Command reference

Use ramenv --help and ramenv <command> --help to check available arguments. Run ordinary vault commands from the directory containing .ramenv.vault.toml.

Initialization

Command	Purpose
ramenv menu	List available ingredients.
ramenv init [--ingredient <ingredient>]	Create a workspace and vault in the current directory.
ramenv init workspace [--ingredient <ingredient>]	Create workspace metadata and keys without a root vault.
ramenv init service	Register and initialize a service vault in an existing workspace.

Ingredients are local, aws, azure, and google. Local is the default. Re-running init does not migrate an existing workspace. See ingredients.

Values and environments

Command	Purpose
ramenv onboard <env>	Import the current directory’s .env, choosing which values to encrypt.
ramenv create-env <env>	Create a shared environment key and an empty environment in the current vault.
ramenv set <env> <key> [--plaintext]	Prompt for a value and add or update it; encrypted by default.
ramenv delete <env> <key>	Remove a value from the selected environment.

set takes no value argument. Onboarding overwrites matching keys, imports unselected values as plaintext, and leaves the source .env on disk. create-env does not populate sibling service vaults.

Inspect and validate

Command	Purpose
ramenv list <env> [--reveal]	List values, masked by default.
ramenv diff <env1> <env2> [--reveal]	Compare environments in the current vault, masking values by default.
ramenv validate [<env>]	Validate one environment, or all environments in the current vault when omitted.

--reveal prints complete decrypted values. Default masks can still expose parts of values. Avoid either output in shared logs if it could disclose secrets.

Validation checks declared rules. It does not reject extra variables or run automatically during run.

Execute an application

ramenv run <env> -- <command> [args...]

For example:

ramenv run development -- npm run dev

The -- separator keeps application flags separate from ramenv flags. ramenv uppercases variable names when injecting values into the process environment. Values override matching inherited variables; other inherited variables remain. ramenv returns the child’s exit code.

To gate startup in a POSIX shell:

ramenv validate production && ramenv run production -- ./my-server

Workspace-wide maintenance

Command	Purpose
ramenv rotate <env> [--yes]	Rotate the shared key and re-encrypt affected registered vaults.
ramenv remove-env <env> [--yes]	Delete environment data in affected registered vaults and remove its shared key.

Both commands operate across the workspace even when invoked from a service directory. When multiple vaults are affected, ramenv asks for confirmation. --yes or -y confirms the workspace-wide change without a prompt.

Rotation preserves plaintext values. Environment removal is destructive, and cloud deletion may remove all versions of the key secret. Consult environments and your provider guide before using these commands.