From 5913c5f352ff6b8c42f37685f5ae02cfe2d3b458 Mon Sep 17 00:00:00 2001
From: kloud-bot <ws@kloud.email>
Date: Tue, 13 Jan 2026 07:22:54 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=84=20Sync=20updated=20`workspace`=20m?=
 =?UTF-8?q?anifests=20@=20cd3c1f5d814b0d58bb15c79023afd3df4aa930f1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .vitepress/data/dependencies.yaml  |  2 +-
 .vitepress/data/env.reference.yaml | 52 ++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 1 deletion(-)

diff --git a/.vitepress/data/dependencies.yaml b/.vitepress/data/dependencies.yaml
index 584fa68..d357f1e 100644
--- a/.vitepress/data/dependencies.yaml
+++ b/.vitepress/data/dependencies.yaml
@@ -715,7 +715,7 @@ dependencies:
     home: https://github.com/kloudkit/ws-cli
     license: MIT
     package: github.com/kloudkit/ws-cli
-    version: 0.0.36
+    version: 0.0.43
 
   yamllint:
     cmd: yamllint --version
diff --git a/.vitepress/data/env.reference.yaml b/.vitepress/data/env.reference.yaml
index 54f095c..8f69f14 100644
--- a/.vitepress/data/env.reference.yaml
+++ b/.vitepress/data/env.reference.yaml
@@ -292,6 +292,58 @@ envs:
         description: Combined log file for `stdout` and `stderr`.
         since: 0.0.21
 
+  secrets:
+    properties:
+      master_key:
+        type: string
+        default: null
+        example: dGhpcyBpcyBhIHNlY3JldCBrZXkgZXhhbXBsZQ==
+        since: 0.1.1
+        description: Master encryption key for secrets vault.
+        longDescription: |
+          Used to encrypt and decrypt secrets in the vault.
+          Can be provided as:
+
+          - A base64-encoded string.
+          - A plaintext string.
+
+          **Master key lookup precedence:**
+
+          1. CLI `--master` flag *(if provided)*.
+          2. `WS_SECRETS_MASTER_KEY` *(this variable)*.
+          3. `WS_SECRETS_MASTER_KEY_FILE`.
+          4. `/etc/workspace/master.key` *(default path)*.
+
+      master_key_file:
+        type: string
+        default: /etc/workspace/master.key
+        example: /etc/workspace/custom-master.key
+        since: 0.1.1
+        description: Path to file containing the master encryption key.
+        longDescription: |
+          Used to encrypt and decrypt secrets in the vault.
+          Can be provided as:
+
+          - A base64-encoded string.
+          - A plaintext string.
+
+          **Master key lookup precedence:*
+
+          1. CLI `--master` flag *(if provided)*.
+          2. `WS_SECRETS_MASTER_KEY`.
+          3. `WS_SECRETS_MASTER_KEY_FILE` *(this variable)*.
+          4. `/etc/workspace/master.key` *(default path)*.
+
+      vault:
+        type: string
+        default: null
+        example: /workspace/.vault.yaml
+        since: 0.1.1
+        description: Path to the secrets vault file.
+        longDescription: |
+          A YAML file containing encrypted secrets that can be decrypted and
+          deployed to various destinations during startup.
+
   server:
     properties:
       port: