abadge item

The item subcommands operate against the active profile.

`abadge item add`

Create a new item interactively.

abadge item add
abadge item add --label "OpenAI" --kind api_key --storage-mode server_managed
abadge item add --label "Deploy SSH key" --kind ssh_key --storage-mode zero_knowledge

Flag	Description
`--label <label>`	Item label (cleartext). `--name` is accepted as a synonym.
`--kind <kind>`	`login`, `api_key`, `token`, `json`, `certificate`, `ssh_key`, `opaque`
`--value <value>`	Secret value. Prefer the interactive prompt — passing on the command line risks leaking into shell history.
`--storage-mode <mode>`	`zero_knowledge` or `server_managed`. Defaults to `server_managed`.
`--json`	Print raw JSON

Fields not provided via flags are prompted interactively (the value prompt is echo-masked). For zero-knowledge items, the daemon must be unlocked. The CLI:

Generates a 32-byte DEK locally.
Encrypts the payload with the DEK (XChaCha20-Poly1305).
Wraps the DEK with the profile root key (XChaCha20-Poly1305).
Sends encryptedItemKey and ciphertext to POST /v1/items.

For server-managed items, the CLI sends the plaintext payload to POST /v1/items and the API encrypts with AES-256-GCM.

`abadge item list`

Lists items in the active profile. Metadata only — never returns secret values.

abadge item list
abadge item list --json

`abadge item get <id>`

Fetch a single item.

abadge item get <item-id>
abadge item get <item-id> --reveal
abadge item get <item-id> --json

Flag	Description
`--reveal`	For zero-knowledge items, fetch the encrypted blob and ask the daemon to decrypt. For server-managed items, this flag is a no-op — use `AbadgeUserClient.ownerReveal()` or the dashboard to reveal plaintext.
`--json`	Print raw JSON

`abadge item update <id>`

Update an item interactively. Optimistic concurrency rejects stale edits with STALE_VERSION.

abadge item update <item-id>
abadge item update <item-id> --json

`abadge item rm <id>`

Soft-delete the item. Ciphertext is retained but inaccessible; permissions cascade-deny.

abadge item rm <item-id>
abadge item rm <item-id> --force

--force skips the confirmation prompt.

Storage modes

Mode	Encryption	Where
`zero_knowledge`	XChaCha20-Poly1305 with per-item DEK	Client-side (daemon)
`server_managed`	AES-256-GCM with `ENCRYPTION_KEY`	API worker

The mode is fixed at creation and inherited from the profile.

Getting started

Authentication

Local daemon

Resources

Runtime

Data movement

`abadge item add`

`abadge item list`

`abadge item get <id>`

`abadge item update <id>`

`abadge item rm <id>`

Storage modes

​abadge item add

​abadge item list

​abadge item get <id>

​abadge item update <id>

​abadge item rm <id>

​Storage modes

​Related

`abadge item add`

`abadge item list`

`abadge item get <id>`

`abadge item update <id>`

`abadge item rm <id>`

Storage modes

Related