skarbiec export

Invocation#

skarbiec export <out-file> [--browser-csv | --bitwarden-csv | --canonical] [--encrypt-to <uid>] [--kind <kind>] [--tag <tag>] [--updated-before <iso8601>] [--match <text>] [--shared-with <uid>] [--pinned]

Purpose#

Write a runtime view of the vault for a consumer that reads one JSON file instead of resolving each item, a copy another vault imports, or hand the logins to a browser's own password manager or to Bitwarden: the decrypted live items, narrowed to the ones it is for.

Required inputs and options#

• Requires the output path, relative to the working directory, as the first positional or --out; name it before any flag. --kind, --tag, --updated-before, --match, --shared-with and --pinned narrow the items exactly as they narrow list. --canonical writes rows import reads back instead of bare payloads. --browser-csv writes the CSV Chrome, Edge, Firefox and Safari import instead of JSON; every exported item must then be a login, so it is used with --kind login. --bitwarden-csv writes the CSV Bitwarden's import reads (https://bitwarden.com/help/condition-bitwarden-import/); every exported item must then be a login or a note. --encrypt-to names one registered recipient whose key seals the file. POST /v1/operator/items/export takes an absolute path and the same flags.

Output and state effects#

• Decrypts every live item that passes the filters and writes them to the output file, owner-only from its first byte and replaced atomically: one JSON array of canonical payloads; with --canonical one JSON array of rows with id, payload and tags, which `skarbiec import` reads back (recipients are left out, since another vault registers its own); with --browser-csv a header row name,url,username,password,note and one row per login, every cell quoted (name is context.display_name, else the id; url is https://<first site>/, empty for a login with no site; note is context.notes, the notes command's text, empty when there are none); or with --bitwarden-csv Bitwarden's header folder,favorite,type,name,notes,fields,reprompt,login_uri,login_username,login_password,login_totp and one row per item — a login with every site as https://<site>/ in login_uri, comma separated, and its totp_secret in login_totp; a note with its text, followed by its notes, in notes. With --encrypt-to the same content is written as an armored OpenPGP message to that recipient's key, which `gpg --decrypt` opens with their secret key and `skarbiec import` opens itself, so the file is never plaintext on disk. Prints ok, exported (how many items), out, browser_csv, bitwarden_csv, canonical and encrypted_to. The vault stays the source of truth, and without --encrypt-to every value in the file is plaintext, so the narrowest filter that serves the consumer is the one to use and a CSV is deleted once imported. import --format browser-csv reads the browser file back.

Refusals#

• A missing path exits 2 with the usage. --all and --trashed exit 2 with `export writes live items only; a trashed item does not open, so --<flag> is refused`, and naming two of --browser-csv, --bitwarden-csv and --canonical exits 2 with `--browser-csv, --bitwarden-csv and --canonical are shapes of the file; name one`. With --browser-csv an item of another kind is refused with `--browser-csv holds logins only, and these items are another kind: <ids>; add --kind login`; with --bitwarden-csv an item that is neither a login nor a note is refused naming the items and --kind; a username, password, seed or note text that is not text names the item. --encrypt-to with a uid that is not registered exits 2 with `--encrypt-to <uid> is not a registered recipient; `skarbiec recipient list` names them`, and gpg's refusal to encrypt is shown in its words. Each list refusal applies to the filters, an item that will not open fails the export with its decryption error, and a file that cannot be written fails naming the path; nothing is written on any refusal.