@dinanathdash/envault 1.0.0

package/bin/envault.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+
+import { Command } from 'commander';
+import chalk from 'chalk';
+import boxen from 'boxen';
+import { login } from '../src/commands/login.js';
+import { init } from '../src/commands/init.js';
+import { deploy } from '../src/commands/deploy.js';
+import { pull } from '../src/commands/pull.js';
+
+const program = new Command();
+
+// Gradient Logo Helper
+const showLogo = () => {
+    console.log(chalk.bold.hex('#10B981')(`
+  ███████╗███╗   ██╗██╗   ██╗ █████╗ ██╗   ██╗██╗  ████████╗
+  ██╔════╝████╗  ██║██║   ██║██╔══██╗██║   ██║██║  ╚══██╔══╝
+  █████╗  ██╔██╗ ██║██║   ██║███████║██║   ██║██║     ██║   
+  ██╔══╝  ██║╚██╗██║╚██╗ ██╔╝██╔══██║██║   ██║██║     ██║   
+  ███████╗██║ ╚████║ ╚████╔╝ ██║  ██║╚██████╔╝███████╗██║   
+  ╚══════╝╚═╝  ╚═══╝  ╚═══╝  ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝   
+`));
+    console.log(chalk.dim('  Secure Environment Variable Management\n'));
+};
+
+program
+    .name('envault')
+    .description('Cliff-side security for your environment variables')
+    .version('1.0.0')
+    .hook('preAction', (thisCommand) => {
+        // Show logo on all commands? Maybe too noisy.
+        // Let's show it only on help or specific ones.
+        // Or just a mini header.
+    });
+
+program.command('login')
+    .description('Authenticate with Envault using Device Flow')
+    .action(async () => {
+        showLogo();
+        await login();
+    });
+
+program.command('init')
+    .description('Initialize Envault in the current directory')
+    .action(async () => {
+        await init();
+    });
+
+program.command('deploy')
+    .description('Deploy local .env to Envault (Encrypt & Push)')
+    .option('-p, --project <id>', 'Project ID')
+    .option('--dry-run', 'Show what would change without pushing')
+    .action(async (options) => {
+        await deploy(options);
+    });
+
+program.command('pull')
+    .description('Pull secrets from Envault to local .env')
+    .option('-p, --project <id>', 'Project ID')
+    .option('-f, --force', 'Overwrite local .env without asking')
+    .action(async (options) => {
+        await pull(options);
+    });
+
+program.parse();

package/package.json

@@ -0,0 +1,31 @@
+{
+    "name": "@dinanathdash/envault",
+    "version": "1.0.0",
+    "description": "Envault CLI - Securely manage your environment variables",
+    "main": "src/index.js",
+    "bin": {
+        "envault": "./bin/envault.js"
+    },
+    "type": "module",
+    "scripts": {
+        "test": "echo \"Error: no test specified\" && exit 1"
+    },
+    "keywords": [
+        "envault",
+        "secrets",
+        "cli"
+    ],
+    "author": "Envault",
+    "license": "MIT",
+    "dependencies": {
+        "axios": "^1.6.0",
+        "boxen": "^7.1.1",
+        "chalk": "^5.3.0",
+        "commander": "^11.1.0",
+        "conf": "^12.0.0",
+        "dotenv": "^16.3.1",
+        "inquirer": "^9.2.11",
+        "ora": "^7.0.1",
+        "open": "^10.0.3"
+    }
+}

package/src/commands/deploy.js

@@ -0,0 +1,53 @@
+
+import fs from 'fs';
+import dotenv from 'dotenv';
+import chalk from 'chalk';
+import ora from 'ora';
+import { api, handleApiError } from '../lib/api.js';
+
+function getProjectId(options) {
+    if (options.project) return options.project;
+    if (fs.existsSync('envault.json')) {
+        const config = JSON.parse(fs.readFileSync('envault.json', 'utf-8'));
+        return config.projectId;
+    }
+    return null;
+}
+
+export async function deploy(options) {
+    const projectId = getProjectId(options);
+    if (!projectId) {
+        console.error(chalk.red('Error: No project linked. Run "envault init" or use --project <id>'));
+        return;
+    }
+
+    const envPath = '.env';
+    if (!fs.existsSync(envPath)) {
+        console.error(chalk.red('Error: .env file not found.'));
+        return;
+    }
+
+    const envConfig = dotenv.parse(fs.readFileSync(envPath));
+    const secrets = Object.entries(envConfig).map(([key, value]) => ({ key, value }));
+
+    if (secrets.length === 0) {
+        console.log(chalk.yellow('No secrets found in .env'));
+        return;
+    }
+
+    if (options.dryRun) {
+        console.log(chalk.blue(`Dry Run: Would deploy ${secrets.length} secrets to project ${projectId}`));
+        secrets.forEach(s => console.log(`- ${s.key}`));
+        return;
+    }
+
+    const spinner = ora('Encrypting and deploying secrets...').start();
+
+    try {
+        const { data } = await api.post(`/projects/${projectId}/secrets`, { secrets });
+        spinner.succeed(chalk.green(`✔ Successfully deployed ${secrets.length} secrets!`));
+    } catch (error) {
+        spinner.fail('Deploy failed.');
+        console.error(chalk.red(handleApiError(error)));
+    }
+}

package/src/commands/init.js

@@ -0,0 +1,59 @@
+
+import inquirer from 'inquirer';
+import fs from 'fs';
+import path from 'path';
+import chalk from 'chalk';
+import ora from 'ora';
+import { api, handleApiError } from '../lib/api.js';
+
+export async function init() {
+    // Check config existing
+    if (fs.existsSync('envault.json')) {
+        console.log(chalk.yellow('envault.json already exists in this directory.'));
+        const { confirm } = await inquirer.prompt([{
+            type: 'confirm',
+            name: 'confirm',
+            message: 'Do you want to overwrite it?',
+            default: false
+        }]);
+        if (!confirm) return;
+    }
+
+    const spinner = ora('Fetching your projects...').start();
+    let projects = [];
+
+    // We can't use /projects directly if we implemented /cli/projects/... 
+    // Wait, I implemented /projects (standard API)? No, I only implemented /api/cli/projects/[id]/secrets
+    // I need a list projects endpoint for the CLI to pick from!
+    // I missed `GET /api/cli/projects` in the plan implementation step 105.
+    // I should probably add it now or reusing the frontend logic if possible? 
+    // Or just "Enter Project ID" fallback? 
+    // "Interactive project picker" was promised. I need that endpoint.
+
+    // Quick fix: Add the endpoint after this file creation.
+
+    try {
+        const { data } = await api.get('/projects'); // Assuming exists or I will create it next.
+        projects = data.projects || data.data || []; // Adjust based on API response structure
+        spinner.stop();
+    } catch (error) {
+        spinner.fail('Failed to fetch projects.');
+        console.error(chalk.red(handleApiError(error)));
+        return;
+    }
+
+    if (projects.length === 0) {
+        console.log(chalk.yellow('No projects found. Create one in the dashboard first.'));
+        return;
+    }
+
+    const { projectId } = await inquirer.prompt([{
+        type: 'list',
+        name: 'projectId',
+        message: 'Select the project to link:',
+        choices: projects.map(p => ({ name: p.name, value: p.id }))
+    }]);
+
+    fs.writeFileSync('envault.json', JSON.stringify({ projectId }, null, 2));
+    console.log(chalk.green(`\n✔ Project linked! (ID: ${projectId})`));
+}

package/src/commands/login.js

@@ -0,0 +1,86 @@
+
+import chalk from 'chalk';
+import boxen from 'boxen';
+import ora from 'ora';
+import open from 'open';
+import { api, handleApiError } from '../lib/api.js';
+import { setToken } from '../lib/config.js';
+
+export async function login() {
+    console.log(chalk.blue('  Starting Device Authentication Flow...\n'));
+
+    // 1. Request Code
+    const spinner = ora('Contacting Envault servers...').start();
+    let deviceCode, userCode, verificationUri, interval;
+
+    try {
+        const { data } = await api.post('/auth/device/code');
+        deviceCode = data.device_code;
+        userCode = data.user_code; // 8-char
+        verificationUri = data.verification_uri;
+        interval = data.interval || 2;
+        spinner.succeed('Device code generated.');
+    } catch (error) {
+        spinner.fail('Failed to initiate login.');
+        console.error(chalk.red('Error: ' + handleApiError(error)));
+        return;
+    }
+
+    // 2. Display Code
+    console.log('\nPlease visit: ' + chalk.cyan.underline(verificationUri));
+
+    console.log(boxen(chalk.green.bold(userCode), {
+        title: 'Authentication Code',
+        titleAlignment: 'center',
+        padding: 1,
+        margin: 1,
+        borderStyle: 'round',
+        borderColor: 'green'
+    }));
+
+    // Open browser automatically
+    try {
+        await open(verificationUri);
+    } catch (e) {
+        // Ignore if fails (headless env)
+    }
+
+    // 3. Poll for Token
+    spinner.text = 'Waiting for browser approval...';
+    spinner.start();
+
+    const poll = async () => {
+        while (true) {
+            try {
+                const { data } = await api.post('/auth/device/token', { device_code: deviceCode });
+                if (data.access_token) {
+                    return data.access_token;
+                }
+            } catch (error) {
+                const errMsg = error.response?.data?.error;
+                if (errMsg === 'authorization_pending') {
+                    // Continue waiting
+                } else if (errMsg === 'access_denied') {
+                    throw new Error('Access denied by user.');
+                } else if (errMsg === 'expired_token') {
+                    throw new Error('Code expired. Please try again.');
+                } else {
+                    // Unknown error
+                    // throw new Error(handleApiError(error));
+                }
+            }
+
+            // Wait interval
+            await new Promise(resolve => setTimeout(resolve, interval * 1000));
+        }
+    };
+
+    try {
+        const token = await poll();
+        setToken(token);
+        spinner.succeed(chalk.green('Successfully authenticated! Token saved.'));
+    } catch (error) {
+        spinner.fail('Authentication failed.');
+        console.error(chalk.red(error.message));
+    }
+}

package/src/commands/pull.js

@@ -0,0 +1,56 @@
+
+import fs from 'fs';
+import chalk from 'chalk';
+import ora from 'ora';
+import inquirer from 'inquirer';
+import { api, handleApiError } from '../lib/api.js';
+
+function getProjectId(options) {
+    if (options.project) return options.project;
+    if (fs.existsSync('envault.json')) {
+        const config = JSON.parse(fs.readFileSync('envault.json', 'utf-8'));
+        return config.projectId;
+    }
+    return null;
+}
+
+export async function pull(options) {
+    const projectId = getProjectId(options);
+    if (!projectId) {
+        console.error(chalk.red('Error: No project linked. Run "envault init" or use --project <id>'));
+        return;
+    }
+
+    if (fs.existsSync('.env') && !options.force) {
+        const { confirm } = await inquirer.prompt([{
+            type: 'confirm',
+            name: 'confirm',
+            message: 'This will overwrite your current .env file. Continue?',
+            default: false
+        }]);
+        if (!confirm) return;
+    }
+
+    const spinner = ora('Fetching secrets...').start();
+
+    try {
+        const { data } = await api.get(`/projects/${projectId}/secrets`);
+        // data.secrets = [{key, value}]
+
+        if (!data.secrets || data.secrets.length === 0) {
+            spinner.info('No secrets found for this project.');
+            return;
+        }
+
+        const envContent = data.secrets
+            .map(s => `${s.key}="${s.value}"`) // Quote values to be safe
+            .join('\n');
+
+        fs.writeFileSync('.env', envContent);
+        spinner.succeed(chalk.green(`✔ Pulled ${data.secrets.length} secrets to .env`));
+
+    } catch (error) {
+        spinner.fail('Pull failed.');
+        console.error(chalk.red(handleApiError(error)));
+    }
+}

package/src/lib/api.js

@@ -0,0 +1,25 @@
+
+import axios from 'axios';
+import { getToken, getApiUrl } from './config.js';
+
+export const api = axios.create({
+    baseURL: getApiUrl(),
+    headers: {
+        'Content-Type': 'application/json',
+    },
+});
+
+api.interceptors.request.use((config) => {
+    const token = getToken();
+    if (token) {
+        config.headers.Authorization = `Bearer ${token}`; // Note: Backend expects Bearer
+    }
+    return config;
+});
+
+export function handleApiError(error) {
+    if (error.response) {
+        return error.response.data.error || error.response.statusText;
+    }
+    return error.message;
+}

package/src/lib/config.js

@@ -0,0 +1,31 @@
+
+import Conf from 'conf';
+
+// Schema:
+// {
+//   "auth": {
+//     "token": "..."
+//   }
+// }
+
+const config = new Conf({
+    projectName: 'envault-cli',
+    projectSuffix: ''
+});
+
+export function getToken() {
+    return config.get('auth.token');
+}
+
+export function setToken(token) {
+    config.set('auth.token', token);
+}
+
+export function clearToken() {
+    config.delete('auth.token');
+}
+
+export function getApiUrl() {
+    // Default to localhost for dev, but should check env
+    return process.env.ENVAULT_API_URL || 'http://localhost:3000/api/cli';
+}