@envsave/cli 1.0.39 → 1.0.41

package/dist/cli.js

@@ -259,6 +259,7 @@ __export(exports_vault, {
   showSecret: () => showSecret,
   setSecret: () => setSecret,
   searchKeys: () => searchKeys,
+  revealKeysByPattern: () => revealKeysByPattern,
   revealKey: () => revealKey,
   listKeys: () => listKeys,
   initVault: () => initVault,
@@ -573,6 +574,22 @@ function revealKey(cleanName, password) {
   const opaque = computeOpaqueName(vault.hmacSeed, cleanName, sshKeyContent);
   return opaque in vault.secrets ? opaque : undefined;
 }
+function revealKeysByPattern(patterns, password) {
+  const vault = readMainVault(password);
+  const sshKeyContent = loadSshKey(vault);
+  writeSessionCache(vault.secrets, vault.registry);
+  return patterns.map((pattern) => {
+    const lower = pattern.toLowerCase();
+    const matchingNames = vault.registry.filter((k) => k.toLowerCase().includes(lower));
+    return {
+      pattern,
+      matches: matchingNames.map((name) => ({
+        name,
+        opaque: computeOpaqueName(vault.hmacSeed, name, sshKeyContent)
+      }))
+    };
+  });
+}
 function getSecretFromCache(opaqueKey) {
   checkRateLimit();
   const cache = readSessionCache();
@@ -857,6 +874,57 @@ import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { join as join4 } from "node:path";
 import { homedir as homedir3 } from "node:os";
+// package.json
+var package_default = {
+  name: "@envsave/cli",
+  version: "1.0.41",
+  description: "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
+  type: "module",
+  main: "dist/index.js",
+  types: "dist/index.d.ts",
+  bin: {
+    envsave: "dist/cli.js"
+  },
+  files: [
+    "dist",
+    "python"
+  ],
+  scripts: {
+    prebuild: `bun -e "const p=require('./package.json');const v=p.version.split('.');v[2]=+v[2]+1;p.version=v.join('.');require('fs').writeFileSync('package.json',JSON.stringify(p,null,2)+'\\n')"`,
+    build: "bun build src/cli.ts --outdir dist --target node --format esm && bun build src/index.ts --outdir dist --target node --format esm --outfile dist/index.js",
+    dev: "bun run src/cli.ts",
+    webapp: "bun run webapp/server.ts",
+    "lint:claude": "claude -p 'you are a linter. please look at the changes vs. main and report any issues related to typos. report the filename and line number on one line, and a description of the issue on the second line. do not return any other text.'"
+  },
+  devDependencies: {
+    "@types/bun": "latest",
+    "@types/node": "^25.5.0"
+  },
+  peerDependencies: {
+    typescript: "^5"
+  },
+  keywords: [
+    "vault",
+    "secrets",
+    "encryption",
+    "llm",
+    "security",
+    "env"
+  ],
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/jcsancho/envsave.git"
+  },
+  homepage: "https://api.envsave.com",
+  author: "Jose C Sancho",
+  dependencies: {
+    "@clerk/backend": "^3.2.1",
+    "@supabase/supabase-js": "^2.99.2"
+  }
+};
+
+// src/cli.ts
 var args = process.argv.slice(2);
 var command = args[0];
 function checkEnvFiles() {
@@ -893,7 +961,7 @@ Usage:
   envsave set <key> <value>             Add/update a secret (outputs opaque key)
   envsave get <opaque_key>              Retrieve a value (no password needed)
   envsave show <key>                    Show real value by key name (password required)
-  envsave reveal <key> [key2] [key3]... Show opaque key name(s) (password required)
+  envsave reveal <keyword> [keyword2]... Show opaque key(s) for any name matching keyword (password required)
   envsave delete <key>                  Remove a secret (password required)
   envsave search <keyword>              Search keys matching keyword (no password)
   envsave scan [dir]                    Scan project for env variable usage
@@ -981,6 +1049,10 @@ async function main() {
     checkEnvFiles();
     return;
   }
+  if (command === "--version" || command === "-v" || command === "version") {
+    console.log(package_default.version);
+    return;
+  }
   switch (command) {
     case "activate": {
       const token = args[1];
@@ -1052,27 +1124,31 @@ Use 'envsave reveal <KEY>' to get the opaque key for each secret.`);
       break;
     }
     case "reveal": {
-      const keys = args.slice(1);
-      if (keys.length === 0) {
-        console.error("Usage: envsave reveal <key> [key2] [key3]...");
+      const patterns = args.slice(1);
+      if (patterns.length === 0) {
+        console.error("Usage: envsave reveal <keyword> [keyword2]...");
         process.exit(1);
       }
       const password = await requirePassword();
-      let notFound = 0;
-      for (const key of keys) {
-        const opaque = revealKey(key, password);
-        if (opaque) {
+      const results = revealKeysByPattern(patterns, password);
+      let totalMatches = 0;
+      let notFoundPatterns = 0;
+      for (const { pattern, matches } of results) {
+        if (matches.length === 0) {
+          console.error(`No keys matching '${pattern}'.`);
+          notFoundPatterns++;
+          continue;
+        }
+        for (const { name, opaque } of matches) {
           console.log(`
-  ${key} → ${opaque}`);
+  ${name} → ${opaque}`);
           console.log(`    envsave.get("${opaque}")`);
-        } else {
-          console.error(`Secret '${key}' not found.`);
-          notFound++;
+          totalMatches++;
         }
       }
-      if (keys.length > 1 && notFound === 0)
+      if (totalMatches > 0)
         console.log();
-      if (notFound > 0 && notFound === keys.length)
+      if (notFoundPatterns === patterns.length)
         process.exit(1);
       break;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsave/cli",
-  "version": "1.0.39",
+  "version": "1.0.41",
   "description": "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
   "type": "module",
   "main": "dist/index.js",