Quick Start

Install envpkt
Terminal window
```
npm install -g envpkt
```
Discover credentials in your environment

envpkt scans your shell for known credential patterns — API keys, tokens, connection strings — and reports what it finds:
Terminal window
```
envpkt env scan
```
You’ll see a table with each detected variable, its inferred service, and a confidence indicator.
Scaffold your envpkt.toml

Turn those discoveries into a config file:
Terminal window
```
envpkt env scan --write
```
This creates (or appends to) envpkt.toml with [secret.*] sections for each discovered credential.
Generate an encryption key (optional — needed for sealing)

If you want to encrypt secrets into your config:
Terminal window
```
envpkt keygen
```
This generates an age keypair and auto-configures identity.recipient in your envpkt.toml.
Audit credential health

Check expiration dates, staleness, and missing metadata:
Terminal window
```
envpkt audit
```
Exit codes: 0 = healthy, 1 = degraded, 2 = critical.
Check for drift

Detect mismatches between your config and live environment:
Terminal window
```
envpkt env check
```
This runs bidirectional drift detection — secrets in TOML but missing from env, and credential-shaped env vars not tracked in TOML.

Next Steps