@dotenvx/dotenvx 1.61.6 → 1.63.0

package/CHANGELOG.md

@@ -2,7 +2,43 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.61.6...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.63.0...main)
+
+## [1.63.0](https://github.com/dotenvx/dotenvx/compare/v1.62.0...v1.63.0) (2026-04-24)
+
+### Added
+
+* Add support for encrypted values passed to `--env` flag ([#804](https://github.com/dotenvx/dotenvx/pull/804))
+* Add support for `--format=colon` in order to support cloudflare's wrangler `--var` flag format ([#804](https://github.com/dotenvx/dotenvx/pull/804))
+
+## [1.62.0](https://github.com/dotenvx/dotenvx/compare/v1.61.6...v1.62.0) (2026-04-23)
+
+### Added
+
+* Add support for `config({ envs })`. unlocks simpler cloudflare worker integration ([#803](https://github.com/dotenvx/dotenvx/pull/803))
+
+```js
+// src/index.js
+import envSrc from '../.env.txt'
+import dotenvx from '@dotenvx/dotenvx'
+
+const config = dotenvx.config({ envs: [{ type: 'env', value: envSrc, privateKeyName: 'DOTENV_PRIVATE_KEY' }] })
+const envx = config.parsed
+
+export default {
+  async fetch(request, env, ctx) {
+    return new Response(`Hello ${envx.HELLO}`)
+  }
+}
+```
+```json
+"scripts": {
+  "deploy": "wrangler deploy",
+  "dev": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
+  "start": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
+  "test": "vitest"
+},
+```
 
 ## [1.61.6](https://github.com/dotenvx/dotenvx/compare/v1.61.5...v1.61.6) (2026-04-23)
 

package/README.md

@@ -150,6 +150,28 @@ $ dotenvx run -- npx tsx index.ts
 Hello Dotenvx
 ```
 
+</details>
+<details><summary>Cloudflare Workers ⛅️</summary><br>
+
+```sh
+cp .env .env.txt
+```
+
+```js
+import envSrc from '../.env.txt' // txt so cloudflare includes it in deployment
+import dotenvx from '@dotenvx/dotenvx'
+
+// use `wrangler secret put DOTENV_PRIVATE_KEY` to set decryption key once
+const config = dotenvx.config({ envs: [{ type: 'env', value: envSrc, privateKeyName: 'DOTENV_PRIVATE_KEY' }] })
+const envx = config.parsed
+
+export default {
+  async fetch(request, env, ctx) {
+    return new Response(`Hello ${envx.HELLO}`)
+  }
+}
+```
+
 </details>
 <details><summary>Deno 🦕</summary><br>
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.61.6",
+  "version": "1.63.0",
   "name": "@dotenvx/dotenvx",
   "description": "secrets for agents–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/get.js

@@ -66,6 +66,14 @@ async function get (key) {
         }
         inline = inline.trim()
 
+        console.log(inline)
+      } else if (options.format === 'colon') {
+        let inline = ''
+        for (const [key, value] of Object.entries(parsed)) {
+          inline += `${key}:${value} `
+        }
+        inline = inline.trim()
+
         console.log(inline)
       } else {
         let space = 0

package/src/cli/actions/keypair.js

@@ -22,11 +22,18 @@ async function keypair (key) {
 
   if (spinner) spinner.stop()
   if (typeof results === 'object' && results !== null) {
-    // inline shell format - env $(dotenvx keypair --format=shell) your-command
     if (options.format === 'shell') {
       let inline = ''
-      for (const [key, value] of Object.entries(results)) {
-        inline += `${key}=${value || ''} `
+      for (const [keyName, value] of Object.entries(results)) {
+        inline += `${keyName}=${value || ''} `
+      }
+      inline = inline.trim()
+
+      console.log(inline)
+    } else if (options.format === 'colon') {
+      let inline = ''
+      for (const [keyName, value] of Object.entries(results)) {
+        inline += `${keyName}:${value || ''} `
       }
       inline = inline.trim()
 
@@ -44,6 +51,8 @@ async function keypair (key) {
     if (results === undefined) {
       console.log('')
       process.exit(1)
+    } else if (options.format === 'colon' && key) {
+      console.log(`${key}:${results}`)
     } else {
       console.log(results)
     }

package/src/cli/actions/run.js

@@ -8,6 +8,7 @@ const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
 
 const conventions = require('./../../lib/helpers/conventions')
+const { determine } = require('./../../lib/helpers/envResolution')
 
 async function run () {
   const options = this.opts()
@@ -45,6 +46,7 @@ async function run () {
     } else {
       envs = this.envs
     }
+    envs = determine(envs, process.env)
 
     const {
       processedEnvs,

package/src/cli/dotenvx.js

@@ -92,7 +92,7 @@ program.command('get')
   .option('-a, --all', 'include all machine envs as well')
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
-  .option('--format <type>', 'format of the output (json, shell, eval)', 'json')
+  .option('--format <type>', 'format of the output (json, shell, colon, eval)', 'json')
   .option('--no-ops', 'disable dotenvx-ops features')
   .action(function (...args) {
     this.envs = envs
@@ -171,7 +171,7 @@ program.command('keypair')
   .option('--no-ops', 'disable dotenvx-ops features')
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
-  .option('--format <type>', 'format of the output (json, shell)', 'json')
+  .option('--format <type>', 'format of the output (json, shell, colon)', 'json')
   .action(function (...args) {
     return require('./actions/keypair').apply(this, args)
   })

package/src/lib/extensions/ops.js

@@ -1,6 +1,7 @@
 const path = require('path')
 const childProcess = require('child_process')
 const util = require('util')
+const { logger } = require('../../shared/logger')
 
 const execFile = util.promisify(childProcess.execFile)
 
@@ -98,6 +99,8 @@ class Ops {
   }
 
   _execSync (binary, args) {
+    logger.debug(binary)
+    logger.debug(args)
     return childProcess.execFileSync(binary, args).toString().trim()
   }
 
@@ -130,13 +133,17 @@ class Ops {
       this._execSync(npmBin, ['--version'])
       this._binarySync = npmBin
       return this._binarySync
-    } catch (_e) {}
+    } catch (err) {
+      logger.debug(err.message)
+    }
 
     try {
       this._execSync('dotenvx-ops', ['--version'])
       this._binarySync = 'dotenvx-ops'
       return this._binarySync
-    } catch (_e) {}
+    } catch (err) {
+      logger.debug(err.message)
+    }
 
     this._binarySync = null
     return null

package/src/lib/helpers/buildEnvs.js

@@ -2,6 +2,10 @@ const conventions = require('./conventions')
 const dotenvOptionPaths = require('./dotenvOptionPaths')
 
 function buildEnvs (options) {
+  if (options.envs) {
+    return options.envs
+  }
+
   // build envs using user set option.path
   const optionPaths = dotenvOptionPaths(options) // [ '.env' ]
 

package/src/lib/helpers/canonicalEnvFilename.js

@@ -0,0 +1,13 @@
+const path = require('path')
+
+function canonicalEnvFilename (filepath) {
+  let filename = path.basename(filepath).toLowerCase()
+
+  if (filename.startsWith('.env') && filename.endsWith('.txt')) {
+    filename = filename.slice(0, -4)
+  }
+
+  return filename
+}
+
+module.exports = canonicalEnvFilename

package/src/lib/helpers/envResolution/environment.js

@@ -1,7 +1,7 @@
-const path = require('path')
+const canonicalEnvFilename = require('./../canonicalEnvFilename')
 
 function environment (filepath) {
-  const filename = path.basename(filepath).toLowerCase()
+  const filename = canonicalEnvFilename(filepath)
 
   const parts = filename.split('.')
   const possibleEnvironmentList = [...parts.slice(2)]

package/src/lib/helpers/keyResolution/index.js

@@ -2,6 +2,7 @@ module.exports = {
   keyNames: require('./keyNames'),
   keyValues: require('./keyValues'),
   keyValuesSync: require('./keyValuesSync'),
+  keyValuesFromEnvSrc: require('./keyValuesFromEnvSrc'),
 
   // private
   // private keys are resolved via keyValuesSync()

package/src/lib/helpers/keyResolution/keyNames.js

@@ -1,8 +1,8 @@
-const path = require('path')
+const canonicalEnvFilename = require('./../canonicalEnvFilename')
 const environment = require('./../envResolution/environment')
 
 function keyNames (filepath) {
-  const filename = path.basename(filepath).toLowerCase()
+  const filename = canonicalEnvFilename(filepath)
 
   // .env
   if (filename === '.env') {

package/src/lib/helpers/keyResolution/keyValuesFromEnvSrc.js

@@ -0,0 +1,66 @@
+const path = require('path')
+
+const dotenvParse = require('./../dotenvParse')
+const readFileKeySync = require('./readFileKeySync')
+const opsKeypairSync = require('../cryptography/opsKeypairSync')
+
+const PUBLIC_KEY_SCHEMA = 'DOTENV_PUBLIC_KEY'
+const PRIVATE_KEY_SCHEMA = 'DOTENV_PRIVATE_KEY'
+
+function readProcessKey (processEnv, keyName) {
+  if (processEnv[keyName] && processEnv[keyName].length > 0) {
+    return processEnv[keyName]
+  }
+}
+
+function publicKeyNameFromEnvSrc (envParsed) {
+  for (const keyName of Object.keys(envParsed)) {
+    if (keyName === PUBLIC_KEY_SCHEMA || keyName.startsWith(PUBLIC_KEY_SCHEMA)) {
+      return keyName
+    }
+  }
+
+  return null
+}
+
+function keyValuesFromEnvSrc (src, privateKeyName = null, opts = {}) {
+  let keysFilepath = opts.keysFilepath || null
+  const noOps = opts.noOps === true
+  const processEnv = opts.processEnv || process.env
+  const envParsed = dotenvParse(src)
+
+  const publicKeyName = publicKeyNameFromEnvSrc(envParsed)
+  const publicKeyValue = publicKeyName ? readProcessKey(processEnv, publicKeyName) || envParsed[publicKeyName] || null : null
+
+  if (!privateKeyName && publicKeyName) {
+    privateKeyName = publicKeyName.replace(PUBLIC_KEY_SCHEMA, PRIVATE_KEY_SCHEMA)
+  }
+
+  let privateKeyValue = null
+  if (privateKeyName) {
+    privateKeyValue = readProcessKey(processEnv, privateKeyName)
+
+    if (!privateKeyValue) {
+      if (keysFilepath) {
+        keysFilepath = path.resolve(keysFilepath)
+      } else {
+        keysFilepath = path.resolve('.env.keys')
+      }
+
+      privateKeyValue = readFileKeySync(privateKeyName, keysFilepath)
+    }
+  }
+
+  if (!noOps && !privateKeyValue && publicKeyValue && publicKeyValue.length > 0) {
+    const kp = opsKeypairSync(publicKeyValue)
+    privateKeyValue = kp.privateKey
+  }
+
+  return {
+    publicKeyValue: publicKeyValue || null,
+    privateKeyValue: privateKeyValue || null,
+    privateKeyName: privateKeyName || null
+  }
+}
+
+module.exports = keyValuesFromEnvSrc

package/src/lib/main.d.ts

@@ -50,6 +50,15 @@ export function parse<T extends DotenvParseOutput = DotenvParseOutput>(
 ): T;
 
 export interface DotenvConfigOptions {
+  /**
+   * Specify explicit env sources. When set, `path` and `convention` are ignored.
+   *
+   * @default undefined
+   * @example require('@dotenvx/dotenvx').config({ envs: [{ type: 'envFile', value: '.env' }] })
+   * @example require('@dotenvx/dotenvx').config({ envs: [{ type: 'env', value: 'HELLO=World', privateKeyName: 'DOTENV_PRIVATE_KEY' }] })
+   */
+  envs?: DotenvConfigEnv[];
+
   /**
    * Specify a custom path if your file containing environment variables is located elsewhere.
    * Can also be an array of strings, specifying multiple paths.
@@ -161,6 +170,21 @@ export interface DotenvConfigOptions {
   opsOff?: boolean;
 }
 
+export type DotenvConfigEnv =
+  | DotenvConfigEnvFile
+  | DotenvConfigEnvSrc;
+
+export interface DotenvConfigEnvFile {
+  type: 'envFile';
+  value: string | URL;
+}
+
+export interface DotenvConfigEnvSrc {
+  type: 'env';
+  value: string | Buffer;
+  privateKeyName?: string;
+}
+
 export interface DotenvConfigOutput {
   error?: Error;
   parsed?: DotenvParseOutput;

package/src/lib/main.js

@@ -16,6 +16,7 @@ const Session = require('./../db/session')
 
 // helpers
 const buildEnvs = require('./helpers/buildEnvs')
+const { determine } = require('./helpers/envResolution')
 const Parse = require('./helpers/parse')
 const fsx = require('./helpers/fsx')
 const localDisplayPath = require('./helpers/localDisplayPath')
@@ -50,7 +51,10 @@ const config = function (options = {}) {
   const noOps = resolveNoOps(options)
 
   try {
-    const envs = buildEnvs(options)
+    let envs = buildEnvs(options)
+    if (!options.envs) {
+      envs = determine(envs, processEnv)
+    }
     const {
       processedEnvs,
       readableFilepaths,
@@ -272,6 +276,14 @@ const get = function (key, options = {}) {
       }
       inline = inline.trim()
 
+      return inline
+    } else if (options.format === 'colon') {
+      let inline = ''
+      for (const [key, value] of Object.entries(parsed)) {
+        inline += `${key}:${value} `
+      }
+      inline = inline.trim()
+
       return inline
     } else {
       return parsed

package/src/lib/services/get.js

@@ -1,5 +1,6 @@
 const Run = require('./run')
 const Errors = require('./../helpers/errors')
+const { determine } = require('./../helpers/envResolution')
 
 class Get {
   constructor (key, envs = [], overload = false, all = false, envKeysFilepath = null, noOps = false) {
@@ -13,13 +14,15 @@ class Get {
 
   runSync () {
     const processEnv = { ...process.env }
-    const { processedEnvs } = new Run(this.envs, this.overload, processEnv, this.envKeysFilepath, this.noOps).runSync()
+    const envs = determine(this.envs, processEnv)
+    const { processedEnvs } = new Run(envs, this.overload, processEnv, this.envKeysFilepath, this.noOps).runSync()
     return this._result(processedEnvs, processEnv)
   }
 
   async run () {
     const processEnv = { ...process.env }
-    const { processedEnvs } = await new Run(this.envs, this.overload, processEnv, this.envKeysFilepath, this.noOps).run()
+    const envs = determine(this.envs, processEnv)
+    const { processedEnvs } = await new Run(envs, this.overload, processEnv, this.envKeysFilepath, this.noOps).run()
     return this._result(processedEnvs, processEnv)
   }
 

package/src/lib/services/run.js

@@ -12,16 +12,13 @@ const detectEncodingSync = require('./../helpers/detectEncodingSync')
 const {
   keyNames,
   keyValues,
-  keyValuesSync
+  keyValuesSync,
+  keyValuesFromEnvSrc
 } = require('./../helpers/keyResolution')
 
-const {
-  determine
-} = require('./../helpers/envResolution')
-
 class Run {
   constructor (envs = [], overload = false, processEnv = process.env, envKeysFilepath = null, noOps = false) {
-    this.envs = determine(envs, processEnv)
+    this.envs = envs
     this.overload = overload
     this.processEnv = processEnv
     this.envKeysFilepath = envKeysFilepath
@@ -46,7 +43,7 @@ class Run {
       if (env.type === TYPE_ENV_FILE) {
         this._injectEnvFileSync(env.value)
       } else if (env.type === TYPE_ENV) {
-        this._injectEnv(env.value)
+        this._injectEnv(env.value, env.privateKeyName)
       }
     }
 
@@ -72,7 +69,7 @@ class Run {
       if (env.type === TYPE_ENV_FILE) {
         await this._injectEnvFile(env.value)
       } else if (env.type === TYPE_ENV) {
-        this._injectEnv(env.value)
+        this._injectEnv(env.value, env.privateKeyName)
       }
     }
 
@@ -86,19 +83,26 @@ class Run {
     }
   }
 
-  _injectEnv (env) {
+  _injectEnv (env, privateKeyName = null) {
     const row = {}
     row.type = TYPE_ENV
     row.string = env
 
     try {
+      const {
+        privateKeyName: resolvedPrivateKeyName,
+        privateKeyValue
+      } = keyValuesFromEnvSrc(env, privateKeyName, { keysFilepath: this.envKeysFilepath, noOps: this.noOps, processEnv: this.processEnv })
+
       const {
         parsed,
         errors,
         injected,
         preExisted
-      } = new Parse(env, null, this.processEnv, this.overload).run()
+      } = new Parse(env, privateKeyValue, this.processEnv, this.overload, resolvedPrivateKeyName).run()
 
+      row.privateKeyName = resolvedPrivateKeyName
+      row.privateKey = privateKeyValue
       row.parsed = parsed
       row.errors = errors
       row.injected = injected