sefy-cli 0.1.2 → 0.3.0

package/README.md

@@ -106,6 +106,21 @@ error: 2 items match "ma":
 narrow the text, or use an id
 ```
 
+Two machines, two copies, both edited? Fold one into the other. Where they
+disagree about the same item, sefy keeps both versions rather than letting a
+timestamp decide which password you get to keep:
+
+```
+$ sefy merge ~/from-laptop.bak
+Password for /home/you/from-laptop.bak:
+merged: 1 added, 1 updated, 1 unchanged
+
+1 item changed on both sides and could not be resolved here.
+This vault's version was kept; the incoming one is beside it:
+  "mail" → also kept as "mail (conflicted copy)"
+Compare them, keep the right one, and remove the other.
+```
+
 A vault is never a trap. `sefy export` writes everything back out as plain
 JSON - which is exactly as sensitive as the vault and protects nothing, so the
 command makes you say so out loud:
@@ -119,6 +134,34 @@ pass --i-know-this-writes-plaintext to go ahead
 
 Full command reference: **[lacodda.github.io/sefy](https://lacodda.github.io/sefy/)**.
 
+## Transports
+
+Carrying a vault to another machine is the job of a **plugin**: any executable
+named `sefy-plugin-*`, found in sefy's data directory or on `PATH`. sefy knows
+nothing about git, FTP or any cloud drive - it asks a plugin what it can do and
+what happened.
+
+```
+$ sefy plugin list
+ftp     0.2.1     push
+future  9.0.0     unusable: it speaks protocol 99 and this build speaks 1
+github  0.1.0     pull, push
+```
+
+A transport is handed the **path of the sealed file** and nothing else - no
+master password, no key, no item. What it carries is what anyone would find on
+your disk: a blob it cannot read. That is also why a plugin cannot merge; it
+fetches the other copy to a file, and `sefy merge` folds the two together where
+both sides can actually be read.
+
+Broken plugins are listed with the reason rather than skipped: an omitted line
+would look exactly like a plugin that was never installed.
+
+The protocol is small enough to implement in a shell script - manifest on
+`--manifest`, one JSON request on stdin for `run`. Writing one:
+[plugin reference](https://lacodda.github.io/sefy/reference/plugin/) ·
+[ADR-0002](https://github.com/lacodda/sefy/blob/main/docs/adr/0002-plugin-protocol.md).
+
 ## How it works
 
 - The master password is stretched into a key with **Argon2id**.
@@ -137,6 +180,18 @@ Details and rationale: [ADR-0001](https://github.com/lacodda/sefy/blob/main/docs
 
 ## Install
 
+**One-line installers.** Windows (PowerShell):
+
+```powershell
+irm https://raw.githubusercontent.com/lacodda/sefy/main/tools/install.ps1 | iex
+```
+
+macOS / Linux:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/lacodda/sefy/main/tools/install.sh | sh
+```
+
 **cargo** - `cargo install sefy`
 
 **npm** - `npm install -g sefy-cli`
@@ -145,6 +200,9 @@ Details and rationale: [ADR-0001](https://github.com/lacodda/sefy/blob/main/docs
 (Windows x86_64, Linux x86_64, macOS arm64), unpack and put `sefy` on your
 `PATH`.
 
+Both installers take the newest release by default; set `SEFY_VERSION` to a tag
+to pin one, and `SEFY_INSTALL_DIR` to choose where the binary lands.
+
 Shell completions: `sefy completions bash` (also `zsh`, `fish`, `powershell`,
 `elvish`).
 
@@ -155,6 +213,16 @@ will stay readable: any future change to the format arrives as version 2, able
 to read version 1 and migrate it. The Argon2 parameters are part of that
 promise, not a tuning knob.
 
+The database inside the ciphertext is versioned separately, and it does move:
+0.2.0 added an identity to items so two copies of a vault can be merged. A vault
+from 0.1.x opens, is migrated on the way in, and is still readable by 0.1.x
+afterwards - the file on disk did not change shape.
+
+The **plugin protocol is at version 1** as of 0.3.0. Optional fields may be
+added to the manifest without breaking a plugin that predates them; changing
+what an existing field means would arrive as version 2, with both accepted for a
+time.
+
 Released versions and what landed in each: [CHANGELOG on the Releases page](https://github.com/lacodda/sefy/releases).
 
 ## Building

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "sefy-cli",
-  "version": "0.1.2",
+  "version": "0.3.0",
   "sefy": {
-    "binary": "v0.1.2"
+    "binary": "v0.3.0"
   },
   "description": "An inconspicuous encrypted store for notes, credentials and files",
   "license": "MIT",
@@ -12,16 +12,31 @@
     "type": "git",
     "url": "git+https://github.com/lacodda/sefy.git"
   },
-  "keywords": ["cli", "secrets", "password-manager", "encryption", "vault"],
+  "keywords": [
+    "cli",
+    "secrets",
+    "password-manager",
+    "encryption",
+    "vault"
+  ],
   "bin": {
     "sefy": "run.js"
   },
-  "files": ["download.js", "install.js", "run.js", "README.md"],
+  "files": [
+    "download.js",
+    "install.js",
+    "run.js",
+    "README.md"
+  ],
   "scripts": {
     "prepack": "node -e \"require('fs').copyFileSync('../README.md','README.md')\"",
     "postinstall": "node install.js"
   },
-  "os": ["win32", "darwin", "linux"],
+  "os": [
+    "win32",
+    "darwin",
+    "linux"
+  ],
   "engines": {
     "node": ">=18"
   }