@akshxy/envgit 0.2.0 → 0.4.0

package/bin/envgit.js

@@ -37,9 +37,10 @@ program
   .action(status);
 
 program
-  .command('set <assignments...>')
-  .description('Set one or more KEY=VALUE pairs (defaults to active env)')
+  .command('set [assignments...]')
+  .description('Set KEY=VALUE pairs, or load from a file with -f')
   .option('--env <name>', 'target environment')
+  .option('-f, --file <path>', 'read variables from a .env file')
   .action(set);
 
 program

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akshxy/envgit",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Encrypted per-project environment variable manager",
   "type": "module",
   "bin": {

package/src/commands/init.js

@@ -1,10 +1,11 @@
 import { existsSync, mkdirSync, appendFileSync, readFileSync } from 'fs';
 import { join } from 'path';
+import { randomUUID } from 'crypto';
 import { generateKey } from '../crypto.js';
-import { saveKey } from '../keystore.js';
+import { saveKey, globalKeyPath } from '../keystore.js';
 import { saveConfig, getEnvctlDir } from '../config.js';
 import { writeEncEnv } from '../enc.js';
-import { ok, warn, fatal, bold, dim, label } from '../ui.js';
+import { ok, fatal, bold, dim, label } from '../ui.js';
 
 export async function init(options) {
   const projectRoot = process.cwd();
@@ -15,18 +16,21 @@ export async function init(options) {
   }
 
   const defaultEnv = options.env;
+  const keyId = randomUUID();
 
   mkdirSync(envgitDir, { recursive: true });
 
-  const key = generateKey();
-  saveKey(projectRoot, key);
-
+  // Save config first (saveKey needs key_id from config)
   saveConfig(projectRoot, {
     version: 1,
     default_env: defaultEnv,
     envs: [defaultEnv],
+    key_id: keyId,
   });
 
+  const key = generateKey();
+  const keyPath = saveKey(projectRoot, key, keyId);
+
   writeEncEnv(projectRoot, defaultEnv, key, {});
 
   updateGitignore(projectRoot);
@@ -35,16 +39,19 @@ export async function init(options) {
   console.log(bold('envgit initialized'));
   console.log('');
   ok(`Default environment: ${label(defaultEnv)}`);
-  ok('Key saved to .envgit.key');
+  ok(`Key stored at ${dim(keyPath)}`);
   console.log('');
-  console.log(dim('Keep .envgit.key secret and do not commit it.'));
   console.log(dim('Commit .envgit/ to share encrypted environments with your team.'));
+  console.log(dim('Your key never touches the repo — it lives only on your machine.'));
+  console.log('');
+  console.log(`Share your key with teammates:  ${bold('envgit keygen --show')}`);
+  console.log(`Teammates save it with:         ${bold('envgit keygen --set <key>')}`);
   console.log('');
 }
 
 function updateGitignore(projectRoot) {
   const gitignorePath = join(projectRoot, '.gitignore');
-  const entries = ['.env', '.envgit.key'];
+  const entries = ['.env'];
 
   let existing = '';
   if (existsSync(gitignorePath)) {

package/src/commands/keygen.js

@@ -1,21 +1,20 @@
 import { generateKey } from '../crypto.js';
-import { findProjectRoot, saveKey, loadKey } from '../keystore.js';
-import { ok, warn, bold, dim } from '../ui.js';
+import { findProjectRoot, saveKey, loadKey, globalKeyPath } from '../keystore.js';
+import { loadConfig } from '../config.js';
+import { ok, warn, fatal, bold, dim } from '../ui.js';
 
 export async function keygen(options) {
   const projectRoot = findProjectRoot();
 
   if (options.show) {
     if (!projectRoot) {
-      warn('No envgit project found — cannot show key.');
-      process.exit(1);
+      fatal('No envgit project found — cannot show key.');
     }
     let key;
     try {
       key = loadKey(projectRoot);
     } catch (e) {
-      warn(e.message);
-      process.exit(1);
+      fatal(e.message);
     }
     const hint = key.slice(0, 8);
     console.log('');
@@ -23,8 +22,8 @@ export async function keygen(options) {
     console.log(`  ${key}`);
     console.log('');
     console.log(dim(`Hint (first 8 chars): ${hint}`));
-    console.log(dim('Share this key with teammates via a secure channel (not git).'));
-    console.log(dim('They can save it with: envgit keygen --set <key>'));
+    console.log(dim('Share via a secure channel (not git, not chat).'));
+    console.log(dim('Teammate saves it with: envgit keygen --set <key>'));
     console.log('');
     return;
   }
@@ -33,16 +32,18 @@ export async function keygen(options) {
     const key = options.set;
     const decoded = Buffer.from(key, 'base64');
     if (decoded.length !== 32) {
-      warn(`Invalid key — must decode to exactly 32 bytes (got ${decoded.length}). Generate one with: envgit keygen`);
-      process.exit(1);
+      fatal(`Invalid key — must decode to exactly 32 bytes (got ${decoded.length}). Generate one with: envgit keygen`);
     }
     if (!projectRoot) {
-      warn('No envgit project found. Run envgit init first.');
-      process.exit(1);
+      fatal('No envgit project found. Run envgit init first, or clone a repo that uses envgit.');
     }
-    saveKey(projectRoot, key);
-    ok(`Key saved to .envgit.key`);
-    console.log(dim(`Hint: ${key.slice(0, 8)}`));
+    const keyPath = saveKey(projectRoot, key);
+    ok(`Key saved for this project`);
+    console.log(dim(`  Stored at: ${keyPath}`));
+    console.log(dim(`  Hint: ${key.slice(0, 8)}`));
+    console.log('');
+    console.log(dim('Run `envgit verify` to confirm it works.'));
+    console.log('');
     return;
   }
 
@@ -51,8 +52,9 @@ export async function keygen(options) {
   const hint = key.slice(0, 8);
 
   if (projectRoot) {
-    saveKey(projectRoot, key);
-    ok('New key generated and saved to .envgit.key');
+    const keyPath = saveKey(projectRoot, key);
+    ok(`New key generated`);
+    console.log(dim(`  Stored at: ${keyPath}`));
   } else {
     console.log('');
     console.log(bold('Generated key (no project found — not saved):'));
@@ -63,7 +65,7 @@ export async function keygen(options) {
   console.log(`  ${key}`);
   console.log('');
   console.log(dim(`Hint (first 8 chars): ${hint}`));
-  console.log(dim('Share this key with teammates via a secure channel (not git).'));
-  console.log(dim('They can save it with: envgit keygen --set <key>'));
+  console.log(dim('Share via a secure channel (not git, not chat).'));
+  console.log(dim('Teammate saves it with: envgit keygen --set <key>'));
   console.log('');
 }

package/src/commands/set.js

@@ -1,6 +1,9 @@
+import { join } from 'path';
+import { existsSync } from 'fs';
 import { requireProjectRoot, loadKey } from '../keystore.js';
 import { resolveEnv } from '../config.js';
 import { readEncEnv, writeEncEnv } from '../enc.js';
+import { readEnvFile } from '../envfile.js';
 import { getCurrentEnv } from '../state.js';
 import { ok, fatal, label } from '../ui.js';
 
@@ -11,15 +14,31 @@ export async function set(assignments, options) {
 
   const vars = readEncEnv(projectRoot, envName, key);
 
-  for (const assignment of assignments) {
-    const eqIdx = assignment.indexOf('=');
-    if (eqIdx === -1) {
-      fatal(`Invalid assignment '${assignment}'. Expected KEY=VALUE format.`);
+  if (options.file) {
+    const filePath = join(projectRoot, options.file);
+    if (!existsSync(filePath)) {
+      fatal(`File not found: ${options.file}`);
+    }
+    const fileVars = readEnvFile(filePath);
+    const entries = Object.entries(fileVars);
+    if (entries.length === 0) {
+      fatal(`No variables found in ${options.file}`);
+    }
+    for (const [k, v] of entries) {
+      vars[k] = v;
+      ok(`Set ${k} in ${label(envName)}`);
+    }
+  } else {
+    for (const assignment of assignments) {
+      const eqIdx = assignment.indexOf('=');
+      if (eqIdx === -1) {
+        fatal(`Invalid assignment '${assignment}'. Expected KEY=VALUE format.`);
+      }
+      const k = assignment.slice(0, eqIdx).trim();
+      const v = assignment.slice(eqIdx + 1);
+      vars[k] = v;
+      ok(`Set ${k} in ${label(envName)}`);
     }
-    const k = assignment.slice(0, eqIdx).trim();
-    const v = assignment.slice(eqIdx + 1);
-    vars[k] = v;
-    ok(`Set ${k} in ${label(envName)}`);
   }
 
   writeEncEnv(projectRoot, envName, key, vars);

package/src/commands/status.js

@@ -1,6 +1,6 @@
 import { existsSync } from 'fs';
 import { join } from 'path';
-import { requireProjectRoot } from '../keystore.js';
+import { requireProjectRoot, globalKeyPath } from '../keystore.js';
 import { loadConfig } from '../config.js';
 import { getCurrentEnv } from '../state.js';
 import chalk from 'chalk';
@@ -11,11 +11,19 @@ export async function status() {
   const config = loadConfig(projectRoot);
   const current = getCurrentEnv(projectRoot);
 
-  const keySource = process.env.ENVCTL_KEY
-    ? 'ENVCTL_KEY env var'
-    : existsSync(join(projectRoot, '.envgit.key'))
-    ? '.envgit.key'
-    : chalk.red('(not found)');
+  let keySource;
+  if (process.env.ENVGIT_KEY) {
+    keySource = chalk.green('ENVGIT_KEY') + dim(' (env var)');
+  } else if (config.key_id) {
+    const keyPath = globalKeyPath(config.key_id);
+    keySource = existsSync(keyPath)
+      ? chalk.green('~/.config/envgit/keys/') + dim(config.key_id.slice(0, 8) + '…')
+      : chalk.red('not found on this machine') + dim(' — run: envgit keygen --set <key>');
+  } else {
+    // Legacy
+    const legacyPath = join(projectRoot, '.envgit.key');
+    keySource = existsSync(legacyPath) ? dim('.envgit.key (legacy)') : chalk.red('(not found)');
+  }
 
   const dotenvExists = existsSync(join(projectRoot, '.env'));
 

package/src/envfile.js

@@ -1,5 +1,338 @@
 import { readFileSync, writeFileSync, existsSync } from 'fs';
 
+// ─── Section label mappings (prefix → section name) ──────────────────────────
+const SECTION_LABELS = {
+  // ── App / Runtime ──────────────────────────────────────────────────────────
+  NODE:                   'App / Runtime',
+  APP:                    'App / Config',
+  SERVER:                 'App / Server',
+  SERVICE:                'App / Service',
+  WORKER:                 'App / Worker',
+
+  // ── Frontend Frameworks ────────────────────────────────────────────────────
+  NEXT:                   'Next.js',
+  NEXT_PUBLIC:            'Next.js / Public (client-side)',
+  NUXT:                   'Nuxt',
+  NUXT_PUBLIC:            'Nuxt / Public (client-side)',
+  VITE:                   'Vite',
+  VITE_APP:               'Vite / Public (client-side)',
+  REACT:                  'React',
+  REACT_APP:              'React / Public (client-side)',
+  GATSBY:                 'Gatsby',
+  SVELTE:                 'SvelteKit',
+  PUBLIC:                 'Public (client-side)',
+
+  // ── Databases ──────────────────────────────────────────────────────────────
+  DB:                     'Database',
+  DATABASE:               'Database',
+  POSTGRES:               'Database / PostgreSQL',
+  POSTGRESQL:             'Database / PostgreSQL',
+  PG:                     'Database / PostgreSQL',
+  PGHOST:                 'Database / PostgreSQL',
+  PGPORT:                 'Database / PostgreSQL',
+  PGUSER:                 'Database / PostgreSQL',
+  PGPASSWORD:             'Database / PostgreSQL',
+  PGDATABASE:             'Database / PostgreSQL',
+  MYSQL:                  'Database / MySQL',
+  MARIADB:                'Database / MariaDB',
+  MONGO:                  'Database / MongoDB',
+  MONGODB:                'Database / MongoDB',
+  SQLITE:                 'Database / SQLite',
+  COCKROACH:              'Database / CockroachDB',
+  COCKROACHDB:            'Database / CockroachDB',
+  NEON:                   'Database / Neon',
+  PLANETSCALE:            'Database / PlanetScale',
+  TURSO:                  'Database / Turso',
+  SUPABASE:               'Supabase',
+  XATA:                   'Database / Xata',
+  CONVEX:                 'Database / Convex',
+
+  // ── Cache / Queues ─────────────────────────────────────────────────────────
+  REDIS:                  'Cache / Redis',
+  UPSTASH:                'Cache / Upstash Redis',
+  MEMCACHED:              'Cache / Memcached',
+  KAFKA:                  'Queue / Kafka',
+  RABBITMQ:               'Queue / RabbitMQ',
+  SQS:                    'Queue / AWS SQS',
+  BULL:                   'Queue / Bull',
+  INNGEST:                'Queue / Inngest',
+  TRIGGER:                'Queue / Trigger.dev',
+  QSTASH:                 'Queue / QStash',
+
+  // ── Auth ───────────────────────────────────────────────────────────────────
+  AUTH:                   'Auth',
+  AUTH0:                  'Auth / Auth0',
+  CLERK:                  'Auth / Clerk',
+  NEXTAUTH:               'Auth / NextAuth',
+  NEXT_AUTH:              'Auth / NextAuth',
+  LUCIA:                  'Auth / Lucia',
+  BETTER_AUTH:            'Auth / Better Auth',
+  SUPABASE_AUTH:          'Auth / Supabase Auth',
+  FIREBASE_AUTH:          'Auth / Firebase Auth',
+  COGNITO:                'Auth / AWS Cognito',
+  OKTA:                   'Auth / Okta',
+  WORKOS:                 'Auth / WorkOS',
+  PROPELAUTH:             'Auth / PropelAuth',
+  STYTCH:                 'Auth / Stytch',
+  MAGIC:                  'Auth / Magic',
+  OAUTH:                  'Auth / OAuth',
+  JWT:                    'Auth / JWT',
+  SESSION:                'Auth / Session',
+  COOKIE:                 'Auth / Cookie',
+  CSRF:                   'Auth / CSRF',
+  TOTP:                   'Auth / 2FA',
+  MFA:                    'Auth / 2FA',
+
+  // ── AWS ────────────────────────────────────────────────────────────────────
+  AWS:                    'AWS',
+  S3:                     'AWS / S3',
+  EC2:                    'AWS / EC2',
+  ECS:                    'AWS / ECS',
+  EKS:                    'AWS / EKS',
+  LAMBDA:                 'AWS / Lambda',
+  CLOUDFRONT:             'AWS / CloudFront',
+  CLOUDWATCH:             'AWS / CloudWatch',
+  COGNITO:                'AWS / Cognito',
+  DYNAMODB:               'AWS / DynamoDB',
+  SES:                    'AWS / SES',
+  SNS:                    'AWS / SNS',
+  SQS:                    'AWS / SQS',
+  ROUTE53:                'AWS / Route 53',
+  ECR:                    'AWS / ECR',
+  SECRETS:                'AWS / Secrets Manager',
+
+  // ── Google Cloud ───────────────────────────────────────────────────────────
+  GCP:                    'Google Cloud',
+  GOOGLE:                 'Google',
+  GOOGLE_CLOUD:           'Google Cloud',
+  FIREBASE:               'Firebase',
+  FIRESTORE:              'Firebase / Firestore',
+  GCS:                    'Google Cloud / Storage',
+  BIGQUERY:               'Google Cloud / BigQuery',
+  PUBSUB:                 'Google Cloud / Pub/Sub',
+  GCLOUD:                 'Google Cloud',
+
+  // ── Azure ──────────────────────────────────────────────────────────────────
+  AZURE:                  'Azure',
+  AZURE_AD:               'Azure / Active Directory',
+  COSMOS:                 'Azure / Cosmos DB',
+  COSMOSDB:               'Azure / Cosmos DB',
+  BLOB:                   'Azure / Blob Storage',
+
+  // ── AI / LLMs ──────────────────────────────────────────────────────────────
+  OPENAI:                 'AI / OpenAI',
+  ANTHROPIC:              'AI / Anthropic',
+  GEMINI:                 'AI / Google Gemini',
+  COHERE:                 'AI / Cohere',
+  REPLICATE:              'AI / Replicate',
+  HUGGINGFACE:            'AI / HuggingFace',
+  HF:                     'AI / HuggingFace',
+  TOGETHER:               'AI / Together AI',
+  GROQ:                   'AI / Groq',
+  MISTRAL:                'AI / Mistral',
+  PERPLEXITY:             'AI / Perplexity',
+  FIREWORKS:              'AI / Fireworks AI',
+  ANYSCALE:               'AI / Anyscale',
+  AI21:                   'AI / AI21 Labs',
+  STABILITY:              'AI / Stability AI',
+  DEEPINFRA:              'AI / DeepInfra',
+  ELEVENLABS:             'AI / ElevenLabs',
+  ASSEMBLYAI:             'AI / AssemblyAI',
+  DEEPGRAM:               'AI / Deepgram',
+
+  // ── Vector DBs ─────────────────────────────────────────────────────────────
+  PINECONE:               'Vector DB / Pinecone',
+  WEAVIATE:               'Vector DB / Weaviate',
+  QDRANT:                 'Vector DB / Qdrant',
+  CHROMA:                 'Vector DB / Chroma',
+  MILVUS:                 'Vector DB / Milvus',
+
+  // ── Payments ───────────────────────────────────────────────────────────────
+  STRIPE:                 'Payments / Stripe',
+  PAYPAL:                 'Payments / PayPal',
+  BRAINTREE:              'Payments / Braintree',
+  SQUARE:                 'Payments / Square',
+  LEMON:                  'Payments / Lemon Squeezy',
+  LEMONSQUEEZY:           'Payments / Lemon Squeezy',
+  PADDLE:                 'Payments / Paddle',
+  COINBASE:               'Payments / Coinbase Commerce',
+  RAZORPAY:               'Payments / Razorpay',
+
+  // ── Email ──────────────────────────────────────────────────────────────────
+  SMTP:                   'Email / SMTP',
+  MAIL:                   'Email',
+  EMAIL:                  'Email',
+  SENDGRID:               'Email / SendGrid',
+  RESEND:                 'Email / Resend',
+  MAILGUN:                'Email / Mailgun',
+  POSTMARK:               'Email / Postmark',
+  MAILCHIMP:              'Email / Mailchimp',
+  MANDRILL:               'Email / Mandrill',
+  SES:                    'Email / AWS SES',
+  SPARKPOST:              'Email / SparkPost',
+  CONVERTKIT:             'Email / ConvertKit',
+  LOOPS:                  'Email / Loops',
+
+  // ── SMS / Communications ───────────────────────────────────────────────────
+  TWILIO:                 'SMS / Twilio',
+  VONAGE:                 'SMS / Vonage',
+  MESSAGEBIRD:            'SMS / MessageBird',
+  TELNYX:                 'SMS / Telnyx',
+  SINCH:                  'SMS / Sinch',
+  BANDWIDTH:              'SMS / Bandwidth',
+
+  // ── Search ─────────────────────────────────────────────────────────────────
+  ALGOLIA:                'Search / Algolia',
+  MEILISEARCH:            'Search / Meilisearch',
+  TYPESENSE:              'Search / Typesense',
+  ELASTICSEARCH:          'Search / Elasticsearch',
+  OPENSEARCH:             'Search / OpenSearch',
+
+  // ── Storage / CDN ──────────────────────────────────────────────────────────
+  CLOUDINARY:             'Storage / Cloudinary',
+  IMAGEKIT:               'Storage / ImageKit',
+  UPLOADTHING:            'Storage / UploadThing',
+  BUNNY:                  'Storage / Bunny CDN',
+  BACKBLAZE:              'Storage / Backblaze B2',
+  R2:                     'Storage / Cloudflare R2',
+  TIGRIS:                 'Storage / Tigris',
+
+  // ── Observability ──────────────────────────────────────────────────────────
+  SENTRY:                 'Observability / Sentry',
+  DATADOG:                'Observability / Datadog',
+  NEWRELIC:               'Observability / New Relic',
+  NEW_RELIC:              'Observability / New Relic',
+  GRAFANA:                'Observability / Grafana',
+  PROMETHEUS:             'Observability / Prometheus',
+  LOGTAIL:                'Observability / Logtail',
+  AXIOM:                  'Observability / Axiom',
+  BETTERSTACK:            'Observability / Better Stack',
+  LOGFLARE:               'Observability / Logflare',
+  HIGHLIGHT:              'Observability / Highlight',
+  BASELIME:               'Observability / Baselime',
+
+  // ── Analytics ──────────────────────────────────────────────────────────────
+  POSTHOG:                'Analytics / PostHog',
+  SEGMENT:                'Analytics / Segment',
+  MIXPANEL:               'Analytics / Mixpanel',
+  AMPLITUDE:              'Analytics / Amplitude',
+  HEAP:                   'Analytics / Heap',
+  HOTJAR:                 'Analytics / Hotjar',
+  GA:                     'Analytics / Google Analytics',
+  GOOGLE_ANALYTICS:       'Analytics / Google Analytics',
+  PLAUSIBLE:              'Analytics / Plausible',
+  FATHOM:                 'Analytics / Fathom',
+  PIRSCH:                 'Analytics / Pirsch',
+  UMAMI:                  'Analytics / Umami',
+  JUNE:                   'Analytics / June',
+  OPENPANEL:              'Analytics / OpenPanel',
+
+  // ── Feature Flags ──────────────────────────────────────────────────────────
+  LAUNCHDARKLY:           'Feature Flags / LaunchDarkly',
+  GROWTHBOOK:             'Feature Flags / GrowthBook',
+  FLAGSMITH:              'Feature Flags / Flagsmith',
+  STATSIG:                'Feature Flags / Statsig',
+  UNLEASH:                'Feature Flags / Unleash',
+  HYPERTUNE:              'Feature Flags / Hypertune',
+
+  // ── CMS ────────────────────────────────────────────────────────────────────
+  CONTENTFUL:             'CMS / Contentful',
+  SANITY:                 'CMS / Sanity',
+  STRAPI:                 'CMS / Strapi',
+  DIRECTUS:               'CMS / Directus',
+  PAYLOAD:                'CMS / Payload',
+  PRISMIC:                'CMS / Prismic',
+  GHOST:                  'CMS / Ghost',
+  STORYBLOK:              'CMS / Storyblok',
+  BUILDER:                'CMS / Builder.io',
+
+  // ── Hosting / Deploy ───────────────────────────────────────────────────────
+  VERCEL:                 'Hosting / Vercel',
+  NETLIFY:                'Hosting / Netlify',
+  RAILWAY:                'Hosting / Railway',
+  RENDER:                 'Hosting / Render',
+  FLY:                    'Hosting / Fly.io',
+  COOLIFY:                'Hosting / Coolify',
+  DOKKU:                  'Hosting / Dokku',
+  HEROKU:                 'Hosting / Heroku',
+  DENO:                   'Hosting / Deno Deploy',
+  CLOUDFLARE:             'Hosting / Cloudflare',
+
+  // ── Social / OAuth Providers ───────────────────────────────────────────────
+  GITHUB:                 'OAuth / GitHub',
+  GITLAB:                 'OAuth / GitLab',
+  TWITTER:                'OAuth / Twitter / X',
+  TWITTER_X:              'OAuth / Twitter / X',
+  X:                      'OAuth / Twitter / X',
+  FACEBOOK:               'OAuth / Facebook',
+  INSTAGRAM:              'OAuth / Instagram',
+  LINKEDIN:               'OAuth / LinkedIn',
+  DISCORD:                'OAuth / Discord',
+  SPOTIFY:                'OAuth / Spotify',
+  APPLE:                  'OAuth / Apple',
+  MICROSOFT:              'OAuth / Microsoft',
+
+  // ── Collaboration / Productivity ───────────────────────────────────────────
+  SLACK:                  'Integrations / Slack',
+  NOTION:                 'Integrations / Notion',
+  LINEAR:                 'Integrations / Linear',
+  JIRA:                   'Integrations / Jira',
+  AIRTABLE:               'Integrations / Airtable',
+  ZAPIER:                 'Integrations / Zapier',
+  MAKE:                   'Integrations / Make',
+
+  // ── Maps / Location ────────────────────────────────────────────────────────
+  MAPBOX:                 'Maps / Mapbox',
+  GOOGLE_MAPS:            'Maps / Google Maps',
+  MAPS:                   'Maps / Google Maps',
+  HERE:                   'Maps / HERE',
+  IPINFO:                 'Maps / IPinfo',
+  MAXMIND:                'Maps / MaxMind',
+
+  // ── Crypto / Web3 ──────────────────────────────────────────────────────────
+  ALCHEMY:                'Web3 / Alchemy',
+  INFURA:                 'Web3 / Infura',
+  MORALIS:                'Web3 / Moralis',
+  THIRDWEB:               'Web3 / Thirdweb',
+  WALLET:                 'Web3 / Wallet',
+
+  // ── Testing / Dev Tools ────────────────────────────────────────────────────
+  PLAYWRIGHT:             'Testing / Playwright',
+  CYPRESS:                'Testing / Cypress',
+  BROWSERSTACK:           'Testing / BrowserStack',
+  SAUCE:                  'Testing / Sauce Labs',
+  STORYBOOK:              'Dev / Storybook',
+  CHROMATIC:              'Dev / Chromatic',
+};
+
+const STANDALONE_LABELS = {
+  PORT:           'App / Config',
+  HOST:           'App / Config',
+  NODE_ENV:       'App / Config',
+  APP_ENV:        'App / Config',
+  ENVIRONMENT:    'App / Config',
+  BASE_URL:       'App / Config',
+  API_URL:        'App / Config',
+  SITE_URL:       'App / Config',
+  FRONTEND_URL:   'App / Config',
+  BACKEND_URL:    'App / Config',
+  PUBLIC_URL:     'App / Config',
+  LOG_LEVEL:      'App / Config',
+  DEBUG:          'App / Config',
+  TZ:             'App / Config',
+  TIMEZONE:       'App / Config',
+  LOCALE:         'App / Config',
+  LANG:           'App / Config',
+  SECRET:         'Secrets',
+  SECRET_KEY:     'Secrets',
+  ENCRYPTION_KEY: 'Secrets',
+  API_KEY:        'API Keys',
+  API_SECRET:     'API Keys',
+  ACCESS_TOKEN:   'API Keys',
+  PRIVATE_KEY:    'Secrets',
+  PUBLIC_KEY:     'Secrets',
+};
+
 export function parseEnv(content) {
   const vars = {};
   for (const line of content.split('\n')) {
@@ -9,7 +342,6 @@ export function parseEnv(content) {
     if (eqIdx === -1) continue;
     const key = trimmed.slice(0, eqIdx).trim();
     let value = trimmed.slice(eqIdx + 1).trim();
-    // Strip surrounding quotes
     if (
       (value.startsWith('"') && value.endsWith('"')) ||
       (value.startsWith("'") && value.endsWith("'"))
@@ -21,6 +353,7 @@ export function parseEnv(content) {
   return vars;
 }
 
+// Used internally for encryption — keeps insertion order, no formatting
 export function stringifyEnv(vars) {
   const lines = Object.entries(vars).map(([k, v]) => {
     const needsQuotes = /[\s"'\\#]/.test(v) || v === '';
@@ -30,19 +363,95 @@ export function stringifyEnv(vars) {
   return lines.join('\n') + (lines.length ? '\n' : '');
 }
 
+function formatValue(v) {
+  const needsQuotes = /[\s"'\\#]/.test(v) || v === '';
+  const escaped = v.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+  return needsQuotes ? `"${escaped}"` : v;
+}
+
+function getSectionForKey(key) {
+  if (STANDALONE_LABELS[key]) return STANDALONE_LABELS[key];
+
+  // Try progressively shorter prefixes — longest match wins
+  const parts = key.split('_');
+  for (let len = parts.length - 1; len >= 1; len--) {
+    const prefix = parts.slice(0, len).join('_');
+    if (SECTION_LABELS[prefix]) return SECTION_LABELS[prefix];
+  }
+
+  return 'General';
+}
+
+function groupAndSort(vars) {
+  const sections = {};
+
+  for (const [key, value] of Object.entries(vars)) {
+    const section = getSectionForKey(key);
+    if (!sections[section]) sections[section] = [];
+    sections[section].push([key, value]);
+  }
+
+  for (const section of Object.keys(sections)) {
+    sections[section].sort(([a], [b]) => a.localeCompare(b));
+  }
+
+  // App/Config first, Secrets near top, General at bottom
+  const priority = {
+    'App / Config':  0,
+    'App / Runtime': 1,
+    'App / Server':  2,
+    'Secrets':       3,
+    'API Keys':      4,
+    'General':       999,
+  };
+
+  return Object.entries(sections).sort(([a], [b]) => {
+    const pa = priority[a] ?? 50;
+    const pb = priority[b] ?? 50;
+    if (pa !== pb) return pa - pb;
+    return a.localeCompare(b);
+  });
+}
+
 export function readEnvFile(filePath) {
   if (!existsSync(filePath)) return {};
   return parseEnv(readFileSync(filePath, 'utf8'));
 }
 
 export function writeEnvFile(filePath, vars, { envName, projectRoot } = {}) {
-  let content = '';
+  const entries = Object.entries(vars);
+  const projectName = projectRoot ? projectRoot.split('/').pop() : null;
+  const lines = [];
+
+  // Header
   if (envName) {
-    const projectName = projectRoot ? projectRoot.split('/').pop() : null;
-    content += `# Generated by envgit from [${envName}]`;
-    if (projectName) content += ` (${projectName})`;
-    content += '\n# Do not edit directly — use envgit set to update values\n\n';
+    const width = 50;
+    const bar = '─'.repeat(width);
+    lines.push(`# ${bar}`);
+    lines.push(`#  envgit — encrypted environment manager`);
+    if (projectName) lines.push(`#  Project : ${projectName}`);
+    lines.push(`#  Env     : ${envName}`);
+    lines.push(`#  Edit    : envgit set KEY=VALUE --env ${envName}`);
+    lines.push(`# ${bar}`);
+    lines.push('');
+  }
+
+  if (entries.length === 0) {
+    writeFileSync(filePath, lines.join('\n'), 'utf8');
+    return;
+  }
+
+  const grouped = groupAndSort(vars);
+  const maxKeyLen = Math.max(...entries.map(([k]) => k.length));
+
+  for (const [section, sectionVars] of grouped) {
+    lines.push(`# ── ${section} ${'─'.repeat(Math.max(0, 44 - section.length))}`);
+    for (const [k, v] of sectionVars) {
+      const padding = ' '.repeat(maxKeyLen - k.length);
+      lines.push(`${k}${padding} = ${formatValue(v)}`);
+    }
+    lines.push('');
   }
-  content += stringifyEnv(vars);
-  writeFileSync(filePath, content, 'utf8');
+
+  writeFileSync(filePath, lines.join('\n'), 'utf8');
 }

package/src/keystore.js

@@ -1,16 +1,25 @@
-import { readFileSync, writeFileSync, chmodSync, existsSync, statSync } from 'fs';
+import { readFileSync, writeFileSync, chmodSync, existsSync, statSync, mkdirSync } from 'fs';
 import { join, dirname } from 'path';
+import { homedir } from 'os';
+import { loadConfig } from './config.js';
 
-const KEY_FILE = '.envgit.key';
 const ENV_VAR = 'ENVGIT_KEY';
 const SECURE_MODE = 0o600;
 
+function globalKeysDir() {
+  return join(homedir(), '.config', 'envgit', 'keys');
+}
+
+export function globalKeyPath(keyId) {
+  return join(globalKeysDir(), `${keyId}.key`);
+}
+
 export function findProjectRoot(startDir = process.cwd()) {
   let dir = startDir;
   while (true) {
     if (existsSync(join(dir, '.envgit'))) return dir;
     const parent = dirname(dir);
-    if (parent === dir) return null; // reached filesystem root
+    if (parent === dir) return null;
     dir = parent;
   }
 }
@@ -26,27 +35,53 @@ export function requireProjectRoot() {
 
 export function loadKey(projectRoot) {
   if (process.env[ENV_VAR]) return process.env[ENV_VAR];
-  const keyPath = join(projectRoot, KEY_FILE);
-  if (existsSync(keyPath)) {
-    const stat = statSync(keyPath);
-    const mode = stat.mode & 0o777;
-    if (mode & 0o077) {
-      console.error(
-        `Error: ${KEY_FILE} has insecure permissions (${mode.toString(8)}). Run: chmod 600 ${KEY_FILE}`
-      );
-      process.exit(1);
+
+  const config = loadConfig(projectRoot);
+
+  if (config.key_id) {
+    const keyPath = globalKeyPath(config.key_id);
+    if (existsSync(keyPath)) {
+      enforcePermissions(keyPath);
+      return readFileSync(keyPath, 'utf8').trim();
     }
-    return readFileSync(keyPath, 'utf8').trim();
+    // Project found, but this machine doesn't have the key yet
+    console.error(
+      `No key found for this project. Ask your team for the key, then run:\n  envgit keygen --set <key>`
+    );
+    process.exit(1);
   }
-  throw new Error(
-    `No encryption key found. Add it to ${KEY_FILE} or set the ENVGIT_KEY environment variable.`
+
+  // Legacy fallback: .envgit.key in project root
+  const legacyPath = join(projectRoot, '.envgit.key');
+  if (existsSync(legacyPath)) {
+    enforcePermissions(legacyPath);
+    return readFileSync(legacyPath, 'utf8').trim();
+  }
+
+  console.error(
+    `No key found for this project. Ask your team for the key, then run:\n  envgit keygen --set <key>`
   );
+  process.exit(1);
 }
 
-export function saveKey(projectRoot, key) {
-  const keyPath = join(projectRoot, KEY_FILE);
+export function saveKey(projectRoot, key, keyId) {
+  const dir = globalKeysDir();
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+
+  const id = keyId ?? loadConfig(projectRoot).key_id;
+  const keyPath = globalKeyPath(id);
   writeFileSync(keyPath, key + '\n', { mode: SECURE_MODE });
-  // Explicitly tighten permissions in case the file already existed —
-  // writeFileSync's mode option only applies when creating a new file.
   chmodSync(keyPath, SECURE_MODE);
+  return keyPath;
+}
+
+function enforcePermissions(keyPath) {
+  const stat = statSync(keyPath);
+  const mode = stat.mode & 0o777;
+  if (mode & 0o077) {
+    console.error(
+      `Error: key file has insecure permissions (${mode.toString(8)}). Run: chmod 600 ${keyPath}`
+    );
+    process.exit(1);
+  }
 }