@envsave/cli 1.0.37

package/dist/cli.js

@@ -0,0 +1,1604 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/crypto.ts
+import { createCipheriv, createDecipheriv, createHmac, randomBytes, pbkdf2Sync } from "node:crypto";
+function deriveKey(password, salt) {
+  return pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, KEY_LENGTH, "sha512");
+}
+function encrypt(data, password) {
+  const salt = randomBytes(SALT_LENGTH);
+  const iv = randomBytes(IV_LENGTH);
+  const key = deriveKey(password, salt);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(data, "utf8"), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return Buffer.concat([salt, iv, encrypted, authTag]);
+}
+function decrypt(payload, password) {
+  const salt = payload.subarray(0, SALT_LENGTH);
+  const iv = payload.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);
+  const authTag = payload.subarray(payload.length - AUTH_TAG_LENGTH);
+  const encrypted = payload.subarray(SALT_LENGTH + IV_LENGTH, payload.length - AUTH_TAG_LENGTH);
+  const key = deriveKey(password, salt);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(authTag);
+  return decipher.update(encrypted) + decipher.final("utf8");
+}
+function encryptWithKey(data, key) {
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(data, "utf8"), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return Buffer.concat([iv, encrypted, authTag]);
+}
+function decryptWithKey(payload, key) {
+  const iv = payload.subarray(0, IV_LENGTH);
+  const authTag = payload.subarray(payload.length - AUTH_TAG_LENGTH);
+  const encrypted = payload.subarray(IV_LENGTH, payload.length - AUTH_TAG_LENGTH);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(authTag);
+  return decipher.update(encrypted) + decipher.final("utf8");
+}
+function hmacSha256(seedHex, data) {
+  return createHmac("sha256", Buffer.from(seedHex, "hex")).update(data).digest("hex");
+}
+var PBKDF2_ITERATIONS = 1e5, SALT_LENGTH = 32, IV_LENGTH = 12, KEY_LENGTH = 32, AUTH_TAG_LENGTH = 16;
+var init_crypto = () => {};
+
+// src/env-parser.ts
+import { readFileSync } from "node:fs";
+function parseEnvFile(filePath) {
+  const content = readFileSync(filePath, "utf8");
+  const result = {};
+  for (const line of content.split(`
+`)) {
+    let trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    if (trimmed.startsWith("export ")) {
+      trimmed = trimmed.substring(7).trim();
+    }
+    const eqIndex = trimmed.indexOf("=");
+    if (eqIndex === -1)
+      continue;
+    const key = trimmed.substring(0, eqIndex).trim();
+    let value = trimmed.substring(eqIndex + 1).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    if (key) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+var init_env_parser = () => {};
+
+// src/license.ts
+import { readFileSync as readFileSync2, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+function ensureDir() {
+  if (!existsSync(ENVSAVE_DIR)) {
+    mkdirSync(ENVSAVE_DIR, { recursive: true, mode: 448 });
+  }
+}
+function parseToken(token) {
+  if (!token.startsWith("es_"))
+    return null;
+  try {
+    const b64 = token.slice(3);
+    const pad = b64.length % 4 === 0 ? "" : "=".repeat(4 - b64.length % 4);
+    const raw = Buffer.from(b64.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64").toString("utf8");
+    const parts = raw.split("|");
+    if (parts.length !== 4)
+      return null;
+    return {
+      email: parts[0],
+      createdAt: new Date(Number(parts[1]) * 1000),
+      expiresAt: new Date(Number(parts[2]) * 1000)
+    };
+  } catch {
+    return null;
+  }
+}
+async function activateLicense(token, offline = false) {
+  const dates = parseToken(token);
+  const OFFLINE_ALLOWED_EMAILS = [
+    "support@envsave.com"
+  ];
+  if (offline) {
+    if (!dates) {
+      console.error("Invalid token format. Must be a signed es_ token.");
+      return false;
+    }
+    if (!OFFLINE_ALLOWED_EMAILS.includes(dates.email)) {
+      console.error("Offline activation is not available for this account.");
+      return false;
+    }
+    if (dates.expiresAt < new Date) {
+      console.error("Token is expired.");
+      return false;
+    }
+    ensureDir();
+    writeFileSync(LICENSE_FILE, JSON.stringify({
+      token,
+      validatedAt: new Date().toISOString(),
+      expiresAt: dates.expiresAt.toISOString()
+    }, null, 2), { mode: 384 });
+    return true;
+  }
+  try {
+    const response = await fetch(LICENSE_API_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ token })
+    });
+    if (!response.ok) {
+      console.error("License validation failed: server returned", response.status);
+      return false;
+    }
+    const data = await response.json();
+    if (!data.valid) {
+      console.error("Invalid license token.");
+      return false;
+    }
+    ensureDir();
+    const licenseData = {
+      token,
+      validatedAt: new Date().toISOString(),
+      expiresAt: dates?.expiresAt.toISOString() ?? data.expiresAt ?? null
+    };
+    writeFileSync(LICENSE_FILE, JSON.stringify(licenseData, null, 2), { mode: 384 });
+    return true;
+  } catch (err) {
+    console.error("Failed to contact license server:", err.message);
+    return false;
+  }
+}
+function getLicenseToken() {
+  if (!existsSync(LICENSE_FILE))
+    return null;
+  try {
+    const data = JSON.parse(readFileSync2(LICENSE_FILE, "utf8"));
+    return data.token ?? null;
+  } catch {
+    return null;
+  }
+}
+async function tryAutoRenew(token) {
+  try {
+    const response = await fetch(RENEW_API_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ token })
+    });
+    if (!response.ok)
+      return false;
+    const result = await response.json();
+    if (!result.token || !result.renewed)
+      return false;
+    const newDates = parseToken(result.token);
+    ensureDir();
+    writeFileSync(LICENSE_FILE, JSON.stringify({
+      token: result.token,
+      validatedAt: new Date().toISOString(),
+      expiresAt: newDates?.expiresAt.toISOString() ?? result.expiresAt ?? null
+    }, null, 2), { mode: 384 });
+    console.error("License renewed automatically.");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function hasValidLicense() {
+  if (!existsSync(LICENSE_FILE))
+    return false;
+  try {
+    const data = JSON.parse(readFileSync2(LICENSE_FILE, "utf8"));
+    const dates = parseToken(data.token);
+    if (dates)
+      return dates.expiresAt > new Date;
+    if (data.expiresAt)
+      return new Date(data.expiresAt) > new Date;
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function checkLicense() {
+  if (!existsSync(LICENSE_FILE))
+    return false;
+  try {
+    const data = JSON.parse(readFileSync2(LICENSE_FILE, "utf8"));
+    const dates = parseToken(data.token);
+    if (dates) {
+      if (dates.expiresAt > new Date)
+        return true;
+      return await tryAutoRenew(data.token);
+    }
+    if (data.expiresAt) {
+      if (new Date(data.expiresAt) > new Date)
+        return true;
+      return await tryAutoRenew(data.token);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+var ENVSAVE_DIR, LICENSE_FILE, LICENSE_API_URL, RENEW_API_URL;
+var init_license = __esm(() => {
+  ENVSAVE_DIR = join(homedir(), ".envsave");
+  LICENSE_FILE = join(ENVSAVE_DIR, "license.json");
+  LICENSE_API_URL = process.env.ENVSAVE_LICENSE_API || "https://api.envsave.com/api/license/validate";
+  RENEW_API_URL = (process.env.ENVSAVE_LICENSE_API || "https://api.envsave.com/api/license/validate").replace("/validate", "/renew");
+});
+
+// src/vault.ts
+var exports_vault = {};
+__export(exports_vault, {
+  vaultExists: () => vaultExists,
+  showSecret: () => showSecret,
+  setSecret: () => setSecret,
+  searchKeys: () => searchKeys,
+  revealKey: () => revealKey,
+  listKeys: () => listKeys,
+  initVault: () => initVault,
+  importEnv: () => importEnv,
+  hasSecretWithSession: () => hasSecretWithSession,
+  getSecretWithSession: () => getSecretWithSession,
+  getSecretFromCache: () => getSecretFromCache,
+  getSecret: () => getSecret,
+  getRateLimitConfig: () => getRateLimitConfig,
+  getDeploySecrets: () => getDeploySecrets,
+  exportEnv: () => exportEnv,
+  deleteSecret: () => deleteSecret,
+  configureRateLimit: () => configureRateLimit,
+  changePassword: () => changePassword
+});
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, chmodSync, appendFileSync, statSync } from "node:fs";
+import { join as join2 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { randomBytes as randomBytes2 } from "node:crypto";
+function getEnvsaveDir() {
+  return process.env.ENVSAVE_DIR || join2(homedir2(), ".envsave");
+}
+function getVaultFile() {
+  return join2(getEnvsaveDir(), "vault.enc");
+}
+function getCacheFile() {
+  return join2(getEnvsaveDir(), "cache.enc");
+}
+function getSessionFile() {
+  return join2(getEnvsaveDir(), ".session");
+}
+function getRateFile() {
+  return join2(getEnvsaveDir(), ".rate");
+}
+function getAccessLog() {
+  return join2(getEnvsaveDir(), "access.log");
+}
+function getConfigFile() {
+  return join2(getEnvsaveDir(), "config.json");
+}
+function guardRealVault() {
+  if (false) {}
+}
+function readConfig() {
+  if (!existsSync2(getConfigFile())) {
+    return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX, sessionTtlHours: DEFAULT_SESSION_TTL_MS / 3600000 };
+  }
+  try {
+    return JSON.parse(readFileSync3(getConfigFile(), "utf8"));
+  } catch {
+    return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX, sessionTtlHours: DEFAULT_SESSION_TTL_MS / 3600000 };
+  }
+}
+function writeConfig(config) {
+  ensureDir2();
+  writeFileSync2(getConfigFile(), JSON.stringify(config, null, 2), { mode: 384 });
+}
+function configureRateLimit(password, options) {
+  readMainVault(password);
+  const config = readConfig();
+  if (options.maxGetsPerMinute !== undefined)
+    config.maxGetsPerMinute = options.maxGetsPerMinute;
+  if (options.sessionTtlHours !== undefined)
+    config.sessionTtlHours = options.sessionTtlHours;
+  writeConfig(config);
+  return config;
+}
+function getRateLimitConfig() {
+  return readConfig();
+}
+function hexToBaseN(hex, length, chars) {
+  let result = "";
+  for (let i = 0;i < length; i++) {
+    const hexPair = hex.slice(i * 2 % hex.length, i * 2 % hex.length + 2) || hex.slice(0, 2);
+    const byte = parseInt(hexPair, 16);
+    result += chars[byte % chars.length];
+  }
+  return result;
+}
+function computeOpaqueNameV3(hmacSeed, cleanName, sshKeyContent) {
+  let effectiveSeed = hmacSeed;
+  if (sshKeyContent) {
+    effectiveSeed = hmacSha256(hmacSeed, sshKeyContent);
+  }
+  const hash1 = hmacSha256(effectiveSeed, cleanName);
+  const hash2 = hmacSha256(effectiveSeed, cleanName + ":2");
+  return "es_" + hexToBaseN(hash1 + hash2, 48, BASE_CHARS_V3);
+}
+function computeOpaqueName(hmacSeed, cleanName, sshKeyContent) {
+  let effectiveSeed = hmacSeed;
+  if (sshKeyContent) {
+    effectiveSeed = hmacSha256(hmacSeed, sshKeyContent);
+  }
+  const hash1 = hmacSha256(effectiveSeed, cleanName);
+  const hash2 = hmacSha256(effectiveSeed, cleanName + ":2");
+  return "es_" + hexToBaseN(hash1 + hash2, 48, BASE_CHARS);
+}
+function computeOpaqueNameV4(hmacSeed, cleanName, sshKeyContent) {
+  let effectiveSeed = hmacSeed;
+  if (sshKeyContent) {
+    effectiveSeed = hmacSha256(hmacSeed, sshKeyContent);
+  }
+  const hash1 = hmacSha256(effectiveSeed, cleanName);
+  const hash2 = hmacSha256(effectiveSeed, cleanName + ":2");
+  return "es_" + hexToBaseN(hash1 + hash2, 48, BASE_CHARS_V4);
+}
+function computeOpaqueNameV2(hmacSeed, cleanName, sshKeyContent) {
+  let effectiveSeed = hmacSeed;
+  if (sshKeyContent) {
+    effectiveSeed = hmacSha256(hmacSeed, sshKeyContent);
+  }
+  const hash = hmacSha256(effectiveSeed, cleanName);
+  return "es_" + hash.slice(0, 24);
+}
+function ensureDir2() {
+  guardRealVault();
+  if (!existsSync2(getEnvsaveDir())) {
+    mkdirSync2(getEnvsaveDir(), { recursive: true, mode: 448 });
+  }
+}
+function vaultExists() {
+  return existsSync2(getVaultFile());
+}
+function readMainVault(password) {
+  guardRealVault();
+  if (!existsSync2(getVaultFile())) {
+    throw new Error("Vault not found. Run 'envsave init' first.");
+  }
+  const payload = readFileSync3(getVaultFile());
+  const json = decrypt(payload, password);
+  const data = JSON.parse(json);
+  if (!data.version || data.version < 2) {
+    throw new Error("Vault format outdated. Delete ~/.envsave/ and re-initialize.");
+  }
+  if (data.version === 2 && data.registry?.length > 0) {
+    const sshKeyContent = data.sshKeyPath && existsSync2(data.sshKeyPath) ? readFileSync3(data.sshKeyPath, "utf8") : undefined;
+    const newSecrets = {};
+    for (const cleanName of data.registry) {
+      const oldKey = computeOpaqueNameV2(data.hmacSeed, cleanName, sshKeyContent);
+      const newKey = computeOpaqueName(data.hmacSeed, cleanName, sshKeyContent);
+      if (oldKey in data.secrets) {
+        newSecrets[newKey] = data.secrets[oldKey];
+      }
+    }
+    data.secrets = newSecrets;
+    data.version = 3;
+    writeMainVault(data, password);
+    console.error("Vault migrated to v3 (stronger opaque keys).");
+  }
+  if (data.version === 3 && data.registry?.length > 0) {
+    const sshKeyContent = data.sshKeyPath && existsSync2(data.sshKeyPath) ? readFileSync3(data.sshKeyPath, "utf8") : undefined;
+    const newSecrets = {};
+    for (const cleanName of data.registry) {
+      const oldKey = computeOpaqueNameV3(data.hmacSeed, cleanName, sshKeyContent);
+      const newKey = computeOpaqueName(data.hmacSeed, cleanName, sshKeyContent);
+      if (oldKey in data.secrets) {
+        newSecrets[newKey] = data.secrets[oldKey];
+      }
+    }
+    data.secrets = newSecrets;
+    data.version = 4;
+    writeMainVault(data, password);
+    console.error("Vault migrated to v4 (shell-safe opaque keys).");
+  }
+  if (data.version === 4 && data.registry?.length > 0) {
+    const sshKeyContent = data.sshKeyPath && existsSync2(data.sshKeyPath) ? readFileSync3(data.sshKeyPath, "utf8") : undefined;
+    const newSecrets = {};
+    for (const cleanName of data.registry) {
+      const oldKey = computeOpaqueNameV4(data.hmacSeed, cleanName, sshKeyContent);
+      const newKey = computeOpaqueName(data.hmacSeed, cleanName, sshKeyContent);
+      if (oldKey in data.secrets) {
+        newSecrets[newKey] = data.secrets[oldKey];
+      }
+    }
+    data.secrets = newSecrets;
+    data.version = 5;
+    writeMainVault(data, password);
+    console.error("Vault migrated to v5 (Vercel-compatible opaque keys).");
+  }
+  return data;
+}
+function writeMainVault(data, password) {
+  ensureDir2();
+  const json = JSON.stringify(data);
+  const encrypted = encrypt(json, password);
+  writeFileSync2(getVaultFile(), encrypted, { mode: 384 });
+}
+function writeSessionCache(secrets, registry) {
+  ensureDir2();
+  const sessionKey = randomBytes2(32);
+  const cache = { secrets, registry };
+  const json = JSON.stringify(cache);
+  const encrypted = encryptWithKey(json, sessionKey);
+  writeFileSync2(getCacheFile(), encrypted, { mode: 384 });
+  writeFileSync2(getSessionFile(), sessionKey.toString("hex"), { mode: 384 });
+}
+function readSessionCache() {
+  if (!existsSync2(getSessionFile()) || !existsSync2(getCacheFile()))
+    return null;
+  try {
+    const sessionStat = statSync(getSessionFile());
+    const age = Date.now() - sessionStat.mtimeMs;
+    const config = readConfig();
+    if (age > config.sessionTtlHours * 3600000) {
+      return null;
+    }
+    const sessionKeyHex = readFileSync3(getSessionFile(), "utf8").trim();
+    const sessionKey = Buffer.from(sessionKeyHex, "hex");
+    const payload = readFileSync3(getCacheFile());
+    const json = decryptWithKey(payload, sessionKey);
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+function checkRateLimit() {
+  const config = readConfig();
+  const now = Date.now();
+  let timestamps = [];
+  if (existsSync2(getRateFile())) {
+    try {
+      timestamps = JSON.parse(readFileSync3(getRateFile(), "utf8"));
+    } catch {
+      timestamps = [];
+    }
+  }
+  timestamps = timestamps.filter((t) => now - t < DEFAULT_RATE_LIMIT_WINDOW_MS);
+  if (timestamps.length >= config.maxGetsPerMinute) {
+    logAccess("RATE_LIMIT_BLOCKED", "blocked");
+    throw new Error(`Rate limit exceeded. Max ${config.maxGetsPerMinute} get calls per minute. Try again in ${Math.ceil((DEFAULT_RATE_LIMIT_WINDOW_MS - (now - timestamps[0])) / 1000)}s.`);
+  }
+  const threshold = Math.floor(config.maxGetsPerMinute * 0.8);
+  if (timestamps.length >= threshold) {
+    const remaining = config.maxGetsPerMinute - timestamps.length;
+    console.error(`⚠ Rate limit warning: ${remaining} get(s) remaining this minute.`);
+  }
+  timestamps.push(now);
+  writeFileSync2(getRateFile(), JSON.stringify(timestamps), { mode: 384 });
+}
+function logAccess(opaqueKey, source) {
+  ensureDir2();
+  const entry = `${new Date().toISOString()} ${source} ${opaqueKey.slice(0, 10)}...
+`;
+  appendFileSync(getAccessLog(), entry, { mode: 384 });
+}
+function loadSshKey(vault) {
+  if (!vault.sshKeyPath)
+    return;
+  if (!existsSync2(vault.sshKeyPath)) {
+    throw new Error(`SSH key not found: ${vault.sshKeyPath}. This vault requires the SSH key to operate.`);
+  }
+  return readFileSync3(vault.sshKeyPath, "utf8");
+}
+function initVault(password, options) {
+  if (vaultExists()) {
+    throw new Error("Vault already exists. Delete ~/.envsave/vault.enc to reinitialize.");
+  }
+  if (options?.sshKeyPath && !existsSync2(options.sshKeyPath)) {
+    throw new Error(`SSH key not found: ${options.sshKeyPath}`);
+  }
+  const hmacSeed = randomBytes2(32).toString("hex");
+  const sshKeyContent = options?.sshKeyPath ? readFileSync3(options.sshKeyPath, "utf8") : undefined;
+  const vault = {
+    version: 4,
+    hmacSeed,
+    sshKeyPath: options?.sshKeyPath,
+    secrets: {},
+    registry: []
+  };
+  let count = 0;
+  if (options?.envFile) {
+    const envSecrets = parseEnvFile(options.envFile);
+    if (!hasValidLicense() && Object.keys(envSecrets).length > FREE_TIER_MAX_SECRETS) {
+      throw new Error(`Free tier limit: max ${FREE_TIER_MAX_SECRETS} secrets. .env file has ${Object.keys(envSecrets).length} keys.
+Run 'envsave activate <token>' to unlock unlimited secrets.
+Get your license at https://api.envsave.com`);
+    }
+    for (const [key, value] of Object.entries(envSecrets)) {
+      const opaque = computeOpaqueName(hmacSeed, key, sshKeyContent);
+      vault.secrets[opaque] = value;
+      vault.registry.push(key);
+      count++;
+    }
+  }
+  writeMainVault(vault, password);
+  writeSessionCache(vault.secrets, vault.registry);
+  chmodSync(getEnvsaveDir(), 448);
+  return count;
+}
+function setSecret(key, value, password) {
+  const vault = readMainVault(password);
+  const sshKeyContent = loadSshKey(vault);
+  const opaque = computeOpaqueName(vault.hmacSeed, key, sshKeyContent);
+  if (!(opaque in vault.secrets) && !hasValidLicense()) {
+    if (vault.registry.length >= FREE_TIER_MAX_SECRETS) {
+      throw new Error(`Free tier limit: max ${FREE_TIER_MAX_SECRETS} secrets. Run 'envsave activate <token>' to unlock unlimited secrets.
+Get your license at https://api.envsave.com`);
+    }
+  }
+  vault.secrets[opaque] = value;
+  if (!vault.registry.includes(key)) {
+    vault.registry.push(key);
+  }
+  writeMainVault(vault, password);
+  writeSessionCache(vault.secrets, vault.registry);
+  return opaque;
+}
+function showSecret(cleanName, password) {
+  const vault = readMainVault(password);
+  const sshKeyContent = loadSshKey(vault);
+  const opaque = computeOpaqueName(vault.hmacSeed, cleanName, sshKeyContent);
+  writeSessionCache(vault.secrets, vault.registry);
+  return vault.secrets[opaque];
+}
+function revealKey(cleanName, password) {
+  const vault = readMainVault(password);
+  const sshKeyContent = loadSshKey(vault);
+  writeSessionCache(vault.secrets, vault.registry);
+  const opaque = computeOpaqueName(vault.hmacSeed, cleanName, sshKeyContent);
+  return opaque in vault.secrets ? opaque : undefined;
+}
+function getSecretFromCache(opaqueKey) {
+  checkRateLimit();
+  const cache = readSessionCache();
+  if (!cache) {
+    throw new Error("No session found. Run any envsave command with your password first.");
+  }
+  logAccess(opaqueKey, "cache");
+  return cache.secrets[opaqueKey];
+}
+function getSecret(opaqueKey, password) {
+  checkRateLimit();
+  const vault = readMainVault(password);
+  writeSessionCache(vault.secrets, vault.registry);
+  logAccess(opaqueKey, "vault");
+  return vault.secrets[opaqueKey];
+}
+function deleteSecret(key, password) {
+  const vault = readMainVault(password);
+  const sshKeyContent = loadSshKey(vault);
+  const opaque = computeOpaqueName(vault.hmacSeed, key, sshKeyContent);
+  if (!(opaque in vault.secrets))
+    return false;
+  delete vault.secrets[opaque];
+  vault.registry = vault.registry.filter((k) => k !== key);
+  writeMainVault(vault, password);
+  writeSessionCache(vault.secrets, vault.registry);
+  return true;
+}
+function listKeys(password) {
+  const vault = readMainVault(password);
+  writeSessionCache(vault.secrets, vault.registry);
+  return vault.registry;
+}
+function importEnv(filePath, password) {
+  const envSecrets = parseEnvFile(filePath);
+  const vault = readMainVault(password);
+  const sshKeyContent = loadSshKey(vault);
+  if (!hasValidLicense()) {
+    const newKeys = Object.keys(envSecrets).filter((key) => {
+      const opaque = computeOpaqueName(vault.hmacSeed, key, sshKeyContent);
+      return !(opaque in vault.secrets);
+    });
+    if (vault.registry.length + newKeys.length > FREE_TIER_MAX_SECRETS) {
+      throw new Error(`Free tier limit: max ${FREE_TIER_MAX_SECRETS} secrets. Import would add ${newKeys.length} new keys (${vault.registry.length} existing).
+Run 'envsave activate <token>' to unlock unlimited secrets.
+Get your license at https://api.envsave.com`);
+    }
+  }
+  let count = 0;
+  for (const [key, value] of Object.entries(envSecrets)) {
+    const opaque = computeOpaqueName(vault.hmacSeed, key, sshKeyContent);
+    vault.secrets[opaque] = value;
+    if (!vault.registry.includes(key)) {
+      vault.registry.push(key);
+    }
+    count++;
+  }
+  writeMainVault(vault, password);
+  writeSessionCache(vault.secrets, vault.registry);
+  return count;
+}
+function exportEnv(password) {
+  const vault = readMainVault(password);
+  const sshKeyContent = loadSshKey(vault);
+  return vault.registry.map((cleanName) => {
+    const opaque = computeOpaqueName(vault.hmacSeed, cleanName, sshKeyContent);
+    return `${cleanName}=${vault.secrets[opaque] ?? ""}`;
+  }).join(`
+`);
+}
+function changePassword(oldPassword, newPassword) {
+  const vault = readMainVault(oldPassword);
+  writeMainVault(vault, newPassword);
+  writeSessionCache(vault.secrets, vault.registry);
+}
+function searchKeys(pattern) {
+  const cache = readSessionCache();
+  if (!cache || !cache.registry) {
+    throw new Error("No session found. Run any envsave command with your password first.");
+  }
+  const lower = pattern.toLowerCase();
+  return cache.registry.filter((k) => k.toLowerCase().includes(lower));
+}
+function getDeploySecrets(opaqueKeys, password) {
+  const vault = readMainVault(password);
+  const sshKeyContent = loadSshKey(vault);
+  writeSessionCache(vault.secrets, vault.registry);
+  const results = [];
+  for (const opaque of opaqueKeys) {
+    if (opaque in vault.secrets) {
+      const cleanName = vault.registry?.find((r) => computeOpaqueName(vault.hmacSeed, r, sshKeyContent) === opaque) || opaque;
+      results.push({ name: cleanName, opaque, value: vault.secrets[opaque] });
+    }
+  }
+  return results;
+}
+function getSecretWithSession(opaqueKey) {
+  return getSecretFromCache(opaqueKey);
+}
+function hasSecretWithSession(opaqueKey) {
+  try {
+    const cache = readSessionCache();
+    if (!cache)
+      return false;
+    return opaqueKey in cache.secrets;
+  } catch {
+    return false;
+  }
+}
+var FREE_TIER_MAX_SECRETS = 5, DEFAULT_SESSION_TTL_MS, DEFAULT_RATE_LIMIT_WINDOW_MS, DEFAULT_RATE_LIMIT_MAX = 30, BASE_CHARS_V3 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@$&*=-!", BASE_CHARS_V4 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_", BASE_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_";
+var init_vault = __esm(() => {
+  init_crypto();
+  init_env_parser();
+  init_license();
+  DEFAULT_SESSION_TTL_MS = 4 * 60 * 60 * 1000;
+  DEFAULT_RATE_LIMIT_WINDOW_MS = 60 * 1000;
+});
+
+// src/scanner.ts
+var exports_scanner = {};
+__export(exports_scanner, {
+  scanProject: () => scanProject
+});
+import { readdirSync, readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
+import { join as join3, relative } from "node:path";
+function walkDir(dir, base, results) {
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (SKIP_DIRS.has(entry))
+      continue;
+    const fullPath = join3(dir, entry);
+    let stat;
+    try {
+      stat = statSync2(fullPath);
+    } catch {
+      continue;
+    }
+    if (stat.isDirectory()) {
+      walkDir(fullPath, base, results);
+    } else if (stat.isFile()) {
+      const ext = entry.slice(entry.lastIndexOf("."));
+      if (!SCAN_EXTENSIONS.has(ext))
+        continue;
+      scanFile(fullPath, base, results);
+    }
+  }
+}
+function scanFile(filePath, base, results) {
+  let content;
+  try {
+    content = readFileSync4(filePath, "utf8");
+  } catch {
+    return;
+  }
+  const relPath = relative(base, filePath);
+  const lines = content.split(`
+`);
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    for (const pattern of PATTERNS) {
+      pattern.regex.lastIndex = 0;
+      let m;
+      while ((m = pattern.regex.exec(line)) !== null) {
+        results.push({
+          file: relPath,
+          line: i + 1,
+          match: pattern.extract(m),
+          type: pattern.type
+        });
+      }
+    }
+  }
+}
+function scanProject(dir) {
+  const results = [];
+  walkDir(dir, dir, results);
+  return results;
+}
+var SKIP_DIRS, SCAN_EXTENSIONS, PATTERNS;
+var init_scanner = __esm(() => {
+  SKIP_DIRS = new Set([
+    "node_modules",
+    ".git",
+    ".next",
+    ".vercel",
+    "dist",
+    "build",
+    ".output",
+    ".nuxt",
+    "__pycache__",
+    ".venv",
+    "venv",
+    ".tox"
+  ]);
+  SCAN_EXTENSIONS = new Set([
+    ".ts",
+    ".tsx",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+    ".py",
+    ".rb",
+    ".go",
+    ".rs",
+    ".java",
+    ".kt",
+    ".yml",
+    ".yaml",
+    ".toml",
+    ".json",
+    ".sh",
+    ".bash",
+    ".vue",
+    ".svelte",
+    ".astro"
+  ]);
+  PATTERNS = [
+    {
+      regex: /envsave\.get\(["'`]([^"'`]+)["'`]\)/g,
+      type: "envsave.get",
+      extract: (m) => m[1]
+    },
+    {
+      regex: /envsave_get\(["'`]([^"'`]+)["'`]\)/g,
+      type: "envsave.get (Python alias)",
+      extract: (m) => m[1]
+    },
+    {
+      regex: /envsave\.has\(["'`]([^"'`]+)["'`]\)/g,
+      type: "envsave.has",
+      extract: (m) => m[1]
+    },
+    {
+      regex: /process\.env\.([A-Z_][A-Z0-9_]*)/g,
+      type: "process.env",
+      extract: (m) => m[1]
+    },
+    {
+      regex: /process\.env\[["'`]([A-Z_][A-Z0-9_]*)["'`]\]/g,
+      type: "process.env",
+      extract: (m) => m[1]
+    },
+    {
+      regex: /os\.environ\[["']([A-Z_][A-Z0-9_]*)["']\]/g,
+      type: "os.environ (Python)",
+      extract: (m) => m[1]
+    },
+    {
+      regex: /os\.getenv\(["']([A-Z_][A-Z0-9_]*)["']\)/g,
+      type: "os.getenv (Python)",
+      extract: (m) => m[1]
+    },
+    {
+      regex: /os\.Getenv\(["']([A-Z_][A-Z0-9_]*)["']\)/g,
+      type: "os.Getenv (Go)",
+      extract: (m) => m[1]
+    },
+    {
+      regex: /Bun\.env\.([A-Z_][A-Z0-9_]*)/g,
+      type: "Bun.env",
+      extract: (m) => m[1]
+    },
+    {
+      regex: /import\.meta\.env\.([A-Z_][A-Z0-9_]*)/g,
+      type: "import.meta.env",
+      extract: (m) => m[1]
+    }
+  ];
+});
+
+// src/cli.ts
+init_vault();
+init_license();
+import { createInterface } from "node:readline";
+import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, statSync as statSync3 } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { join as join4 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+var args = process.argv.slice(2);
+var command = args[0];
+function checkEnvFiles() {
+  const cwd = process.cwd();
+  const envPatterns = [".env", ".env.local", ".env.development", ".env.production", ".env.staging", ".env.test"];
+  const found = [];
+  try {
+    const files = readdirSync2(cwd);
+    for (const f of files) {
+      if (f === ".env" || f.startsWith(".env.")) {
+        found.push(f);
+      }
+    }
+  } catch {}
+  if (found.length > 0) {
+    const RED = "\x1B[31m";
+    const BOLD = "\x1B[1m";
+    const RESET = "\x1B[0m";
+    console.error(`
+${RED}${BOLD}⚠  Warning: Found .env files in current directory:${RESET}`);
+    for (const f of found) {
+      console.error(`${RED}   • ${f}${RESET}`);
+    }
+    console.error(`${RED}   Consider importing them into EnvSave: envsave import <file>${RESET}`);
+  }
+}
+function usage() {
+  console.log(`
+EnvSave — Local Secret Vault for LLM-Safe Environments
+
+Usage:
+  envsave activate <token> [--offline]   Activate license (--offline skips server)
+  envsave init [--env <f>] [--ssh-key <f>]  Initialize vault
+  envsave set <key> <value>             Add/update a secret (outputs opaque key)
+  envsave get <opaque_key>              Retrieve a value (no password needed)
+  envsave show <key>                    Show real value by key name (password required)
+  envsave reveal <key> [key2] [key3]... Show opaque key name(s) (password required)
+  envsave delete <key>                  Remove a secret (password required)
+  envsave search <keyword>              Search keys matching keyword (no password)
+  envsave scan [dir]                    Scan project for env variable usage
+  envsave passwd                        Change master password
+  envsave config                        Show rate limit config
+  envsave config --max-gets <n>         Set max gets per minute (password required)
+  envsave config --session-ttl <hours>  Set session TTL in hours (password required)
+  envsave list                          List clean key names (password required)
+  envsave import <file>                 Import from .env file (password required)
+  envsave export                        Export as .env format (password required)
+  envsave backup                        Upload encrypted vault to server
+  envsave restore                       Download vault backup from server
+  envsave sync                          Sync vault with server (pull if cloud newer)
+  envsave vercel <key> [key2]...        Push secrets to Vercel as opaque env vars
+  envsave help                          Show this help
+
+Security model:
+  1. envsave set OPENAI_API_KEY sk-...     → outputs: es_7a3f2b1e9c8d4f6b2a1c3d5f
+  2. envsave reveal OPENAI_API_KEY         → password required to see opaque key
+  3. envsave.get("es_7a3f2b1e9c8d4f6b2a1c3d5f")  → returns value (no password)
+
+  Key names are HMAC-SHA256 hashes — fully opaque, no trace of original name.
+  Session cache stores secrets only — no aliases, no seed, no enumeration.
+  Optional --ssh-key adds hardware-level "something you have" factor.
+`);
+}
+async function promptPassword(prompt = "Master password: ") {
+  return new Promise((resolve) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stderr,
+      terminal: false
+    });
+    process.stderr.write(prompt);
+    const stdin = process.stdin;
+    const wasRaw = stdin.isRaw;
+    if (stdin.isTTY && stdin.setRawMode) {
+      stdin.setRawMode(true);
+    }
+    let password = "";
+    const onData = (ch) => {
+      const c = ch.toString();
+      if (c === `
+` || c === "\r" || c === "\x04") {
+        if (stdin.isTTY && stdin.setRawMode) {
+          stdin.setRawMode(wasRaw ?? false);
+        }
+        stdin.removeListener("data", onData);
+        process.stderr.write(`
+`);
+        rl.close();
+        resolve(password);
+      } else if (c === "\x03") {
+        process.exit(1);
+      } else if (c === "" || c === "\b") {
+        password = password.slice(0, -1);
+      } else {
+        password += c;
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+async function requirePassword() {
+  const password = await promptPassword();
+  if (!password) {
+    console.error("Password cannot be empty.");
+    process.exit(1);
+  }
+  return password;
+}
+async function requireLicense() {
+  if (!await checkLicense()) {
+    console.error("No valid license found. Run 'envsave activate <token>' first.");
+    console.error("Get your license at https://api.envsave.com");
+    process.exit(1);
+  }
+}
+function getFlag(name) {
+  const idx = args.indexOf(name);
+  return idx !== -1 ? args[idx + 1] : undefined;
+}
+async function main() {
+  if (!command || command === "help" || command === "--help" || command === "-h") {
+    usage();
+    checkEnvFiles();
+    return;
+  }
+  switch (command) {
+    case "activate": {
+      const token = args[1];
+      if (!token) {
+        console.error("Usage: envsave activate <token> [--offline]");
+        process.exit(1);
+      }
+      const offline = args.includes("--offline");
+      const ok = await activateLicense(token, offline);
+      if (ok) {
+        console.log("License activated successfully!");
+      } else {
+        process.exit(1);
+      }
+      break;
+    }
+    case "init": {
+      if (vaultExists()) {
+        console.error("Vault already exists. Delete ~/.envsave/vault.enc to reinitialize.");
+        process.exit(1);
+      }
+      const password = await promptPassword("Set master password: ");
+      if (!password) {
+        console.error("Password cannot be empty.");
+        process.exit(1);
+      }
+      const confirm = await promptPassword("Confirm password: ");
+      if (password !== confirm) {
+        console.error("Passwords do not match.");
+        process.exit(1);
+      }
+      const envFile = getFlag("--env");
+      const sshKeyPath = getFlag("--ssh-key");
+      if (envFile && !existsSync3(envFile)) {
+        console.error(`File not found: ${envFile}`);
+        process.exit(1);
+      }
+      if (sshKeyPath && !existsSync3(sshKeyPath)) {
+        console.error(`SSH key not found: ${sshKeyPath}`);
+        process.exit(1);
+      }
+      const count = initVault(password, { envFile, sshKeyPath });
+      console.log("Vault initialized successfully!");
+      if (sshKeyPath) {
+        console.log(`SSH key factor enabled: ${sshKeyPath}`);
+      }
+      if (count > 0) {
+        console.log(`Imported ${count} secrets.`);
+        console.log(`
+Use 'envsave reveal <KEY>' to get the opaque key for each secret.`);
+      }
+      break;
+    }
+    case "set": {
+      const key = args[1];
+      const value = args[2];
+      if (!key || value === undefined) {
+        console.error("Usage: envsave set <key> <value>");
+        process.exit(1);
+      }
+      const password = await requirePassword();
+      const opaque = setSecret(key, value, password);
+      console.log(`
+  ${key} → ${opaque}
+`);
+      console.log(`  Use this in your code to access ${key}:`);
+      console.log(`    envsave.get("${opaque}")
+`);
+      break;
+    }
+    case "reveal": {
+      const keys = args.slice(1);
+      if (keys.length === 0) {
+        console.error("Usage: envsave reveal <key> [key2] [key3]...");
+        process.exit(1);
+      }
+      const password = await requirePassword();
+      let notFound = 0;
+      for (const key of keys) {
+        const opaque = revealKey(key, password);
+        if (opaque) {
+          console.log(`
+  ${key} → ${opaque}`);
+          console.log(`    envsave.get("${opaque}")`);
+        } else {
+          console.error(`Secret '${key}' not found.`);
+          notFound++;
+        }
+      }
+      if (keys.length > 1 && notFound === 0)
+        console.log();
+      if (notFound > 0 && notFound === keys.length)
+        process.exit(1);
+      break;
+    }
+    case "show": {
+      const key = args[1];
+      if (!key) {
+        console.error("Usage: envsave show <key>");
+        process.exit(1);
+      }
+      const password = await requirePassword();
+      const val = showSecret(key, password);
+      if (val !== undefined) {
+        console.log(`
+  ${key} = ${val}
+`);
+      } else {
+        console.error(`Secret '${key}' not found.`);
+        process.exit(1);
+      }
+      break;
+    }
+    case "get": {
+      const key = args[1];
+      if (!key) {
+        console.error("Usage: envsave get <opaque_key>");
+        process.exit(1);
+      }
+      try {
+        const value = getSecretFromCache(key);
+        if (value !== undefined) {
+          process.stdout.write(value);
+          break;
+        }
+      } catch {}
+      const password = await requirePassword();
+      const val = getSecret(key, password);
+      if (val !== undefined) {
+        process.stdout.write(val);
+      } else {
+        console.error(`Secret not found. Use 'envsave reveal <name>' to get the opaque key.`);
+        process.exit(1);
+      }
+      break;
+    }
+    case "delete": {
+      const key = args[1];
+      if (!key) {
+        console.error("Usage: envsave delete <key>");
+        process.exit(1);
+      }
+      const password = await requirePassword();
+      const deleted = deleteSecret(key, password);
+      if (deleted) {
+        console.log(`Secret '${key}' deleted.`);
+      } else {
+        console.error(`Secret '${key}' not found.`);
+        process.exit(1);
+      }
+      break;
+    }
+    case "config": {
+      const maxGets = getFlag("--max-gets");
+      const sessionTtl = getFlag("--session-ttl");
+      if (!maxGets && !sessionTtl) {
+        const config2 = getRateLimitConfig();
+        console.log(`Rate limit config:`);
+        console.log(`  Max gets per minute: ${config2.maxGetsPerMinute}`);
+        console.log(`  Session TTL: ${config2.sessionTtlHours} hours`);
+        break;
+      }
+      const password = await requirePassword();
+      const options = {};
+      if (maxGets)
+        options.maxGetsPerMinute = parseInt(maxGets, 10);
+      if (sessionTtl)
+        options.sessionTtlHours = parseFloat(sessionTtl);
+      if (options.maxGetsPerMinute !== undefined && (isNaN(options.maxGetsPerMinute) || options.maxGetsPerMinute < 1)) {
+        console.error("--max-gets must be a positive number.");
+        process.exit(1);
+      }
+      if (options.sessionTtlHours !== undefined && (isNaN(options.sessionTtlHours) || options.sessionTtlHours <= 0)) {
+        console.error("--session-ttl must be a positive number.");
+        process.exit(1);
+      }
+      const config = configureRateLimit(password, options);
+      console.log(`Config updated:`);
+      console.log(`  Max gets per minute: ${config.maxGetsPerMinute}`);
+      console.log(`  Session TTL: ${config.sessionTtlHours} hours`);
+      break;
+    }
+    case "passwd": {
+      const oldPassword = await promptPassword("Current password: ");
+      if (!oldPassword) {
+        console.error("Password cannot be empty.");
+        process.exit(1);
+      }
+      try {
+        listKeys(oldPassword);
+      } catch {
+        console.error("Incorrect current password.");
+        process.exit(1);
+      }
+      const newPassword = await promptPassword("New password: ");
+      if (!newPassword) {
+        console.error("Password cannot be empty.");
+        process.exit(1);
+      }
+      const confirmNew = await promptPassword("Confirm new password: ");
+      if (newPassword !== confirmNew) {
+        console.error("Passwords do not match.");
+        process.exit(1);
+      }
+      const { changePassword: changePassword2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
+      changePassword2(oldPassword, newPassword);
+      console.log("Password changed successfully!");
+      break;
+    }
+    case "search": {
+      const keyword = args[1];
+      if (!keyword) {
+        console.error("Usage: envsave search <keyword>");
+        process.exit(1);
+      }
+      let matches;
+      try {
+        matches = searchKeys(keyword);
+      } catch {
+        const password = await requirePassword();
+        listKeys(password);
+        matches = searchKeys(keyword);
+      }
+      if (matches.length === 0) {
+        console.log(`No keys matching "${keyword}".`);
+      } else {
+        for (const k of matches) {
+          console.log(k);
+        }
+        console.log(`
+${matches.length} key(s) matching "${keyword}".`);
+      }
+      break;
+    }
+    case "scan": {
+      const scanDir = args.slice(1).find((a) => !a.startsWith("--")) || process.cwd();
+      const { scanProject: scanProject2 } = await Promise.resolve().then(() => (init_scanner(), exports_scanner));
+      const results = scanProject2(scanDir);
+      if (results.length === 0) {
+        console.log("No env variable usage found.");
+      } else {
+        let opaqueToName = {};
+        const hasOpaqueKeys = results.some((r) => r.match.startsWith("es_"));
+        if (hasOpaqueKeys && vaultExists()) {
+          try {
+            const password = await requirePassword();
+            const keys = listKeys(password);
+            for (const k of keys) {
+              const opaque = revealKey(k, password);
+              if (opaque)
+                opaqueToName[opaque] = k;
+            }
+          } catch (err) {
+            if (err.message?.includes("unable to authenticate data") || err.message?.includes("Unsupported state")) {
+              console.error("Incorrect password — skipping key resolution.");
+            }
+          }
+        }
+        const grouped = {};
+        for (const r of results) {
+          if (!grouped[r.type])
+            grouped[r.type] = [];
+          grouped[r.type].push(r);
+        }
+        for (const [type, entries] of Object.entries(grouped)) {
+          console.log(`
+\x1B[1m${type}\x1B[0m`);
+          for (const e of entries) {
+            const name = opaqueToName[e.match];
+            const display = name ? `${e.match} → ${name}` : e.match;
+            console.log(`  ${e.file}:${e.line}  ${display}`);
+          }
+        }
+        const uniqueVars = new Set(results.map((r) => r.match));
+        console.log(`
+${results.length} reference(s), ${uniqueVars.size} unique variable(s) found.`);
+      }
+      break;
+    }
+    case "list": {
+      const password = await requirePassword();
+      const keys = listKeys(password);
+      if (keys.length === 0) {
+        console.log("No secrets stored.");
+      } else {
+        for (const k of keys) {
+          console.log(k);
+        }
+        console.log(`
+${keys.length} secret(s). Use 'envsave reveal <KEY>' to get the opaque key.`);
+        if (!hasValidLicense()) {
+          console.log(`\x1B[33mFree tier: ${keys.length}/5 secrets used. Activate a license for unlimited.\x1B[0m`);
+        }
+      }
+      break;
+    }
+    case "import": {
+      const file = args[1];
+      if (!file) {
+        console.error("Usage: envsave import <file>");
+        process.exit(1);
+      }
+      if (!existsSync3(file)) {
+        console.error(`File not found: ${file}`);
+        process.exit(1);
+      }
+      const password = await requirePassword();
+      const count = importEnv(file, password);
+      console.log(`Imported ${count} secrets.`);
+      console.log(`
+Use 'envsave reveal <KEY>' to get the opaque key for each secret.`);
+      break;
+    }
+    case "export": {
+      const password = await requirePassword();
+      const output = exportEnv(password);
+      console.log(output);
+      break;
+    }
+    case "backup": {
+      await requireLicense();
+      const token = getLicenseToken();
+      if (!token) {
+        console.error("No license token found. Run 'envsave activate <token>' first.");
+        process.exit(1);
+      }
+      const envsaveDir = join4(homedir3(), ".envsave");
+      const vaultFile = join4(envsaveDir, "vault.enc");
+      if (!existsSync3(vaultFile)) {
+        console.error("No vault found. Run 'envsave init' first.");
+        process.exit(1);
+      }
+      const vaultData = readFileSync5(vaultFile);
+      const checksum = createHash("sha256").update(vaultData).digest("hex");
+      const apiBase = (process.env.ENVSAVE_LICENSE_API || "https://api.envsave.com/api/license/validate").replace("/api/license/validate", "");
+      console.log(`Uploading encrypted vault (${vaultData.byteLength} bytes)...`);
+      const resp = await fetch(`${apiBase}/api/vault/backup`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/octet-stream"
+        },
+        body: vaultData
+      });
+      if (!resp.ok) {
+        const err = await resp.json().catch(() => ({}));
+        console.error(`Backup failed: ${err.error || resp.statusText}`);
+        process.exit(1);
+      }
+      const result = await resp.json();
+      if (result.checksum !== checksum) {
+        console.error("Checksum mismatch! Backup may be corrupted.");
+        process.exit(1);
+      }
+      console.log(`Vault backed up successfully!`);
+      console.log(`  Size: ${result.size} bytes`);
+      console.log(`  Checksum: ${checksum.slice(0, 16)}...`);
+      break;
+    }
+    case "restore": {
+      await requireLicense();
+      const token = getLicenseToken();
+      if (!token) {
+        console.error("No license token found. Run 'envsave activate <token>' first.");
+        process.exit(1);
+      }
+      const envsaveDir = join4(homedir3(), ".envsave");
+      const vaultFile = join4(envsaveDir, "vault.enc");
+      const apiBase = (process.env.ENVSAVE_LICENSE_API || "https://api.envsave.com/api/license/validate").replace("/api/license/validate", "");
+      if (existsSync3(vaultFile)) {
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        const answer = await new Promise((resolve) => {
+          rl.question("Local vault exists. Overwrite with backup? (y/N) ", resolve);
+        });
+        rl.close();
+        if (answer.toLowerCase() !== "y") {
+          console.log("Restore cancelled.");
+          break;
+        }
+      }
+      console.log("Downloading vault backup...");
+      const resp = await fetch(`${apiBase}/api/vault/download`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}` }
+      });
+      if (!resp.ok) {
+        const err = await resp.json().catch(() => ({}));
+        console.error(`Restore failed: ${err.error || resp.statusText}`);
+        process.exit(1);
+      }
+      const vaultData = Buffer.from(await resp.arrayBuffer());
+      const serverChecksum = resp.headers.get("x-checksum") || "";
+      const localChecksum = createHash("sha256").update(vaultData).digest("hex");
+      if (serverChecksum && localChecksum !== serverChecksum) {
+        console.error("Checksum mismatch! Download may be corrupted.");
+        process.exit(1);
+      }
+      if (!existsSync3(envsaveDir)) {
+        mkdirSync3(envsaveDir, { recursive: true, mode: 448 });
+      }
+      writeFileSync3(vaultFile, vaultData, { mode: 384 });
+      const backupDate = resp.headers.get("x-backup-date") || "unknown";
+      console.log(`Vault restored successfully!`);
+      console.log(`  Size: ${vaultData.byteLength} bytes`);
+      console.log(`  Backup date: ${backupDate}`);
+      console.log(`
+Use 'envsave list' to verify your secrets.`);
+      break;
+    }
+    case "sync": {
+      await requireLicense();
+      const token = getLicenseToken();
+      if (!token) {
+        console.error("No license token found. Run 'envsave activate <token>' first.");
+        process.exit(1);
+      }
+      const envsaveDir = join4(homedir3(), ".envsave");
+      const vaultFile = join4(envsaveDir, "vault.enc");
+      const apiBase = (process.env.ENVSAVE_LICENSE_API || "https://api.envsave.com/api/license/validate").replace("/api/license/validate", "");
+      const statusResp = await fetch(`${apiBase}/api/vault/status`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}` }
+      });
+      if (!statusResp.ok) {
+        console.error("Failed to check cloud status.");
+        process.exit(1);
+      }
+      const cloudStatus = await statusResp.json();
+      const hasLocal = existsSync3(vaultFile);
+      let localChecksum = "";
+      let localSize = 0;
+      if (hasLocal) {
+        const localData = readFileSync5(vaultFile);
+        localChecksum = createHash("sha256").update(localData).digest("hex");
+        localSize = localData.byteLength;
+      }
+      if (cloudStatus.hasBackup && hasLocal && cloudStatus.checksum === localChecksum) {
+        console.log("Already in sync.");
+        console.log(`  Checksum: ${localChecksum.slice(0, 16)}...`);
+        break;
+      }
+      if (!cloudStatus.hasBackup && hasLocal) {
+        console.log("No cloud backup found. Uploading local vault...");
+        const localData = readFileSync5(vaultFile);
+        const resp = await fetch(`${apiBase}/api/vault/backup`, {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/octet-stream"
+          },
+          body: localData
+        });
+        if (!resp.ok) {
+          console.error("Upload failed.");
+          process.exit(1);
+        }
+        console.log(`Pushed local vault to cloud (${localSize} bytes).`);
+        break;
+      }
+      if (cloudStatus.hasBackup && !hasLocal) {
+        console.log("No local vault found. Downloading from cloud...");
+        const resp = await fetch(`${apiBase}/api/vault/download`, {
+          method: "POST",
+          headers: { Authorization: `Bearer ${token}` }
+        });
+        if (!resp.ok) {
+          console.error("Download failed.");
+          process.exit(1);
+        }
+        const vaultData = Buffer.from(await resp.arrayBuffer());
+        if (!existsSync3(envsaveDir)) {
+          mkdirSync3(envsaveDir, { recursive: true, mode: 448 });
+        }
+        writeFileSync3(vaultFile, vaultData, { mode: 384 });
+        console.log(`Pulled vault from cloud (${vaultData.byteLength} bytes).`);
+        break;
+      }
+      if (cloudStatus.hasBackup && hasLocal && cloudStatus.checksum !== localChecksum) {
+        const localMtime = statSync3(vaultFile).mtimeMs;
+        const cloudDate = cloudStatus.updatedAt ? new Date(cloudStatus.updatedAt).getTime() : 0;
+        console.log("Local and cloud vaults differ:");
+        console.log(`  Local:  ${localSize} bytes, modified ${new Date(localMtime).toISOString()}`);
+        console.log(`  Cloud:  ${cloudStatus.size} bytes, modified ${cloudStatus.updatedAt || "unknown"}`);
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        const answer = await new Promise((resolve) => {
+          rl.question("Pull from cloud (p), push local to cloud (l), or cancel (c)? [p/l/c] ", resolve);
+        });
+        rl.close();
+        if (answer.toLowerCase() === "p") {
+          const resp = await fetch(`${apiBase}/api/vault/download`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${token}` }
+          });
+          if (!resp.ok) {
+            console.error("Download failed.");
+            process.exit(1);
+          }
+          const vaultData = Buffer.from(await resp.arrayBuffer());
+          writeFileSync3(vaultFile, vaultData, { mode: 384 });
+          console.log(`Pulled vault from cloud (${vaultData.byteLength} bytes).`);
+        } else if (answer.toLowerCase() === "l") {
+          const localData = readFileSync5(vaultFile);
+          const resp = await fetch(`${apiBase}/api/vault/backup`, {
+            method: "POST",
+            headers: {
+              Authorization: `Bearer ${token}`,
+              "Content-Type": "application/octet-stream"
+            },
+            body: localData
+          });
+          if (!resp.ok) {
+            console.error("Upload failed.");
+            process.exit(1);
+          }
+          console.log(`Pushed local vault to cloud (${localData.byteLength} bytes).`);
+        } else {
+          console.log("Sync cancelled.");
+        }
+        break;
+      }
+      if (!cloudStatus.hasBackup && !hasLocal) {
+        console.log("No vault found locally or in cloud. Run 'envsave init' first.");
+      }
+      break;
+    }
+    case "vercel": {
+      const vercelDir = join4(process.cwd(), ".vercel");
+      const vercelProjectJson = join4(vercelDir, "project.json");
+      if (!existsSync3(vercelProjectJson)) {
+        console.error("This project is not linked to Vercel.");
+        console.error("Run 'vercel link' first to connect this directory to a Vercel project.");
+        process.exit(1);
+      }
+      let projectName = "unknown";
+      try {
+        const proj = JSON.parse(readFileSync5(vercelProjectJson, "utf8"));
+        projectName = proj.projectId || "unknown";
+      } catch {}
+      const envArg = getFlag("--env");
+      const environments = envArg ? envArg.split(",") : ["production", "preview", "development"];
+      const keyArgs = args.slice(1).filter((a) => !a.startsWith("--"));
+      if (envArg) {
+        const envIdx = keyArgs.indexOf(envArg);
+        if (envIdx !== -1)
+          keyArgs.splice(envIdx, 1);
+      }
+      if (keyArgs.length === 0) {
+        console.error("Usage: envsave vercel <es_key> [es_key2]... [--env production,preview]");
+        process.exit(1);
+      }
+      const invalidKeys = keyArgs.filter((k) => !k.startsWith("es_"));
+      if (invalidKeys.length > 0) {
+        console.error(`Only opaque keys (es_...) are accepted. Use 'envsave reveal <NAME>' to get the opaque key.`);
+        console.error(`Invalid: ${invalidKeys.join(", ")}`);
+        process.exit(1);
+      }
+      const password = await requirePassword();
+      const keysToPush = keyArgs;
+      const secrets = getDeploySecrets(keysToPush, password);
+      const notFound = keysToPush.filter((k) => !secrets.find((s) => s.opaque === k));
+      if (notFound.length > 0) {
+        console.error(`Secrets not found: ${notFound.join(", ")}`);
+        if (secrets.length === 0)
+          process.exit(1);
+      }
+      console.log(`
+Pushing ${secrets.length} secret(s) to Vercel (${environments.join(", ")})...
+`);
+      let success = 0;
+      let failed = 0;
+      for (const secret of secrets) {
+        for (const env of environments) {
+          spawnSync("vercel", ["env", "rm", secret.opaque, env, "-y"], {
+            stdio: "ignore"
+          });
+          const proc = spawnSync("vercel", ["env", "add", secret.opaque, env], {
+            input: Buffer.from(secret.value),
+            stdio: ["pipe", "pipe", "pipe"]
+          });
+          if (proc.status === 0) {
+            console.log(`  \x1B[32m✓\x1B[0m ${secret.name} → ${secret.opaque} [${env}]`);
+            success++;
+          } else {
+            const errMsg = proc.stderr.toString().trim();
+            console.error(`  \x1B[31m✗\x1B[0m ${secret.name} → ${secret.opaque} [${env}]: ${errMsg}`);
+            failed++;
+          }
+        }
+      }
+      console.log(`
+Done: ${success} pushed, ${failed} failed.`);
+      if (failed > 0)
+        process.exit(1);
+      break;
+    }
+    default:
+      console.error(`Unknown command: ${command}`);
+      usage();
+      process.exit(1);
+  }
+  if (command !== "get") {
+    checkEnvFiles();
+  }
+}
+main().catch((err) => {
+  if (err.message?.includes("unable to authenticate data") || err.message?.includes("Unsupported state")) {
+    console.error("Incorrect password.");
+  } else {
+    console.error("Error:", err.message);
+  }
+  process.exit(1);
+});