pack

monkeys pack [path] [--open] [--only [KEY[,KEY...]] [@profile[,profile...] [KEY[,KEY...]]]...]

Writes a project's secrets as one encrypted file, the only way they leave the vault. With no arguments it takes every profile the .monkeys file declares:

monkeys pack

Passphrase:
Again:
wrote /tmp/a.monsecrets: +foo @test,production @production, 5 secrets

The file goes to /tmp, which is never inside a repository, and the message shows the path. A path before --only puts it elsewhere: a directory gets a.monsecrets inside it, and a file path is used as given, with .monkeys added when missing.

monkeys pack ~/Desktop
monkeys pack ~/Desktop/for-sam

wrote ~/Desktop/a.monsecrets: +foo @test,production @production, 5 secrets
wrote ~/Desktop/for-sam.monsecrets: +foo @test,production @production, 5 secrets

It carries the project's namespace, each profile's name, the keys the project lists for it, and their secrets, sealed with ChaCha20-Poly1305 under a key scrypt derives from the passphrase. One bundle carries one project. The file is safe to send over whatever you already use; the passphrase goes another way.

--open then reveals the file, in Finder with the file selected, or its folder through xdg-open on Linux, since the next thing to do with a bundle is to drag it somewhere.

A pack with a secret still missing refuses, since a bundle that fills half a profile is a bug for whoever receives it.

--only

--only says which profiles and keys, and reads the way the file is written: a @profile opens a block, @a,b opens one for several profiles at once, and the keys after it belong to every profile in that block. A block with no keys after it goes whole; keys before any @ come from the default profile, the first the file mentions. That is how a teammate gets test and never production, or one key on its own:

monkeys pack --only @test
monkeys pack shared --only @test @production
monkeys pack --only DATABASE_URL
monkeys pack --only @test,production DATABASE_URL
monkeys pack --only @test DATABASE_URL @production SENTRY_DSN

wrote /tmp/a.monsecrets: +foo @test, 2 secrets
wrote shared.monsecrets: +foo @test @production, 5 secrets
wrote /tmp/a.monsecrets: +foo @test, 1 secret
wrote /tmp/a.monsecrets: +foo @test,production, 2 secrets
wrote /tmp/a.monsecrets: +foo @test @production, 2 secrets

The bundle keeps that shape, block for block, and unpack writes it back as the project file. The path goes before --only, which takes the rest of the line. A key a profile does not list is refused rather than left out.

Outside a project, --only @foo.test names a profile in full, and a bundle made there carries its profiles under their full names, with no + line.

The passphrase is read from standard input when it is not a terminal, for the rare script that needs to.