envmaster CLI

A thin wrapper over the SDK: same client-side decryption, same guarantees.

Install

npm i -g envmaster      # or bun add -g envmaster
envmaster --help

One-off, without installing:

npx envmaster export --project billing-api --env production

The package is called envmaster — unscoped, like the command. Requires Node 20+ or Bun.

Commands

Exactly five commands:

envmaster login    --url <url> --client-id <id> --client-secret <secret>
envmaster export   --project <slug> --env <slug> [--file out.env]
envmaster run      --project <slug> --env <slug> [--mask] -- <cmd...>
envmaster validate --project <slug> --env <slug> [--schema env.schema.yml] [--warn-undeclared]
envmaster import   [file] --project <slug> --env <slug> [--dry-run] [--overwrite] [--all-secrets]

Where credentials come from

In descending order of priority: flags → environment variables → ~/.envmaster/config.json (written by envmaster login, permissions 0600). The config holds machine credentials, not entry values: secrets never touch disk at any step.

login verifies the credentials with a real login and only then saves them.

run instead of export

export writes a file; run passes values to a child process — and leaves nothing on disk:

envmaster run --project billing-api --env production --mask -- ./deploy.sh

The child process gets all entries of the environment and does not get your ENVMASTER_* — they are scrubbed from its environment. With --mask the process output is filtered line by line: secret values and the credentials themselves are masked. The exit code is proxied.

export prints dotenv to stdout (in a terminal — with a warning on stderr) or to --file with 0600 permissions. Real values: this is the only command that leaves them on disk, and only on explicit request.

validate: checking before deploy

envmaster validate compares a local schema (--schema, default env.schema.yml) against what is actually in the environment: what is missing, what has the wrong type, what has expired. Findings — exit code 1, the pipeline fails before the deploy. Keys not in the schema are silent by default; --warn-undeclared prints them without affecting the exit code. The check works on names; values are not disclosed.

import for migration

ENVMASTER_TOKEN=<access-токен из кабинета> \
  envmaster import .env --project billing-api --env production --dry-run

Keys with SECRET, PASSWORD, TOKEN, KEY, CREDENTIAL, PRIVATE, DSN, AUTH, SALT, or CERT in the name become secrets (masked); the rest become variables (plain); --all-secrets switches everything to secrets. Existing keys are skipped unless --overwrite is passed. --dry-run prints the decision for each key without writing anything. Values are never printed — only names and decisions.

The command writes, so it requires a user access token rather than machine credentials — those are read-only by design.