Metadata-Version: 2.5
Name: criptenv
Version: 0.2.2
Summary: Zero-Knowledge secret management CLI
Project-URL: Homepage, https://github.com/77mdias/criptenv
Project-URL: Repository, https://github.com/77mdias/criptenv
Project-URL: Issues, https://github.com/77mdias/criptenv/issues
Project-URL: Documentation, https://github.com/77mdias/criptenv#readme
Author-email: Jean Carlos Moreira Dias <jean.77mdiasdev@gmail.com>
License: MIT License
        
        Copyright (c) 2026 CriptEnv
        
        Permission is hereby granted, free of charge, to any person obtaining a copy
        of this software and associated documentation files (the "Software"), to deal
        in the Software without restriction, including without limitation the rights
        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
        copies of the Software, and to permit persons to whom the Software is
        furnished to do so, subject to the following conditions:
        
        The above copyright notice and this permission notice shall be included in all
        copies or substantial portions of the Software.
        
        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
        SOFTWARE.
License-File: LICENSE
Keywords: cli,encryption,env,environment-variables,secrets,zero-knowledge
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: Utilities
Requires-Python: >=3.10
Requires-Dist: aiosqlite>=0.20.0
Requires-Dist: click>=8.1.0
Requires-Dist: cryptography>=42.0.0
Requires-Dist: httpx>=0.27.0
Requires-Dist: python-dotenv>=1.0.0
Provides-Extra: dev
Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
Requires-Dist: pytest>=8.0.0; extra == 'dev'
Requires-Dist: ruff>=0.6.0; extra == 'dev'
Description-Content-Type: text/markdown

# CriptEnv CLI

> Zero-Knowledge secret management for developers and teams.

CriptEnv CLI is the command-line interface for the [CriptEnv](https://github.com/77mdias/criptenv) platform — an open-source alternative to Doppler and Infisical. Manage environment variables, API keys, and sensitive credentials with client-side AES-256-GCM encryption. Your secrets never reach our servers in plaintext.

## Features

- **Zero-Knowledge Encryption** — Secrets are encrypted 100% client-side with AES-256-GCM before leaving your machine.
- **Remote Terminal** — Commands operate directly on the encrypted project vault in CriptEnv Cloud.
- **Lightweight Local Metadata** — `~/.criptenv/` stores session/config metadata, not a local secrets vault.
- **Team Sync** — Everyone reads and writes the same remote encrypted vault.
- **Secret Rotation** — Built-in commands to rotate and expire secrets.
- **CI/CD Friendly** — Native support for CI tokens, GitHub Actions, and cloud integrations.
- **Cloud Integrations** — Sync secrets with Vercel and Render.

## Installation

```bash
pip install criptenv
```

Requires Python **3.10+**.

## Quick Start

```bash
# Log in to your CriptEnv account
criptenv login --email user@example.com

# Set a secret in the remote project vault
criptenv set DATABASE_URL=postgres://localhost/mydb

# List all secrets (names only — values never exposed)
criptenv list

# Get decrypted value
criptenv get DATABASE_URL

# Export latest remote secrets to a file
criptenv pull -p <project-id> --output .env.production

# Import a local .env file into the remote vault
criptenv push .env.production -p <project-id>
```

## Commands

### Core Commands

| Command | Description |
|---------|-------------|
| `init` | Prepare local CLI metadata and configuration |
| `login` | Authenticate with your CriptEnv account |
| `logout` | Clear local session |
| `set <key>=<value>` | Encrypt and store a secret in the remote vault |
| `get <key>` | Retrieve and decrypt a remote secret in memory |
| `list` | List remote secret keys (names only) |
| `delete <key>` | Remove a secret from the remote vault |

### Sync & Projects

| Command | Description |
|---------|-------------|
| `push <file> -p <project-id>` | Import `.env` secrets into the remote vault |
| `pull -p <project-id> -o <file>` | Export remote secrets to a file |
| `projects` | List projects |
| `projects create` | Create a new cloud project |
| `env` | Manage project environments |

### Import / Export

| Command | Description |
|---------|-------------|
| `import <file>` | Import secrets from `.env` file into the remote vault |
| `export -o <file>` | Export remote secrets to `.env` or JSON |

### Secret Management

| Command | Description |
|---------|-------------|
| `rotate <key>` | Rotate a secret value |
| `secrets expire <key>` | Set secret expiration |
| `secrets alert <key>` | Configure alert timing |
| `rotation list` | List secrets pending rotation |

### CI / CD

| Command | Description |
|---------|-------------|
| `ci login` | Login with CI token |
| `ci logout` | Clear CI session |
| `ci secrets` | List secrets in CI context |
| `ci deploy --file <file>` | Import a file into the remote vault in CI context |
| `ci tokens list` | List CI tokens |
| `ci tokens create` | Create CI token |
| `ci tokens revoke` | Revoke CI token |

### Integrations

| Command | Description |
|---------|-------------|
| `integrations list` | List cloud integrations |
| `integrations connect` | Connect a provider (vercel, render) |
| `integrations disconnect` | Disconnect a provider |
| `integrations sync` | Sync secrets with provider |

### Utilities

| Command | Description |
|---------|-------------|
| `doctor` | Check CLI health and connectivity |

## Security

Secrets are encrypted using a key derived from the project Vault password via PBKDF2-HMAC-SHA256 (100,000 iterations) and HKDF-SHA256. The CLI prompts for that password only when a command must decrypt or mutate secrets, or reads it from `CRIPTENV_VAULT_PASSWORD` for automation. The server only stores opaque encrypted blobs — it has no ability to decrypt your data.

## Development

```bash
cd apps/cli
pip install -e ".[dev]"
python -m pytest tests -q
```

**178 tests passing.**

## License

MIT License — see [LICENSE](../../LICENSE) for details.

---

Made with ❤️ by [Jean Carlos Moreira Dias](https://github.com/77mdias)
