New Research: Supply Chain Attack on Axios Pulls Malicious Dependency from npm.Details
Socket
Book a DemoSign in
Socket

envtrue

Package Overview
Dependencies
Maintainers
1
Versions
2
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

envtrue

Type-safe environment variables. Loads .env files, validates with Zod/Valibot/ArkType, auto-coerces types. Drop-in dotenv replacement.

latest
Source
npmnpm
Version
0.1.1
Version published
Maintainers
1
Created
Source

envtrue

Type-safe environment variables. Loads .env files, validates with Zod/Valibot/ArkType, auto-coerces types. Drop-in dotenv replacement.

npm version npm downloads license

The problem

  • process.env is string | undefined, so you lose types immediately.
  • Missing or malformed variables fail at runtime, often far away from startup.
  • Client bundles can accidentally expose server secrets if env handling is ad hoc.

Install

npm install envtrue zod
pnpm add envtrue zod
yarn add envtrue zod

Quick start

import { createEnv } from "envtrue";
import { z } from "zod";

const env = createEnv({
  server: {
    DATABASE_URL: z.string().url(),
    PORT: z.number(),        // auto-coerced from "3000" → 3000
    API_KEY: z.string().min(1),
  },
  client: {
    API_BASE: z.string().url(),
  },
  clientPrefix: "NEXT_PUBLIC_"
});

const db: string = env.DATABASE_URL;  // typed as string
await connect(db, { port: env.PORT }); // typed as number
fetch(env.API_BASE);

Why not t3-env?

Featureenvtruet3-env
Loads .env files for you
Auto-coerces z.number(), z.boolean(), z.array()
No runtimeEnv boilerplate
Framework-agnostic core⚠️

envtrue is optimized for the common case: read .env, merge with runtime env, coerce strings into the right primitives, validate once, return typed values. No extra runtime mapping step.

Why not the DIY Zod pattern?

The usual Zod setup is a small pile of repeated glue:

  • Load .env yourself
  • Merge sources manually
  • Remember to coerce strings before validation
  • Split public and private variables by convention
  • Build readable startup errors yourself

envtrue keeps the schema but removes the glue. It auto-loads .env and .env.local, auto-coerces string inputs, separates client variables by prefix, and throws one formatted error with every invalid variable listed at once.

Framework adapters

AdapterImportNotes
Next.jsimport { createNextEnv } from "envtrue/nextjs"Uses NEXT_PUBLIC_, skips server validation in browser bundles, skips validation during Next build phases when needed
Viteimport { createViteEnv } from "envtrue/vite"Uses VITE_, works with import.meta.env or process.env
Honoimport { createHonoEnv } from "envtrue/hono"Server-only, supports explicit env bindings such as Cloudflare Workers / c.env

API reference

createEnv(options)

createEnv({
  server,
  client,
  clientPrefix,
  envFiles,
  cwd,
  env,
  skipValidation,
  onError
})
OptionTypeDefaultDescription
serverSchemaShape{}Server-only environment schema
clientSchemaShape{}Client-safe environment schema
clientPrefixstring"NEXT_PUBLIC_"Prefix required for client variables
envFilesstring | string[][".env", ".env.local"].env files to load, in merge order
cwdstringprocess.cwd()Base directory used to resolve envFiles
envRecord<string, string | undefined>process.envExplicit runtime env source override
skipValidationbooleanfalseSkip schema validation and return coerced raw values
onError(errors: EnvError[]) => voidthrows formatted errorHook for custom error handling

Validation flow

  • Load .env files from disk.
  • Merge loaded values with runtime env. Runtime env wins.
  • Coerce string values before validation.
  • Validate server and client schemas.
  • Throw one aggregated error if anything is invalid.
  • Return a frozen typed object.

Supported schemas

  • Zod raw shapes
  • Standard Schema compatible shapes (Valibot, ArkType)

ArkType is supported through Standard Schema compatibility, but is not currently covered by the test suite.

Roadmap

  • Monorepo support
  • Encrypted .env support with dotenvx compatibility
  • VS Code extension for .env autocomplete and intellisense

License

MIT

Keywords

dotenv

FAQs

Package last updated on 22 Mar 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts