Skip to content

Features

  • Git-like commands: show, log, diff, ls, tag
  • Staging workflow: edit → status → diff → apply (review changes before applying), plus export / import for portable, per-service snapshots
  • Version navigation: #VERSION, ~SHIFT, :LABEL syntax
  • Colored diff output: Easy-to-read unified diff format
  • Multi-cloud: AWS SSM Parameter Store / Secrets Manager, Google Cloud Secret Manager, and Azure Key Vault / App Configuration
  • Secure staging: Working staging state is encrypted at rest with a data key stored in the OS keychain (override with SUVE_STAGING_KEY). Each encrypted file is bound to its scope and service, so a file moved to another scope or service fails to decrypt, and an unencrypted file found while a key is configured is reported with a warning. When no key is available (no keychain backend and no SUVE_STAGING_KEY), an interactive session falls back to plaintext with a warning, while a non-interactive one refuses to write unencrypted unless SUVE_STAGING_ALLOW_PLAINTEXT is set. Exported snapshot files carry a separately passphrase-encrypted payload (Argon2 + AES-GCM; an empty passphrase writes plaintext).
  • TUI mode: Keyboard-driven terminal UI via --tui flag (built with Bubble Tea); ships in every build, including the dependency-free CLI/TUI-only one
  • GUI mode: Desktop application via --gui flag (built with Wails)

Metadata Terminology

suve uses AWS-friendly terms and maps each backend's native concept onto three axes. Mind two naming traps: Google Cloud "labels" are suve tags (key=value metadata), and Azure App Configuration's "label" is suve's namespace (an identity axis, --namespace/--ns) — neither is the other.

Backend suve tag
(tag/untag)		 suve :LABEL
(version selector)		 suve description
(--description)		 suve namespace
(--namespace)
AWS Parameter Store resource tags — resource description —
AWS Secrets Manager resource tags version staging labels (AWSCURRENT / AWSPREVIOUS / custom) resource description —
Google Cloud Secret Manager resource labels — resource annotation: description=... —
Azure Key Vault tags on a specific version — — —
Azure App Configuration tags on a specific version — — label — the (key, label) composite address (unset = empty string, or dev / prd / …)

All key=value metadata is unified as tags; suve adds no per-provider command or flag aliases. For the App Configuration label axis, see Namespaces.