cendarum import

cendarum import [--project <name|id>] --env <name|id> [--email <email>] \
                [--file <path>|-]

cendarum import --env dev --file .env
cat .env.production | cendarum import --env production
cendarum import --env dev            # reads stdin

On success:

cendarum: imported 12 keys into dev (version 2)

The version number is the environment’s payload version. It increments on every write, which is what lets concurrent editors detect that they were working from stale state.

Flags

Flag	Meaning
--env <name|id>	Required. Destination environment
--project <name|id>	Disambiguates the environment name
--email <email>	Account email; falls back to CENDARUM_EMAIL, then a prompt
--file <path>	Read from a file. - or omitted means stdin

Accepted dialect

# comments are ignored
export API_URL=https://api.example.test     # `export ` prefix tolerated
DB_PASSWORD="s3cr3t-smoke-value"            # double quotes
FEATURE_FLAG='on'                           # single quotes
MULTILINE="first\nsecond"                   # escapes inside double quotes

Blank lines skipped, surrounding whitespace trimmed.

Duplicate keys stop the import

$ printf 'DUP=1\nDUP=2\n' | cendarum import --env dev
cendarum: error: duplicate key DUP (lines 1 and 2)

Nothing is written. A file that sets the same key twice has a meaning that depends on your loader’s precedence rules, and quietly choosing one is how the wrong value reaches production. You get both line numbers and you decide.

Upsert semantics

For a key that already exists in the environment, the value is replaced and the type and note are preserved. Re-importing a refreshed .env therefore does not discard the classification and notes you added in the app.

New keys arrive with type secret, which is the safe default: masked until you say otherwise.

Concurrent edits

An import is a normal write, so it participates in the same optimistic concurrency as every other change. If the environment moved underneath you, the import stops:

cendarum: error: import conflicts with concurrent changes — resolve in the desktop app:
cendarum:   conflicting key: API_URL

Only key names appear — never values, on either side. The CLI ships no conflict resolution interface, deliberately: choosing between two versions of a secret is a decision that needs both values visible and a human looking at them, which is what the desktop app’s conflict view is for. See sync and conflicts.

What it will never do is pick one silently. A wrong value in production is an outage, and last-writer-wins is how you get one.

Limits

Entries per environment	10,000
Key length	1,024 bytes
Value length	1 MiB
Note length	4,096 bytes

Values must be valid UTF-8.