@envsave/cli 1.0.44 → 1.0.45

package/README.md

@@ -161,6 +161,17 @@ envsave list
 # Delete a secret (password required)
 envsave delete OPENAI_API_KEY
 
+# Rename a secret (password required)
+# Creates a new opaque key derived from the new name, copies the value over,
+# and deletes the old opaque key. The output prints OLD → NEW for easy
+# search-and-replace in your code.
+envsave rename CLERK_SECRET_KEY_THEHOTELAGENTS CLERK_SECRET_KEY_DIRECTBOOKAI
+#  Output:
+#    Renamed: CLERK_SECRET_KEY_THEHOTELAGENTS → CLERK_SECRET_KEY_DIRECTBOOKAI
+#    Replace in your code:
+#      OLD (deleted):  es_7cXxcbsVaJQv...
+#      NEW (created):  es_enLaxEjzTO5r...
+
 # Bulk import from .env file (password required)
 envsave import .env
 

package/dist/cli.js

@@ -100,6 +100,7 @@ __export(exports_vault, {
   searchKeys: () => searchKeys,
   revealKeysByPattern: () => revealKeysByPattern,
   revealKey: () => revealKey,
+  renameSecret: () => renameSecret,
   listKeys: () => listKeys,
   initVault: () => initVault,
   importEnv: () => importEnv,
@@ -446,6 +447,28 @@ function deleteSecret(key, password) {
   writeSessionCache(vault.secrets, vault.registry);
   return true;
 }
+function renameSecret(oldName, newName, password) {
+  if (oldName === newName) {
+    throw new Error("Old and new names are the same.");
+  }
+  const vault = readMainVault(password);
+  const sshKeyContent = loadSshKey(vault);
+  const oldOpaque = computeOpaqueName(vault.hmacSeed, oldName, sshKeyContent);
+  if (!vault.registry.includes(oldName) || !(oldOpaque in vault.secrets)) {
+    throw new Error(`Secret '${oldName}' not found.`);
+  }
+  if (vault.registry.includes(newName)) {
+    throw new Error(`Secret '${newName}' already exists.`);
+  }
+  const newOpaque = computeOpaqueName(vault.hmacSeed, newName, sshKeyContent);
+  const value = vault.secrets[oldOpaque];
+  vault.secrets[newOpaque] = value;
+  delete vault.secrets[oldOpaque];
+  vault.registry = vault.registry.map((k) => k === oldName ? newName : k);
+  writeMainVault(vault, password);
+  writeSessionCache(vault.secrets, vault.registry);
+  return { oldOpaque, newOpaque };
+}
 function listKeys(password) {
   const vault = readMainVault(password);
   writeSessionCache(vault.secrets, vault.registry);
@@ -836,7 +859,7 @@ async function checkLicense() {
 // package.json
 var package_default = {
   name: "@envsave/cli",
-  version: "1.0.44",
+  version: "1.0.45",
   description: "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
   type: "module",
   main: "dist/index.js",
@@ -922,6 +945,7 @@ Usage:
   envsave show <key>                    Show real value by key name (password required)
   envsave reveal <keyword> [keyword2]... Show opaque key(s) for any name matching keyword (password required)
   envsave delete <key>                  Remove a secret (password required)
+  envsave rename <old> <new>            Rename a secret (creates new opaque key, deletes old) (password required)
   envsave search <keyword>              Search keys matching keyword (no password)
   envsave scan [dir]                    Scan project for env variable usage
   envsave passwd                        Change master password
@@ -1168,6 +1192,28 @@ Use 'envsave reveal <KEY>' to get the opaque key for each secret.`);
       }
       break;
     }
+    case "rename": {
+      const oldName = args[1];
+      const newName = args[2];
+      if (!oldName || !newName) {
+        console.error("Usage: envsave rename <old> <new>");
+        process.exit(1);
+      }
+      const password = await requirePassword();
+      const { oldOpaque, newOpaque } = renameSecret(oldName, newName, password);
+      console.log(`
+  Renamed: ${oldName} → ${newName}`);
+      console.log(`
+  Replace in your code:`);
+      console.log(`    OLD (deleted):  ${oldOpaque}`);
+      console.log(`    NEW (created):  ${newOpaque}`);
+      console.log(`
+  Or replace the full call:`);
+      console.log(`    envsave.get("${oldOpaque}")`);
+      console.log(`    envsave.get("${newOpaque}")
+`);
+      break;
+    }
     case "config": {
       const maxGets = getFlag("--max-gets");
       if (!maxGets) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsave/cli",
-  "version": "1.0.44",
+  "version": "1.0.45",
   "description": "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
   "type": "module",
   "main": "dist/index.js",