A library is a project made to be imported (storeenv init --kind library). An environment of another project imports it, and the imported keys arrive with every pull and run. The values stay in the library: nothing is copied.

Filters#

--only takes key patterns such as STRIPE_* (a trailing * matches any end). Without it, every key of the source environment is imported. --from-env picks the source environment when its name differs.

Pins#

By default an import follows the source's newest version. storeenv import pin <id> <version> keeps it on one version until you unpin it or move the pin.

Order#

This project's own keys always win. Among imports, later ones win over earlier ones; storeenv import move <id> <position> changes the order (0 is first).

Access is checked at the source#

Every pull checks the person pulling against the library itself: they must be a member of the source and allowed to read that environment. Someone who can't sees nothing from that import, even if the importing project shares everything else with them. A pin never bypasses this. Reads through an import are recorded in the source project's activity log.

Rotation#

Rotate a shared key once, in the library, and push. Imports that follow the newest version get it on their next pull; pinned imports stay on the old value until the pin moves.

Cycles and chains#

Imports don't chain: a library's own imports don't reach its importers. An import that would make a direct cycle (the source already imports this environment) is refused with SE_IMPORT_CYCLE.

Copy instead of import#

storeenv copy takes keys from another project and makes them this project's own secrets, decrypted and encrypted again on your device. Later changes at the source don't follow.