Vault manifest operations: entry types, load/save, ID generation.
Types
EntryKind = enum ekFile = "file", ## Regular file entry ekDir = "dir" ## Directory entry (for future use) ## hash = SHA-256 of ciphertext blob; contentHash = SHA-256 of plaintext (optional, v4+).
VaultEntry = tuple[id, path, hash: string, kind: EntryKind, contentHash: string]
Procs
proc expandHome(p: string): string {....raises: [], tags: [ReadEnvEffect, ReadIOEffect], forbids: [].}
- Expand ~ to $HOME in path strings.
proc genId(): string {....raises: [], tags: [], forbids: [].}
- 16-char random hex via cryptographic randomness.
proc isPathSafe(cfg: GpgConfig; manifestPath: string): bool {....raises: [], tags: [ReadEnvEffect, ReadIOEffect], forbids: [].}
- Validate that a manifest path resolves within expected boundaries. Returns false for directory traversal attempts (e.g. ../../etc/passwd).
proc loadManifest(repo: string; verifySig = false; cfg = GpgConfig()): seq[ VaultEntry] {....raises: [NimvaultError, OSError, IOError, ValueError], tags: [ ReadDirEffect, ReadEnvEffect, ReadIOEffect, ExecIOEffect, RootEffect, WriteIOEffect, TimeEffect], forbids: [].}
-
Decrypt and parse the vault manifest. Returns empty seq if no manifest exists. Supports v1–v4 (v4 adds plaintext contentHash for fast status).
cfg is optional so the many call sites that only read a gpg vault stay unchanged. findManifest still refuses to report a vault sealed by the other backend as empty, so omitting it fails loudly rather than quietly.
proc resolvePath(cfg: GpgConfig; path: string): string {....raises: [], tags: [ReadEnvEffect, ReadIOEffect], forbids: [].}
- Resolve a manifest path to an absolute filesystem path. When cfg.root is set, paths are relative to root. Otherwise, ~/... paths are expanded via expandHome.
proc saveManifest(repo: string; entries: seq[VaultEntry]; cfg: GpgConfig) {. ...raises: [IOError, NimvaultError, OSError, ValueError], tags: [WriteIOEffect, ExecIOEffect, ReadEnvEffect, RootEffect, ReadDirEffect, ReadIOEffect, TimeEffect, WriteDirEffect], forbids: [].}
- Serialize entries (v4: blob hash, kind, plaintext content hash) and encrypt.
proc storePath(cfg: GpgConfig; absPath: string; repo: string): string {. ...raises: [Exception], tags: [RootEffect, ReadEnvEffect, ReadIOEffect], forbids: [].}
- Convert an absolute path to the stored manifest format. When cfg.root is set, stores relative to root. Otherwise, stores with ~/ prefix if under HOME.
proc vaultDir(repo: string): string {....raises: [], tags: [], forbids: [].}
- Path to the .vault directory within a repo.