Installation

Global Install

npm install -g envpkt
# or
pnpm add -g envpkt

Once installed globally, the envpkt command is available everywhere:

envpkt --version
envpkt --help

Local Install

Add envpkt as a dev dependency to your project:

npm install -D envpkt
# or
pnpm add -D envpkt

Then run via npx or package scripts:

npx envpkt audit

Run Without Installing

npx envpkt env scan
npx envpkt audit

The age CLI (required for sealed packets)

envpkt itself needs only Node. But sealing and unsealing encrypted_value packets shells out to the age CLI — it’s a runtime dependency with no bundled/JS fallback. Install it if you use sealed packets:

# macOS
brew install age
# Debian/Ubuntu (and most CI runners)
sudo apt-get update && sudo apt-get install -y age

You do not need age if you only use plaintext [env.*] defaults or resolve secrets via fnox. Because those paths resolve without age, a config can appear to work while sealed secrets silently fail to decrypt — run envpkt doctor to confirm age is detected.

Library Usage

envpkt is also a TypeScript library. Import functions directly:

import { boot, loadConfig, computeAudit, scanFleet } from "envpkt"

See the Library API reference for full documentation.