Moves every secret stored under a profile to a new name, and inside a project rewrites the @ lines of .monkeys to match, so the vault and the file change…
monkeys rename @old @newmonkeys rename +old +new
Moves every secret stored under a profile to a new name, and inside a project
rewrites the @ lines of .monkeys to match, so the vault and the file change
together. Old name first, then new, the way mv reads:
monkeys rename @staging @preview
moved @staging to @preview: DATABASE_URL, STRIPE_SECRET_KEY, SENTRY_DSNrewrote .monkeys: @staging is now @preview
Inside a project both names are the project's, and a prefix that fits only one
declared profile is enough for the old one, @stag. From anywhere, by full
name, monkeys rename @foo.staging @foo.preview moves the secrets and leaves
every file alone, since none is in reach; a project that names the old profile
then has doctor report it missing until its file is edited or the name is
moved back.
A namespace is renamed the same way, for every profile under it, declared in
the file or not, and the + line of the project's file with it:
monkeys rename +foo +bar
moved @foo.production to @bar.production: DATABASE_URL, STRIPE_SECRET_KEY, SENTRY_DSNmoved @foo.test to @bar.test: DATABASE_URL, STRIPE_SECRET_KEYrewrote .monkeys: +foo is now +bar
A target that already holds a key is refused, so a rename never merges two
profiles:
monkeys: @preview already holds DATABASE_URL; a rename never merges two profiles. To merge, fill @preview --with @staging, then remove what @staging still holds
The vault has no transaction, so the secrets move one key at a time, stored
under the new name and then removed from the old. At the first failure it
stops, names the keys that moved and the one that did not, and leaves the file
as it was; the file is rewritten only after the last key moved. A bare @ is
no profile and is neither a source nor a target; a key moves into or out of
the keys with no profile through fill or set. No secret is printed.
monkeys