@envsave/cli 1.0.40 → 1.0.42

package/README.md

@@ -28,9 +28,9 @@ const openai = new OpenAI({ apiKey: get("es_7a3f2b1e9c8d4f6b2a1c3d5f") });
 
 This is the single problem this project is built around. Everything else — the CLI, the license server, the Python bridge, the cloud backup — exists to make opaque-key-based secrets practical to use day to day.
 
-## Free tier
+## Pricing
 
-Up to **5 secrets** with no license. Beyond that you'll need to activate a license (`envsave activate <token>`) — get yours at https://envsave.com.
+Local personal use is **free and unlimited** — store as many secrets as you want with no license. A license is only required to sync your vault to the cloud; activate one with `envsave activate <token>` — get yours at https://envsave.com.
 
 ## Installation
 

package/dist/cli.js

@@ -91,167 +91,6 @@ function parseEnvFile(filePath) {
 }
 var init_env_parser = () => {};
 
-// src/license.ts
-import { readFileSync as readFileSync2, writeFileSync, existsSync, mkdirSync } from "node:fs";
-import { join } from "node:path";
-import { homedir } from "node:os";
-function ensureDir() {
-  if (!existsSync(ENVSAVE_DIR)) {
-    mkdirSync(ENVSAVE_DIR, { recursive: true, mode: 448 });
-  }
-}
-function parseToken(token) {
-  if (!token.startsWith("es_"))
-    return null;
-  try {
-    const b64 = token.slice(3);
-    const pad = b64.length % 4 === 0 ? "" : "=".repeat(4 - b64.length % 4);
-    const raw = Buffer.from(b64.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64").toString("utf8");
-    const parts = raw.split("|");
-    if (parts.length !== 4)
-      return null;
-    return {
-      email: parts[0],
-      createdAt: new Date(Number(parts[1]) * 1000),
-      expiresAt: new Date(Number(parts[2]) * 1000)
-    };
-  } catch {
-    return null;
-  }
-}
-async function activateLicense(token, offline = false) {
-  const dates = parseToken(token);
-  const OFFLINE_ALLOWED_EMAILS = [
-    "support@envsave.com"
-  ];
-  if (offline) {
-    if (!dates) {
-      console.error("Invalid token format. Must be a signed es_ token.");
-      return false;
-    }
-    if (!OFFLINE_ALLOWED_EMAILS.includes(dates.email)) {
-      console.error("Offline activation is not available for this account.");
-      return false;
-    }
-    if (dates.expiresAt < new Date) {
-      console.error("Token is expired.");
-      return false;
-    }
-    ensureDir();
-    writeFileSync(LICENSE_FILE, JSON.stringify({
-      token,
-      validatedAt: new Date().toISOString(),
-      expiresAt: dates.expiresAt.toISOString()
-    }, null, 2), { mode: 384 });
-    return true;
-  }
-  try {
-    const response = await fetch(LICENSE_API_URL, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ token })
-    });
-    if (!response.ok) {
-      console.error("License validation failed: server returned", response.status);
-      return false;
-    }
-    const data = await response.json();
-    if (!data.valid) {
-      console.error("Invalid license token.");
-      return false;
-    }
-    ensureDir();
-    const licenseData = {
-      token,
-      validatedAt: new Date().toISOString(),
-      expiresAt: dates?.expiresAt.toISOString() ?? data.expiresAt ?? null
-    };
-    writeFileSync(LICENSE_FILE, JSON.stringify(licenseData, null, 2), { mode: 384 });
-    return true;
-  } catch (err) {
-    console.error("Failed to contact license server:", err.message);
-    return false;
-  }
-}
-function getLicenseToken() {
-  if (!existsSync(LICENSE_FILE))
-    return null;
-  try {
-    const data = JSON.parse(readFileSync2(LICENSE_FILE, "utf8"));
-    return data.token ?? null;
-  } catch {
-    return null;
-  }
-}
-async function tryAutoRenew(token) {
-  try {
-    const response = await fetch(RENEW_API_URL, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ token })
-    });
-    if (!response.ok)
-      return false;
-    const result = await response.json();
-    if (!result.token || !result.renewed)
-      return false;
-    const newDates = parseToken(result.token);
-    ensureDir();
-    writeFileSync(LICENSE_FILE, JSON.stringify({
-      token: result.token,
-      validatedAt: new Date().toISOString(),
-      expiresAt: newDates?.expiresAt.toISOString() ?? result.expiresAt ?? null
-    }, null, 2), { mode: 384 });
-    console.error("License renewed automatically.");
-    return true;
-  } catch {
-    return false;
-  }
-}
-function hasValidLicense() {
-  if (!existsSync(LICENSE_FILE))
-    return false;
-  try {
-    const data = JSON.parse(readFileSync2(LICENSE_FILE, "utf8"));
-    const dates = parseToken(data.token);
-    if (dates)
-      return dates.expiresAt > new Date;
-    if (data.expiresAt)
-      return new Date(data.expiresAt) > new Date;
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function checkLicense() {
-  if (!existsSync(LICENSE_FILE))
-    return false;
-  try {
-    const data = JSON.parse(readFileSync2(LICENSE_FILE, "utf8"));
-    const dates = parseToken(data.token);
-    if (dates) {
-      if (dates.expiresAt > new Date)
-        return true;
-      return await tryAutoRenew(data.token);
-    }
-    if (data.expiresAt) {
-      if (new Date(data.expiresAt) > new Date)
-        return true;
-      return await tryAutoRenew(data.token);
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
-var ENVSAVE_DIR, LICENSE_FILE, LICENSE_API_URL, RENEW_API_URL;
-var init_license = __esm(() => {
-  ENVSAVE_DIR = join(homedir(), ".envsave");
-  LICENSE_FILE = join(ENVSAVE_DIR, "license.json");
-  LICENSE_API_URL = process.env.ENVSAVE_LICENSE_API || "https://api.envsave.com/api/license/validate";
-  RENEW_API_URL = (process.env.ENVSAVE_LICENSE_API || "https://api.envsave.com/api/license/validate").replace("/validate", "/renew");
-});
-
 // src/vault.ts
 var exports_vault = {};
 __export(exports_vault, {
@@ -275,47 +114,47 @@ __export(exports_vault, {
   configureRateLimit: () => configureRateLimit,
   changePassword: () => changePassword
 });
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, chmodSync, appendFileSync } from "node:fs";
-import { join as join2 } from "node:path";
-import { homedir as homedir2 } from "node:os";
+import { readFileSync as readFileSync2, writeFileSync, existsSync, mkdirSync, chmodSync, appendFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
 import { randomBytes as randomBytes2 } from "node:crypto";
 function getEnvsaveDir() {
-  return process.env.ENVSAVE_DIR || join2(homedir2(), ".envsave");
+  return process.env.ENVSAVE_DIR || join(homedir(), ".envsave");
 }
 function getVaultFile() {
-  return join2(getEnvsaveDir(), "vault.enc");
+  return join(getEnvsaveDir(), "vault.enc");
 }
 function getCacheFile() {
-  return join2(getEnvsaveDir(), "cache.enc");
+  return join(getEnvsaveDir(), "cache.enc");
 }
 function getSessionFile() {
-  return join2(getEnvsaveDir(), ".session");
+  return join(getEnvsaveDir(), ".session");
 }
 function getRateFile() {
-  return join2(getEnvsaveDir(), ".rate");
+  return join(getEnvsaveDir(), ".rate");
 }
 function getAccessLog() {
-  return join2(getEnvsaveDir(), "access.log");
+  return join(getEnvsaveDir(), "access.log");
 }
 function getConfigFile() {
-  return join2(getEnvsaveDir(), "config.json");
+  return join(getEnvsaveDir(), "config.json");
 }
 function guardRealVault() {
   if (false) {}
 }
 function readConfig() {
-  if (!existsSync2(getConfigFile())) {
+  if (!existsSync(getConfigFile())) {
     return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX };
   }
   try {
-    return JSON.parse(readFileSync3(getConfigFile(), "utf8"));
+    return JSON.parse(readFileSync2(getConfigFile(), "utf8"));
   } catch {
     return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX };
   }
 }
 function writeConfig(config) {
-  ensureDir2();
-  writeFileSync2(getConfigFile(), JSON.stringify(config, null, 2), { mode: 384 });
+  ensureDir();
+  writeFileSync(getConfigFile(), JSON.stringify(config, null, 2), { mode: 384 });
 }
 function configureRateLimit(password, options) {
   readMainVault(password);
@@ -372,28 +211,28 @@ function computeOpaqueNameV2(hmacSeed, cleanName, sshKeyContent) {
   const hash = hmacSha256(effectiveSeed, cleanName);
   return "es_" + hash.slice(0, 24);
 }
-function ensureDir2() {
+function ensureDir() {
   guardRealVault();
-  if (!existsSync2(getEnvsaveDir())) {
-    mkdirSync2(getEnvsaveDir(), { recursive: true, mode: 448 });
+  if (!existsSync(getEnvsaveDir())) {
+    mkdirSync(getEnvsaveDir(), { recursive: true, mode: 448 });
   }
 }
 function vaultExists() {
-  return existsSync2(getVaultFile());
+  return existsSync(getVaultFile());
 }
 function readMainVault(password) {
   guardRealVault();
-  if (!existsSync2(getVaultFile())) {
+  if (!existsSync(getVaultFile())) {
     throw new Error("Vault not found. Run 'envsave init' first.");
   }
-  const payload = readFileSync3(getVaultFile());
+  const payload = readFileSync2(getVaultFile());
   const json = decrypt(payload, password);
   const data = JSON.parse(json);
   if (!data.version || data.version < 2) {
     throw new Error("Vault format outdated. Delete ~/.envsave/ and re-initialize.");
   }
   if (data.version === 2 && data.registry?.length > 0) {
-    const sshKeyContent = data.sshKeyPath && existsSync2(data.sshKeyPath) ? readFileSync3(data.sshKeyPath, "utf8") : undefined;
+    const sshKeyContent = data.sshKeyPath && existsSync(data.sshKeyPath) ? readFileSync2(data.sshKeyPath, "utf8") : undefined;
     const newSecrets = {};
     for (const cleanName of data.registry) {
       const oldKey = computeOpaqueNameV2(data.hmacSeed, cleanName, sshKeyContent);
@@ -408,7 +247,7 @@ function readMainVault(password) {
     console.error("Vault migrated to v3 (stronger opaque keys).");
   }
   if (data.version === 3 && data.registry?.length > 0) {
-    const sshKeyContent = data.sshKeyPath && existsSync2(data.sshKeyPath) ? readFileSync3(data.sshKeyPath, "utf8") : undefined;
+    const sshKeyContent = data.sshKeyPath && existsSync(data.sshKeyPath) ? readFileSync2(data.sshKeyPath, "utf8") : undefined;
     const newSecrets = {};
     for (const cleanName of data.registry) {
       const oldKey = computeOpaqueNameV3(data.hmacSeed, cleanName, sshKeyContent);
@@ -423,7 +262,7 @@ function readMainVault(password) {
     console.error("Vault migrated to v4 (shell-safe opaque keys).");
   }
   if (data.version === 4 && data.registry?.length > 0) {
-    const sshKeyContent = data.sshKeyPath && existsSync2(data.sshKeyPath) ? readFileSync3(data.sshKeyPath, "utf8") : undefined;
+    const sshKeyContent = data.sshKeyPath && existsSync(data.sshKeyPath) ? readFileSync2(data.sshKeyPath, "utf8") : undefined;
     const newSecrets = {};
     for (const cleanName of data.registry) {
       const oldKey = computeOpaqueNameV4(data.hmacSeed, cleanName, sshKeyContent);
@@ -440,27 +279,27 @@ function readMainVault(password) {
   return data;
 }
 function writeMainVault(data, password) {
-  ensureDir2();
+  ensureDir();
   const json = JSON.stringify(data);
   const encrypted = encrypt(json, password);
-  writeFileSync2(getVaultFile(), encrypted, { mode: 384 });
+  writeFileSync(getVaultFile(), encrypted, { mode: 384 });
 }
 function writeSessionCache(secrets, registry) {
-  ensureDir2();
+  ensureDir();
   const sessionKey = randomBytes2(32);
   const cache = { secrets, registry };
   const json = JSON.stringify(cache);
   const encrypted = encryptWithKey(json, sessionKey);
-  writeFileSync2(getCacheFile(), encrypted, { mode: 384 });
-  writeFileSync2(getSessionFile(), sessionKey.toString("hex"), { mode: 384 });
+  writeFileSync(getCacheFile(), encrypted, { mode: 384 });
+  writeFileSync(getSessionFile(), sessionKey.toString("hex"), { mode: 384 });
 }
 function readSessionCache() {
-  if (!existsSync2(getSessionFile()) || !existsSync2(getCacheFile()))
+  if (!existsSync(getSessionFile()) || !existsSync(getCacheFile()))
     return null;
   try {
-    const sessionKeyHex = readFileSync3(getSessionFile(), "utf8").trim();
+    const sessionKeyHex = readFileSync2(getSessionFile(), "utf8").trim();
     const sessionKey = Buffer.from(sessionKeyHex, "hex");
-    const payload = readFileSync3(getCacheFile());
+    const payload = readFileSync2(getCacheFile());
     const json = decryptWithKey(payload, sessionKey);
     return JSON.parse(json);
   } catch {
@@ -471,9 +310,9 @@ function checkRateLimit() {
   const config = readConfig();
   const now = Date.now();
   let timestamps = [];
-  if (existsSync2(getRateFile())) {
+  if (existsSync(getRateFile())) {
     try {
-      timestamps = JSON.parse(readFileSync3(getRateFile(), "utf8"));
+      timestamps = JSON.parse(readFileSync2(getRateFile(), "utf8"));
     } catch {
       timestamps = [];
     }
@@ -489,10 +328,10 @@ function checkRateLimit() {
     console.error(`⚠ Rate limit warning: ${remaining} get(s) remaining this minute.`);
   }
   timestamps.push(now);
-  writeFileSync2(getRateFile(), JSON.stringify(timestamps), { mode: 384 });
+  writeFileSync(getRateFile(), JSON.stringify(timestamps), { mode: 384 });
 }
 function logAccess(opaqueKey, source) {
-  ensureDir2();
+  ensureDir();
   const entry = `${new Date().toISOString()} ${source} ${opaqueKey.slice(0, 10)}...
 `;
   appendFileSync(getAccessLog(), entry, { mode: 384 });
@@ -500,20 +339,20 @@ function logAccess(opaqueKey, source) {
 function loadSshKey(vault) {
   if (!vault.sshKeyPath)
     return;
-  if (!existsSync2(vault.sshKeyPath)) {
+  if (!existsSync(vault.sshKeyPath)) {
     throw new Error(`SSH key not found: ${vault.sshKeyPath}. This vault requires the SSH key to operate.`);
   }
-  return readFileSync3(vault.sshKeyPath, "utf8");
+  return readFileSync2(vault.sshKeyPath, "utf8");
 }
 function initVault(password, options) {
   if (vaultExists()) {
     throw new Error("Vault already exists. Delete ~/.envsave/vault.enc to reinitialize.");
   }
-  if (options?.sshKeyPath && !existsSync2(options.sshKeyPath)) {
+  if (options?.sshKeyPath && !existsSync(options.sshKeyPath)) {
     throw new Error(`SSH key not found: ${options.sshKeyPath}`);
   }
   const hmacSeed = randomBytes2(32).toString("hex");
-  const sshKeyContent = options?.sshKeyPath ? readFileSync3(options.sshKeyPath, "utf8") : undefined;
+  const sshKeyContent = options?.sshKeyPath ? readFileSync2(options.sshKeyPath, "utf8") : undefined;
   const vault = {
     version: 5,
     hmacSeed,
@@ -524,11 +363,6 @@ function initVault(password, options) {
   let count = 0;
   if (options?.envFile) {
     const envSecrets = parseEnvFile(options.envFile);
-    if (!hasValidLicense() && Object.keys(envSecrets).length > FREE_TIER_MAX_SECRETS) {
-      throw new Error(`Free tier limit: max ${FREE_TIER_MAX_SECRETS} secrets. .env file has ${Object.keys(envSecrets).length} keys.
-Run 'envsave activate <token>' to unlock unlimited secrets.
-Get your license at https://api.envsave.com`);
-    }
     for (const [key, value] of Object.entries(envSecrets)) {
       const opaque = computeOpaqueName(hmacSeed, key, sshKeyContent);
       vault.secrets[opaque] = value;
@@ -546,12 +380,6 @@ function setSecret(key, value, password) {
   const sshKeyContent = loadSshKey(vault);
   const opaque = computeOpaqueName(vault.hmacSeed, key, sshKeyContent);
   const updated = opaque in vault.secrets;
-  if (!updated && !hasValidLicense()) {
-    if (vault.registry.length >= FREE_TIER_MAX_SECRETS) {
-      throw new Error(`Free tier limit: max ${FREE_TIER_MAX_SECRETS} secrets. Run 'envsave activate <token>' to unlock unlimited secrets.
-Get your license at https://api.envsave.com`);
-    }
-  }
   vault.secrets[opaque] = value;
   if (!vault.registry.includes(key)) {
     vault.registry.push(key);
@@ -627,17 +455,6 @@ function importEnv(filePath, password) {
   const envSecrets = parseEnvFile(filePath);
   const vault = readMainVault(password);
   const sshKeyContent = loadSshKey(vault);
-  if (!hasValidLicense()) {
-    const newKeys = Object.keys(envSecrets).filter((key) => {
-      const opaque = computeOpaqueName(vault.hmacSeed, key, sshKeyContent);
-      return !(opaque in vault.secrets);
-    });
-    if (vault.registry.length + newKeys.length > FREE_TIER_MAX_SECRETS) {
-      throw new Error(`Free tier limit: max ${FREE_TIER_MAX_SECRETS} secrets. Import would add ${newKeys.length} new keys (${vault.registry.length} existing).
-Run 'envsave activate <token>' to unlock unlimited secrets.
-Get your license at https://api.envsave.com`);
-    }
-  }
   let count = 0;
   for (const [key, value] of Object.entries(envSecrets)) {
     const opaque = computeOpaqueName(vault.hmacSeed, key, sshKeyContent);
@@ -673,12 +490,13 @@ function searchKeys(pattern) {
   const lower = pattern.toLowerCase();
   return cache.registry.filter((k) => k.toLowerCase().includes(lower));
 }
-function getDeploySecrets(opaqueKeys, password) {
+function getDeploySecrets(keys, password) {
   const vault = readMainVault(password);
   const sshKeyContent = loadSshKey(vault);
   writeSessionCache(vault.secrets, vault.registry);
   const results = [];
-  for (const opaque of opaqueKeys) {
+  for (const key of keys) {
+    const opaque = key.startsWith("es_") ? key : computeOpaqueName(vault.hmacSeed, key, sshKeyContent);
     if (opaque in vault.secrets) {
       const cleanName = vault.registry?.find((r) => computeOpaqueName(vault.hmacSeed, r, sshKeyContent) === opaque) || opaque;
       results.push({ name: cleanName, opaque, value: vault.secrets[opaque] });
@@ -699,11 +517,10 @@ function hasSecretWithSession(opaqueKey) {
     return false;
   }
 }
-var FREE_TIER_MAX_SECRETS = 5, DEFAULT_RATE_LIMIT_WINDOW_MS, DEFAULT_RATE_LIMIT_MAX = 30, BASE_CHARS_V3 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@$&*=-!", BASE_CHARS_V4 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_", BASE_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_";
+var DEFAULT_RATE_LIMIT_WINDOW_MS, DEFAULT_RATE_LIMIT_MAX = 30, BASE_CHARS_V3 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@$&*=-!", BASE_CHARS_V4 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_", BASE_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_";
 var init_vault = __esm(() => {
   init_crypto();
   init_env_parser();
-  init_license();
   DEFAULT_RATE_LIMIT_WINDOW_MS = 60 * 1000;
 });
 
@@ -867,13 +684,206 @@ var init_scanner = __esm(() => {
 
 // src/cli.ts
 init_vault();
-init_license();
 import { createInterface } from "node:readline";
 import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { join as join4 } from "node:path";
 import { homedir as homedir3 } from "node:os";
+
+// src/license.ts
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+var ENVSAVE_DIR = join2(homedir2(), ".envsave");
+var LICENSE_FILE = join2(ENVSAVE_DIR, "license.json");
+var LICENSE_API_URL = process.env.ENVSAVE_LICENSE_API || "https://api.envsave.com/api/license/validate";
+function ensureDir2() {
+  if (!existsSync2(ENVSAVE_DIR)) {
+    mkdirSync2(ENVSAVE_DIR, { recursive: true, mode: 448 });
+  }
+}
+function parseToken(token) {
+  if (!token.startsWith("es_"))
+    return null;
+  try {
+    const b64 = token.slice(3);
+    const pad = b64.length % 4 === 0 ? "" : "=".repeat(4 - b64.length % 4);
+    const raw = Buffer.from(b64.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64").toString("utf8");
+    const parts = raw.split("|");
+    if (parts.length !== 4)
+      return null;
+    return {
+      email: parts[0],
+      createdAt: new Date(Number(parts[1]) * 1000),
+      expiresAt: new Date(Number(parts[2]) * 1000)
+    };
+  } catch {
+    return null;
+  }
+}
+async function activateLicense(token, offline = false) {
+  const dates = parseToken(token);
+  const OFFLINE_ALLOWED_EMAILS = [
+    "support@envsave.com"
+  ];
+  if (offline) {
+    if (!dates) {
+      console.error("Invalid token format. Must be a signed es_ token.");
+      return false;
+    }
+    if (!OFFLINE_ALLOWED_EMAILS.includes(dates.email)) {
+      console.error("Offline activation is not available for this account.");
+      return false;
+    }
+    if (dates.expiresAt < new Date) {
+      console.error("Token is expired.");
+      return false;
+    }
+    ensureDir2();
+    writeFileSync2(LICENSE_FILE, JSON.stringify({
+      token,
+      validatedAt: new Date().toISOString(),
+      expiresAt: dates.expiresAt.toISOString()
+    }, null, 2), { mode: 384 });
+    return true;
+  }
+  try {
+    const response = await fetch(LICENSE_API_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ token })
+    });
+    if (!response.ok) {
+      console.error("License validation failed: server returned", response.status);
+      return false;
+    }
+    const data = await response.json();
+    if (!data.valid) {
+      console.error("Invalid license token.");
+      return false;
+    }
+    ensureDir2();
+    const licenseData = {
+      token,
+      validatedAt: new Date().toISOString(),
+      expiresAt: dates?.expiresAt.toISOString() ?? data.expiresAt ?? null
+    };
+    writeFileSync2(LICENSE_FILE, JSON.stringify(licenseData, null, 2), { mode: 384 });
+    return true;
+  } catch (err) {
+    console.error("Failed to contact license server:", err.message);
+    return false;
+  }
+}
+function getLicenseToken() {
+  if (!existsSync2(LICENSE_FILE))
+    return null;
+  try {
+    const data = JSON.parse(readFileSync3(LICENSE_FILE, "utf8"));
+    return data.token ?? null;
+  } catch {
+    return null;
+  }
+}
+var RENEW_API_URL = (process.env.ENVSAVE_LICENSE_API || "https://api.envsave.com/api/license/validate").replace("/validate", "/renew");
+async function tryAutoRenew(token) {
+  try {
+    const response = await fetch(RENEW_API_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ token })
+    });
+    if (!response.ok)
+      return false;
+    const result = await response.json();
+    if (!result.token || !result.renewed)
+      return false;
+    const newDates = parseToken(result.token);
+    ensureDir2();
+    writeFileSync2(LICENSE_FILE, JSON.stringify({
+      token: result.token,
+      validatedAt: new Date().toISOString(),
+      expiresAt: newDates?.expiresAt.toISOString() ?? result.expiresAt ?? null
+    }, null, 2), { mode: 384 });
+    console.error("License renewed automatically.");
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function checkLicense() {
+  if (!existsSync2(LICENSE_FILE))
+    return false;
+  try {
+    const data = JSON.parse(readFileSync3(LICENSE_FILE, "utf8"));
+    const dates = parseToken(data.token);
+    if (dates) {
+      if (dates.expiresAt > new Date)
+        return true;
+      return await tryAutoRenew(data.token);
+    }
+    if (data.expiresAt) {
+      if (new Date(data.expiresAt) > new Date)
+        return true;
+      return await tryAutoRenew(data.token);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+// package.json
+var package_default = {
+  name: "@envsave/cli",
+  version: "1.0.42",
+  description: "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
+  type: "module",
+  main: "dist/index.js",
+  types: "dist/index.d.ts",
+  bin: {
+    envsave: "dist/cli.js"
+  },
+  files: [
+    "dist",
+    "python"
+  ],
+  scripts: {
+    prebuild: `bun -e "const p=require('./package.json');const v=p.version.split('.');v[2]=+v[2]+1;p.version=v.join('.');require('fs').writeFileSync('package.json',JSON.stringify(p,null,2)+'\\n')"`,
+    build: "bun build src/cli.ts --outdir dist --target node --format esm && bun build src/index.ts --outdir dist --target node --format esm --outfile dist/index.js",
+    dev: "bun run src/cli.ts",
+    webapp: "bun run webapp/server.ts",
+    "lint:claude": "claude -p 'you are a linter. please look at the changes vs. main and report any issues related to typos. report the filename and line number on one line, and a description of the issue on the second line. do not return any other text.'"
+  },
+  devDependencies: {
+    "@types/bun": "latest",
+    "@types/node": "^25.5.0"
+  },
+  peerDependencies: {
+    typescript: "^5"
+  },
+  keywords: [
+    "vault",
+    "secrets",
+    "encryption",
+    "llm",
+    "security",
+    "env"
+  ],
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/jcsancho/envsave.git"
+  },
+  homepage: "https://api.envsave.com",
+  author: "Jose C Sancho",
+  dependencies: {
+    "@clerk/backend": "^3.2.1",
+    "@supabase/supabase-js": "^2.99.2"
+  }
+};
+
+// src/cli.ts
 var args = process.argv.slice(2);
 var command = args[0];
 function checkEnvFiles() {
@@ -923,7 +933,7 @@ Usage:
   envsave backup                        Upload encrypted vault to server
   envsave restore                       Download vault backup from server
   envsave sync                          Sync vault with server (pull if cloud newer)
-  envsave vercel <key> [key2]...        Push secrets to Vercel as opaque env vars
+  envsave vercel <KEY|es_key>...        Push secrets to Vercel (accepts names or opaque keys)
   envsave help                          Show this help
 
 Security model:
@@ -998,6 +1008,10 @@ async function main() {
     checkEnvFiles();
     return;
   }
+  if (command === "--version" || command === "-v" || command === "version") {
+    console.log(package_default.version);
+    return;
+  }
   switch (command) {
     case "activate": {
       const token = args[1];
@@ -1283,9 +1297,6 @@ ${results.length} reference(s), ${uniqueVars.size} unique variable(s) found.`);
         }
         console.log(`
 ${keys.length} secret(s). Use 'envsave reveal <KEY>' to get the opaque key.`);
-        if (!hasValidLicense()) {
-          console.log(`\x1B[33mFree tier: ${keys.length}/5 secrets used. Activate a license for unlimited.\x1B[0m`);
-        }
       }
       break;
     }
@@ -1540,19 +1551,13 @@ Use 'envsave list' to verify your secrets.`);
           keyArgs.splice(envIdx, 1);
       }
       if (keyArgs.length === 0) {
-        console.error("Usage: envsave vercel <es_key> [es_key2]... [--env production,preview]");
-        process.exit(1);
-      }
-      const invalidKeys = keyArgs.filter((k) => !k.startsWith("es_"));
-      if (invalidKeys.length > 0) {
-        console.error(`Only opaque keys (es_...) are accepted. Use 'envsave reveal <NAME>' to get the opaque key.`);
-        console.error(`Invalid: ${invalidKeys.join(", ")}`);
+        console.error("Usage: envsave vercel <KEY|es_key> [KEY|es_key2]... [--env production,preview]");
         process.exit(1);
       }
       const password = await requirePassword();
       const keysToPush = keyArgs;
       const secrets = getDeploySecrets(keysToPush, password);
-      const notFound = keysToPush.filter((k) => !secrets.find((s) => s.opaque === k));
+      const notFound = keysToPush.filter((k) => !secrets.find((s) => s.opaque === k || s.name === k));
       if (notFound.length > 0) {
         console.error(`Secrets not found: ${notFound.join(", ")}`);
         if (secrets.length === 0)

package/dist/index.js

@@ -1,7 +1,7 @@
 // src/vault.ts
 import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, appendFileSync } from "node:fs";
-import { join as join2 } from "node:path";
-import { homedir as homedir2 } from "node:os";
+import { join } from "node:path";
+import { homedir } from "node:os";
 
 // src/crypto.ts
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, pbkdf2Sync } from "node:crypto";
@@ -16,34 +16,26 @@ function decryptWithKey(payload, key) {
   return decipher.update(encrypted) + decipher.final("utf8");
 }
 
-// src/license.ts
-import { join } from "node:path";
-import { homedir } from "node:os";
-var ENVSAVE_DIR = join(homedir(), ".envsave");
-var LICENSE_FILE = join(ENVSAVE_DIR, "license.json");
-var LICENSE_API_URL = process.env.ENVSAVE_LICENSE_API || "https://api.envsave.com/api/license/validate";
-var RENEW_API_URL = (process.env.ENVSAVE_LICENSE_API || "https://api.envsave.com/api/license/validate").replace("/validate", "/renew");
-
 // src/vault.ts
 function getEnvsaveDir() {
-  return process.env.ENVSAVE_DIR || join2(homedir2(), ".envsave");
+  return process.env.ENVSAVE_DIR || join(homedir(), ".envsave");
 }
 function getCacheFile() {
-  return join2(getEnvsaveDir(), "cache.enc");
+  return join(getEnvsaveDir(), "cache.enc");
 }
 function getSessionFile() {
-  return join2(getEnvsaveDir(), ".session");
+  return join(getEnvsaveDir(), ".session");
 }
 function getRateFile() {
-  return join2(getEnvsaveDir(), ".rate");
+  return join(getEnvsaveDir(), ".rate");
 }
 function getAccessLog() {
-  return join2(getEnvsaveDir(), "access.log");
+  return join(getEnvsaveDir(), "access.log");
 }
 var DEFAULT_RATE_LIMIT_WINDOW_MS = 60 * 1000;
 var DEFAULT_RATE_LIMIT_MAX = 30;
 function getConfigFile() {
-  return join2(getEnvsaveDir(), "config.json");
+  return join(getEnvsaveDir(), "config.json");
 }
 function guardRealVault() {
   if (false) {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsave/cli",
-  "version": "1.0.40",
+  "version": "1.0.42",
   "description": "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
   "type": "module",
   "main": "dist/index.js",