lsh-framework 1.7.4 → 1.8.0

package/dist/lib/secrets-manager.js

@@ -159,8 +159,8 @@ export class SecretsManager {
         }
         message += `\nThis is likely unintentional and could break your application.\n\n`;
         message += `To proceed anyway, use the --force flag:\n`;
-        message += `  lsh lib secrets push --force\n`;
-        message += `  lsh lib secrets sync --force\n`;
+        message += `  lsh push --force\n`;
+        message += `  lsh sync --force\n`;
         return message;
     }
     /**
@@ -505,7 +505,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
      * Smart sync command - automatically set up and synchronize secrets
      * This is the new enhanced sync that does everything automatically
      */
-    async smartSync(envFilePath = '.env', environment = 'dev', autoExecute = true, loadMode = false, force = false) {
+    async smartSync(envFilePath = '.env', environment = 'dev', autoExecute = true, loadMode = false, force = false, forceRekey = false) {
         // In load mode, suppress all logger output to prevent zsh glob interpretation
         // Save original level and restore at the end
         const originalLogLevel = loadMode ? logger['config'].level : undefined;
@@ -551,11 +551,40 @@ LSH_SECRETS_KEY=${this.encryptionKey}
             // Step 4: Determine action and execute if auto mode
             let _action = 'in-sync';
             if (status.cloudExists && status.keyMatches === false) {
+                if (forceRekey) {
+                    // Force re-keying: push local secrets with current key
+                    _action = 'push';
+                    out('🔄 Force re-keying: Re-encrypting cloud secrets with current key...');
+                    if (autoExecute) {
+                        if (!status.localExists) {
+                            out('❌ Cannot re-key: No local .env file found');
+                            out(`💡 Pull with original key first, or create new .env`);
+                            return;
+                        }
+                        out('   Pushing to cloud with new key...');
+                        await this.push(envFilePath, effectiveEnv, true); // Force push
+                        out();
+                        out('✅ Re-keying complete! Cloud secrets now encrypted with current key.');
+                    }
+                    else {
+                        out('💡 Run: lsh push -f ${envFilePath} -e ${environment}');
+                    }
+                    out();
+                    // Output export commands in load mode
+                    if (loadMode && fs.existsSync(envFilePath)) {
+                        console.log(this.generateExportCommands(envFilePath));
+                    }
+                    return;
+                }
+                // No force-rekey: show error and options
                 _action = 'key-mismatch';
                 out('⚠️  Encryption key mismatch!');
                 out('   The local key does not match the cloud storage.');
-                out('   Please use the original key or push new secrets with:');
-                out(`   lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+                out();
+                out('   Options:');
+                out(`   1. Use the original key (recommended if you have it)`);
+                out(`   2. Re-encrypt with current key: lsh push -f ${envFilePath} -e ${environment}`);
+                out(`   3. Re-key during sync: lsh sync --force-rekey -f ${envFilePath} -e ${environment}`);
                 out();
                 return;
             }
@@ -571,7 +600,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                     out('✅ Setup complete! Edit your .env and run sync again to update.');
                 }
                 else {
-                    out('💡 Run: lsh lib secrets create && lsh lib secrets push');
+                    out('💡 Run: lsh create && lsh push');
                 }
                 out();
                 // Output export commands in load mode
@@ -589,7 +618,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                     out('✅ Secrets pushed to cloud!');
                 }
                 else {
-                    out(`💡 Run: lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+                    out(`💡 Run: lsh push -f ${envFilePath} -e ${environment}`);
                 }
                 out();
                 // Output export commands in load mode
@@ -607,7 +636,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                     out('✅ Secrets pulled from cloud!');
                 }
                 else {
-                    out(`💡 Run: lsh lib secrets pull -f ${envFilePath} -e ${environment}`);
+                    out(`💡 Run: lsh pull -f ${envFilePath} -e ${environment}`);
                 }
                 out();
                 // Output export commands in load mode
@@ -644,7 +673,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                             out('✅ Secrets synced to cloud!');
                         }
                         else {
-                            out(`💡 Run: lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+                            out(`💡 Run: lsh push -f ${envFilePath} -e ${environment}`);
                         }
                     }
                     else {
@@ -658,7 +687,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                             out('✅ Secrets synced from cloud!');
                         }
                         else {
-                            out(`💡 Run: lsh lib secrets pull -f ${envFilePath} -e ${environment}`);
+                            out(`💡 Run: lsh pull -f ${envFilePath} -e ${environment}`);
                         }
                     }
                     out();
@@ -723,22 +752,22 @@ LSH_SECRETS_KEY=${this.encryptionKey}
         const suggestions = [];
         if (!status.keySet) {
             suggestions.push('⚠️  No encryption key set!');
-            suggestions.push('   Generate a key: lsh lib secrets key');
+            suggestions.push('   Generate a key: lsh key');
             suggestions.push('   Add it to .env: LSH_SECRETS_KEY=<your-key>');
             suggestions.push('   Load it: export $(cat .env | xargs)');
         }
         if (status.cloudExists && status.keyMatches === false) {
             suggestions.push('⚠️  Encryption key does not match cloud storage!');
             suggestions.push('   Either use the original key, or push new secrets:');
-            suggestions.push(`   lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+            suggestions.push(`   lsh push -f ${envFilePath} -e ${environment}`);
         }
         if (!status.localExists && status.cloudExists && status.keyMatches) {
             suggestions.push('💡 Cloud secrets available but no local file');
-            suggestions.push(`   Pull from cloud: lsh lib secrets pull -f ${envFilePath} -e ${environment}`);
+            suggestions.push(`   Pull from cloud: lsh pull -f ${envFilePath} -e ${environment}`);
         }
         if (status.localExists && !status.cloudExists) {
             suggestions.push('💡 Local .env exists but not in cloud');
-            suggestions.push(`   Push to cloud: lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+            suggestions.push(`   Push to cloud: lsh push -f ${envFilePath} -e ${environment}`);
         }
         if (status.localExists && status.cloudExists && status.keyMatches) {
             if (status.localModified && status.cloudModified) {
@@ -747,11 +776,11 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                 const daysDiff = Math.floor(timeDiff / (1000 * 60 * 60 * 24));
                 if (localNewer && daysDiff > 0) {
                     suggestions.push('💡 Local file is newer than cloud');
-                    suggestions.push(`   Push to cloud: lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+                    suggestions.push(`   Push to cloud: lsh push -f ${envFilePath} -e ${environment}`);
                 }
                 else if (!localNewer && daysDiff > 0) {
                     suggestions.push('💡 Cloud is newer than local file');
-                    suggestions.push(`   Pull from cloud: lsh lib secrets pull -f ${envFilePath} -e ${environment}`);
+                    suggestions.push(`   Pull from cloud: lsh pull -f ${envFilePath} -e ${environment}`);
                 }
                 else {
                     suggestions.push('✅ Local and cloud are in sync!');

package/dist/services/secrets/secrets.js

@@ -250,7 +250,7 @@ API_KEY=
             console.log('');
             console.log('Next steps:');
             console.log(`  1. Edit the file: ${options.file}`);
-            console.log(`  2. Push to cloud: lsh lib secrets push -f ${options.file}`);
+            console.log(`  2. Push to cloud: lsh push -f ${options.file}`);
             console.log('');
         }
         catch (error) {
@@ -269,6 +269,7 @@ API_KEY=
         .option('--legacy', 'Use legacy sync mode (suggestions only)')
         .option('--load', 'Output eval-able export commands for loading secrets')
         .option('--force', 'Force sync even if destructive changes detected')
+        .option('--force-rekey', 'Re-encrypt cloud secrets with current local key (use when key mismatch)')
         .action(async (options) => {
         const manager = new SecretsManager();
         try {
@@ -278,7 +279,7 @@ API_KEY=
             }
             else {
                 // Use new smart sync (auto-execute)
-                await manager.smartSync(options.file, options.env, !options.dryRun, options.load, options.force);
+                await manager.smartSync(options.file, options.env, !options.dryRun, options.load, options.force, options.forceRekey);
             }
         }
         catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lsh-framework",
-  "version": "1.7.4",
+  "version": "1.8.0",
   "description": "Simple, cross-platform encrypted secrets manager with automatic sync, IPFS audit logs, and multi-environment support. Just run lsh sync and start managing your secrets.",
   "main": "dist/app.js",
   "bin": {