A view-less Laravel engine for reading and safely editing .env files — one code path behind a programmatic API, a CLI, and an interactive TUI.

laranail/env-kit-headless is the engine of the EnvKit family. Every mutation flows through one transactional, atomic, guarded, audited commit path — whether you call it from a controller, an Artisan command, or the interactive editor. It never renders HTML or handles HTTP; the env-kit-webui companion drives this engine for the web.

use Simtabi\Laranail\EnvKit\Headless\Facades\EnvKit;

EnvKit::set('MAIL_HOST', 'smtp.acme.test');   // atomic · backed-up · audited
$debug = EnvKit::getBool('APP_DEBUG', false);  // typed read

Editing .env from code is deceptively risky: a half-written file, a clobbered concurrent edit, a leaked secret in a log, or an accidental production write. EnvKit makes those failure modes impossible by construction:

• Format-preserving — comments, blank lines, quoting, ordering, EOL and BOM all survive a round-trip (conformant with vlucas/phpdotenv).
• Atomic & self-healing — write to a temp file, fsync, rename; verify the result and auto-rollback on mismatch. Optimistic concurrency rejects clobbering writes.
• Secret-safe — secret-shaped values are redacted from logs, exceptions, audit records and events. Optional per-value encryption-at-rest, plus cryptographic secret generators (token/hex/base64/app_key).
• Validated — declare a schema (config-seeded or fluent) and gate CI/deploys on EnvKit::assertValid() or env:validate. Keep .env aligned with its .env.example via env:sync / env:check.
• Guarded — production-write protection and a layered protected/hidden/editable key policy on every surface (programmatic, CLI, TUI), plus a pluggable authorization gate + write observers. Every CLI command prints a PRODUCTION … banner when APP_ENV=production.
• Observable — a full lifecycle event set (redacted, actor-attributed) and opt-in operator notifications.
• Open/Closed — reshape the engine from your own service provider with zero source edits (fluent DSL, Macroable, driver registry, pipeline middleware, container tags).

composer require laranail/env-kit-headless

Requires PHP 8.4.1+ and Laravel 13. The service provider and EnvKit facade auto-register. Publish the config if you want to tune it:

php artisan vendor:publish --tag=env-kit-config

See docs/installation.md for details.

Programmatic — Facade, DI of EnvKitInterface, or the env_kit() helper:

EnvKit::set('FEATURE_X', 'true');
EnvKit::transaction(fn ($s) => $s->set('A', '1')->set('B', '2')); // one commit
$value = env_kit('APP_NAME', 'Laravel');

Migrating off jackiedo/dotenv-editor? EnvKit exposes the jackiedo-named aliases (getValue/setKey/deleteKey/…) and a drop-in Compat\DotenvEditor facade, so existing call sites move over with a class swap — see Programmatic API.

CLI — 23 commands under laranail::env-kit-headless.*, each with a short env:* alias:

php artisan env:set MAIL_HOST=smtp.acme.test
php artisan env:get APP_NAME
php artisan env:doctor          # health-check rules
php artisan env:export --format=json --output=env.json   # also csv / dotenv / yaml

TUI — an interactive editor on laravel/prompts:

php artisan env:edit

// config/env-kit.php (excerpt)
'auto_commit'       => true,                       // immediate writes
'auto_backup'       => true,                       // snapshot before each write
'protect_production'=> true,                       // block prod writes unless overridden
'protected_keys'    => ['APP_KEY', 'DB_PASSWORD'], // never writable
'hidden_keys'       => ['*_PASSWORD', '*_SECRET'], // masked in listings
'audit'             => ['enabled' => true],
'encryption'        => ['driver' => 'laravel'],

Full reference: docs/configuration.md.

The rendered docs live at https://opensource.simtabi.com/env-kit-headless/docs/.

EnvKit handles secrets. Secret-shaped values never reach logs, exception messages, audit records, or events. Found a vulnerability? See SECURITY.md — report privately to opensource@simtabi.com.

PRs welcome — see CONTRIBUTING.md. Run vendor/bin/pest, vendor/bin/phpstan analyse (level 9), and vendor/bin/pint before submitting.

MIT © Simtabi LLC. See LICENSE.