npm package: @nishan30/envoy-cli
Description: Secure secret management with end-to-end encryption
Author: Nishan30
Latest version: 1.0.2

# Envoy CLI

🔐 **Secure secret management with end-to-end encryption**

Envoy is a command-line tool for managing environment variables and secrets with end-to-end encryption. Push your secrets once, pull them anywhere.

## Features

✅ **End-to-End Encryption** - Your secrets are encrypted before leaving your machine  
✅ **Team Collaboration** - Securely share secrets with your team  
✅ **Git Integration** - Automatically detects your repository  
✅ **Zero-Knowledge** - We can't read your secrets, even if we wanted to  
✅ **RepoKey Support** - Deploy secrets to CI/CD without storing private keys  

## Installation

```bash
npm install -g @nishan30/envoy-cli
```

## Quick Start

### 1. Get Your API Key

Visit [https://envoy-it.netlify.app/dashboard](https://envoy-it.netlify.app/dashboard) and generate an API key.

### 2. Initialize Envoy

```bash
envoy init --api-key evy_api_YOUR_KEY_HERE
```

This will:
- Authenticate with the Envoy server
- Generate encryption keys (downloads `id_x25519` private key file)
- Save your configuration

**⚠️ IMPORTANT:** Store your `id_x25519` private key file securely! You'll need it to decrypt your secrets.

### 3. Push Your Secrets

```bash
envoy push -f .env
```

This will:
- Read your `.env` file
- Encrypt the contents with your public key
- Upload to secure storage
- Generate a RepoKey for CI/CD deployments

### 4. Pull Your Secrets

**On another machine (with your private key):**

```bash
envoy pull
```

**In CI/CD (with RepoKey):**

```bash
envoy pull --key evk_YOUR_REPO_KEY_HERE
```

## Commands

### `envoy init`
Initialize Envoy CLI with your API key.

```bash
envoy init --api-key evy_api_YOUR_KEY_HERE
```

**Options:**
- `--api-key` - Your API key from the dashboard (required)
- `--private-key` - Path to existing private key file (optional)
- `--api-url` - Custom API URL for self-hosting (optional)

### `envoy push`
Push secrets to the server.

```bash
envoy push -f .env
```

**Options:**
- `-f, --file` - Path to your environment file (default: `.env`)

### `envoy pull`
Pull secrets from the server.

```bash
# Pull with your identity (requires private key)
envoy pull

# Pull with RepoKey (for CI/CD)
envoy pull --key evk_YOUR_REPO_KEY_HERE
```

**Options:**
- `--key` - RepoKey for anonymous pull (for CI/CD)
- `-o, --output` - Output file path (default: `.env`)

### `envoy configure`
Configure Envoy settings.

```bash
# View current configuration
envoy configure --show

# Set API URL (for self-hosting)
envoy configure --api-url https://your-api.com
```

## Workflow Example

### Developer Workflow

```bash
# One-time setup
npm install -g @nishan30/envoy-cli
envoy init --api-key evy_api_xxx

# Push secrets from your local .env
envoy push -f .env

# On another machine
envoy pull  # Downloads your .env file
```

### CI/CD Workflow

```bash
# In your CI/CD pipeline (GitHub Actions, GitLab CI, etc.)
- name: Install Envoy
  run: npm install -g @nishan30/envoy-cli

- name: Pull Secrets
  run: envoy pull --key ${{ secrets.ENVOY_REPO_KEY }}
  
# Now your .env file is available!
```

## Team Collaboration

Invite team members from the web dashboard:
1. Go to your repository page
2. Click "Invite Member"
3. Enter their email
4. Upload your private key to re-wrap the secret for them
5. They can now `envoy pull` with their own credentials

## Security

- **Client-Side Encryption:** All encryption happens on your machine
- **X25519 + XChaCha20-Poly1305:** Industry-standard algorithms
- **Zero-Knowledge:** Server never sees your plaintext secrets
- **Key Wrapping:** Secrets are wrapped per-user for team access

## Support

- **Website:** [https://envoy-it.netlify.app](https://envoy-it.netlify.app)
- **GitHub:** [https://github.com/Nishan30/envoy](https://github.com/Nishan30/envoy)
- **Issues:** [https://github.com/Nishan30/envoy/issues](https://github.com/Nishan30/envoy/issues)

## License

MIT