weld-env

Push and pull encrypted .env files with your Weld workspace.

Install

npm install -g weld-env

Quick start

# 1. Log in (generates a token from the Weld web app → Settings → CLI Tokens)
weld login

# 2. Link your project directory to a workspace
cd my-project
weld init

# 3. Pull the team's .env
weld pull

# 4. Make changes and push
weld push

Commands

| Command | Description | |---|---| | weld login | Authenticate with your Weld workspace | | weld logout | Remove saved credentials | | weld whoami | Show the currently logged-in user | | weld init | Link this directory to a Weld workspace | | weld pull | Download + decrypt .env from Weld | | weld push | Encrypt and upload .env to Weld | | weld status | Show sync status without decrypting |

Options

weld pull --output .env.local    # write to a different file
weld push --input .env.staging   # push from a different file
weld push --no-retry             # disable automatic conflict retry

How it works

All encryption happens locally on your machine. The Weld server only stores ciphertext it cannot read. Your passphrase never leaves your machine.

Security model

• Zero-knowledge encryption — the server only stores ciphertext
• Argon2id key derivation — your passphrase is stretched via Argon2id before deriving your device keypair
• Per-device Curve25519 keypairs — each machine has a unique keypair derived from your passphrase + a device-specific salt
• DEK wrapping — the Data Encryption Key is sealed separately for each device using crypto_box_seal
• Signed pushes — every push is BLAKE2b-signed with your private key

Requirements

• Node.js ≥ 18
• A Weld workspace with Env Sync initialized