys.txt`\n- Set file permissions: `chmod 600 ~/.config/sops/age/keys.txt`\n- Backup keys securely (encrypted backup)\n- Never commit private keys to git\n\n**AWS KMS**:\n\n- Use separate keys per environment\n- Enable key rotation\n- Use IAM policies for access control\n- Monitor usage with CloudTrail\n\n**Vault**:\n\n- Use transit engine for encryption\n- Enable audit logging\n- Implement least-privilege policies\n- Regular policy reviews\n\n### 4. File Organization\n\n```\nworkspace/\n└── config/\n    ├── provisioning.yaml         # Plain (no secrets)\n    ├── secure.yaml                # Encrypted (SOPS auto-detects)\n    ├── providers/\n    │   ├── aws.toml               # Plain (no secrets)\n    │   └── aws-credentials.enc.toml  # Encrypted\n    └── platform/\n        └── database.enc.yaml      # Encrypted\n```\n\n### 5. Git Integration\n\n**Add to `.gitignore`**:\n\n```\n# Unencrypted sensitive files\n**/secrets.yaml\n**/credentials.yaml\n**/*.dec.yaml\n**/*.dec.toml\n\n# Temporary decrypted files\n*.tmp.yaml\n*.tmp.toml\n```\n\n**Commit encrypted files**:\n\n```\n# Encrypted files are safe to commit\ngit add workspace/config/secure.enc.yaml\ngit commit -m "Add encrypted configuration"\n```\n\n### 6. Rotation Strategy\n\n**Regular Key Rotation**:\n\n```\n# Generate new Age key\nage-keygen -o ~/.config/sops/age/keys-new.txt\n\n# Update .sops.yaml with new recipient\n\n# Rotate keys for file\nprovisioning config rotate-keys workspace/config/secure.yaml <new-key-id>\n```\n\n**Frequency**:\n\n- Development: Annually\n- Production: Quarterly\n- After team member departure: Immediately\n\n### 7. Audit and Monitoring\n\n**Track encryption status**:\n\n```\n# Regular scans\nprovisioning config scan-sensitive workspace --recursive\n\n# Validate encryption setup\nprovisioning config validate-encryption\n```\n\n**Monitor access** (with Vault/AWS KMS):\n\n- Enable audit logging\n- Review access patterns\n- Alert on anomalies\n\n---\n\n## Troubleshooting\n\n### SOPS Not Found\n\n**Error**:\n\n```\nSOPS binary not found\n```\n\n**Solution**:\n\n```\n# Install SOPS\nbrew install sops\n\n# Verify\nsops --version\n```\n\n### Age Key Not Found\n\n**Error**:\n\n```\nAge key file not found: ~/.config/sops/age/keys.txt\n```\n\n**Solution**:\n\n```\n# Generate new key\nmkdir -p ~/.config/sops/age\nage-keygen -o ~/.config/sops/age/keys.txt\n\n# Set environment variable\nexport PROVISIONING_KAGE="$HOME/.config/sops/age/keys.txt"\n```\n\n### SOPS_AGE_RECIPIENTS Not Set\n\n**Error**:\n\n```\nno AGE_RECIPIENTS for file.yaml\n```\n\n**Solution**:\n\n```\n# Extract public key from private key\ngrep "public key:" ~/.config/sops/age/keys.txt\n\n# Set environment variable\nexport SOPS_AGE_RECIPIENTS="age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"\n```\n\n### Decryption Failed\n\n**Error**:\n\n```\nFailed to decrypt configuration file\n```\n\n**Solutions**:\n\n1. **Wrong key**:\n\n   ```bash\n   # Verify you have the correct private key\n   provisioning config validate-encryption\n   ```\n\n1. **File corrupted**:\n\n   ```bash\n   # Check file integrity\n   sops --decrypt workspace/config/secure.yaml\n   ```\n\n2. **Wrong backend**:\n\n   ```bash\n   # Check SOPS metadata in file\n   head -20 workspace/config/secure.yaml\n   ```\n\n### AWS KMS Access Denied\n\n**Error**:\n\n```\nAccessDeniedException: User is not authorized to perform: kms:Decrypt\n```\n\n**Solution**:\n\n```\n# Check AWS credentials\naws sts get-caller-identity\n\n# Verify KMS key policy allows your IAM user/role\naws kms describe-key --key-id <key-arn>\n```\n\n### Vault Connection Failed\n\n**Error**:\n\n```\nVault encryption failed: connection refused\n```\n\n**Solution**:\n\n```\n# Verify Vault address\necho $VAULT_ADDR\n\n# Check connectivity\ncurl -k $VAULT_ADDR/v1/sys/health\n\n# Verify token\nvault token lookup\n```\n\n---\n\n## Security Considerations\n\n### Threat Model\n\n**Protected Against**:\n\n- ✅ Plaintext secrets in git\n- ✅ Accidental secret exposure\n- ✅ Unauthorized file access\n- ✅ Key compromise (with rotation)\n\n**Not Protected Against**:\n\n- ❌ Memory dumps during decryption\n- ❌ Root/admin access to running process\n- ❌ Compromised Age/KMS keys\n- ❌ Social engineering\n\n### Security Best Practices\n\n1. **Principle of Least Privilege**: Only grant decryption access to those who need it\n2. **Key Separation**: Use different keys for different environments\n3. **Regular Audits**: Review who has access to keys\n4. **Secure Key Storage**: Never store private keys in git\n5. **Rotation**: Regularly rotate encryption keys\n6. **Monitoring**: Monitor decryption operations (with AWS KMS/Vault)\n\n---\n\n## Additional Resources\n\n- **SOPS Documentation**: <https://github.com/mozilla/sops>\n- **Age Encryption**: <https://age-encryption.org/>\n- **AWS KMS**: <https://aws.amazon.com/kms/>\n- **HashiCorp Vault**: <https://www.vaultproject.io/>\n- **Cosmian KMS**: <https://www.cosmian.com/>\n\n---\n\n## Support\n\nFor issues or questions:\n\n- Check troubleshooting section above\n- Run: `provisioning config validate-encryption`\n- Review logs with `--debug` flag\n\n---\n\n## Quick Reference\n\n### Setup (One-time)\n\n```\n# 1. Initialize encryption\nprovisioning config init-encryption --kms age\n\n# 2. Set environment variables (add to ~/.zshrc or ~/.bashrc)\nexport SOPS_AGE_RECIPIENTS="age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"\nexport PROVISIONING_KAGE="$HOME/.config/sops/age/keys.txt"\n\n# 3. Validate setup\nprovisioning config validate-encryption\n```\n\n### Common Commands\n\n| Task | Command |\n| ------ | --------- |\n| **Encrypt file** | `provisioning config encrypt secrets.yaml --in-place` |\n| **Decrypt file** | `provisioning config decrypt secrets.enc.yaml` |\n| **Edit encrypted** | `provisioning config edit-secure secrets.enc.yaml` |\n| **Check if encrypted** | `provisioning config is-encrypted secrets.yaml` |\n| **Scan for unencrypted** | `provisioning config scan-sensitive workspace --recursive` |\n| **Encrypt all sensitive** | `provisioning config encrypt-all workspace/config --kms age` |\n| **Validate setup** | `provisioning config validate-encryption` |\n| **Show encryption info** | `provisioning config encryption-info secrets.yaml` |\n\n### File Naming Conventions\n\nAutomatically encrypted by SOPS:\n\n- `workspace/*/config/secure.yaml` ← Auto-encrypted\n- `*.enc.yaml` ← Auto-encrypted\n- `*.enc.yml` ← Auto-encrypted\n- `*.enc.toml` ← Auto-encrypted\n- `workspace/*/config/providers/*credentials*.toml` ← Auto-encrypted\n\n### Quick Workflow\n\n```\n# Create config with secrets\ncat > workspace/config/secure.yaml <<EOF\ndatabase:\n  password: supersecret\napi_key: secret_key_123\nEOF\n\n# Encrypt in-place\nprovisioning config encrypt workspace/config/secure.yaml --in-place\n\n# Verify encrypted\nprovisioning config is-encrypted workspace/config/secure.yaml\n\n# Edit securely (decrypt -> edit -> re-encrypt)\nprovisioning config edit-secure workspace/config/secure.yaml\n\n# Configs are auto-decrypted when loaded\nprovisioning env  # Automatically decrypts secure.yaml\n```\n\n### KMS Backends\n\n| Backend | Use Case | Setup Command |\n| --------- | ---------- | --------------- |\n| **Age** | Development, simple setup | `provisioning config init-encryption --kms age` |\n| **AWS KMS** | Production, AWS environments | Configure in `.sops.yaml` |\n| **Vault** | Enterprise, dynamic secrets | Set `VAULT_ADDR` and `VAULT_TOKEN` |\n| **Cosmian** | Confidential computing | Configure in `config.toml` |\n\n### Security Checklist\n\n- ✅ Encrypt all files with passwords, API keys, secrets\n- ✅ Never commit unencrypted secrets to git\n- ✅ Set file permissions: `chmod 600 ~/.config/sops/age/keys.txt`\n- ✅ Add plaintext files to `.gitignore`: `*.dec.yaml`, `secrets.yaml`\n- ✅ Regular key rotation (quarterly for production)\n- ✅ Separate keys per environment (dev/staging/prod)\n- ✅ Backup Age keys securely (encrypted backup)\n\n### Troubleshooting\n\n| Problem | Solution |\n| --------- | ---------- |\n| `SOPS binary not found` | `brew install sops` |\n| `Age key file not found` | `provisioning config init-encryption --kms age` |\n| `SOPS_AGE_RECIPIENTS not set` | `export SOPS_AGE_RECIPIENTS="age1..."` |\n| `Decryption failed` | Check key file: `provisioning config validate-encryption` |\n| `AWS KMS Access Denied` | Verify IAM permissions: `aws sts get-caller-identity` |\n\n### Testing\n\n```\n# Run all encryption tests\nnu provisioning/core/nulib/lib_provisioning/config/encryption_tests.nu\n\n# Run specific test\nnu provisioning/core/nulib/lib_provisioning/config/encryption_tests.nu --test roundtrip\n\n# Test full workflow\nnu provisioning/core/nulib/lib_provisioning/config/encryption_tests.nu test-full-encryption-workflow\n\n# Test KMS backend\nuse lib_provisioning/kms/client.nu\nkms-test --backend age\n```\n\n### Integration\n\nConfigs are **automatically decrypted** when loaded:\n\n```\n# Nushell code - encryption is transparent\nuse lib_provisioning/config/loader.nu\n\n# Auto-decrypts encrypted files in memory\nlet config = (load-provisioning-config)\n\n# Access secrets normally\nlet db_password = ($config | get database.password)\n```\n\n### Emergency Key Recovery\n\nIf you lose your Age key:\n\n1. **Check backups**: `~/.config/sops/age/keys.txt.backup`\n2. **Check other systems**: Keys might be on other dev machines\n3. **Contact team**: Team members with access can re-encrypt for you\n4. **Rotate secrets**: If keys are lost, rotate all secrets\n\n### Advanced\n\n#### Multiple Recipients (Team Access)\n\n```\n# .sops.yaml\ncreation_rules:\n  - path_regex: .*\.enc\.yaml$\n    age: >-\n      age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p,\n      age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8q\n```\n\n#### Key Rotation\n\n```\n# Generate new key\nage-keygen -o ~/.config/sops/age/keys-new.txt\n\n# Update .sops.yaml with new recipient\n\n# Rotate keys for file\nprovisioning config rotate-keys workspace/config/secure.yaml <new-key-id>\n```\n\n#### Scan and Encrypt All\n\n```\n# Find all unencrypted sensitive configs\nprovisioning config scan-sensitive workspace --recursive\n\n# Encrypt them all\nprovisioning config encrypt-all workspace --kms age --recursive\n\n# Verify\nprovisioning config scan-sensitive workspace --recursive\n```\n\n### Documentation\n\n- **Full Guide**: `docs/user/CONFIG_ENCRYPTION_GUIDE.md`\n- **SOPS Docs**: <https://github.com/mozilla/sops>\n- **Age Docs**: <https://age-encryption.org/>\n\n---\n\n**Last Updated**: 2025-10-08\n**Version**: 1.0.0
