@envsave/cli 1.0.43 → 1.0.45

package/README.md

@@ -26,11 +26,11 @@ import { get } from "@envsave/cli";
 const openai = new OpenAI({ apiKey: get("es_7a3f2b1e9c8d4f6b2a1c3d5f") });
 ```
 
-This is the single problem this project is built around. Everything else — the CLI, the license server, the Python bridge, the cloud backup — exists to make opaque-key-based secrets practical to use day to day.
+This is the single problem this project is built around. Everything else — the CLI, the license server, the Python bridge, the Vercel push, the cloud backup — exists to make opaque-key-based secrets practical to use day to day.
 
 ## Pricing
 
-Local personal use is **free and unlimited** — store as many secrets as you want with no license. A license is only required to sync your vault to the cloud; activate one with `envsave activate <token>` — get yours at https://envsave.com.
+Local personal use is **free and unlimited** — store as many secrets as you want, on as many machines as you want, with no license required. A license is only needed to sync your vault to the EnvSave cloud (backup / restore / sync across machines). Activate one with `envsave activate <token>` — get yours at https://envsave.com.
 
 ## Installation
 
@@ -48,8 +48,16 @@ Python users:
 pip install envsave
 ```
 
+Check the installed version any time:
+
+```bash
+envsave --version
+```
+
 ## Activation
 
+Activation is only required for cloud sync. Local use works without it.
+
 ### Online (production)
 
 Requires the license server running at `https://api.envsave.com`.
@@ -92,12 +100,12 @@ You'll be prompted to set and confirm a master password.
 ```bash
 envsave set OPENAI_API_KEY sk-abc123
 #  Output:
-#    OPENAI_API_KEY → es_7a3f2b1e9c8d4f6b
+#    Added: OPENAI_API_KEY → es_7a3f2b1e9c8d4f6b
 #    Use this in your code to access OPENAI_API_KEY:
 #      envsave.get("es_7a3f2b1e9c8d4f6b")
 ```
 
-The opaque key (`es_...`) is an HMAC-SHA256 hash — no trace of the original key name.
+The opaque key (`es_...`) is an HMAC-SHA256 hash — no trace of the original key name. Re-running `envsave set` on an existing key updates the value in place; the opaque key stays the same, so you don't need to touch any code.
 
 ## Retrieving Secrets
 
@@ -106,6 +114,9 @@ The opaque key (`es_...`) is an HMAC-SHA256 hash — no trace of the original ke
 ```bash
 # By opaque key (tries session cache first, then prompts for password)
 envsave get es_7a3f2b1e9c8d4f6b
+
+# By clean name (password required — returns the plaintext value)
+envsave show OPENAI_API_KEY
 ```
 
 ### Node.js / Bun
@@ -131,28 +142,78 @@ api_key = get("es_7a3f2b1e9c8d4f6b")
 ## Other Commands
 
 ```bash
-# Show opaque key for a named secret (requires password)
-envsave reveal OPENAI_API_KEY
+# Show opaque key(s) for any name matching a keyword (password required)
+envsave reveal OPENAI                       # matches OPENAI_API_KEY, OPENAI_ORG, …
+envsave reveal OPENAI_API_KEY DATABASE_URL  # multiple keywords at once
 
-# Reveal multiple keys at once
-envsave reveal OPENAI_API_KEY DATABASE_URL STRIPE_KEY
+# Show the real value by clean name (password required)
+envsave show OPENAI_API_KEY
 
-# List all stored key names (requires password)
+# Search clean names without revealing opaque keys (no password if session is warm)
+envsave search openai
+
+# Scan the current project for hardcoded env references and opaque keys
+envsave scan [dir]
+
+# List all stored key names (password required)
 envsave list
 
-# Delete a secret (requires password)
+# Delete a secret (password required)
 envsave delete OPENAI_API_KEY
 
-# Bulk import from .env file (requires password)
+# Rename a secret (password required)
+# Creates a new opaque key derived from the new name, copies the value over,
+# and deletes the old opaque key. The output prints OLD → NEW for easy
+# search-and-replace in your code.
+envsave rename CLERK_SECRET_KEY_THEHOTELAGENTS CLERK_SECRET_KEY_DIRECTBOOKAI
+#  Output:
+#    Renamed: CLERK_SECRET_KEY_THEHOTELAGENTS → CLERK_SECRET_KEY_DIRECTBOOKAI
+#    Replace in your code:
+#      OLD (deleted):  es_7cXxcbsVaJQv...
+#      NEW (created):  es_enLaxEjzTO5r...
+
+# Bulk import from .env file (password required)
 envsave import .env
 
-# Export all secrets as .env format (requires password)
+# Export all secrets as .env format (password required)
 envsave export
+
+# Change master password
+envsave passwd
+
+# Rate limit config (password required to change)
+envsave config                     # show current
+envsave config --max-gets 120      # set max gets/minute
+
+# Show version
+envsave --version
+```
+
+## Deploying to Vercel
+
+`envsave vercel` pushes selected secrets to a Vercel project so serverless functions and build-time code both work without any `.env` on disk.
+
+```bash
+# In a directory already linked with `vercel link`
+envsave vercel OPENAI_API_KEY DATABASE_URL
+
+# Push by opaque id instead of clean name
+envsave vercel es_7a3f2b1e9c8d4f6b
+
+# Restrict to specific environments (default is production, preview, development)
+envsave vercel OPENAI_API_KEY --env production,preview
 ```
 
+Each secret is uploaded under **both** the opaque id (`es_...`) and the clean name (`OPENAI_API_KEY`). That means:
+
+- **Build-time / server code** can keep calling `envsave.get("es_7a3f...")` — the opaque id is present as an env var, so no password or vault is needed in the deployed environment.
+- **Runtime serverless functions** that expect `process.env.OPENAI_API_KEY` keep working unchanged.
+
+Only the secrets you name on the command line are pushed — the rest of your vault stays local.
+
 ## Cloud Backup & Sync
 
-The encrypted vault can be backed up to the EnvSave cloud server for disaster recovery or syncing across machines. The server only stores the encrypted bytes — it never sees plaintext secrets.
+Requires an active license. The encrypted vault can be backed up to the EnvSave cloud server for disaster recovery or syncing across machines. The server only stores the encrypted bytes — it never sees plaintext secrets.
 
 ```bash
 # Upload encrypted vault to cloud
@@ -179,7 +240,7 @@ envsave sync
 
 ```bash
 # 1. Install envsave
-bun install @envsave/cli
+npm install -g @envsave/cli
 
 # 2. Activate with same license token
 envsave activate <token>
@@ -198,8 +259,9 @@ envsave list
 2. Stored at `~/.envsave/vault.enc` (binary: salt + iv + encrypted data + auth tag)
 3. Key names are HMAC-SHA256 hashes — fully opaque, no trace of original name
 4. Session cache stores decrypted secrets in memory — no password needed for repeated reads
-5. Optional SSH key adds a "something you have" hardware factor
-6. LLM agents only see opaque keys — they can read values but can't discover or enumerate secrets
+5. `envsave get` is rate-limited (configurable via `envsave config --max-gets`) to blunt automated scraping from a compromised session
+6. Optional SSH key adds a "something you have" hardware factor
+7. LLM agents only see opaque keys — they can read values but can't discover or enumerate secrets
 
 ## License Tokens
 
@@ -219,5 +281,5 @@ When a license token expires, the CLI automatically contacts the server to renew
 | File | Purpose |
 |------|---------|
 | `~/.envsave/vault.enc` | Encrypted vault |
-| `~/.envsave/license.json` | Activated license |
+| `~/.envsave/license.json` | Activated license (cloud sync only) |
 | `~/.envsave/session.json` | Session cache (decrypted secrets) |

package/dist/cli.js

@@ -100,6 +100,7 @@ __export(exports_vault, {
   searchKeys: () => searchKeys,
   revealKeysByPattern: () => revealKeysByPattern,
   revealKey: () => revealKey,
+  renameSecret: () => renameSecret,
   listKeys: () => listKeys,
   initVault: () => initVault,
   importEnv: () => importEnv,
@@ -446,6 +447,28 @@ function deleteSecret(key, password) {
   writeSessionCache(vault.secrets, vault.registry);
   return true;
 }
+function renameSecret(oldName, newName, password) {
+  if (oldName === newName) {
+    throw new Error("Old and new names are the same.");
+  }
+  const vault = readMainVault(password);
+  const sshKeyContent = loadSshKey(vault);
+  const oldOpaque = computeOpaqueName(vault.hmacSeed, oldName, sshKeyContent);
+  if (!vault.registry.includes(oldName) || !(oldOpaque in vault.secrets)) {
+    throw new Error(`Secret '${oldName}' not found.`);
+  }
+  if (vault.registry.includes(newName)) {
+    throw new Error(`Secret '${newName}' already exists.`);
+  }
+  const newOpaque = computeOpaqueName(vault.hmacSeed, newName, sshKeyContent);
+  const value = vault.secrets[oldOpaque];
+  vault.secrets[newOpaque] = value;
+  delete vault.secrets[oldOpaque];
+  vault.registry = vault.registry.map((k) => k === oldName ? newName : k);
+  writeMainVault(vault, password);
+  writeSessionCache(vault.secrets, vault.registry);
+  return { oldOpaque, newOpaque };
+}
 function listKeys(password) {
   const vault = readMainVault(password);
   writeSessionCache(vault.secrets, vault.registry);
@@ -836,7 +859,7 @@ async function checkLicense() {
 // package.json
 var package_default = {
   name: "@envsave/cli",
-  version: "1.0.43",
+  version: "1.0.45",
   description: "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
   type: "module",
   main: "dist/index.js",
@@ -922,6 +945,7 @@ Usage:
   envsave show <key>                    Show real value by key name (password required)
   envsave reveal <keyword> [keyword2]... Show opaque key(s) for any name matching keyword (password required)
   envsave delete <key>                  Remove a secret (password required)
+  envsave rename <old> <new>            Rename a secret (creates new opaque key, deletes old) (password required)
   envsave search <keyword>              Search keys matching keyword (no password)
   envsave scan [dir]                    Scan project for env variable usage
   envsave passwd                        Change master password
@@ -1168,6 +1192,28 @@ Use 'envsave reveal <KEY>' to get the opaque key for each secret.`);
       }
       break;
     }
+    case "rename": {
+      const oldName = args[1];
+      const newName = args[2];
+      if (!oldName || !newName) {
+        console.error("Usage: envsave rename <old> <new>");
+        process.exit(1);
+      }
+      const password = await requirePassword();
+      const { oldOpaque, newOpaque } = renameSecret(oldName, newName, password);
+      console.log(`
+  Renamed: ${oldName} → ${newName}`);
+      console.log(`
+  Replace in your code:`);
+      console.log(`    OLD (deleted):  ${oldOpaque}`);
+      console.log(`    NEW (created):  ${newOpaque}`);
+      console.log(`
+  Or replace the full call:`);
+      console.log(`    envsave.get("${oldOpaque}")`);
+      console.log(`    envsave.get("${newOpaque}")
+`);
+      break;
+    }
     case "config": {
       const maxGets = getFlag("--max-gets");
       if (!maxGets) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsave/cli",
-  "version": "1.0.43",
+  "version": "1.0.45",
   "description": "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
   "type": "module",
   "main": "dist/index.js",