envbook 0.3.1

package/README.md

@@ -0,0 +1,38 @@
+# envbook
+
+The command line for [EnvBook](https://envbook.com) — your setup book for
+AI-assisted projects.
+
+```bash
+npx envbook pull     # write .env.local for this repo
+npx envbook check    # does this repo have everything it needs? (no vault password)
+```
+
+`pull` works out which EnvBook project this directory is from your git remote
+(then the folder name), decrypts your values **locally**, and writes
+`.env.local`. Values never appear in the terminal — it prints key names only.
+
+`check` reads the code for the environment variables it actually uses and
+tells you which ones you don't hold yet. It needs no vault password, so it
+runs in CI and on a fresh clone.
+
+## Setup
+
+| Variable | Needed for | |
+| --- | --- | --- |
+| `ENVBOOK_TOKEN` | everything | create one at [envbook.com/account/security](https://envbook.com/account/security) |
+| `ENVBOOK_VAULT_PASSWORD` | `pull` only | your vault password — decryption happens on your machine |
+| `ENVBOOK_PROJECT` | optional | default project slug, when the guess is wrong |
+| `ENVBOOK_URL` | optional | self-hosted instance |
+
+## What this package is
+
+A bin and nothing more. The implementation lives in
+[`envbook-mcp`](https://www.npmjs.com/package/envbook-mcp), which also
+provides the MCP server for coding agents:
+
+```bash
+npx envbook-mcp      # MCP server (stdio)
+```
+
+Both packages release together at the same version.

package/bin/envbook.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+/**
+ * `npx envbook` — a bin, and nothing else.
+ *
+ * The CLI itself lives in `envbook-mcp`, which also ships the MCP server. It
+ * declares an `envbook` bin too, but reaching that through
+ * `npx -p envbook-mcp envbook` is unreliable: on Windows the shim isn't
+ * always resolvable, which is exactly what happened the first time anyone
+ * tried it. `npx <name>` only works cleanly when the PACKAGE is named what
+ * you type, so this package exists to own that name.
+ *
+ * It deliberately contains NO logic. One implementation, imported through a
+ * public export path (`envbook-mcp/cli`) rather than a deep `dist/` reach,
+ * so the two can't drift and adding an exports map upstream can't break it.
+ * The dependency is pinned EXACTLY: the wrapper and the implementation ship
+ * as one release, and `version-lockstep.test.ts` fails the build if they
+ * ever disagree.
+ */
+import "envbook-mcp/cli";

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "envbook",
+  "version": "0.3.1",
+  "description": "EnvBook on the command line \u2014 pull your project's .env.local, or check whether this repo has everything it needs.",
+  "keywords": [
+    "envbook",
+    "dotenv",
+    "env",
+    "secrets",
+    "cli",
+    "zero-knowledge"
+  ],
+  "homepage": "https://envbook.com",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "envbook": "bin/envbook.js"
+  },
+  "files": [
+    "bin",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "envbook-mcp": "0.3.1"
+  }
+}