One config. Every workspace pulls its keys.

DATABASE_URL drifts across packages

The API uses one value, the worker package uses a slightly older one. The bug only reproduces in one workspace.

One vault, one value per environment. Every workspace pulls the same source of truth on demand.

Each package has its own .env

Three packages, three .env files, one engineer keeping them in sync. They go on vacation and onboarding breaks.

One .envshed.json at the root declares each workspace's keys. envshed pull writes them where each package expects.

New engineer hits five missing keys at once

They clone the repo, run pnpm install, and the API crashes at startup with undefined. Nobody remembers which package needs what.

Declared keys are required keys. Envshed fails loud if a workspace is missing a value — at pull time, not at runtime.

Workspace-level changes are invisible

Someone added STRIPE_SECRET_KEY to apps/web by mistake. Three weeks later it ends up in the client bundle.

Per-workspace audit log. See which keys each package declared, who changed them, and when.