{
  "slug": "sops-encrypt",
  "name": "gizza-ai/sops-encrypt",
  "version": "0.1.0",
  "title": "SOPS-style config encryption — encrypt YAML, JSON and .env values — gizza.ai",
  "description": "Encrypt or decrypt YAML, JSON and .env values with a passphrase. Keys stay readable, the file stays valid, and diffs still show what changed.",
  "tags": [
    "sops",
    "encrypt yaml",
    "encrypt json",
    "encrypt env file",
    "secrets",
    "config encryption",
    "aes-256-gcm"
  ],
  "category": "security",
  "urls": {
    "page": "https://gizza.ai/tools/sops-encrypt/",
    "markdown": "https://gizza.ai/tools/sops-encrypt/index.md",
    "descriptor": "https://gizza.ai/tools/sops-encrypt/tool.json",
    "deep_link_example": "https://gizza.ai/tools/sops-encrypt/?document=app%3A%20demo%0Adatabase%3A%0A%20%20host_unencrypted%3A%20db.internal%0A%20%20password%3A%20s3cr3t%0A%20%20port%3A%205432&passphrase=A%20long%20passphrase%20you%20can%20reproduce%20later&mode=encrypt&format=auto&encrypted_suffix=_secret&unencrypted_suffix=_unencrypted&encrypted_regex=%5E%28password%7Ctoken%7C.%2A_key%29%24&unencrypted_regex=%5E%28host%7Cregion%7Cport%29%24"
  },
  "cli": "gizza tool sops-encrypt \"app: demo\ndatabase:\n  host_unencrypted: db.internal\n  password: s3cr3t\n  port: 5432\" 'passphrase=A long passphrase you can reproduce later'",
  "tool": {
    "description": "Encrypt or decrypt the values of a YAML, JSON or .env document with a passphrase, leaving every key readable. Each selected leaf value is replaced with an ENC[GZAE1,data:...,iv:...,tag:...,type:...] marker (AES-256-GCM, one PBKDF2-HMAC-SHA256 key per document, the value's key path as authenticated data), so the file stays valid, stays diffable, and a ciphertext cannot be moved to another key. Pick which values are covered with encrypted_suffix, unencrypted_suffix (default _unencrypted), encrypted_regex or unencrypted_regex — one at a time. mode=decrypt reverses a document this tool produced and restores the original scalar types. This is a passphrase-based format, not the sops binary's KMS/age/PGP format, so the output is not interchangeable with the sops CLI.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "document": {
          "description": "The YAML, JSON or .env document to rewrite. Paste the file contents; the format is auto-detected unless format is set. Keys stay readable — only leaf values are replaced with ENC[GZAE1,...] markers, and a metadata block carrying the KDF salt is appended so the same tool can decrypt it later.",
          "type": "string"
        },
        "encrypted_regex": {
          "description": "Encrypt ONLY values whose key, or an ancestor key, matches this regular expression (e.g. ^(password|token|.*_key)$). Ignored when mode=decrypt.",
          "type": "string"
        },
        "encrypted_suffix": {
          "description": "Encrypt ONLY values whose key, or an ancestor key, ends with this suffix (e.g. _secret). Leave empty to encrypt everything the unencrypted rules do not exempt. Only one of encrypted_suffix, unencrypted_suffix, encrypted_regex and unencrypted_regex may be set at a time. Ignored when mode=decrypt.",
          "type": "string"
        },
        "format": {
          "default": "auto",
          "description": "Document format. auto (default) detects JSON by its opening brace, .env when every meaningful line is a KEY=VALUE assignment, and YAML otherwise.",
          "enum": [
            "auto",
            "yaml",
            "json",
            "env"
          ],
          "type": "string"
        },
        "mode": {
          "default": "encrypt",
          "description": "encrypt replaces the selected leaf values with ENC[GZAE1,...] markers; decrypt restores a document this tool encrypted, including the original scalar types.",
          "enum": [
            "encrypt",
            "decrypt"
          ],
          "type": "string"
        },
        "passphrase": {
          "description": "Passphrase the per-document AES-256-GCM key is derived from (PBKDF2-HMAC-SHA256, 200000 iterations). The same passphrase is needed to decrypt. Treat it as a secret: do not put it in a shared link, a bookmark, a ticket, or anything else that gets pasted alongside the encrypted document.",
          "type": "string"
        },
        "unencrypted_regex": {
          "description": "Leave values whose key, or an ancestor key, matches this regular expression in the clear (e.g. ^(host|region|port)$). Ignored when mode=decrypt.",
          "type": "string"
        },
        "unencrypted_suffix": {
          "default": "_unencrypted",
          "description": "Leave values whose key, or an ancestor key, ends with this suffix in the clear. Defaults to _unencrypted; set it to an empty string to encrypt every value. Ignored when mode=decrypt.",
          "type": "string"
        }
      },
      "required": [
        "document",
        "passphrase"
      ],
      "type": "object"
    }
  }
}