feat: accept stored key names in envapor migrate

- migrate OLDKEY NEWKEY now resolves each argument as a stored key name
  first, falling back to a PEM file path (./ prefix forces a path)
- Directories and unknown names produce clear errors pointing at
  'envapor keys' instead of a raw read failure
- Add resolveKeyArg tests covering names, paths, ambiguity, and dirs

🤖 Generated with Claude Code

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: ranaroussi

.env

@@ -1,2 +1,2 @@
-SAMPLE_KEY=ENC[v2:NPrnvEanwQu9mYtgFWm7zWe0W7MkILJ+GZ0vdL1QWCrST4sbk7KAcNrFgTDN6dbm]
+SAMPLE_KEY=ENC[v2:abDKaSL0zjJaZJmJSrTRu2NJttsM2DKt41YRbeKZaumGg0cE8oyrPVzIywITyQS6]
 PUBLIC_KEY=hello-world # PUBLIC

README.md

@@ -93,7 +93,7 @@ Parsing **fails closed**: a value is left in plaintext *only* on an unambiguous
 | `envapor init NAME` or `--pem PATH` | Configure filters, hook, `.gitattributes`, and map the repo to a key (by stored name or key file) |
 | `envapor doctor` | Diagnose the setup (filters, hook, mapping, coverage, crypto round-trip) |
 | `envapor status` | Show the mapping and per-file encryption state |
-| `envapor migrate OLDPEM NEWPEM` | Re-encrypt managed values from one key to another |
+| `envapor migrate OLDKEY NEWKEY` | Re-encrypt managed values from one key to another (names or PEM paths) |
 | `envapor encrypt` / `decrypt` | Manually transform managed files (rarely needed) |
 
 ## How it works

docs/user-guide.md

@@ -274,9 +274,9 @@ Runs a full health check and reports on:
 
 Run this first whenever something looks off.
 
-### `envapor migrate OLDPEM NEWPEM`
+### `envapor migrate OLDKEY NEWKEY`
 
-Re-encrypts every managed value from the old key to a new one. Both arguments are paths to PEM key files. Used when a teammate leaves or a key is compromised. See [Rotating keys](#rotating-keys) for scope and limits.
+Re-encrypts every managed value from the old key to a new one. Each argument is either the name of a stored key (as shown by `envapor keys`) or a path to a PEM key file; when a name matches both, the stored key wins (prefix with `./` to force a file path). Used when a teammate leaves or a key is compromised. See [Rotating keys](#rotating-keys) for scope and limits.
 
 ### `envapor status`
 
@@ -356,10 +356,10 @@ The action accepts two optional inputs:
 When a teammate leaves or a key is compromised:
 
 ```bash
-envapor migrate OLDPEM NEWPEM
+envapor migrate OLDKEY NEWKEY
 ```
 
-Both arguments are paths to PEM key files. This re-encrypts the current working tree and all future commits under the new key.
+Each argument is a stored key name (see `envapor keys`) or a path to a PEM key file. This re-encrypts the current working tree and all future commits under the new key.
 
 **Important scope and limits:**
 

src/internal/cmd/common.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 
@@ -56,6 +57,26 @@ func selfPath() (string, error) {
 	return p, nil
 }
 
+// resolveKeyArg interprets a user-supplied key argument as either the name of
+// a stored key or a path to a PEM file, returning the file path to load. A
+// stored key wins when both interpretations exist; prefix a path with ./ to
+// force the file interpretation.
+func resolveKeyArg(arg string) (string, error) {
+	if path, err := config.KeyPath(arg); err == nil {
+		if info, statErr := os.Stat(path); statErr == nil && !info.IsDir() {
+			return path, nil
+		}
+	}
+	info, err := os.Stat(arg)
+	if err != nil {
+		return "", fmt.Errorf("%q is neither a stored key (see 'envapor keys') nor a PEM file", arg)
+	}
+	if info.IsDir() {
+		return "", fmt.Errorf("%q is a directory; pass a stored key name (see 'envapor keys') or a PEM file", arg)
+	}
+	return arg, nil
+}
+
 // keyNameFromPath derives a key name from a PEM file path, dropping a trailing
 // ".pem" extension.
 func keyNameFromPath(path string) string {

src/internal/cmd/common_test.go

@@ -0,0 +1,63 @@
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/automazeio/envapor/internal/config"
+	"github.com/automazeio/envapor/internal/crypto"
+)
+
+func TestResolveKeyArg(t *testing.T) {
+	root := t.TempDir()
+	t.Chdir(root)
+	t.Setenv("ENVAPOR_HOME", filepath.Join(root, "config"))
+	key, err := crypto.Generate()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := config.WriteKey("team", key.MarshalPEM()); err != nil {
+		t.Fatal(err)
+	}
+
+	stored, err := config.KeyPath("team")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, err := resolveKeyArg("team"); err != nil || got != stored {
+		t.Fatalf("resolveKeyArg(name) = %q, %v; want %q", got, err, stored)
+	}
+
+	pem := filepath.Join(root, "other.pem")
+	if err := os.WriteFile(pem, key.MarshalPEM(), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if got, err := resolveKeyArg(pem); err != nil || got != pem {
+		t.Fatalf("resolveKeyArg(path) = %q, %v; want %q", got, err, pem)
+	}
+
+	// A local file with the same name as a stored key: the stored key wins,
+	// and the ./ prefix forces the file interpretation.
+	local := filepath.Join(root, "team")
+	if err := os.WriteFile(local, key.MarshalPEM(), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if got, _ := resolveKeyArg("team"); got != stored {
+		t.Fatalf("resolveKeyArg(ambiguous) = %q, want stored key %q", got, stored)
+	}
+	if got, err := resolveKeyArg("./team"); err != nil || got != "./team" {
+		t.Fatalf("resolveKeyArg(./team) = %q, %v; want ./team", got, err)
+	}
+
+	if err := os.Mkdir(filepath.Join(root, "demo"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := resolveKeyArg("demo"); err == nil {
+		t.Fatal("resolveKeyArg accepted a directory")
+	}
+
+	if _, err := resolveKeyArg("no-such-key"); err == nil {
+		t.Fatal("resolveKeyArg accepted a nonexistent argument")
+	}
+}

src/internal/cmd/migrate.go

@@ -14,9 +14,11 @@ import (
 )
 
 var migrateCmd = &cobra.Command{
-	Use:   "migrate OLDPEM NEWPEM",
+	Use:   "migrate OLDKEY NEWKEY",
 	Short: "Re-encrypt managed values from an old key to a new one",
-	Long: "Re-encrypts the working tree and future commits from OLDPEM to NEWPEM.\n" +
+	Long: "Re-encrypts the working tree and future commits from OLDKEY to NEWKEY.\n" +
+		"Each argument is either the name of a stored key (see 'envapor keys') or\n" +
+		"the path to a PEM key file; a stored key wins when both exist.\n" +
 		"It does not rewrite Git history: past commits stay encrypted under the old\n" +
 		"key, so migration rotates the key, not the secrets themselves. After a\n" +
 		"compromise, also rotate the affected secrets at their source.",
@@ -33,10 +35,18 @@ type migrationFile struct {
 	mode     os.FileMode
 }
 
-func runMigrate(oldPEM, newPEM string) (err error) {
+func runMigrate(oldArg, newArg string) (err error) {
 	if !gitutil.InsideRepo() {
 		return fmt.Errorf("not a git repository")
 	}
+	oldPEM, err := resolveKeyArg(oldArg)
+	if err != nil {
+		return fmt.Errorf("old key: %w", err)
+	}
+	newPEM, err := resolveKeyArg(newArg)
+	if err != nil {
+		return fmt.Errorf("new key: %w", err)
+	}
 	oldKey, err := loadPEMFile(oldPEM)
 	if err != nil {
 		return fmt.Errorf("old key: %w", err)