@envsave/cli 1.0.38 → 1.0.40

package/dist/cli.js

@@ -259,6 +259,7 @@ __export(exports_vault, {
   showSecret: () => showSecret,
   setSecret: () => setSecret,
   searchKeys: () => searchKeys,
+  revealKeysByPattern: () => revealKeysByPattern,
   revealKey: () => revealKey,
   listKeys: () => listKeys,
   initVault: () => initVault,
@@ -514,7 +515,7 @@ function initVault(password, options) {
   const hmacSeed = randomBytes2(32).toString("hex");
   const sshKeyContent = options?.sshKeyPath ? readFileSync3(options.sshKeyPath, "utf8") : undefined;
   const vault = {
-    version: 4,
+    version: 5,
     hmacSeed,
     sshKeyPath: options?.sshKeyPath,
     secrets: {},
@@ -544,7 +545,8 @@ function setSecret(key, value, password) {
   const vault = readMainVault(password);
   const sshKeyContent = loadSshKey(vault);
   const opaque = computeOpaqueName(vault.hmacSeed, key, sshKeyContent);
-  if (!(opaque in vault.secrets) && !hasValidLicense()) {
+  const updated = opaque in vault.secrets;
+  if (!updated && !hasValidLicense()) {
     if (vault.registry.length >= FREE_TIER_MAX_SECRETS) {
       throw new Error(`Free tier limit: max ${FREE_TIER_MAX_SECRETS} secrets. Run 'envsave activate <token>' to unlock unlimited secrets.
 Get your license at https://api.envsave.com`);
@@ -556,7 +558,7 @@ Get your license at https://api.envsave.com`);
   }
   writeMainVault(vault, password);
   writeSessionCache(vault.secrets, vault.registry);
-  return opaque;
+  return { opaque, updated };
 }
 function showSecret(cleanName, password) {
   const vault = readMainVault(password);
@@ -572,6 +574,22 @@ function revealKey(cleanName, password) {
   const opaque = computeOpaqueName(vault.hmacSeed, cleanName, sshKeyContent);
   return opaque in vault.secrets ? opaque : undefined;
 }
+function revealKeysByPattern(patterns, password) {
+  const vault = readMainVault(password);
+  const sshKeyContent = loadSshKey(vault);
+  writeSessionCache(vault.secrets, vault.registry);
+  return patterns.map((pattern) => {
+    const lower = pattern.toLowerCase();
+    const matchingNames = vault.registry.filter((k) => k.toLowerCase().includes(lower));
+    return {
+      pattern,
+      matches: matchingNames.map((name) => ({
+        name,
+        opaque: computeOpaqueName(vault.hmacSeed, name, sshKeyContent)
+      }))
+    };
+  });
+}
 function getSecretFromCache(opaqueKey) {
   checkRateLimit();
   const cache = readSessionCache();
@@ -892,7 +910,7 @@ Usage:
   envsave set <key> <value>             Add/update a secret (outputs opaque key)
   envsave get <opaque_key>              Retrieve a value (no password needed)
   envsave show <key>                    Show real value by key name (password required)
-  envsave reveal <key> [key2] [key3]... Show opaque key name(s) (password required)
+  envsave reveal <keyword> [keyword2]... Show opaque key(s) for any name matching keyword (password required)
   envsave delete <key>                  Remove a secret (password required)
   envsave search <keyword>              Search keys matching keyword (no password)
   envsave scan [dir]                    Scan project for env variable usage
@@ -1041,9 +1059,9 @@ Use 'envsave reveal <KEY>' to get the opaque key for each secret.`);
         process.exit(1);
       }
       const password = await requirePassword();
-      const opaque = setSecret(key, value, password);
+      const { opaque, updated } = setSecret(key, value, password);
       console.log(`
-  ${key} → ${opaque}
+  ${updated ? "Updated" : "Added"}: ${key} → ${opaque}
 `);
       console.log(`  Use this in your code to access ${key}:`);
       console.log(`    envsave.get("${opaque}")
@@ -1051,27 +1069,31 @@ Use 'envsave reveal <KEY>' to get the opaque key for each secret.`);
       break;
     }
     case "reveal": {
-      const keys = args.slice(1);
-      if (keys.length === 0) {
-        console.error("Usage: envsave reveal <key> [key2] [key3]...");
+      const patterns = args.slice(1);
+      if (patterns.length === 0) {
+        console.error("Usage: envsave reveal <keyword> [keyword2]...");
         process.exit(1);
       }
       const password = await requirePassword();
-      let notFound = 0;
-      for (const key of keys) {
-        const opaque = revealKey(key, password);
-        if (opaque) {
+      const results = revealKeysByPattern(patterns, password);
+      let totalMatches = 0;
+      let notFoundPatterns = 0;
+      for (const { pattern, matches } of results) {
+        if (matches.length === 0) {
+          console.error(`No keys matching '${pattern}'.`);
+          notFoundPatterns++;
+          continue;
+        }
+        for (const { name, opaque } of matches) {
           console.log(`
-  ${key} → ${opaque}`);
+  ${name} → ${opaque}`);
           console.log(`    envsave.get("${opaque}")`);
-        } else {
-          console.error(`Secret '${key}' not found.`);
-          notFound++;
+          totalMatches++;
         }
       }
-      if (keys.length > 1 && notFound === 0)
+      if (totalMatches > 0)
         console.log();
-      if (notFound > 0 && notFound === keys.length)
+      if (notFoundPatterns === patterns.length)
         process.exit(1);
       break;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsave/cli",
-  "version": "1.0.38",
+  "version": "1.0.40",
   "description": "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
   "type": "module",
   "main": "dist/index.js",