cendarum import

cendarum import [--project <name|id>] --env <name|id> [--email <email>] \
                --scope shared|personal [--file <path>|-]

cendarum import --env dev --scope shared --file .env
cat .env.production | cendarum import --env production --scope shared
printf 'MY_TOKEN=personal-tok\n' | cendarum import --env dev --scope personal

On success:

cendarum: imported 12 keys into dev (version 2)

or, for the personal scope:

cendarum: imported 3 personal overrides into dev (version 1)

The version number is the target stream’s payload version. It increments on every write, which is what lets concurrent editors detect that they were working from stale state. Your personal overlay has its own version counter, separate from the shared stream’s.

Two scopes, no default

--scope is required, deliberately. An import writes either the team’s shared stream or your own personal overlay, and a merged default is how a personal secret ends up inside a .env you hand to a teammate. You name the stream you are writing, every time, and a missing --scope is refused before any password prompt or network call:

$ cendarum import --env dev --file .env
cendarum: error: --scope <shared|personal> is required

(The usage text follows, and the exit code is 2.)

There is no import --scope effective: a write targets one stream, so the merged view is not writable.

Flags

Flag	Meaning
--env <name|id>	Required. Destination environment
--scope shared|personal	Required. Which stream the import writes
--project <name|id>	Disambiguates the environment name
--email <email>	Account email; falls back to CENDARUM_EMAIL, then a prompt
--file <path>	Read from a file. - or omitted means stdin

Accepted dialect

# comments are ignored
export API_URL=https://api.example.test     # `export ` prefix tolerated
DB_PASSWORD="s3cr3t-smoke-value"            # double quotes
FEATURE_FLAG='on'                           # single quotes
MULTILINE="first\nsecond"                   # escapes inside double quotes

Blank lines skipped, surrounding whitespace trimmed.

Duplicate keys stop the import

$ printf 'DUP=1\nDUP=2\n' | cendarum import --env dev --scope shared
cendarum: error: duplicate key DUP (lines 1 and 2)

Nothing is written. A file that sets the same key twice has a meaning that depends on your loader’s precedence rules, and quietly choosing one is how the wrong value reaches production. You get both line numbers and you decide.

Upsert semantics

For a key that already exists in the environment, the value is replaced and the type and note are preserved. Re-importing a refreshed .env therefore does not discard the classification and notes you added in the app.

New keys arrive with type secret, which is the safe default: masked until you say otherwise.

Concurrent edits

An import is a normal write, so it participates in the same optimistic concurrency as every other change. If the environment moved underneath you, the import stops:

cendarum: error: import conflicts with concurrent changes — resolve in the desktop app:
cendarum:   conflicting key: API_URL

Only key names appear — never values, on either side. The CLI ships no conflict resolution interface, deliberately: choosing between two versions of a secret is a decision that needs both values visible and a human looking at them, which is what the desktop app’s conflict view is for. See sync and conflicts.

A personal import conflicts only against your own concurrent personal edits — the two streams park separately in the app — and says which stream stopped it:

cendarum: error: import conflicts with concurrent personal changes — resolve in the desktop app:
cendarum:   conflicting key: MY_TOKEN

What it will never do is pick one silently. A wrong value in production is an outage, and last-writer-wins is how you get one.

Limits

Entries per environment	10,000
Key length	1,024 bytes
Value length	1 MiB
Note length	4,096 bytes

Values must be valid UTF-8.