yamlock 0.2.0 → 0.2.3

package/README.md

@@ -47,10 +47,22 @@ YAMLOCK_KEY="super-secret" yamlock encrypt config.yaml
 
 # Decrypt values in place using explicit key/algorithm flags
 yamlock decrypt settings.json --key "super-secret" --algorithm aes-256-cbc
+
+# Encrypt only selected fields into a new file
+yamlock encrypt config.json --key "$YAMLOCK_KEY" --paths "db.password,api.token" --output config.secure.json
+
+# Inspect CLI metadata
+yamlock version
+yamlock algorithms
 ```
 
 The CLI detects YAML (`.yaml`/`.yml`) and JSON extensions automatically and writes the file back in the same format.
 
+Options of note:
+- `--output <file>` writes the result to a separate file instead of overwriting the input.
+- `--paths <path1,path2>` targets only the specified fields (dot/bracket notation like `db.password` or `users[0].token`).
+- Commands `version` and `algorithms` print the installed CLI version and the list of supported ciphers respectively.
+
 ### Node.js API
 
 ```js

package/dist/cli/cli.js

@@ -2,10 +2,15 @@
 import { readFileSync, writeFileSync } from 'node:fs';
 import { resolve, extname } from 'node:path';
 import { exit } from 'node:process';
+import { createRequire } from 'node:module';
 
 import yaml from 'js-yaml';
 
 import { processConfig } from '../utils/config.js';
+import { listSupportedAlgorithms } from '../crypto/utils.js';
+
+const require = createRequire(import.meta.url);
+const packageJson = require('../../package.json');
 
 const HELP_TEXT = `
 ░█░█░█▀█░█▄░▄█░█░░░█▀█░█▀▀░█░█░
@@ -16,12 +21,16 @@ Usage:
 yamlock <command> [options]
 
 Commands:
-  encrypt <file>   Encrypt string values in the given YAML/JSON file.
-  decrypt <file>   Decrypt string values in the given YAML/JSON file.
+  encrypt <file>       Encrypt string values in the given YAML/JSON file.
+  decrypt <file>       Decrypt string values in the given YAML/JSON file.
+  version              Print the yamlock CLI version.
+  algorithms           Print the list of supported cipher algorithms.
 
 Options:
   -k, --key <value>        Encryption key (or use YAMLOCK_KEY env).
   -a, --algorithm <value>  Cipher algorithm (default: aes-256-cbc).
+  -o, --output <file>      Write the result to a different file (otherwise overwrites the input file).
+  -p, --paths <p1,p2>      Comma-separated list of field paths to process (dot/bracket notation).
 `;
 
 function print(message) {
@@ -63,6 +72,17 @@ function writeConfigFile(filePath, format, data) {
   writeFileSync(filePath, `${serialized}\n`, 'utf8');
 }
 
+function parsePaths(value) {
+  if (!value) {
+    return [];
+  }
+
+  return String(value)
+    .split(',')
+    .map((segment) => segment.trim())
+    .filter((segment) => segment.length > 0);
+}
+
 function parseArgs(argv) {
   const args = argv.slice(2);
   const result = {
@@ -81,6 +101,12 @@ function parseArgs(argv) {
     } else if (arg === '-a' || arg === '--algorithm') {
       result.options.algorithm = next;
       i += 1;
+    } else if (arg === '-o' || arg === '--output') {
+      result.options.output = next;
+      i += 1;
+    } else if (arg === '-p' || arg === '--paths') {
+      result.options.paths = parsePaths(next);
+      i += 1;
     }
   }
 
@@ -90,7 +116,25 @@ function parseArgs(argv) {
 export async function runCli(argv = process.argv) {
   const { command, file, options } = parseArgs(argv);
 
-  if (!command || !file) {
+  if (!command) {
+    print(HELP_TEXT.trim());
+    return exit(1);
+  }
+
+  if (command === 'version') {
+    print(`yamlock ${packageJson.version}`);
+    return exit(0);
+  }
+
+  if (command === 'algorithms') {
+    const algorithms = listSupportedAlgorithms();
+    print('Supported algorithms:');
+    algorithms.forEach((name) => print(`- ${name}`));
+    return exit(0);
+  }
+
+  if (!file) {
+    printError('A file path is required for this command.');
     print(HELP_TEXT.trim());
     return exit(1);
   }
@@ -110,18 +154,32 @@ export async function runCli(argv = process.argv) {
     return exit(1);
   }
 
+  const outputPath = options.output
+    ? resolve(process.cwd(), options.output)
+    : absolutePath;
+
   try {
     if (command === 'encrypt') {
-      const result = processConfig(config.data, { mode: 'encrypt', key, algorithm: options.algorithm });
-      writeConfigFile(absolutePath, config.format, result);
-      print(`Encrypted values in ${file}`);
+      const result = processConfig(config.data, {
+        mode: 'encrypt',
+        key,
+        algorithm: options.algorithm,
+        paths: options.paths
+      });
+      writeConfigFile(outputPath, config.format, result);
+      print(`Encrypted values in ${outputPath === absolutePath ? file : options.output}`);
       return exit(0);
     }
 
     if (command === 'decrypt') {
-      const result = processConfig(config.data, { mode: 'decrypt', key });
-      writeConfigFile(absolutePath, config.format, result);
-      print(`Decrypted values in ${file}`);
+      const result = processConfig(config.data, {
+        mode: 'decrypt',
+        key,
+        algorithm: options.algorithm,
+        paths: options.paths
+      });
+      writeConfigFile(outputPath, config.format, result);
+      print(`Decrypted values in ${outputPath === absolutePath ? file : options.output}`);
       return exit(0);
     }
 

package/dist/utils/config.js

@@ -15,18 +15,33 @@ const MODES = {
  * @param {string|Buffer} options.key
  * @param {string|object} [options.algorithm]
  * @param {object} [options.algorithmOptions]
+ * @param {string[]} [options.paths]
  * @param {Array<string|number>} [options.parentPath]
  * @returns {Object|Array}
  */
-export function processConfig(node, { mode, key, algorithm, algorithmOptions, parentPath = [] }) {
+export function processConfig(node, options) {
   if (typeof node !== 'object' || node === null) {
     throw new Error('processConfig expects a non-null object or array.');
   }
 
+  const mode = options.mode;
   if (mode !== MODES.ENCRYPT && mode !== MODES.DECRYPT) {
     throw new Error(`Unknown processConfig mode: ${mode}`);
   }
 
+  const normalizedPaths = Array.isArray(options.paths) && options.paths.length > 0
+    ? new Set(options.paths.map((path) => String(path).trim()).filter(Boolean))
+    : null;
+
+  return traverseConfig(node, {
+    ...options,
+    mode,
+    parentPath: options.parentPath ?? [],
+    normalizedPaths
+  });
+}
+
+function traverseConfig(node, { mode, key, algorithm, algorithmOptions, parentPath, normalizedPaths }) {
   const isArrayNode = Array.isArray(node);
   const result = isArrayNode ? [] : {};
   const cryptoOptions = algorithmOptions ?? algorithm;
@@ -37,12 +52,13 @@ export function processConfig(node, { mode, key, algorithm, algorithmOptions, pa
     const currentPath = buildPath(parentPath, segment);
 
     if (value !== null && typeof value === 'object') {
-      result[targetKey] = processConfig(value, {
+      result[targetKey] = traverseConfig(value, {
         mode,
         key,
         algorithm: cryptoOptions,
         algorithmOptions: cryptoOptions,
-        parentPath: [...parentPath, segment]
+        parentPath: [...parentPath, segment],
+        normalizedPaths
       });
       return;
     }
@@ -52,6 +68,12 @@ export function processConfig(node, { mode, key, algorithm, algorithmOptions, pa
       return;
     }
 
+    const shouldProcess = !normalizedPaths || normalizedPaths.has(currentPath);
+    if (!shouldProcess) {
+      result[targetKey] = value;
+      return;
+    }
+
     if (mode === MODES.ENCRYPT) {
       result[targetKey] = encryptValue(value, key, currentPath, cryptoOptions);
     } else {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "yamlock",
-  "version": "0.2.0",
-  "author": "PAVEL TKACHEV",
+  "version": "0.2.3",
+  "author": "PAVEL TKACHEV (phoenixweiss) <mail@phoenixweiss.me>",
   "description": "Value-level encryption for YAML/JSON configuration files with CLI + Node.js APIs.",
   "license": "MIT",
   "type": "module",