🧩 EncoraDB CLI

EncoraDB CLI is the essential toolkit for managing encryption in your EncoraDB-powered applications. It helps you generate configurations, audit database schemas for sensitive data, and securely manage key rotation.

🛠️ Local Development

🧪 Testing Without Publishing

To test the CLI locally, you can link it globally:

# 1. Navigate to the CLI package (if not already there)
cd packages/cli

# 2. Link the package globally
pnpm link --global

# 3. Now you can use 'encoradb' anywhere in your terminal
encoradb --help

To unlink when done:

pnpm unlink --global

🚀 Installation

Global Install

npm install -g @encoradb/cli
# or
pnpm add -g @encoradb/cli

Usage

encoradb --help

📦 Commands

encoradb verify

Validates your current configuration and checks if the Master Key is valid.

encoradb verify

encoradb scan

Introspect your database to automatically find sensitive columns (like passwords, emails, keys) and generate a suggested encryption configuration.

Usage:

encoradb scan <connection-string> [options]

Examples:

# Local Postgres
encoradb scan postgres://user:pass@localhost:5432/mydb

# AWS RDS with SSL
encoradb scan postgres://user:[email protected]:5432/mydb --ssl --ca ./us-east-1-bundle.pem

Options:

• --ssl: Enable SSL/TLS connection (required for most cloud databases).
• --ca <path>: Path to a CA Certificate file (e.g., for AWS RDS).

encoradb rotate-keys

Securely rotate your Master Key by re-encrypting data in your database.

1. Generates a new Master Key.
2. Iterates through your database using your config.
3. Decrypts data with the old key and re-encrypts with the new key.
4. Updates your configuration file.

⚠️ Warning: This operation performs data modification. Backup your database before running.

Usage:

encoradb rotate-keys <connection-string> [options]

Options:

• --ssl: Enable SSL/TLS connection.
• --ca <path>: Path to a CA Certificate file.
• --batch-size <number>: Number of rows to process in each transaction (default: 1000).

⚙️ Configuration

The CLI looks for an encoradb.json file in the current directory for commands like rotate-keys.

{
  "masterKey": "YOUR_32_BYTE_HEX_MASTER_KEY",
  "mode": "local",
  "encryptColumns": {
    "users": ["password", "ssn"],
    "orders": ["credit_card"]
  }
}

🛡️ Security Best Practices

• Backups: Always backup data before operations like Key Rotation.
• SSL: Always use --ssl when connecting to production databases.
• Private Access: For databases in private VPCs, run the CLI from a bastion host or use an SSH tunnel.

📄 License

MIT © 2025 EncoraDB Team