small corrections to readme

README.md

@@ -55,7 +55,7 @@ export PASSWORD=your-secure-password
 uv run python-encrypt-code encrypt ${MODULE_PATH} -o ${ENCRYPTED_FILE} -p ${PASSWORD}
 ```
 
-### 3. Decrypt and Extract
+### 3. Decrypt an Encrypted File
 
 ```bash
 uv run python-encrypt-code decrypt ${ENCRYPTED_FILE} -o ./decrypted -p ${PASSWORD}
@@ -64,7 +64,7 @@ uv run python-encrypt-code decrypt ${ENCRYPTED_FILE} -o ./decrypted -p ${PASSWOR
 ### 4. Run Encrypted Module Directly
 
 ```bash
-uv run python-encrypt-code run-insecure ${ENCRYPTED_FILE} -p ${PASSWORD} --script main.py
+uv run python-encrypt-code run-insecure ${ENCRYPTED_FILE} --script main.py
 ```
 
 ## Commands
@@ -82,7 +82,7 @@ uv run python-encrypt-code generate-password
 Encrypt a Python module or package directory.
 
 ```bash
-uv run python-encrypt-code encrypt <source_path> -o <output.pec> -p <password> [-kv <key>=<value>]
+uv run python-encrypt-code encrypt <source_path> -o <output.pec> -p <password> [-aad <json-string>]
 ```
 
 **Options:**
@@ -90,22 +90,20 @@ uv run python-encrypt-code encrypt <source_path> -o <output.pec> -p <password> [
 - `source_path`: Directory containing Python files to encrypt
 - `-o, --output`: Output path for encrypted file
 - `-p, --password`: Password for encryption
-- `-kv, --key-value`: Key-value pair to embed in the encrypted file
+- `-aad, --additional-authenticated-data`: JSON-formatted string to embed metadata in the encrypted file
 
 ### `decrypt`
 
 Decrypt a file and extract contents to disk.
 
 ```bash
-uv run python-encrypt-code decrypt <encrypted_file> -o <output_dir> -p <password> [-kv <key>=<value>]
+uv run python-encrypt-code decrypt <encrypted_file> -o <output_dir>
 ```
 
 **Options:**
 
 - `encrypted.pec`: Path to encrypted file
 - `-o, --output`: Directory to extract decrypted files
-- `-p, --password`: Password for decryption
-- `-kv, --key-value`: Key-value pair matching what is embedded in the encrypted file
 
 ### `run-insecure`
 
@@ -113,15 +111,13 @@ Decrypt and execute a Python script from an encrypted package.
 **N.B. this writes decrypted files to a temporary folder on the disk before executing!**
 
 ```bash
-uv run python-encrypt-code run-insecure <encrypted.pec> -p <password> --script <script_name> [-kv <key>=<value>]
+uv run python-encrypt-code run-insecure <encrypted_file> --script <script_name>
 ```
 
 **Options:**
 
 - `encrypted.pec`: Path to encrypted file
-- `-p, --password`: Password for decryption
 - `-s, --script`: Python script to execute (default: `main.py`)
-- `-kv, --key-value`: Key-value pair matching what is embedded in the encrypted file
 
 ## Use Cases
 
@@ -132,8 +128,9 @@ uv run python-encrypt-code run-insecure <encrypted.pec> -p <password> --script <
 export PASSWORD=$(uv run python-encrypt-code generate-password)
 uv run python-encrypt-code encrypt ./my_app -o my_app.pec -p ${PASSWORD}
 
-# Distribute the .pec file and password to customers
-# They can run it without seeing the source code
+# Setup your own authentication source and subclass the PasswordProvider
+# Distribute the .pec file to customers and let
+# them run it without seeing the source code
 uv run python-encrypt-code run-insecure ./my_app.pec -p ${PASSWORD} --script main.py
 ```
 
@@ -144,7 +141,7 @@ uv run python-encrypt-code run-insecure ./my_app.pec -p ${PASSWORD} --script mai
 uv run python-encrypt-code encrypt ./production_code -o deployment.pec -p $DEPLOY_PASSWORD
 
 # Deploy and run on target server
-uv run python-encrypt-code run-insecure deployment.pec -p $DEPLOY_PASSWORD --script startup.py
+uv run python-encrypt-code run-insecure deployment.pec --script startup.py
 ```
 
 ### 3. Educational Content Protection