envs

Getting started

The catalog is a file in your project. There is no account and no server, and this takes about five minutes.

1. Create a catalog

npx @modootoday/envs init

This prints your key and a set of recovery codes once and stores neither. Save them somewhere before you close the terminal — the catalog holds only wrapped copies and cannot give them back.

It also adds .envs/ to your .gitignore. The catalog is encrypted, but it carries history and an audit trail, so it does not belong in a commit.

2. Load what you already have

envs load .env

The file is checked against the format rule first. If it is not env format, nothing is written at all, so you never end up with three of the four files loaded and no sign of the fourth.

Loading a second file keeps the first: envs load other.env carries the earlier values forward unless you pass --replace.

3. Run your app

envs run -- node server.js

Values reach the child through its environment and never through the command line, so nothing lands in a process listing or a shell history. Nothing is written into your build either.

Or load them in-process

import "@modootoday/envs/config";       // where dotenv/config went

import { config } from "@modootoday/envs";
config({ override: true });

config() takes dotenv's options name for name and is fully synchronous, so it works as a side-effect import.

Where the key comes from

ENVS_KEK in the environment, or a recovery code passed to a command. In development, keep the key in your shell profile; in CI, pass it as a secret. Nothing else needs to change.

What to do next