chirag127/envpact-npm-cli

envpact-cli

Zero-dependency CLI for envpact — a centralized, serverless, Git-backed secrets manager for solo developers managing 100+ public GitHub repositories.

One private vault, every project, zero infrastructure, $0 forever.

Live: https://envpact-npm-cli.oriz.in

Why envpact?

If you maintain dozens of public repos, you can't commit .env files. You also can't afford to duplicate the same OPENAIAPIKEY, STRIPESECRETKEY, and DATABASEURL across 40 projects — when they leak or expire, rotation becomes a 200-step manual nightmare.

envpact solves this with a single private GitHub repo holding a single secrets.json file. Project-specific secrets reference shared secrets via a shared.KEYNAME syntax. Rotate once → every project resolves the new value on next run.

Installation

# Run with no install (recommended)
npx envpact-cli

# Or install globally
npm install -g envpact-cli

Quick Start

# 1. Create your private vault (auto via gh CLI)
npx envpact-cli --init auto

# 2. In any project with a .env.example, generate the full .env
cd my-project
npx envpact-cli
# → resolves shared refs, prompts for missing values, writes .env

# 3. Sync a single key in either direction
npx envpact-cli --pull DATABASE_URL    # vault → .env
npx envpact-cli --push DATABASE_URL    # .env → vault

npx envpact-cli --status

5. Sync secrets to GitHub Actions for CI/CD

npx envpact-cli --github

## How It Works

Your machine GitHub.com ───────────────── ────────────────────────── ~/.envpact/secrets/ ←—git—→ chirag127/envpact-secrets (private) ├── secrets.json │ ├── shared: { OPENAIAPIKEY, … } │ └── projects: { my-app: { … } }

cd my-project envpact → reads .env.example → resolves "shared.OPENAIAPIKEY" → "sk-..." → writes .env (gitignored, mode 0600) → commits any new keys back to the vault

## Vault Schema

`secrets.json` (v3 — flat, single-environment, per-key timestamps):