@dotenvx/dotenvx 1.62.0 → 1.64.0

package/CHANGELOG.md

@@ -2,7 +2,26 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.62.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.64.0...main)
+
+## [1.64.0](https://github.com/dotenvx/dotenvx/compare/v1.63.0...v1.64.0) (2026-04-27)
+
+### Added
+
+* Add optional `dotenvx armor` command.
+  * `armor up` armor private key
+  * `armor down` dearmor private key
+  * `armor push` push armored key (from .env.keys)
+  * `armor pull` pull armored key (into .env.keys)
+
+Move private keys off device and under access control with Dotenvx Ops ⛨. [Learn more](https://dotenvx.com/ops)
+
+## [1.63.0](https://github.com/dotenvx/dotenvx/compare/v1.62.0...v1.63.0) (2026-04-24)
+
+### Added
+
+* Add support for encrypted values passed to `--env` flag ([#804](https://github.com/dotenvx/dotenvx/pull/804))
+* Add support for `--format=colon` in order to support cloudflare's wrangler `--var` flag format ([#804](https://github.com/dotenvx/dotenvx/pull/804))
 
 ## [1.62.0](https://github.com/dotenvx/dotenvx/compare/v1.61.6...v1.62.0) (2026-04-23)
 
@@ -10,17 +29,30 @@ All notable changes to this project will be documented in this file. See [standa
 
 * Add support for `config({ envs })`. unlocks simpler cloudflare worker integration ([#803](https://github.com/dotenvx/dotenvx/pull/803))
 
+```sh
+$ dotenvx encrypt -f .env.txt
+```
 ```js
+// src/index.js
 import envSrc from '../.env.txt'
 import dotenvx from '@dotenvx/dotenvx'
 
+const config = dotenvx.config({ envs: [{ type: 'env', value: envSrc, privateKeyName: 'DOTENV_PRIVATE_KEY' }] })
+const envx = config.parsed
+
 export default {
   async fetch(request, env, ctx) {
-    dotenvx.config({ envs: [{ type: 'env', value: envSrc, privateKeyName: 'DOTENV_PRIVATE_KEY' }] processEnv: env })
-
-    return new Response(`Hello ${env.HELLO}`)
-  },
-};
+    return new Response(`Hello ${envx.HELLO}`)
+  }
+}
+```
+```json
+"scripts": {
+  "deploy": "wrangler deploy",
+  "dev": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
+  "start": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
+  "test": "vitest"
+},
 ```
 
 ## [1.61.6](https://github.com/dotenvx/dotenvx/compare/v1.61.5...v1.61.6) (2026-04-23)

package/README.md

@@ -150,6 +150,35 @@ $ dotenvx run -- npx tsx index.ts
 Hello Dotenvx
 ```
 
+</details>
+<details><summary>Cloudflare Workers ⛅️</summary><br>
+
+```sh
+$ dotenvx encrypt -f .env.txt
+```
+
+```js
+// src/index.js
+import envSrc from '../.env.txt'
+import dotenvx from '@dotenvx/dotenvx'
+
+const config = dotenvx.config({ envs: [{ type: 'env', value: envSrc, privateKeyName: 'DOTENV_PRIVATE_KEY' }] })
+const envx = config.parsed
+
+export default {
+  async fetch(request, env, ctx) {
+    return new Response(`Hello ${envx.HELLO}`)
+  }
+}
+```
+```json
+"scripts": {
+  "deploy": "wrangler deploy",
+  "dev": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
+  "start": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
+}
+```
+
 </details>
 <details><summary>Deno 🦕</summary><br>
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.62.0",
+  "version": "1.64.0",
   "name": "@dotenvx/dotenvx",
   "description": "secrets for agents–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/get.js

@@ -66,6 +66,14 @@ async function get (key) {
         }
         inline = inline.trim()
 
+        console.log(inline)
+      } else if (options.format === 'colon') {
+        let inline = ''
+        for (const [key, value] of Object.entries(parsed)) {
+          inline += `${key}:${value} `
+        }
+        inline = inline.trim()
+
         console.log(inline)
       } else {
         let space = 0

package/src/cli/actions/keypair.js

@@ -22,11 +22,18 @@ async function keypair (key) {
 
   if (spinner) spinner.stop()
   if (typeof results === 'object' && results !== null) {
-    // inline shell format - env $(dotenvx keypair --format=shell) your-command
     if (options.format === 'shell') {
       let inline = ''
-      for (const [key, value] of Object.entries(results)) {
-        inline += `${key}=${value || ''} `
+      for (const [keyName, value] of Object.entries(results)) {
+        inline += `${keyName}=${value || ''} `
+      }
+      inline = inline.trim()
+
+      console.log(inline)
+    } else if (options.format === 'colon') {
+      let inline = ''
+      for (const [keyName, value] of Object.entries(results)) {
+        inline += `${keyName}:${value || ''} `
       }
       inline = inline.trim()
 
@@ -44,6 +51,8 @@ async function keypair (key) {
     if (results === undefined) {
       console.log('')
       process.exit(1)
+    } else if (options.format === 'colon' && key) {
+      console.log(`${key}:${results}`)
     } else {
       console.log(results)
     }

package/src/cli/dotenvx.js

@@ -92,7 +92,7 @@ program.command('get')
   .option('-a, --all', 'include all machine envs as well')
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
-  .option('--format <type>', 'format of the output (json, shell, eval)', 'json')
+  .option('--format <type>', 'format of the output (json, shell, colon, eval)', 'json')
   .option('--no-ops', 'disable dotenvx-ops features')
   .action(function (...args) {
     this.envs = envs
@@ -171,7 +171,7 @@ program.command('keypair')
   .option('--no-ops', 'disable dotenvx-ops features')
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
-  .option('--format <type>', 'format of the output (json, shell)', 'json')
+  .option('--format <type>', 'format of the output (json, shell, colon)', 'json')
   .action(function (...args) {
     return require('./actions/keypair').apply(this, args)
   })
@@ -197,13 +197,22 @@ program.command('login')
 
 // dotenvx logout
 program.command('logout', { hidden: true })
-  .description('optional: log out of your dotenvx account')
+  .description('log out of your dotenvx account')
   .allowUnknownOption()
   .action(() => {
     const rawArgs = ['ops', 'logout', ...process.argv.slice(3)]
     executeDynamic(program, 'ops', rawArgs)
   })
 
+// dotenvx armor
+program.command('armor', { hidden: true })
+  .description('ARMORED KEYS ⛨')
+  .allowUnknownOption()
+  .action((args) => {
+    const rawArgs = ['ops', 'armor', ...process.argv.slice(3)]
+    executeDynamic(program, 'ops', rawArgs)
+  })
+
 // dotenvx help
 program.command('help [command]')
   .description('display help for command')

package/src/lib/extensions/ops.js

@@ -1,6 +1,7 @@
 const path = require('path')
 const childProcess = require('child_process')
 const util = require('util')
+const { logger } = require('../../shared/logger')
 
 const execFile = util.promisify(childProcess.execFile)
 
@@ -98,6 +99,8 @@ class Ops {
   }
 
   _execSync (binary, args) {
+    logger.debug(binary)
+    logger.debug(args)
     return childProcess.execFileSync(binary, args).toString().trim()
   }
 
@@ -130,13 +133,17 @@ class Ops {
       this._execSync(npmBin, ['--version'])
       this._binarySync = npmBin
       return this._binarySync
-    } catch (_e) {}
+    } catch (err) {
+      logger.debug(err.message)
+    }
 
     try {
       this._execSync('dotenvx-ops', ['--version'])
       this._binarySync = 'dotenvx-ops'
       return this._binarySync
-    } catch (_e) {}
+    } catch (err) {
+      logger.debug(err.message)
+    }
 
     this._binarySync = null
     return null

package/src/lib/helpers/canonicalEnvFilename.js

@@ -0,0 +1,13 @@
+const path = require('path')
+
+function canonicalEnvFilename (filepath) {
+  let filename = path.basename(filepath).toLowerCase()
+
+  if (filename.startsWith('.env') && filename.endsWith('.txt')) {
+    filename = filename.slice(0, -4)
+  }
+
+  return filename
+}
+
+module.exports = canonicalEnvFilename

package/src/lib/helpers/envResolution/environment.js

@@ -1,7 +1,7 @@
-const path = require('path')
+const canonicalEnvFilename = require('./../canonicalEnvFilename')
 
 function environment (filepath) {
-  const filename = path.basename(filepath).toLowerCase()
+  const filename = canonicalEnvFilename(filepath)
 
   const parts = filename.split('.')
   const possibleEnvironmentList = [...parts.slice(2)]

package/src/lib/helpers/keyResolution/index.js

@@ -2,6 +2,7 @@ module.exports = {
   keyNames: require('./keyNames'),
   keyValues: require('./keyValues'),
   keyValuesSync: require('./keyValuesSync'),
+  keyValuesFromEnvSrc: require('./keyValuesFromEnvSrc'),
 
   // private
   // private keys are resolved via keyValuesSync()

package/src/lib/helpers/keyResolution/keyNames.js

@@ -1,8 +1,8 @@
-const path = require('path')
+const canonicalEnvFilename = require('./../canonicalEnvFilename')
 const environment = require('./../envResolution/environment')
 
 function keyNames (filepath) {
-  const filename = path.basename(filepath).toLowerCase()
+  const filename = canonicalEnvFilename(filepath)
 
   // .env
   if (filename === '.env') {

package/src/lib/helpers/keyResolution/keyValuesFromEnvSrc.js

@@ -0,0 +1,66 @@
+const path = require('path')
+
+const dotenvParse = require('./../dotenvParse')
+const readFileKeySync = require('./readFileKeySync')
+const opsKeypairSync = require('../cryptography/opsKeypairSync')
+
+const PUBLIC_KEY_SCHEMA = 'DOTENV_PUBLIC_KEY'
+const PRIVATE_KEY_SCHEMA = 'DOTENV_PRIVATE_KEY'
+
+function readProcessKey (processEnv, keyName) {
+  if (processEnv[keyName] && processEnv[keyName].length > 0) {
+    return processEnv[keyName]
+  }
+}
+
+function publicKeyNameFromEnvSrc (envParsed) {
+  for (const keyName of Object.keys(envParsed)) {
+    if (keyName === PUBLIC_KEY_SCHEMA || keyName.startsWith(PUBLIC_KEY_SCHEMA)) {
+      return keyName
+    }
+  }
+
+  return null
+}
+
+function keyValuesFromEnvSrc (src, privateKeyName = null, opts = {}) {
+  let keysFilepath = opts.keysFilepath || null
+  const noOps = opts.noOps === true
+  const processEnv = opts.processEnv || process.env
+  const envParsed = dotenvParse(src)
+
+  const publicKeyName = publicKeyNameFromEnvSrc(envParsed)
+  const publicKeyValue = publicKeyName ? readProcessKey(processEnv, publicKeyName) || envParsed[publicKeyName] || null : null
+
+  if (!privateKeyName && publicKeyName) {
+    privateKeyName = publicKeyName.replace(PUBLIC_KEY_SCHEMA, PRIVATE_KEY_SCHEMA)
+  }
+
+  let privateKeyValue = null
+  if (privateKeyName) {
+    privateKeyValue = readProcessKey(processEnv, privateKeyName)
+
+    if (!privateKeyValue) {
+      if (keysFilepath) {
+        keysFilepath = path.resolve(keysFilepath)
+      } else {
+        keysFilepath = path.resolve('.env.keys')
+      }
+
+      privateKeyValue = readFileKeySync(privateKeyName, keysFilepath)
+    }
+  }
+
+  if (!noOps && !privateKeyValue && publicKeyValue && publicKeyValue.length > 0) {
+    const kp = opsKeypairSync(publicKeyValue)
+    privateKeyValue = kp.privateKey
+  }
+
+  return {
+    publicKeyValue: publicKeyValue || null,
+    privateKeyValue: privateKeyValue || null,
+    privateKeyName: privateKeyName || null
+  }
+}
+
+module.exports = keyValuesFromEnvSrc

package/src/lib/main.js

@@ -276,6 +276,14 @@ const get = function (key, options = {}) {
       }
       inline = inline.trim()
 
+      return inline
+    } else if (options.format === 'colon') {
+      let inline = ''
+      for (const [key, value] of Object.entries(parsed)) {
+        inline += `${key}:${value} `
+      }
+      inline = inline.trim()
+
       return inline
     } else {
       return parsed

package/src/lib/services/run.js

@@ -12,7 +12,8 @@ const detectEncodingSync = require('./../helpers/detectEncodingSync')
 const {
   keyNames,
   keyValues,
-  keyValuesSync
+  keyValuesSync,
+  keyValuesFromEnvSrc
 } = require('./../helpers/keyResolution')
 
 class Run {
@@ -88,17 +89,20 @@ class Run {
     row.string = env
 
     try {
-      const privateKey = privateKeyName ? this.processEnv[privateKeyName] || null : null
+      const {
+        privateKeyName: resolvedPrivateKeyName,
+        privateKeyValue
+      } = keyValuesFromEnvSrc(env, privateKeyName, { keysFilepath: this.envKeysFilepath, noOps: this.noOps, processEnv: this.processEnv })
 
       const {
         parsed,
         errors,
         injected,
         preExisted
-      } = new Parse(env, privateKey, this.processEnv, this.overload, privateKeyName).run()
+      } = new Parse(env, privateKeyValue, this.processEnv, this.overload, resolvedPrivateKeyName).run()
 
-      row.privateKeyName = privateKeyName
-      row.privateKey = privateKey
+      row.privateKeyName = resolvedPrivateKeyName
+      row.privateKey = privateKeyValue
       row.parsed = parsed
       row.errors = errors
       row.injected = injected