@dotenvx/dotenvx 1.68.1 → 1.69.1

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.68.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.69.1...main)
+
+## [1.69.1](https://github.com/dotenvx/dotenvx/compare/v1.69.0...v1.69.1) (2026-05-25)
+
+### Changed
+
+* Internally rename `ops` to `vlt` ([#823](https://github.com/dotenvx/dotenvx/pull/823))
+
+## [1.69.0](https://github.com/dotenvx/dotenvx/compare/v1.68.1...v1.69.0) (2026-05-25)
+
+### Changed
+
+* Remove fully-deprecated `opsOff` option in favor of `noOps` ([#822](https://github.com/dotenvx/dotenvx/pull/822))
 
 ## [1.68.1](https://github.com/dotenvx/dotenvx/compare/v1.68.0...v1.68.1) (2026-05-24)
 
@@ -296,7 +308,7 @@ export default {
 
 ### Added
 
-* Add hint on `.env.keys` for `dotenvx ops backup`. Dotenvx Ops Backup lets you back up your private keys securely with just a single command. It's a convenient alterantive to manually copy/pasting them in and out of 1Password. ([#718](https://github.com/dotenvx/dotenvx/pull/718))
+* Add hint on `.env.keys` for `dotenvx armor up`. Dotenvx Armor lets you armor your private keys securely with just a single command. It's a convenient alternative to manually copy/pasting them in and out of 1Password. ([#718](https://github.com/dotenvx/dotenvx/pull/718))
 
 ## [1.51.2](https://github.com/dotenvx/dotenvx/compare/v1.51.1...v1.51.2) (2025-12-12)
 

package/README.md

@@ -1287,12 +1287,12 @@ $ dotenvx run -fk .env.keys -f apps/app1/.env -- yourcommand
 ```
 
 </details>
-<details><summary>`run --no-ops`</summary><br>
+<details><summary>`run --no-vlt`</summary><br>
 
-Turn off [Dotenvx Ops](https://dotenvx.com/ops) features.
+Turn off [Dotenvx Vlt Ops](https://dotenvx.com/vlt) features.
 
 ```sh
-$ dotenvx run --no-ops -- yourcommand
+$ dotenvx run --no-vlt -- yourcommand
 ```
 
 </details>
@@ -1622,12 +1622,12 @@ $ dotenvx encrypt -f .env.production
 ```
 
 </details>
-<details><summary>`encrypt --no-ops`</summary><br>
+<details><summary>`encrypt --no-vlt`</summary><br>
 
-Turn off [Dotenvx Ops](https://dotenvx.com/ops) features for encrypt.
+Turn off [Dotenvx Vlt Ops](https://dotenvx.com/vlt) features for encrypt.
 
 ```sh
-$ dotenvx encrypt --no-ops
+$ dotenvx encrypt --no-vlt
 ◈ encrypted (.env)
 ```
 
@@ -2548,13 +2548,13 @@ $ dotenvx run --convention=nextjs -- node index.js
 ```
 
 </details>
-<details><summary>`config(noOps:)` - noOps</summary><br>
+<details><summary>`config(noVlt:)` - noVlt</summary><br>
 
-Turn off [Dotenvx Ops](https://dotenvx.com/ops) features.
+Turn off [Dotenvx Vlt Ops](https://dotenvx.com/vlt) features.
 
 ```js
 // index.js
-require('@dotenvx/dotenvx').config({noOps: true})
+require('@dotenvx/dotenvx').config({noVlt: true})
 ```
 
 </details>
@@ -2650,17 +2650,17 @@ This is known as *Decryption at Access* and is written about in [the whitepaper]
 
 &nbsp;
 
-## Ops ⛨
+## Vlt Ops ⛨
 
-[![dotenvx-ops](https://dotenvx.com/dotenvx-ops-banner.png?v=6)](https://dotenvx.com/ops)
+[![dotenvx-vlt](https://dotenvx.com/dotenvx-vlt-banner.png)](https://dotenvx.com/vlt)
 
 ```
 ⛨ ARMORED KEYS: Harden your private keys.
-⮕ install [curl -sfS https://dotenvx.sh/ops | sh]
-⮕ then run [dotenvx-ops login]
+⮕ install [curl -sfS https://dotenvx.sh/vlt | sh]
+⮕ then run [dotenvx-vlt login]
 ```
 
-[Learn more](https://dotenvx.com/ops)
+[Learn more](https://dotenvx.com/vlt)
 
 &nbsp;
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.68.1",
+  "version": "1.69.1",
   "name": "@dotenvx/dotenvx",
   "description": "secrets for agents–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -35,8 +35,8 @@
   "scripts": {
     "standard": "standard",
     "standard:fix": "standard --fix",
-    "test": "tap run --test-env=DOTENVX_NO_OPS=true --allow-empty-coverage --disable-coverage --timeout=60000",
-    "test-coverage": "tap run --test-env=DOTENVX_NO_OPS=true --show-full-coverage --timeout=60000",
+    "test": "tap run --test-env=DOTENVX_NO_VLT=true --allow-empty-coverage --disable-coverage --timeout=60000",
+    "test-coverage": "tap run --test-env=DOTENVX_NO_VLT=true --show-full-coverage --timeout=60000",
     "testshell": "bash shellspec",
     "prerelease": "npm test && npm run testshell",
     "release": "standard-version"

package/src/cli/actions/decrypt.js

@@ -5,16 +5,17 @@ const Decrypt = require('./../../lib/services/decrypt')
 const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
+const normalizeVltOptions = require('./normalizeVltOptions')
 
 async function decrypt () {
-  const options = this.opts()
+  const options = normalizeVltOptions(this.opts())
   const spinner = await createSpinner({ ...options, text: 'decrypting' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
   const sesh = new Session()
   const envs = this.envs
-  const noOps = options.ops === false || (await sesh.noOps())
+  const noVlt = options.vlt === false || (await sesh.noVlt())
 
   let errorCount = 0
 
@@ -22,7 +23,7 @@ async function decrypt () {
   if (options.stdout) {
     const {
       processedEnvs
-    } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noOps).run()
+    } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noVlt).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       if (processedEnv.error) {
@@ -44,7 +45,7 @@ async function decrypt () {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noOps).run()
+      } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noVlt).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`decrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)

package/src/cli/actions/encrypt.js

@@ -8,21 +8,22 @@ const localDisplayPath = require('../../lib/helpers/localDisplayPath')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const prompts = require('../../lib/helpers/prompts')
 const Session = require('../../db/session')
+const normalizeVltOptions = require('./normalizeVltOptions')
 
 function keypairSpinnerHooks (spinner) {
-  let stoppedForOps = false
+  let stoppedForVlt = false
 
   return {
     onStderr: () => {
-      if (spinner && !stoppedForOps) {
+      if (spinner && !stoppedForVlt) {
         spinner.stop()
-        stoppedForOps = true
+        stoppedForVlt = true
       }
     },
     after: () => {
-      if (spinner && stoppedForOps) {
+      if (spinner && stoppedForVlt) {
         spinner.start('encrypting')
-        stoppedForOps = false
+        stoppedForVlt = false
       }
     }
   }
@@ -51,12 +52,12 @@ function keyStorageSelector (spinner) {
   }
 }
 
-function encryptOptions (spinner, noOps) {
+function encryptOptions (spinner, noVlt) {
   const options = {
     keypairHooks: keypairSpinnerHooks(spinner)
   }
 
-  if (!noOps) {
+  if (!noVlt) {
     options.selectKeyStorage = keyStorageSelector(spinner)
   }
 
@@ -64,21 +65,21 @@ function encryptOptions (spinner, noOps) {
 }
 
 async function encrypt () {
-  const options = this.opts()
+  const options = normalizeVltOptions(this.opts())
   const spinner = await createSpinner({ ...options, text: 'encrypting' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
   const sesh = new Session()
   const envs = this.envs
-  const noOps = options.ops === false || (!options.token && (await sesh.noOps()))
+  const noVlt = options.vlt === false || (!options.token && (await sesh.noVlt()))
   const noCreate = options.create === false
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
     const {
       processedEnvs
-    } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noOps, noCreate, options.token, encryptOptions(spinner, noOps)).run()
+    } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noVlt, noCreate, options.token, encryptOptions(spinner, noVlt)).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       console.log(processedEnv.envSrc)
@@ -90,7 +91,7 @@ async function encrypt () {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noOps, noCreate, options.token, encryptOptions(spinner, noOps)).run()
+      } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noVlt, noCreate, options.token, encryptOptions(spinner, noVlt)).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`encrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)

package/src/cli/actions/get.js

@@ -6,9 +6,10 @@ const catchAndLog = require('./../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
 const Get = require('./../../lib/services/get')
+const normalizeVltOptions = require('./normalizeVltOptions')
 
 async function get (key) {
-  const options = this.opts()
+  const options = normalizeVltOptions(this.opts())
   const spinner = await createSpinner({ ...options, text: 'decrypting' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
@@ -29,8 +30,8 @@ async function get (key) {
 
   try {
     const sesh = new Session()
-    const noOps = options.ops === false || (await sesh.noOps())
-    const { parsed, errors } = await new Get(key, envs, options.overload, options.all, options.envKeysFile, noOps).run()
+    const noVlt = options.vlt === false || (await sesh.noVlt())
+    const { parsed, errors } = await new Get(key, envs, options.overload, options.all, options.envKeysFile, noVlt).run()
 
     for (const error of errors || []) {
       if (options.strict) throw error // throw immediately if strict

package/src/cli/actions/keypair.js

@@ -3,9 +3,10 @@ const { logger } = require('./../../shared/logger')
 const Keypair = require('./../../lib/services/keypair')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
+const normalizeVltOptions = require('./normalizeVltOptions')
 
 async function keypair (key) {
-  const options = this.opts()
+  const options = normalizeVltOptions(this.opts())
   const spinner = await createSpinner({ ...options, text: 'retrieving' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
@@ -16,8 +17,8 @@ async function keypair (key) {
   const prettyPrint = options.prettyPrint || options.pp
 
   const sesh = new Session()
-  const noOps = options.ops === false || await sesh.noOps()
-  const keypairs = await new Keypair(options.envFile, options.envKeysFile, noOps).run()
+  const noVlt = options.vlt === false || await sesh.noVlt()
+  const keypairs = await new Keypair(options.envFile, options.envKeysFile, noVlt).run()
   const results = key ? keypairs[key] : keypairs
 
   if (spinner) spinner.stop()

package/src/cli/actions/normalizeVltOptions.js

@@ -0,0 +1,10 @@
+function normalizeVltOptions (options) {
+  if (options.ops === false || options.vlt === false) {
+    options.ops = false
+    options.vlt = false
+  }
+
+  return options
+}
+
+module.exports = normalizeVltOptions

package/src/cli/actions/rotate.js

@@ -7,22 +7,23 @@ const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const localDisplayPath = require('../../lib/helpers/localDisplayPath')
 const Session = require('../../db/session')
+const normalizeVltOptions = require('./normalizeVltOptions')
 
 async function rotate () {
-  const options = this.opts()
+  const options = normalizeVltOptions(this.opts())
   const spinner = await createSpinner({ ...options, text: 'rotating', frames: ['⟳', '⤾', '⥁'] })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
   const envs = this.envs
   const sesh = new Session()
-  const noOps = options.ops === false || (await sesh.noOps())
+  const noVlt = options.vlt === false || (await sesh.noVlt())
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
     const {
       processedEnvs
-    } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noOps).run()
+    } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noVlt).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       console.log(processedEnv.envSrc)
@@ -38,7 +39,7 @@ async function rotate () {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noOps).run()
+      } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noVlt).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`rotating ${processedEnv.envFilepath} (${processedEnv.filepath})`)

package/src/cli/actions/run.js

@@ -6,12 +6,13 @@ const Run = require('./../../lib/services/run')
 const catchAndLog = require('./../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
+const normalizeVltOptions = require('./normalizeVltOptions')
 
 const conventions = require('./../../lib/helpers/conventions')
 const { determine } = require('./../../lib/helpers/envResolution')
 
 async function run () {
-  const options = this.opts()
+  const options = normalizeVltOptions(this.opts())
   const commandArgs = this.args
   const spinner = await createSpinner({ ...options, text: 'injecting' })
 
@@ -21,7 +22,7 @@ async function run () {
   const ignore = options.ignore || []
 
   const sesh = new Session()
-  const noOps = options.ops === false || options.opsOff === true || (await sesh.noOps())
+  const noVlt = options.vlt === false || (await sesh.noVlt())
 
   if (commandArgs.length < 1) {
     if (spinner) spinner.stop()
@@ -53,7 +54,7 @@ async function run () {
       readableStrings,
       readableFilepaths,
       uniqueInjectedKeys
-    } = await new Run(envs, options.overload, process.env, options.envKeysFile, noOps, {
+    } = await new Run(envs, options.overload, process.env, options.envKeysFile, noVlt, {
       keypairHooks: {
         before: () => {
           if (spinner) spinner.start('retrieving')

package/src/cli/actions/set.js

@@ -6,9 +6,10 @@ const createSpinner = require('../../lib/helpers/createSpinner')
 const localDisplayPath = require('../../lib/helpers/localDisplayPath')
 const Session = require('../../db/session')
 const Sets = require('./../../lib/services/sets')
+const normalizeVltOptions = require('./normalizeVltOptions')
 
 async function set (key, value) {
-  const options = this.opts()
+  const options = normalizeVltOptions(this.opts())
 
   let encrypt = true
   let settingMessage = 'encrypting'
@@ -27,14 +28,14 @@ async function set (key, value) {
     const sesh = new Session()
     const envs = this.envs
     const envKeysFilepath = options.envKeysFile
-    const noOps = options.ops === false || (await sesh.noOps())
+    const noVlt = options.vlt === false || (await sesh.noVlt())
     const noCreate = options.create === false
 
     const {
       processedEnvs,
       changedFilepaths,
       unchangedFilepaths
-    } = await new Sets(key, value, envs, encrypt, envKeysFilepath, noOps, noCreate).run()
+    } = await new Sets(key, value, envs, encrypt, envKeysFilepath, noVlt, noCreate).run()
 
     let withEncryption = ''
 

package/src/cli/dotenvx.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 /* c8 ignore start */
-const { Command, Option } = require('commander')
+const { Command } = require('commander')
 const program = new Command()
 
 const { setLogLevel, logger } = require('../shared/logger')
@@ -43,7 +43,7 @@ program
     setLogLevel(options)
   })
 
-// for dynamic loading of dotenvx-ops, etc
+// for dynamic loading of dotenvx-vlt, etc
 program
   .argument('[command]', 'dynamic command')
   .argument('[args...]', 'dynamic command arguments')
@@ -71,7 +71,7 @@ program.command('run')
   .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
   .option('--no-ops', 'disable dotenvx-ops features')
-  .addOption(new Option('--ops-off', 'DEPRECATED: use --no-ops').hideHelp())
+  .option('--no-vlt', 'disable dotenvx-vlt features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/run').apply(this, args)
@@ -94,6 +94,7 @@ program.command('get')
   .option('--pp', 'pretty print output (alias)')
   .option('--format <type>', 'format of the output (json, shell, colon, eval)', 'json')
   .option('--no-ops', 'disable dotenvx-ops features')
+  .option('--no-vlt', 'disable dotenvx-vlt features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/get').apply(this, args)
@@ -113,6 +114,7 @@ program.command('set')
   .option('-p, --plain', 'store value as plain text', false)
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-ops', 'disable dotenvx-ops features')
+  .option('--no-vlt', 'disable dotenvx-vlt features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/set').apply(this, args)
@@ -126,9 +128,10 @@ program.command('encrypt')
   .option('-k, --key <keys...>', 'keys(s) to encrypt (default: all keys in file)')
   .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from encryption (default: none)')
   .option('--stdout', 'send to stdout')
-  .option('--token <token>', 'set Ops token')
+  .option('--token <token>', 'set Vlt Ops token')
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-ops', 'disable dotenvx-ops features')
+  .option('--no-vlt', 'disable dotenvx-vlt features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/encrypt').apply(this, args)
@@ -142,6 +145,7 @@ program.command('decrypt')
   .option('-k, --key <keys...>', 'keys(s) to decrypt (default: all keys in file)')
   .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from decryption (default: none)')
   .option('--no-ops', 'disable dotenvx-ops features')
+  .option('--no-vlt', 'disable dotenvx-vlt features')
   .option('--stdout', 'send to stdout')
   .action(function (...args) {
     this.envs = envs
@@ -156,6 +160,7 @@ program.command('rotate')
   .option('-k, --key <keys...>', 'keys(s) to encrypt (default: all keys in file)')
   .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from encryption (default: none)')
   .option('--no-ops', 'disable dotenvx-ops features')
+  .option('--no-vlt', 'disable dotenvx-vlt features')
   .option('--stdout', 'send to stdout')
   .action(function (...args) {
     this.envs = envs
@@ -170,6 +175,7 @@ program.command('keypair')
   .option('-f, --env-file <paths...>', 'path(s) to your env file(s)')
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('--no-ops', 'disable dotenvx-ops features')
+  .option('--no-vlt', 'disable dotenvx-vlt features')
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
   .option('--format <type>', 'format of the output (json, shell, colon)', 'json')
@@ -238,10 +244,10 @@ program.command('help [command]')
     }
   })
 
-// dotenvx ops
+// dotenvx vlt ops
 program.addHelpText('after', ' ')
 program.addHelpText('after', 'Advanced: ')
-program.addHelpText('after', '  ops                ⛨  Ops [www.dotenvx.com/ops]')
+program.addHelpText('after', '  vlt                ⛨  Vlt Ops [www.dotenvx.com/vlt]')
 program.addHelpText('after', '  ext                🔌 extensions')
 
 // dotenvx ext

package/src/db/session.js

@@ -1,23 +1,23 @@
-const Ops = require('./../lib/extensions/ops')
+const Vlt = require('./../lib/extensions/vlt')
 const { logger } = require('./../shared/logger')
 
 class Session {
   constructor () {
-    this.ops = new Ops()
+    this.vlt = new Vlt()
   }
 
   //
-  // ops status helpers
+  // vlt status helpers
   //
-  async noOps () {
-    const status = await this.ops.status()
-    logger.debug(`ops: ${status}`)
+  async noVlt () {
+    const status = await this.vlt.status()
+    logger.debug(`vlt: ${status}`)
     return status === 'off'
   }
 
-  noOpsSync () {
-    const status = this.ops.statusSync()
-    logger.debug(`ops: ${status}`)
+  noVltSync () {
+    const status = this.vlt.statusSync()
+    logger.debug(`vlt: ${status}`)
     return status === 'off'
   }
 }

package/src/lib/extensions/{ops.js → vlt.js}

@@ -4,8 +4,9 @@ const util = require('util')
 const { logger } = require('../../shared/logger')
 
 const execFile = util.promisify(childProcess.execFile)
+const BINARY_NAMES = ['dotenvx-vlt', 'dotenvx-ops']
 
-class Ops {
+class Vlt {
   async status () {
     if (this._isForcedOff()) return 'off'
 
@@ -156,16 +157,12 @@ class Ops {
     if (this._binaryPromise) return this._binaryPromise
 
     this._binaryPromise = (async () => {
-      const npmBin = path.resolve(process.cwd(), 'node_modules/.bin/dotenvx-ops')
-      try {
-        await this._exec(npmBin, ['--version'])
-        return npmBin
-      } catch (_e) {}
-
-      try {
-        await this._exec('dotenvx-ops', ['--version'])
-        return 'dotenvx-ops'
-      } catch (_e) {}
+      for (const binary of this._binaryCandidates()) {
+        try {
+          await this._exec(binary, ['--version'])
+          return binary
+        } catch (_e) {}
+      }
 
       return null
     })()
@@ -176,30 +173,30 @@ class Ops {
   _resolveBinarySync () {
     if (this._binarySync !== undefined) return this._binarySync
 
-    const npmBin = path.resolve(process.cwd(), 'node_modules/.bin/dotenvx-ops')
-    try {
-      this._execSync(npmBin, ['--version'])
-      this._binarySync = npmBin
-      return this._binarySync
-    } catch (err) {
-      logger.debug(err.message)
-    }
-
-    try {
-      this._execSync('dotenvx-ops', ['--version'])
-      this._binarySync = 'dotenvx-ops'
-      return this._binarySync
-    } catch (err) {
-      logger.debug(err.message)
+    for (const binary of this._binaryCandidates()) {
+      try {
+        this._execSync(binary, ['--version'])
+        this._binarySync = binary
+        return this._binarySync
+      } catch (err) {
+        logger.debug(err.message)
+      }
     }
 
     this._binarySync = null
     return null
   }
 
+  _binaryCandidates () {
+    return BINARY_NAMES.flatMap((binary) => [
+      path.resolve(process.cwd(), `node_modules/.bin/${binary}`),
+      binary
+    ])
+  }
+
   _isForcedOff () {
-    return process.env.DOTENVX_NO_OPS === 'true'
+    return process.env.DOTENVX_NO_OPS === 'true' || process.env.DOTENVX_NO_VLT === 'true'
   }
 }
 
-module.exports = Ops
+module.exports = Vlt

package/src/lib/helpers/cryptography/index.js

@@ -1,6 +1,6 @@
 module.exports = {
-  opsKeypair: require('./opsKeypair'),
-  opsKeypairSync: require('./opsKeypairSync'),
+  vltKeypair: require('./vltKeypair'),
+  vltKeypairSync: require('./vltKeypairSync'),
   localKeypair: require('./localKeypair'),
   encryptValue: require('./encryptValue'),
   decryptKeyValue: require('./decryptKeyValue'),

package/src/lib/helpers/cryptography/mutateKeysSrc.js

@@ -2,7 +2,7 @@ const FIRST_TIME_KEYS_SRC = [
   '#/------------------!DOTENV_PRIVATE_KEYS!-------------------/',
   '#/ private decryption keys. DO NOT commit to source control /',
   '#/     [how it works](https://dotenvx.com/encryption)       /',
-  // '#/           backup with: `dotenvx ops backup`              /',
+  '#/        harden private keys: `dotenvx armor up`           /',
   '#/----------------------------------------------------------/'
 ].join('\n')
 

package/src/lib/helpers/cryptography/mutateKeysSrcSync.js

@@ -2,7 +2,7 @@ const FIRST_TIME_KEYS_SRC = [
   '#/------------------!DOTENV_PRIVATE_KEYS!-------------------/',
   '#/ private decryption keys. DO NOT commit to source control /',
   '#/     [how it works](https://dotenvx.com/encryption)       /',
-  // '#/           backup with: `dotenvx ops backup`              /',
+  '#/        harden private keys: `dotenvx armor up`           /',
   '#/----------------------------------------------------------/'
 ].join('\n')