VAULTRA CLI (envvault)

Sync encrypted environment variables between VAULTRA and a local .env. Talks to the backend REST API using an API token — it never sees the master encryption key (the server encrypts/decrypts).

Install

cd cli
npm install
npm link            # exposes `envvault` on your PATH (or: node src/index.js …)
envvault --help

Authenticate

Create an API token in the dashboard (API Tokens → New token; shown once), then:

envvault login                                   # prompts for the token
# or non-interactively / in CI:
envvault login --token vlt_xxx --api-url http://localhost:4000/api/v1

Credentials are stored at ~/.vaultra/config.json (mode 600). In CI, set VAULTRA_TOKEN and VAULTRA_API_URL instead of logging in.

Create / link a project & sync

envvault new "My App"    # create a project (adds Development + Production envs)
cd my-project
envvault init            # pick project + environment → writes .vaultra.json
envvault pull            # download the environment → .env
# …edit .env…
envvault diff            # added / modified / deleted vs server
envvault push            # upload only changed keys (creates a new version)

Commands

| Command | Description | |---|---| | login / logout | store / clear the API token | | new <name> | create a project (adds Development + Production envs); -d, --tags | | init | link this folder to a project + environment | | pull [-f .env] | download the environment into a local .env | | push [-f .env] [-y] | diff, confirm, upload changed keys (new version) | | diff [-f .env] | show added / modified / deleted keys | | export [-f file] | print (or write) the environment as .env | | import [file] | upload key/values from a .env file | | rollback <KEY> <version> | restore a secret to an earlier version | | list [projects\|environments\|secrets] | list resources (default: secrets) |

Env vars

| Variable | Notes | |---|---| | VAULTRA_API_URL | overrides the stored API URL (default http://localhost:4000/api/v1) | | VAULTRA_TOKEN | overrides the stored token (ideal for CI) |

Install from npm (published)

Published publicly as @liqteq/envvault (the command is still envvault):

npm install -g @liqteq/envvault
envvault --help

Distributing to your team (internal, no public registry)

A) npm tarball

Build a versioned tarball and share the file (Slack/network share/internal release):

cd cli
npm install
npm pack                       # → liqteq-envvault-0.1.0.tgz

Each teammate installs it globally (needs Node ≥ 20, no registry, works offline):

npm install -g ./liqteq-envvault-0.1.0.tgz
envvault --help

B) Single-file bundle (no npm install for users)

Bundle all dependencies into one file. Users just need Node — no npm install:

cd cli
npm install
npm run build                  # → dist/envvault.cjs  (self-contained)

Distribute dist/envvault.cjs. To run it:

node envvault.cjs --help
# or make it a command on PATH:
chmod +x envvault.cjs && sudo mv envvault.cjs /usr/local/bin/envvault
envvault --help

C) Install from your internal Git

If this repo lives on an internal Git server, teammates can install straight from it (subfolder installs need the tarball or a split repo; simplest is to run npm pack in CI and publish the .tgz as a release artifact — see A).

D) Private npm registry (optional, for scale)

Run a private registry (e.g. Verdaccio) or use GitHub Packages, set the registry, remove "private": true, then npm publish / npm install -g vaultra-cli.

E) True standalone binary (no Node at all)

Produce a native executable with Node's Single Executable Applications (SEA) or pkg, starting from the bundle in (B). Roughly:

npm run build                                  # dist/envvault.cjs
node --experimental-sea-config sea-config.json # → blob
# copy the node binary, inject the blob with `postject`, sign if needed

This yields a single file users run without installing Node — heavier to set up, best saved for when you want zero prerequisites.