===============
LIBRARY RULES
===============
From library maintainers:
- envilder.json maps environment variable names to secret paths/names; never put secret values in it.
- With no $config block, the provider is AWS SSM Parameter Store; Azure Key Vault requires $config.provider = "azure" (or the CLI/GitHub Action override).
- Precedence: CLI flags / GitHub Action inputs > $config in the map file > defaults.
- `npx envilder` with no flags uses envilder.json as the map and .env as the output file.
- `npx envilder exec -- <command>` resolves the same mapping and starts the command with the secrets in its environment; no .env file is written. Envilder options go before the command (or before an optional `--`).
- Exec mode is fail-closed (the command never starts if a secret is missing) and is not a sandbox: the command and its children can read the secrets. It is CLI-only; the GitHub Action and SDKs do not offer it.
- Runtime SDKs resolve secrets into process memory; no .env file is needed.
- Never suggest committing generated .env files or secret values to Git.
- SDK APIs differ per language; use only the API documented in each SDK README.

### Setup Node.js SDK Examples

Source: https://github.com/macalbert/envilder/blob/main/examples/sdk/nodejs/README.md

Navigate to the examples directory and install the necessary dependencies.

```bash
cd examples/sdk/nodejs
npm install
```

--------------------------------

### Run .NET SDK Example

Source: https://github.com/macalbert/envilder/blob/main/examples/sdk/dotnet/README.md

Command to navigate to the examples directory and execute the configuration example.

```bash
cd examples/sdk/dotnet
dotnet run 1_configuration.cs
```

--------------------------------

### Run Python SDK Example

Source: https://github.com/macalbert/envilder/blob/main/examples/sdk/python/README.md

Commands to navigate to the examples directory and execute the fluent builder example.

```bash
cd examples/sdk/python
uv run 1_fluent.py
```

--------------------------------

### Install Python SDK

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/python/README.md

Run this command from the repository root to install the Python SDK.

```bash
# From the repo root
make install-sdk-python
```

--------------------------------

### Run Fluent Builder Example

Source: https://github.com/macalbert/envilder/blob/main/examples/sdk/nodejs/README.md

Execute the fluent builder example with provider overrides from the examples/sdk/nodejs directory.

```bash
cd examples/sdk/nodejs
npm run 1_fluent
```

--------------------------------

### Example .env file

Source: https://github.com/macalbert/envilder/blob/main/docs/push-command.md

Example .env file with two variables that match the mapping file keys.

```dotenv
API_KEY=abc123
DB_PASSWORD=secret456
```

--------------------------------

### Install Envilder Python SDK via uv or pip

Source: https://github.com/macalbert/envilder/blob/main/README.md

Install the Python SDK using uv (recommended) or pip.

```bash
uv add envilder
# or
pip install envilder
```

--------------------------------

### Envilder exec command usage examples

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

Examples showing how to pass arguments to the target command and use the -- separator.

```bash
envilder exec npm run dev                       # everything belongs to npm
envilder exec --map=cfg.json npm run dev        # --map is Envilder's, the rest is npm's
envilder exec npm run dev --map=x               # --map=x belongs to npm (it comes after the command)
envilder exec --map=cfg.json -- npm run dev     # same, with an explicit separator
envilder exec -- -weird-program-name            # use -- when the command itself starts with -
```

--------------------------------

### Build the project

Source: https://github.com/macalbert/envilder/blob/main/docs/github-action.md

Install dependencies and build the GitHub Action bundle.

```bash
pnpm install --frozen-lockfile
pnpm build:gha
```

--------------------------------

### Install Envilder Node.js SDK via npm

Source: https://github.com/macalbert/envilder/blob/main/README.md

Installs the @envilder/sdk package from npm.

```bash
npm install @envilder/sdk
```

--------------------------------

### Install Envilder Python SDK via uv or pip

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Installs the Envilder Python SDK using uv (recommended) or pip. Requires Python 3.10+.

```bash
uv add envilder
# or
pip install envilder
```

--------------------------------

### Verify Envilder CLI Installation

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Verifies that the Envilder CLI is installed and available by displaying its help output.

```bash
envilder --help
```

--------------------------------

### Generated .env file example

Source: https://github.com/macalbert/envilder/blob/main/github-action/README.md

Shows the format of the .env file generated by the action, with key-value pairs from cloud provider secrets.

```bash
DATABASE_URL=postgresql://user:pass@host:5432/db
API_KEY=example-not-a-real-secret
SECRET_TOKEN=token_secret_value_here
```

--------------------------------

### Install Envilder .NET SDK via NuGet

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Installs the Envilder .NET SDK package via NuGet. Requires .NET Standard 2.0 compatible runtime (.NET 6+, .NET Framework 4.6.1+).

```bash
dotnet add package Envilder
```

--------------------------------

### Sample .env output

Source: https://github.com/macalbert/envilder/blob/main/docs/pull-command.md

Example output of the generated .env file with a header comment and secret values.

```dotenv
# Generated by Envilder on 2025-07-13
API_KEY=abc123
DB_PASSWORD=secret456
SECRET_TOKEN=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
```

--------------------------------

### Install Envilder Node.js SDK via npm

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Installs the Envilder Node.js SDK via npm. Requires Node.js 22.12+.

```bash
npm install @envilder/sdk
```

--------------------------------

### Install Envilder globally with pnpm

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Install Envilder globally using pnpm. Requires Node.js v22.12+.

```bash
pnpm add -g envilder
```

--------------------------------

### Environment-specific pull commands

Source: https://github.com/macalbert/envilder/blob/main/docs/pull-command.md

Examples for default, development, production, and Azure environments using different map files and profiles.

```bash
# Default
envilder --map=envilder.json --envfile=.env.dev
# Development
envilder --map=envilder.json --envfile=.env.dev --profile=dev-account
# Production
envilder --map=envilder.json --envfile=.env.prod --profile=prod-account
# Azure (using $config in map file)
envilder --map=envilder.azure.json --envfile=.env.prod
# Azure (using CLI flags)
envilder --provider=azure --vault-url=https://prod-vault.vault.azure.net --map=envilder.json --envfile=.env.prod
```

--------------------------------

### Verify Envilder Python SDK Installation

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Verifies the Envilder Python SDK installation by importing the Envilder class and printing a success message.

```python
from envilder import Envilder
print("Envilder Python SDK installed successfully")
```

--------------------------------

### Install Envilder .NET SDK via NuGet

Source: https://github.com/macalbert/envilder/blob/main/README.md

Adds the Envilder NuGet package to a .NET project.

```bash
dotnet add package Envilder
```

--------------------------------

### Execution success summary

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

Example of the summary line printed to stderr upon successful command execution.

```text
envilder: 2 secrets resolved (aws, profile=dev) → npm …
```

--------------------------------

### AWS SSM Quick Start Workflow

Source: https://github.com/macalbert/envilder/blob/main/github-action/README.md

Configures AWS credentials and pulls secrets from AWS SSM Parameter Store into a temporary .env file. Uses the default provider 'aws'.

```yaml
- name: 🪙 Configure AWS Credentials
  uses: aws-actions/configure-aws-credentials@v5
  with:
    role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
    aws-region: us-east-1

- name: 🔐 Pull Secrets from AWS SSM
  uses: macalbert/envilder/github-action@v0
  with:
    map-file: envilder.json
    env-file: ${{ runner.temp }}/envilder.env

```

--------------------------------

### Running commands with envilder exec

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

Examples of using envilder exec to run various commands, including specifying map files and cloud providers.

```bash
envilder exec -- npm run dev
envilder exec --map=config/envilder.json -- node server.js
envilder exec --provider=azure --vault-url=https://my-vault.vault.azure.net -- dotnet run
```

--------------------------------

### Azure Key Vault Quick Start Workflow

Source: https://github.com/macalbert/envilder/blob/main/github-action/README.md

Logs into Azure and pulls secrets from Azure Key Vault into a .env file. Requires provider: azure and vault-url input.

```yaml
- name: 🔑 Azure Login
  uses: azure/login@v2
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

- name: 🔐 Pull Secrets from Azure Key Vault
  uses: macalbert/envilder/github-action@v0
  with:
    map-file: envilder.json
    env-file: .env
    provider: azure
    vault-url: ${{ secrets.AZURE_KEY_VAULT_URL }}

```

--------------------------------

### Run command with envilder exec

Source: https://github.com/macalbert/envilder/blob/main/README.md

Resolves the same mapping and starts the command with secrets in its environment without writing to disk. Fail-closed: command does not start if any secret is missing. Not a sandbox.

```bash
npx envilder exec -- npm run dev
```

--------------------------------

### Azure map file with $config.vaultUrl

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Example map file for Azure Key Vault. Sets provider to azure and specifies the vault URL via $config.vaultUrl.

```json
{
  "$config": {
    "provider": "azure",
    "vaultUrl": "https://my-vault.vault.azure.net"
  },
  "MY_SECRET": "my-secret-name"
}
```

--------------------------------

### Verify Envilder Node.js SDK Installation

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Verifies the Envilder Node.js SDK installation by importing the Envilder class and logging a success message.

```typescript
import { Envilder } from '@envilder/sdk';
console.log('Envilder Node.js SDK installed successfully');
```

--------------------------------

### Azure Map File Configuration

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/nodejs/README.md

Example of a map file configured for the Azure provider, requiring a vaultUrl.

```json
{
  "$schema": "https://envilder.com/schema/map-file.v1.json",
  "$config": {
    "provider": "azure",
    "vaultUrl": "https://my-vault.vault.azure.net"
  },
  "DB_PASSWORD": "myapp-prod-db-password",
  "API_KEY": "myapp-prod-api-key"
}
```

--------------------------------

### Error message for unsupported options

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

Example of the error message displayed when an unsupported option is used with exec.

```text
$ envilder --value=s3cret exec -- node app.js
error: Put envilder options after "exec".
--value cannot be used with exec.
```

--------------------------------

### Local Development Workflow

Source: https://github.com/macalbert/envilder/blob/main/docs/github-action.md

Example steps for testing the Envilder action locally within a repository. Note that the pnpm build:gha step is required for local development after source changes.

```yaml
steps:
  - uses: actions/checkout@v5

  - uses: actions/setup-node@v6
    with:
      node-version: "22.x"
      cache: "pnpm"

  - name: 📦 Build the Envilder GitHub Action
    run: |
      pnpm install --frozen-lockfile
      pnpm build:gha

  - uses: aws-actions/configure-aws-credentials@v5
    with:
      role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
      aws-region: us-east-1

  - name: 🔐 Test Action (Local Reference)
    uses: ./github-action  # Reference action from current repo
    with:
      map-file: e2e/sample/envilder.json
      env-file: .env
```

--------------------------------

### Install Envilder globally with npm

Source: https://github.com/macalbert/envilder/blob/main/README.md

Installs Envilder as a global npm package. Requires Node.js v22.12+ and configured credentials for AWS SSM or Azure Key Vault.

```bash
npm install -g envilder
```

--------------------------------

### GitHub Actions workflow step

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

Example of how to invoke the exec command within a GitHub Actions workflow step.

```yaml
- run: npx envilder exec -- npm test
```

--------------------------------

### Executing shell commands with secrets

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

Example of how to use a shell explicitly to interpret shell features like environment variable expansion.

```bash
envilder exec -- sh -c 'echo $DB_URL'
```

--------------------------------

### Example envilder.json mapping file

Source: https://github.com/macalbert/envilder/blob/main/docs/pull-command.md

A sample mapping file that maps environment variables to secret paths in AWS SSM Parameter Store.

```json
{
  "$schema": "https://envilder.com/schema/map-file.v1.json",
  "API_KEY": "/myapp/api/key",
  "DB_PASSWORD": "/myapp/db/password",
  "SECRET_TOKEN": "/myapp/auth/token"
}
```

--------------------------------

### Azure Key Vault Mapping File (envilder.json)

Source: https://github.com/macalbert/envilder/blob/main/docs/github-action.md

Example of a mapping file for Azure Key Vault, using the $config object to specify the provider and vault URL.

```json
{
  "$config": {
    "provider": "azure",
    "vaultUrl": "https://my-vault.vault.azure.net"
  },
  "DATABASE_URL": "myapp-production-database-url",
  "API_KEY": "myapp-production-api-key",
  "SECRET_TOKEN": "myapp-production-secret-token"
}
```

--------------------------------

### AWS SSM Mapping File (envilder.json)

Source: https://github.com/macalbert/envilder/blob/main/docs/github-action.md

Example of a mapping file for AWS SSM, where keys are environment variables and values are paths to secrets.

```json
{
  "DATABASE_URL": "/myapp/production/database-url",
  "API_KEY": "/myapp/production/api-key",
  "SECRET_TOKEN": "/myapp/production/secret-token"
}
```

--------------------------------

### Redirecting stdout with envilder exec

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

Example of running a command with stdout redirected while Envilder handles SSO login prompts via stderr.

```bash
envilder exec -- node print.js > out.json
```

--------------------------------

### Troubleshooting error message

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Example error message indicating the identity lacks the required secret permission on the key vault. Follow Option A or B to grant access, then retry.

```txt
does not have secrets set permission on key vault '...'
```

--------------------------------

### AWS SSM mapping file with $config profile

Source: https://github.com/macalbert/envilder/blob/main/README.md

Adds a $config section to declare the provider as 'aws' and specify an AWS CLI profile for multi-account setups. All other keys are secret mappings.

```json
{
  "$schema": "https://envilder.com/schema/map-file.v1.json",
  "$config": {
    "provider": "aws",
    "profile": "prod-account"
  },
  "API_KEY": "/myapp/prod/api-key",
  "DB_PASSWORD": "/myapp/prod/db-password"
}
```

--------------------------------

### Error message for misplaced options

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

Example of the error message displayed when envilder options are placed before the exec command.

```text
$ envilder --map=config/prod.json exec -- npm start
error: Put envilder options after "exec": envilder exec --map=config/prod.json -- npm …
```

--------------------------------

### Push with default configuration

Source: https://github.com/macalbert/envilder/blob/main/docs/push-command.md

Runs the push command with default configuration files envilder.json and .env.

```bash
envilder --push
```

--------------------------------

### Env.FromMapFile(path)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Returns an EnvilderBuilder for fluent configuration.

```APIDOC
## Env.FromMapFile(path)

### Description
Returns an EnvilderBuilder for fluent configuration.

### Method
FromMapFile

### Parameters
- **path** (string) - Required - The path to the map file.

### Returns
EnvilderBuilder
```

--------------------------------

### Run All Tests

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/python/README.md

Execute the full suite of tests.

```bash
make test-sdk-python
```

--------------------------------

### Envilder.fromMapFile(path)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/nodejs/README.md

Returns a fluent builder for configuration based on the given map file.

```APIDOC
## Envilder.fromMapFile(path)

### Description
Returns a fluent builder for configuration based on the given map file.

### Method
fromMapFile

### Parameters
- **path** (string) - Required - Path to the map file.

### Response
Returns a fluent builder object.
```

--------------------------------

### Environment variable override notification

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

Example of the stderr output when a mapped variable overrides an inherited shell variable.

```text
Overriding inherited variables: API_KEY
```

--------------------------------

### Run Acceptance Tests

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/python/README.md

Acceptance tests require Docker and a LocalStack auth token.

```bash
export LOCALSTACK_AUTH_TOKEN=<your-token>
cd tests/sdks/python
python -m pytest -v -m acceptance
```

--------------------------------

### Envilder.from_map_file(path)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/python/README.md

Returns a fluent builder for configuration.

```APIDOC
## Envilder.from_map_file(path)

### Description
Returns a fluent builder for configuration.

### Method
from_map_file

### Parameters
- **path** (string) - Required - Path to the map file.

### Returns
Fluent builder object.
```

--------------------------------

### CLI usage with $config and overrides

Source: https://github.com/macalbert/envilder/blob/main/README.md

Shows how to use the CLI: without flags it uses $config from the map file; with flags it overrides provider and vault URL. The second command uses --provider=azure, --vault-url, --map, and --envfile.

```bash
# Uses $config from the map file
envilder
```

```bash
# Overrides provider and vault URL from the map file
envilder --provider=azure --vault-url=https://other-vault.vault.azure.net --map=envilder.json --envfile=.env
```

--------------------------------

### Using with working-directory

Source: https://github.com/macalbert/envilder/blob/main/github-action/README.md

Shows how to use the action when the workflow sets a working-directory. The map-file and env-file paths must be relative to the repository root, not the working directory.

```yaml
jobs:
  deploy:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./app  # Commands run here

    steps:
      - uses: actions/checkout@v5
      
      - uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region: us-east-1
      
      - name: 🔐 Pull Secrets
        uses: macalbert/envilder/github-action@v0
        with:
          map-file: app/config/envilder.json  # Path from repo root!
          env-file: app/.env                    # Path from repo root!
      
      - run: pnpm install --frozen-lockfile      # Runs in ./app
      - run: pnpm build   # Runs in ./app
```

--------------------------------

### Use fluent builder for full control (Node.js)

Source: https://github.com/macalbert/envilder/blob/main/README.md

Builds a resolver with a specific provider and profile for advanced configuration.

```typescript
import { Envilder, SecretProviderType } from '@envilder/sdk';

const secrets = await Envilder.fromMapFile('envilder.json')
  .withProvider(SecretProviderType.Aws)
  .withProfile('prod-account')
  .resolve();
```

--------------------------------

### Commit the action bundle

Source: https://github.com/macalbert/envilder/blob/main/docs/github-action.md

Stage and commit the action configuration and the generated distribution file.

```bash
git add action.yml github-action/dist/index.js
git commit -m "chore: build GitHub Action release"
```

--------------------------------

### Create release tag

Source: https://github.com/macalbert/envilder/blob/main/docs/github-action.md

Tag the release and update the floating v0 tag to point to the new commit.

```bash
release_tag=v0.x.y
git tag -a "$release_tag" -m "Release $release_tag"
git tag -fa v0 -m "Update v0 to $release_tag"
git push origin "$release_tag"
git push origin v0 --force
```

--------------------------------

### Set vault access policy (classic)

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Grants secret permissions directly on the vault. For pull-only access, `get list` is enough; add `set` for push.

```bash
az keyvault set-policy \
  --name <VAULT_NAME> \
  --object-id <YOUR_OBJECT_ID> \
  --secret-permissions get set list
```

--------------------------------

### Load secrets into IConfiguration or environment (.NET)

Source: https://github.com/macalbert/envilder/blob/main/README.md

Two options: Option A integrates with IConfiguration using AddEnvilder, Option B loads into the process environment with Env.Load. Both read from envilder.json.

```csharp
// Option A: integrate with IConfiguration
var config = new ConfigurationBuilder()
    .AddEnvilder("envilder.json")
    .Build();

var dbPassword = config["DB_PASSWORD"];

// Option B: resolve + inject into environment
Env.Load("envilder.json");
var dbPassword = Environment.GetEnvironmentVariable("DB_PASSWORD");
```

--------------------------------

### Run Envilder CLI with default or explicit paths

Source: https://github.com/macalbert/envilder/blob/main/README.md

Zero-config usage relies on envilder.json and .env by default. Use --map and --envfile to specify explicit paths. The exec subcommand runs your app with secrets in memory instead of writing a file.

```bash
# Zero-config: uses envilder.json and .env by default
npx envilder

# Or with explicit paths
npx envilder --map=envilder.json --envfile=.env

# Or skip the file: run your app with the secrets in memory
npx envilder exec -- npm run dev
```

--------------------------------

### Route by environment with map files (Python)

Source: https://github.com/macalbert/envilder/blob/main/README.md

Loads secrets based on the current environment, each pointing to its own map file. Passing None for an environment loads no secrets.

```python
from envilder import Envilder

Envilder.load('production', {
    'production': 'prod-secrets.json',
    'development': 'dev-secrets.json',
    'test': None,  # no secrets loaded
})
```

--------------------------------

### Log in to Azure CLI

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Log in to Azure CLI to authenticate with Azure Default Credentials.

```bash
az login
```

--------------------------------

### Verify the bundle

Source: https://github.com/macalbert/envilder/blob/main/docs/github-action.md

Ensure the committed bundle matches the current build state.

```bash
pnpm verify:gha
```

--------------------------------

### AWS IAM policy for SSM parameter access

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Example IAM policy granting ssm:GetParameter and ssm:PutParameter permissions. Attach this policy to your IAM user or role using the AWS Console or CLI.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:PutParameter"
      ],
      "Resource": "*"
    }
  ]
}
```

--------------------------------

### Assign Key Vault Secrets Officer role (Azure RBAC)

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Assigns the Key Vault Secrets Officer role to your identity for full secret management. Use `az ad signed-in-user show --query id -o tsv` to get your object ID.

```bash
az role assignment create \
  --role "Key Vault Secrets Officer" \
  --assignee <YOUR_OBJECT_ID> \
  --scope /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.KeyVault/vaults/<VAULT_NAME>
```

--------------------------------

### Run Quality Checks

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/python/README.md

Use these commands to perform code quality checks or auto-format the codebase.

```bash
make check-sdk-python    # black + isort + mypy (no changes)
make format-sdk-python   # auto-format
```

--------------------------------

### Env.Load(env, mapping)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Environment-based resolve and inject into the Environment.

```APIDOC
## Env.Load(env, mapping)

### Description
Environment-based resolve and inject into the Environment.

### Method
Load

### Parameters
- **env** (IEnvironment) - Required - The environment to resolve from.
- **mapping** (IMapping) - Required - The mapping configuration.

### Returns
Void
```

--------------------------------

### Basic Workflow with envilder GitHub Action

Source: https://github.com/macalbert/envilder/blob/main/github-action/README.md

Basic GitHub Actions workflow that checks out code, configures AWS credentials with OIDC, pulls secrets from AWS SSM using the envilder action, sets up Node.js, and runs pnpm install/build/deploy. Requires AWS_ROLE_TO_ASSUME and AWS_REGION secrets.

```yaml
name: 🚀 Deploy Application

on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: 🧱 Checkout
        uses: actions/checkout@v5

      - name: 🪙 Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: 🔐 Pull Secrets from AWS SSM
        uses: macalbert/envilder/github-action@v0
        with:
          map-file: config/envilder.json
          env-file: .env

      - name: 🍄 Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "22.x"
          cache: "pnpm"

      - name: 📦 Install Dependencies
        run: pnpm install --frozen-lockfile

      - name: 🏗️ Build Application
        run: pnpm build
        
      - name: 🚀 Deploy Application
        run: pnpm deploy
```

--------------------------------

### Env.LoadAsync(env, mapping, ct?)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Async version of Load(env, mapping). Environment-based resolve and inject into the Environment.

```APIDOC
## Env.LoadAsync(env, mapping, ct?)

### Description
Async version of Load(env, mapping). Environment-based resolve and inject into the Environment.

### Method
LoadAsync

### Parameters
- **env** (IEnvironment) - Required - The environment to resolve from.
- **mapping** (IMapping) - Required - The mapping configuration.
- **ct** (CancellationToken) - Optional - Cancellation token.

### Returns
Task
```

--------------------------------

### Builder.inject()

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/python/README.md

Resolve and inject into os.environ.

```APIDOC
## Builder.inject()

### Description
Resolve and inject into os.environ.

### Method
inject

### Parameters
None

### Returns
None (injects into os.environ)
```

--------------------------------

### Run Unit Tests

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/python/README.md

Execute unit tests which do not require external dependencies.

```bash
cd tests/sdks/python
python -m pytest -v -m "not acceptance"
```

--------------------------------

### Envilder.load(env, mapping)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/nodejs/README.md

Resolves secrets based on the environment and mapping, then injects them into process.env.

```APIDOC
## Envilder.load(env, mapping)

### Description
Resolves secrets based on the environment and mapping, then injects them into process.env.

### Method
load

### Parameters
- **env** (string) - Required - The environment name.
- **mapping** (object) - Required - The mapping configuration.

### Response
No return value (injects into process.env).
```

--------------------------------

### Configure AWS CLI default profile

Source: https://github.com/macalbert/envilder/blob/main/docs/requirements-installation.md

Set up the default AWS CLI profile. Envilder uses these credentials by default.

```bash
aws configure
```

--------------------------------

### Env.LoadAsync(path, ct?)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Async version of Load. Resolves secrets from the specified file path and injects them into the Environment.

```APIDOC
## Env.LoadAsync(path, ct?)

### Description
Async version of Load. Resolves secrets from the specified file path and injects them into the Environment.

### Method
LoadAsync

### Parameters
- **path** (string) - Required - The path to the secrets file.
- **ct** (CancellationToken) - Optional - Cancellation token.

### Returns
Task
```

--------------------------------

### Database Migration Configuration

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

Using Envilder to provide a DATABASE_URL for migration tools without storing the connection string on disk.

```json
{
  "DATABASE_URL": "/my-app/development/database/url"
}
```

```bash
envilder exec -- npx prisma migrate deploy
envilder exec -- python scripts/backfill.py
```

--------------------------------

### Envilder.load(env, mapping)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/python/README.md

Environment-based resolve and inject. Resolves secrets based on the environment and mapping, then injects into os.environ.

```APIDOC
## Envilder.load(env, mapping)

### Description
Environment-based resolve and inject. Resolves secrets based on the environment and mapping, then injects into os.environ.

### Method
load

### Parameters
- **env** (string) - Required - Environment name.
- **mapping** (object) - Required - Mapping configuration.

### Returns
None (injects into os.environ)
```

--------------------------------

### Pull command with default paths

Source: https://github.com/macalbert/envilder/blob/main/docs/pull-command.md

Runs the pull command using default envilder.json and .env files.

```bash
envilder
```

--------------------------------

### Envilder exec command syntax

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

The basic syntax for the exec command.

```text
envilder exec [options] [--] <command> [args...]
```

--------------------------------

### Basic AWS SSM mapping file (envilder.json)

Source: https://github.com/macalbert/envilder/blob/main/README.md

Default mapping file format when no $config is present. Values are SSM parameter paths (e.g., /myapp/prod/api-key). Includes $schema for IDE autocomplete and validation.

```json
{
  "$schema": "https://envilder.com/schema/map-file.v1.json",
  "API_KEY": "/myapp/prod/api-key",
  "DB_PASSWORD": "/myapp/prod/db-password",
  "SECRET_TOKEN": "/myapp/prod/secret-token"
}
```

--------------------------------

### Local Development Server Script

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

Integrating Envilder into package.json scripts for consistent secret management during local development.

```json
{
  "scripts": {
    "dev": "envilder exec -- next dev"
  }
}
```

--------------------------------

### Runtime overrides with IConfiguration

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Pass EnvilderOptions to override map file configurations when using IConfiguration.

```csharp
using Envilder;
using Microsoft.Extensions.Configuration;

var config = new ConfigurationBuilder()
    .AddEnvilder("envilder.json", new EnvilderOptions
    {
        Provider = SecretProviderType.Azure,
        VaultUrl = "https://my-vault.vault.azure.net",
    })
    .Build();
```

--------------------------------

### Check Envilder version with npx

Source: https://github.com/macalbert/envilder/blob/main/README.md

Run this command to verify the Envilder CLI is available. Requires Node.js v22.12+ and configured credentials for AWS SSM or Azure Key Vault.

```bash
npx envilder --version
```

--------------------------------

### Env.Load(path)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Resolves secrets from the specified file path and injects them into the Environment.

```APIDOC
## Env.Load(path)

### Description
Resolves secrets from the specified file path and injects them into the Environment.

### Method
Load

### Parameters
- **path** (string) - Required - The path to the secrets file.

### Returns
Void
```

--------------------------------

### Basic GitHub Actions Workflow with Envilder

Source: https://github.com/macalbert/envilder/blob/main/docs/github-action.md

A complete GitHub Actions workflow that checks out code, configures AWS credentials, pulls secrets from AWS SSM using the Envilder action, and then builds and deploys a Node.js application.

```yaml
name: 🚀 Deploy Application

on:
  push:
    branches: [main]

permissions:
  id-token: write  # Required for OIDC
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: 🧱 Checkout
        uses: actions/checkout@v5

      - name: 🪙 Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: 🔐 Pull Secrets from AWS SSM
        uses: macalbert/envilder/github-action@v0
        with:
          map-file: config/envilder.json
          env-file: .env

      - name: 🍄 Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "22.x"
          cache: "pnpm"

      - name: 📦 Install Dependencies
        run: pnpm install --frozen-lockfile

      - name: 🏗️ Build Application
        run: pnpm build

      - name: 🚀 Deploy Application
        run: pnpm deploy
```

--------------------------------

### Parameter Mapping File (AWS SSM)

Source: https://github.com/macalbert/envilder/blob/main/github-action/README.md

JSON mapping file for AWS SSM. Maps environment variables to SSM parameter paths. Includes a $schema reference.

```json
{
  "$schema": "https://envilder.com/schema/map-file.v1.json",
  "DATABASE_URL": "/myapp/prod/database-url",
  "API_KEY": "/myapp/prod/api-key",
  "SECRET_TOKEN": "/myapp/prod/secret-token"
}
```

--------------------------------

### Comparison of pull mode vs exec mode

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

A conceptual comparison showing how secrets are handled in pull mode versus exec mode.

```text
pull mode:  provider -> .env on disk -> process
exec mode:  provider -> memory -> child process environment
```

--------------------------------

### LocalStack Docker Execution

Source: https://github.com/macalbert/envilder/blob/main/docs/exec-command.md

Running LocalStack with plain Docker using Envilder to inject the auth token.

```bash
envilder exec -- docker run --rm -e LOCALSTACK_AUTH_TOKEN -p 4566:4566 localstack/localstack:stable
```

--------------------------------

### Mermaid diagram of pull mode workflow

Source: https://github.com/macalbert/envilder/blob/main/docs/pull-command.md

Shows the flow from mapping file and cloud credentials through Envilder to AWS SSM/Azure Key Vault and the .env file.

```mermaid
graph LR
    A[Mapping File] --> |Secret Paths| B[Envilder]:::core
    D[Cloud Credentials]:::cloud --> B
    B --> E[AWS SSM / Azure Key Vault]:::cloud
    B --> F[.env File]

    classDef cloud fill:#ffcc66,color:#000000,stroke:#333,stroke-width:1.5px;
    classDef core fill:#1f3b57,color:#fff,stroke:#ccc,stroke-width:2px;
```

--------------------------------

### Azure Key Vault mapping file with $config

Source: https://github.com/macalbert/envilder/blob/main/README.md

Declares the provider as 'azure' and sets the vaultUrl. Secret names are normalized: slashes and underscores become hyphens (e.g., /myapp/db/password → myapp-db-password).

```json
{
  "$schema": "https://envilder.com/schema/map-file.v1.json",
  "$config": {
    "provider": "azure",
    "vaultUrl": "https://my-vault.vault.azure.net"
  },
  "API_KEY": "myapp-prod-api-key",
  "DB_PASSWORD": "myapp-prod-db-password"
}
```

--------------------------------

### Env.ResolveFileAsync(env, mapping, ct?)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Async version of ResolveFile(env, mapping). Environment-based resolve of secrets, returning them as an IReadOnlyDictionary.

```APIDOC
## Env.ResolveFileAsync(env, mapping, ct?)

### Description
Async version of ResolveFile(env, mapping). Environment-based resolve of secrets, returning them as an IReadOnlyDictionary.

### Method
ResolveFileAsync

### Parameters
- **env** (IEnvironment) - Required - The environment to resolve from.
- **mapping** (IMapping) - Required - The mapping configuration.
- **ct** (CancellationToken) - Optional - Cancellation token.

### Returns
Task<IReadOnlyDictionary>
```

--------------------------------

### Integration with IConfiguration

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Integrate Envilder into ASP.NET Core using ConfigurationBuilder.

```csharp
using Microsoft.Extensions.Configuration;

var config = new ConfigurationBuilder()
    .AddEnvilder("envilder.json")
    .Build();

var dbPassword = config["DB_PASSWORD"];
```

```json
{
  "Database/ConnectionString": "/app/prod/db-connection",
  "Database/Password": "/app/prod/db-password"
}
```

```csharp
var dbSettings = config.GetSection("Database");
var connString = dbSettings["ConnectionString"];
```

--------------------------------

### Envilder.load(path)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/nodejs/README.md

Resolves secrets from the given map file and injects them into process.env.

```APIDOC
## Envilder.load(path)

### Description
Resolves secrets from the given map file and injects them into process.env.

### Method
load

### Parameters
- **path** (string) - Required - Path to the map file.

### Response
No return value (injects into process.env).
```

--------------------------------

### Builder.withVaultUrl(url)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/nodejs/README.md

Overrides the Azure Key Vault URL on the fluent builder.

```APIDOC
## Builder.withVaultUrl(url)

### Description
Overrides the Azure Key Vault URL on the fluent builder.

### Method
withVaultUrl

### Parameters
- **url** (string) - Required - The Azure Key Vault URL.

### Response
Returns the builder for chaining.
```

--------------------------------

### Async secret loading

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Every method in the Envilder SDK has an asynchronous counterpart.

```csharp
using Envilder;

await Env.LoadAsync("envilder.json");
var secrets = await Env.ResolveFileAsync("envilder.json");
```

--------------------------------

### Azure Key Vault push via CLI flags

Source: https://github.com/macalbert/envilder/blob/main/docs/push-command.md

Runs push mode targeting Azure Key Vault using --provider and --vault-url flags.

```bash
envilder --push --provider=azure --vault-url=https://my-vault.vault.azure.net --envfile=.env --map=envilder.json
```

--------------------------------

### Load secrets into environment

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/python/README.md

Use Envilder.load to resolve secrets from a map file and inject them directly into os.environ.

```python
from envilder import Envilder

# Resolve secrets and inject into os.environ
Envilder.load('envilder.json')

import os
print(os.environ['DB_PASSWORD'])
```

--------------------------------

### Implement custom secret provider

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/python/README.md

Implement the ISecretProvider protocol to create a custom backend for secret retrieval.

```python
from envilder import EnvilderClient, ISecretProvider, MapFileParser


class MyCustomProvider(ISecretProvider):
    def get_secret(self, name: str) -> str | None:
        # fetch from your custom backend
        ...


with open('envilder.json', encoding='utf-8') as file:
    map_file = MapFileParser().parse(file.read())

provider = MyCustomProvider()
secrets = EnvilderClient(provider).resolve_secrets(map_file)
EnvilderClient.inject_into_environment(secrets)
```

--------------------------------

### Azure Credentials Configuration (OIDC)

Source: https://github.com/macalbert/envilder/blob/main/github-action/README.md

YAML configuration for GitHub Actions to authenticate with Azure using OIDC. Requires id-token: write permission and the azure/login action.

```yaml
permissions:
  id-token: write  # Required for OIDC
  contents: read

jobs:
  deploy:
    steps:
      - uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
```

--------------------------------

### Azure Key Vault configuration

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Configure the map file for Azure Key Vault and load secrets using the .NET SDK.

```json
{
  "$schema": "https://envilder.com/schema/map-file.v1.json",
  "$config": {
    "provider": "azure",
    "vaultUrl": "https://my-vault.vault.azure.net"
  },
  "DB_PASSWORD": "myapp-prod-db-password"
}
```

```csharp
using Envilder;

Env.Load("envilder.json");

var dbPassword = Environment.GetEnvironmentVariable("DB_PASSWORD");
```

--------------------------------

### EnvilderBuilder.InjectAsync(ct?)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Async version of Inject. Resolves secrets and injects them into the Environment.

```APIDOC
## EnvilderBuilder.InjectAsync(ct?)

### Description
Async version of Inject. Resolves secrets and injects them into the Environment.

### Method
InjectAsync

### Parameters
- **ct** (CancellationToken) - Optional - Cancellation token.

### Returns
Task
```

--------------------------------

### Push with explicit file paths

Source: https://github.com/macalbert/envilder/blob/main/docs/push-command.md

Specifies explicit paths for the environment file and mapping file.

```bash
envilder --push --envfile=.env --map=envilder.json
```

--------------------------------

### Generate .env file with npx envilder

Source: https://github.com/macalbert/envilder/blob/main/README.md

Generates the .env file using the default mapping file (envilder.json) and output file (.env). Secrets are pulled from AWS SSM and written to .env. Add .env to .gitignore.

```bash
npx envilder
```

--------------------------------

### Multi-Environment GitHub Actions Workflow with Envilder

Source: https://github.com/macalbert/envilder/blob/main/docs/github-action.md

A GitHub Actions workflow that uses a workflow_dispatch input to select the target environment (dev, staging, production). It configures AWS credentials, pulls environment-specific secrets using the Envilder action, and then builds and deploys the application.

```yaml
name: 🌍 Deploy to Environment

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy'
        required: true
        type: choice
        options:
          - dev
          - staging
          - production

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}

    steps:
      - uses: actions/checkout@v5

      - uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region: us-east-1

      - name: 🔐 Pull ${{ inputs.environment }} secrets
        uses: macalbert/envilder/github-action@v0
        with:
          map-file: config/${{ inputs.environment }}/envilder.json
          env-file: .env

      - uses: actions/setup-node@v6
        with:
          node-version: "22.x"
          cache: "pnpm"

      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - run: pnpm deploy
```

--------------------------------

### Fluent builder for runtime overrides

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/python/README.md

Use the fluent builder to override provider settings or profiles at runtime.

```python
from envilder import Envilder, SecretProviderType

# Override provider + vault URL
secrets = (
    Envilder.from_map_file('envilder.json')
    .with_provider(SecretProviderType.AZURE)
    .with_vault_url('https://my-vault.vault.azure.net')
    .resolve()
)

# Override AWS profile and inject
(
    Envilder.from_map_file('envilder.json')
    .with_profile('staging')
    .inject()
)
```

--------------------------------

### Multi-Environment Deployment with workflow_dispatch

Source: https://github.com/macalbert/envilder/blob/main/github-action/README.md

Workflow that uses workflow_dispatch with an environment choice input to deploy to dev, staging, or production. The action pulls secrets from environment-specific map and env files.

```yaml
name: 🌍 Deploy to Environment

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy'
        required: true
        type: choice
        options:
          - dev
          - staging
          - production

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}

    steps:
      - uses: actions/checkout@v5

      - uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region: us-east-1

      - name: 🔐 Pull ${{ inputs.environment }} secrets
        uses: macalbert/envilder/github-action@v0
        with:
          map-file: config/${{ inputs.environment }}/envilder.json
          env-file: .env.${{ inputs.environment }}

      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - run: pnpm deploy
```

--------------------------------

### EnvilderBuilder.WithVaultUrl(url)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Overrides the Azure Key Vault URL.

```APIDOC
## EnvilderBuilder.WithVaultUrl(url)

### Description
Overrides the Azure Key Vault URL.

### Method
WithVaultUrl

### Parameters
- **url** (string) - Required - The Azure Key Vault URL.

### Returns
EnvilderBuilder
```

--------------------------------

### Env.ResolveFileAsync(path, ct?)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Async version of ResolveFile. Resolves secrets from the specified file path and returns them as an IReadOnlyDictionary.

```APIDOC
## Env.ResolveFileAsync(path, ct?)

### Description
Async version of ResolveFile. Resolves secrets from the specified file path and returns them as an IReadOnlyDictionary.

### Method
ResolveFileAsync

### Parameters
- **path** (string) - Required - The path to the secrets file.
- **ct** (CancellationToken) - Optional - Cancellation token.

### Returns
Task<IReadOnlyDictionary>
```

--------------------------------

### Configuration priority order

Source: https://github.com/macalbert/envilder/blob/main/README.md

Shows the precedence: CLI flags and GitHub Action inputs override $config values, which override defaults (AWS).

```txt
CLI flags / GHA inputs  >  $config in map file  >  defaults (AWS)
```

--------------------------------

### Pull command with AWS profile

Source: https://github.com/macalbert/envilder/blob/main/docs/pull-command.md

Runs the pull command with an AWS profile to select credentials.

```bash
envilder --map=envilder.json --envfile=.env --profile=dev-account
```

--------------------------------

### Parameter Mapping File (Azure Key Vault)

Source: https://github.com/macalbert/envilder/blob/main/github-action/README.md

JSON mapping file for Azure Key Vault. Uses optional $config section to declare provider and vault URL. Secret names are normalized to alphanumeric and hyphens.

```json
{
  "$schema": "https://envilder.com/schema/map-file.v1.json",
  "$config": {
    "provider": "azure",
    "vaultUrl": "https://my-vault.vault.azure.net"
  },
  "DATABASE_URL": "myapp-prod-database-url",
  "API_KEY": "myapp-prod-api-key",
  "SECRET_TOKEN": "myapp-prod-secret-token"
}
```

--------------------------------

### Azure Key Vault push via map file

Source: https://github.com/macalbert/envilder/blob/main/docs/push-command.md

Runs push mode targeting Azure Key Vault using a map file with $config.

```bash
envilder --push --envfile=.env --map=envilder.azure.json
```

--------------------------------

### Fluent builder with runtime overrides

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Use the fluent builder to override map file configurations like providers or profiles at runtime.

```csharp
using Envilder;

// Override provider + vault URL
var secrets = Env.FromMapFile("envilder.json")
    .WithProvider(SecretProviderType.Azure)
    .WithVaultUrl("https://my-vault.vault.azure.net")
    .Resolve();

// Override AWS profile and inject
Env.FromMapFile("envilder.json")
    .WithProfile("staging")
    .Inject();

// Async versions
var secrets = await Env.FromMapFile("envilder.json")
    .WithProvider(SecretProviderType.Azure)
    .WithVaultUrl("https://my-vault.vault.azure.net")
    .ResolveAsync();

await Env.FromMapFile("envilder.json")
    .WithProfile("staging")
    .InjectAsync();
```

--------------------------------

### Env.ResolveFile(path)

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Resolves secrets from the specified file path and returns them as an IReadOnlyDictionary.

```APIDOC
## Env.ResolveFile(path)

### Description
Resolves secrets from the specified file path and returns them as an IReadOnlyDictionary.

### Method
ResolveFile

### Parameters
- **path** (string) - Required - The path to the secrets file.

### Returns
IReadOnlyDictionary
```

--------------------------------

### Resolve and inject secrets

Source: https://github.com/macalbert/envilder/blob/main/src/sdks/dotnet/README.md

Use Env.Load to resolve secrets from a map file and inject them directly into the environment variables.

```csharp
using Envilder;

// Resolve secrets from the map file and inject into Environment
Env.Load("envilder.json");

// Access via standard environment variable API
var dbPassword = Environment.GetEnvironmentVariable("DB_PASSWORD");
```