@dotenvx/dotenvx 1.69.0 → 1.69.2

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.69.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.69.2...main)
+
+## [1.69.2](https://github.com/dotenvx/dotenvx/compare/v1.69.1...v1.69.2) (2026-05-29)
+
+### Changed
+
+* Minor messaging improvements, especially if using armored keys ([#825](https://github.com/dotenvx/dotenvx/pull/825))
+
+## [1.69.1](https://github.com/dotenvx/dotenvx/compare/v1.69.0...v1.69.1) (2026-05-25)
+
+### Changed
+
+* Internally rename `ops` to `vlt` ([#823](https://github.com/dotenvx/dotenvx/pull/823))
 
 ## [1.69.0](https://github.com/dotenvx/dotenvx/compare/v1.68.1...v1.69.0) (2026-05-25)
 
@@ -302,7 +314,7 @@ export default {
 
 ### Added
 
-* Add hint on `.env.keys` for `dotenvx ops backup`. Dotenvx Ops Backup lets you back up your private keys securely with just a single command. It's a convenient alterantive to manually copy/pasting them in and out of 1Password. ([#718](https://github.com/dotenvx/dotenvx/pull/718))
+* Add hint on `.env.keys` for `dotenvx armor up`. Dotenvx Armor lets you armor your private keys securely with just a single command. It's a convenient alternative to manually copy/pasting them in and out of 1Password. ([#718](https://github.com/dotenvx/dotenvx/pull/718))
 
 ## [1.51.2](https://github.com/dotenvx/dotenvx/compare/v1.51.1...v1.51.2) (2025-12-12)
 

package/README.md

@@ -1,4 +1,4 @@
-[![dotenvx](https://dotenvx.com/banner.png)](https://dotenvx.com)
+[![dotenvx](https://dotenvx.com/banner.png?v2)](https://dotenvx.com)
 
 *a secure dotenv*–from the creator of [`dotenv`](https://github.com/motdotla/dotenv).
 
@@ -1289,7 +1289,7 @@ $ dotenvx run -fk .env.keys -f apps/app1/.env -- yourcommand
 </details>
 <details><summary>`run --no-vlt`</summary><br>
 
-Turn off [Dotenvx Vlt Ops](https://dotenvx.com/vlt) features.
+Turn off [Dotenvx VLT ⛨](https://dotenvx.com/vlt) features.
 
 ```sh
 $ dotenvx run --no-vlt -- yourcommand
@@ -1624,7 +1624,7 @@ $ dotenvx encrypt -f .env.production
 </details>
 <details><summary>`encrypt --no-vlt`</summary><br>
 
-Turn off [Dotenvx Vlt Ops](https://dotenvx.com/vlt) features for encrypt.
+Turn off [Dotenvx VLT ⛨](https://dotenvx.com/vlt) features for encrypt.
 
 ```sh
 $ dotenvx encrypt --no-vlt
@@ -2550,7 +2550,7 @@ $ dotenvx run --convention=nextjs -- node index.js
 </details>
 <details><summary>`config(noVlt:)` - noVlt</summary><br>
 
-Turn off [Dotenvx Vlt Ops](https://dotenvx.com/vlt) features.
+Turn off [Dotenvx VLT ⛨](https://dotenvx.com/vlt) features.
 
 ```js
 // index.js
@@ -2650,14 +2650,14 @@ This is known as *Decryption at Access* and is written about in [the whitepaper]
 
 &nbsp;
 
-## Vlt Ops ⛨
+## VLT ⛨
 
-[![dotenvx-vlt](https://dotenvx.com/dotenvx-vlt-banner.png)](https://dotenvx.com/vlt)
+[![dotenvx-vlt](https://dotenvx.com/dotenvx-vlt-banner.png?v2)](https://dotenvx.com/vlt)
 
 ```
 ⛨ ARMORED KEYS: Harden your private keys.
 ⮕ install [curl -sfS https://dotenvx.sh/vlt | sh]
-⮕ then run [dotenvx-vlt login]
+⮕ then run [dotenvx vlt login]
 ```
 
 [Learn more](https://dotenvx.com/vlt)

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.69.0",
+  "version": "1.69.2",
   "name": "@dotenvx/dotenvx",
   "description": "secrets for agents–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/decrypt.js

@@ -15,7 +15,7 @@ async function decrypt () {
 
   const sesh = new Session()
   const envs = this.envs
-  const noOps = options.ops === false || (await sesh.noVlt())
+  const noVlt = options.vlt === false || (await sesh.noVlt())
 
   let errorCount = 0
 
@@ -23,7 +23,7 @@ async function decrypt () {
   if (options.stdout) {
     const {
       processedEnvs
-    } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noOps).run()
+    } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noVlt).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       if (processedEnv.error) {
@@ -45,7 +45,7 @@ async function decrypt () {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noOps).run()
+      } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noVlt).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`decrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)
@@ -63,8 +63,10 @@ async function decrypt () {
       }
 
       if (spinner) spinner.stop()
+      const armoredPrivateKeyUsed = processedEnvs.some((processedEnv) => processedEnv.armoredPrivateKeyUsed)
+      const keyUsedSuffix = armoredPrivateKeyUsed ? ' · armored ⛨' : ''
       if (changedFilepaths.length > 0) {
-        logger.success(`◇ decrypted (${changedFilepaths.join(',')})`)
+        logger.success(`◇ decrypted (${changedFilepaths.join(',')})${keyUsedSuffix}`)
       } else if (unchangedFilepaths.length > 0) {
         logger.info(`○ no change (${unchangedFilepaths})`)
       } else {

package/src/cli/actions/encrypt.js

@@ -4,26 +4,25 @@ const { logger } = require('./../../shared/logger')
 const Encrypt = require('./../../lib/services/encrypt')
 
 const catchAndLog = require('../../lib/helpers/catchAndLog')
-const localDisplayPath = require('../../lib/helpers/localDisplayPath')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const prompts = require('../../lib/helpers/prompts')
 const Session = require('../../db/session')
 const normalizeVltOptions = require('./normalizeVltOptions')
 
 function keypairSpinnerHooks (spinner) {
-  let stoppedForOps = false
+  let stoppedForVlt = false
 
   return {
     onStderr: () => {
-      if (spinner && !stoppedForOps) {
+      if (spinner && !stoppedForVlt) {
         spinner.stop()
-        stoppedForOps = true
+        stoppedForVlt = true
       }
     },
     after: () => {
-      if (spinner && stoppedForOps) {
+      if (spinner && stoppedForVlt) {
         spinner.start('encrypting')
-        stoppedForOps = false
+        stoppedForVlt = false
       }
     }
   }
@@ -37,10 +36,10 @@ function keyStorageSelector (spinner) {
 
     if (spinner) spinner.stop()
     selected = await prompts.select({
-      message: 'Select key storage',
+      message: 'Choose private key storage',
       choices: [
-        { name: 'Local (.env.keys)', value: 'local' },
-        { name: 'Armored ⛨', value: 'armored' }
+        { name: '◫ File (.env.keys)', value: 'file' },
+        { name: '⛨ Armor (vlt.dotenvx.com)', value: 'armored' }
       ]
     }, {
       input: process.stdin,
@@ -52,12 +51,12 @@ function keyStorageSelector (spinner) {
   }
 }
 
-function encryptOptions (spinner, noOps) {
+function encryptOptions (spinner, noVlt) {
   const options = {
     keypairHooks: keypairSpinnerHooks(spinner)
   }
 
-  if (!noOps) {
+  if (!noVlt) {
     options.selectKeyStorage = keyStorageSelector(spinner)
   }
 
@@ -72,14 +71,14 @@ async function encrypt () {
 
   const sesh = new Session()
   const envs = this.envs
-  const noOps = options.ops === false || (!options.token && (await sesh.noVlt()))
+  const noVlt = options.vlt === false || (!options.token && (await sesh.noVlt()))
   const noCreate = options.create === false
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
     const {
       processedEnvs
-    } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noOps, noCreate, options.token, encryptOptions(spinner, noOps)).run()
+    } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noVlt, noCreate, options.token, encryptOptions(spinner, noVlt)).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       console.log(processedEnv.envSrc)
@@ -91,7 +90,7 @@ async function encrypt () {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noOps, noCreate, options.token, encryptOptions(spinner, noOps)).run()
+      } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noVlt, noCreate, options.token, encryptOptions(spinner, noVlt)).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`encrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)
@@ -108,15 +107,10 @@ async function encrypt () {
 
       if (spinner) spinner.stop()
       if (changedFilepaths.length > 0) {
-        const localKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.localPrivateKeyAdded)
         const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
         let msg = `◈ encrypted (${changedFilepaths.join(',')})`
-        if (localKeyAddedEnv) {
-          const envKeysFilepath = localDisplayPath(localKeyAddedEnv.envKeysFilepath)
-          msg += ` + local key (${envKeysFilepath})`
-        }
         if (remoteKeyAddedEnv) {
-          msg += ' + armored key ⛨'
+          msg += ' · armored ⛨'
         }
         logger.success(msg)
       } else if (unchangedFilepaths.length > 0) {

package/src/cli/actions/get.js

@@ -30,8 +30,8 @@ async function get (key) {
 
   try {
     const sesh = new Session()
-    const noOps = options.ops === false || (await sesh.noVlt())
-    const { parsed, errors } = await new Get(key, envs, options.overload, options.all, options.envKeysFile, noOps).run()
+    const noVlt = options.vlt === false || (await sesh.noVlt())
+    const { parsed, errors } = await new Get(key, envs, options.overload, options.all, options.envKeysFile, noVlt).run()
 
     for (const error of errors || []) {
       if (options.strict) throw error // throw immediately if strict

package/src/cli/actions/keypair.js

@@ -17,8 +17,8 @@ async function keypair (key) {
   const prettyPrint = options.prettyPrint || options.pp
 
   const sesh = new Session()
-  const noOps = options.ops === false || await sesh.noVlt()
-  const keypairs = await new Keypair(options.envFile, options.envKeysFile, noOps).run()
+  const noVlt = options.vlt === false || await sesh.noVlt()
+  const keypairs = await new Keypair(options.envFile, options.envKeysFile, noVlt).run()
   const results = key ? keypairs[key] : keypairs
 
   if (spinner) spinner.stop()

package/src/cli/actions/rotate.js

@@ -5,7 +5,6 @@ const Rotate = require('./../../lib/services/rotate')
 
 const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
-const localDisplayPath = require('../../lib/helpers/localDisplayPath')
 const Session = require('../../db/session')
 const normalizeVltOptions = require('./normalizeVltOptions')
 
@@ -17,13 +16,13 @@ async function rotate () {
 
   const envs = this.envs
   const sesh = new Session()
-  const noOps = options.ops === false || (await sesh.noVlt())
+  const noVlt = options.vlt === false || (await sesh.noVlt())
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
     const {
       processedEnvs
-    } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noOps).run()
+    } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noVlt).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       console.log(processedEnv.envSrc)
@@ -39,7 +38,7 @@ async function rotate () {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noOps).run()
+      } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noVlt).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`rotating ${processedEnv.envFilepath} (${processedEnv.filepath})`)
@@ -59,16 +58,11 @@ async function rotate () {
 
       if (spinner) spinner.stop()
       if (changedFilepaths.length > 0) {
-        const localKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.localPrivateKeyAdded)
         const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
 
         let msg = `⟳ rotated (${changedFilepaths.join(',')})`
-        if (localKeyAddedEnv) {
-          const envKeysFilepath = localDisplayPath(localKeyAddedEnv.envKeysFilepath)
-          msg += ` + local key (${envKeysFilepath})`
-        }
         if (remoteKeyAddedEnv) {
-          msg += ' + armored key ⛨'
+          msg += ' · armored ⛨'
         }
         logger.success(msg)
       } else if (unchangedFilepaths.length > 0) {

package/src/cli/actions/run.js

@@ -22,7 +22,7 @@ async function run () {
   const ignore = options.ignore || []
 
   const sesh = new Session()
-  const noOps = options.ops === false || (await sesh.noVlt())
+  const noVlt = options.vlt === false || (await sesh.noVlt())
 
   if (commandArgs.length < 1) {
     if (spinner) spinner.stop()
@@ -54,11 +54,8 @@ async function run () {
       readableStrings,
       readableFilepaths,
       uniqueInjectedKeys
-    } = await new Run(envs, options.overload, process.env, options.envKeysFile, noOps, {
+    } = await new Run(envs, options.overload, process.env, options.envKeysFile, noVlt, {
       keypairHooks: {
-        before: () => {
-          if (spinner) spinner.start('retrieving')
-        },
         after: () => {
           if (spinner) spinner.start('injecting')
         }
@@ -114,8 +111,11 @@ async function run () {
       msg += ` from --env flag${readableStrings.length > 1 ? 's' : ''}`
     }
 
+    const armoredPrivateKeyUsed = processedEnvs.some((processedEnv) => processedEnv.armoredPrivateKeyUsed)
+    const keyUsedSuffix = armoredPrivateKeyUsed ? ' · armored ⛨' : ''
+
     if (spinner) spinner.stop()
-    logger.successv(msg)
+    logger.success(`⟐ ${msg}${keyUsedSuffix}`)
   } catch (error) {
     if (spinner) spinner.stop()
     catchAndLog(error)

package/src/cli/actions/set.js

@@ -3,7 +3,6 @@ const { logger } = require('./../../shared/logger')
 
 const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
-const localDisplayPath = require('../../lib/helpers/localDisplayPath')
 const Session = require('../../db/session')
 const Sets = require('./../../lib/services/sets')
 const normalizeVltOptions = require('./normalizeVltOptions')
@@ -28,14 +27,14 @@ async function set (key, value) {
     const sesh = new Session()
     const envs = this.envs
     const envKeysFilepath = options.envKeysFile
-    const noOps = options.ops === false || (await sesh.noVlt())
+    const noVlt = options.vlt === false || (await sesh.noVlt())
     const noCreate = options.create === false
 
     const {
       processedEnvs,
       changedFilepaths,
       unchangedFilepaths
-    } = await new Sets(key, value, envs, encrypt, envKeysFilepath, noOps, noCreate).run()
+    } = await new Sets(key, value, envs, encrypt, envKeysFilepath, noVlt, noCreate).run()
 
     let withEncryption = ''
 
@@ -59,11 +58,8 @@ async function set (key, value) {
     const localKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.localPrivateKeyAdded)
     const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
     let keyAddedSuffix = ''
-    if (localKeyAddedEnv) {
-      keyAddedSuffix = ` + local key (${localDisplayPath(localKeyAddedEnv.envKeysFilepath)})`
-    }
     if (remoteKeyAddedEnv) {
-      keyAddedSuffix = ' + armored key ⛨'
+      keyAddedSuffix = ' · armored ⛨'
     }
 
     if (spinner) spinner.stop()
@@ -73,7 +69,7 @@ async function set (key, value) {
       } else {
         logger.success(`◇ set ${key} (${changedFilepaths.join(',')})`)
       }
-    } else if (encrypt && localKeyAddedEnv) { // TODO: this needs to take into account remoteKeyAddedEnv
+    } else if (encrypt && localKeyAddedEnv) {
       const localKeyAddedEnvFilepath = localKeyAddedEnv.envFilepath || changedFilepaths[0] || '.env'
       logger.success(`◈ encrypted ${key} (${localKeyAddedEnvFilepath})${keyAddedSuffix}`)
     } else if (unchangedFilepaths.length > 0) {

package/src/cli/dotenvx.js

@@ -202,12 +202,12 @@ program.command('doctor', { hidden: true })
   })
 
 // dotenvx login
-program.command('login')
-  .description('log in to unlock ⛨ ARMORED KEYS ✦ BETA')
+program.command('login', { hidden: true })
+  .description('')
   .allowUnknownOption()
   .action(() => {
-    const rawArgs = ['ops', 'login', ...process.argv.slice(3)]
-    executeDynamic(program, 'ops', rawArgs)
+    const rawArgs = ['vlt', 'login', ...process.argv.slice(3)]
+    executeDynamic(program, 'vlt', rawArgs)
   })
 
 // dotenvx logout
@@ -215,8 +215,8 @@ program.command('logout', { hidden: true })
   .description('log out of your dotenvx account')
   .allowUnknownOption()
   .action(() => {
-    const rawArgs = ['ops', 'logout', ...process.argv.slice(3)]
-    executeDynamic(program, 'ops', rawArgs)
+    const rawArgs = ['vlt', 'logout', ...process.argv.slice(3)]
+    executeDynamic(program, 'vlt', rawArgs)
   })
 
 // dotenvx armor
@@ -224,8 +224,8 @@ program.command('armor', { hidden: true })
   .description('ARMORED KEYS ⛨')
   .allowUnknownOption()
   .action((args) => {
-    const rawArgs = ['ops', 'armor', ...process.argv.slice(3)]
-    executeDynamic(program, 'ops', rawArgs)
+    const rawArgs = ['vlt', 'armor', ...process.argv.slice(3)]
+    executeDynamic(program, 'vlt', rawArgs)
   })
 
 // dotenvx help
@@ -247,8 +247,9 @@ program.command('help [command]')
 // dotenvx vlt ops
 program.addHelpText('after', ' ')
 program.addHelpText('after', 'Advanced: ')
-program.addHelpText('after', '  vlt                ⛨  Vlt Ops [www.dotenvx.com/vlt]')
-program.addHelpText('after', '  ext                🔌 extensions')
+program.addHelpText('after', '  login')
+program.addHelpText('after', '  vlt                      ⛨ ARMORED KEYS [www.dotenvx.com/vlt]')
+program.addHelpText('after', '  ext                      ⊕ extensions')
 
 // dotenvx ext
 program.addCommand(require('./commands/ext'))

package/src/lib/helpers/cryptography/index.js

@@ -1,6 +1,6 @@
 module.exports = {
-  opsKeypair: require('./opsKeypair'),
-  opsKeypairSync: require('./opsKeypairSync'),
+  vltKeypair: require('./vltKeypair'),
+  vltKeypairSync: require('./vltKeypairSync'),
   localKeypair: require('./localKeypair'),
   encryptValue: require('./encryptValue'),
   decryptKeyValue: require('./decryptKeyValue'),

package/src/lib/helpers/cryptography/mutateKeysSrc.js

@@ -2,7 +2,7 @@ const FIRST_TIME_KEYS_SRC = [
   '#/------------------!DOTENV_PRIVATE_KEYS!-------------------/',
   '#/ private decryption keys. DO NOT commit to source control /',
   '#/     [how it works](https://dotenvx.com/encryption)       /',
-  // '#/           backup with: `dotenvx ops backup`              /',
+  '#/          ⛨ ARMORED KEYS: `dotenvx armor up`              /',
   '#/----------------------------------------------------------/'
 ].join('\n')
 

package/src/lib/helpers/cryptography/mutateKeysSrcSync.js

@@ -2,7 +2,7 @@ const FIRST_TIME_KEYS_SRC = [
   '#/------------------!DOTENV_PRIVATE_KEYS!-------------------/',
   '#/ private decryption keys. DO NOT commit to source control /',
   '#/     [how it works](https://dotenvx.com/encryption)       /',
-  // '#/           backup with: `dotenvx ops backup`              /',
+  '#/          ⛨ ARMORED KEYS: `dotenvx armor up`              /',
   '#/----------------------------------------------------------/'
 ].join('\n')
 

package/src/lib/helpers/cryptography/provision.js

@@ -1,13 +1,13 @@
 const mutateSrc = require('./mutateSrc')
 const mutateKeysSrc = require('./mutateKeysSrc')
-const opsKeypair = require('./opsKeypair')
+const vltKeypair = require('./vltKeypair')
 const localKeypair = require('./localKeypair')
 const { keyNames } = require('../keyResolution')
 
-async function provision ({ envSrc, envFilepath, keysFilepath, noOps, token, keypairHooks, selectKeyStorage }) {
-  noOps = noOps !== false
-  if (!noOps && selectKeyStorage) {
-    noOps = await selectKeyStorage() !== 'armored'
+async function provision ({ envSrc, envFilepath, keysFilepath, noVlt, token, keypairHooks, selectKeyStorage }) {
+  noVlt = noVlt !== false
+  if (!noVlt && selectKeyStorage) {
+    noVlt = await selectKeyStorage() !== 'armored'
   }
 
   const { publicKeyName, privateKeyName } = keyNames(envFilepath)
@@ -19,12 +19,12 @@ async function provision ({ envSrc, envFilepath, keysFilepath, noOps, token, key
   let localPrivateKeyAdded = false
   let remotePrivateKeyAdded = false
 
-  if (noOps) {
+  if (noVlt) {
     const kp = localKeypair()
     publicKey = kp.publicKey
     privateKey = kp.privateKey
   } else {
-    const kp = await opsKeypair(undefined, { token, envFilepath, hooks: keypairHooks })
+    const kp = await vltKeypair(undefined, { token, envFilepath, hooks: keypairHooks })
     publicKey = kp.publicKey
     privateKey = kp.privateKey
   }
@@ -32,7 +32,7 @@ async function provision ({ envSrc, envFilepath, keysFilepath, noOps, token, key
   const mutated = mutateSrc({ envSrc, envFilepath, keysFilepath, publicKeyName, publicKeyValue: publicKey })
   envSrc = mutated.envSrc
 
-  if (noOps) {
+  if (noVlt) {
     const mutated = await mutateKeysSrc({ envFilepath, keysFilepath, privateKeyName, privateKeyValue: privateKey })
     keysSrc = mutated.keysSrc
     envKeysFilepath = mutated.envKeysFilepath

package/src/lib/helpers/cryptography/provisionSync.js

@@ -1,11 +1,11 @@
 const mutateSrc = require('./mutateSrc')
 const mutateKeysSrcSync = require('./mutateKeysSrcSync')
-const opsKeypairSync = require('./opsKeypairSync')
+const vltKeypairSync = require('./vltKeypairSync')
 const localKeypair = require('./localKeypair')
 const { keyNames } = require('../keyResolution')
 
-function provisionSync ({ envSrc, envFilepath, keysFilepath, noOps }) {
-  noOps = noOps !== false
+function provisionSync ({ envSrc, envFilepath, keysFilepath, noVlt }) {
+  noVlt = noVlt !== false
   const { publicKeyName, privateKeyName } = keyNames(envFilepath)
 
   let publicKey
@@ -15,12 +15,12 @@ function provisionSync ({ envSrc, envFilepath, keysFilepath, noOps }) {
   let localPrivateKeyAdded = false
   let remotePrivateKeyAdded = false
 
-  if (noOps) {
+  if (noVlt) {
     const kp = localKeypair()
     publicKey = kp.publicKey
     privateKey = kp.privateKey
   } else {
-    const kp = opsKeypairSync(undefined, { envFilepath })
+    const kp = vltKeypairSync(undefined, { envFilepath })
     publicKey = kp.publicKey
     privateKey = kp.privateKey
   }
@@ -28,7 +28,7 @@ function provisionSync ({ envSrc, envFilepath, keysFilepath, noOps }) {
   const mutated = mutateSrc({ envSrc, envFilepath, keysFilepath, publicKeyName, publicKeyValue: publicKey })
   envSrc = mutated.envSrc
 
-  if (noOps) {
+  if (noVlt) {
     const mutated = mutateKeysSrcSync({ envFilepath, keysFilepath, privateKeyName, privateKeyValue: privateKey })
     keysSrc = mutated.keysSrc
     envKeysFilepath = mutated.envKeysFilepath

package/src/lib/helpers/cryptography/provisionWithPrivateKey.js

@@ -3,7 +3,7 @@ const mutateSrc = require('./mutateSrc')
 const localKeypair = require('./localKeypair')
 
 function provisionWithPrivateKey ({ envSrc, envFilepath, keysFilepath, privateKeyValue, publicKeyValue, publicKeyName }) {
-  const { publicKey, privateKey } = localKeypair(privateKeyValue) // noOps doesn't matter here since privateKeyValue was already discovered prior (via ops and local) and passed as privateKeyValue
+  const { publicKey, privateKey } = localKeypair(privateKeyValue) // noVlt doesn't matter here since privateKeyValue was already discovered prior (via vlt and local) and passed as privateKeyValue
 
   // if derivation doesn't match what's in the file (or preset in env)
   if (publicKeyValue && publicKeyValue !== publicKey) {

package/src/lib/helpers/cryptography/{opsKeypair.js → vltKeypair.js}

@@ -1,6 +1,6 @@
 const Vlt = require('../../extensions/vlt')
 
-async function opsKeypair (existingPublicKey, options = {}) {
+async function vltKeypair (existingPublicKey, options = {}) {
   const hooks = options.hooks || {}
   if (hooks.before) await hooks.before()
 
@@ -27,4 +27,4 @@ async function opsKeypair (existingPublicKey, options = {}) {
   }
 }
 
-module.exports = opsKeypair
+module.exports = vltKeypair

package/src/lib/helpers/cryptography/{opsKeypairSync.js → vltKeypairSync.js}

@@ -1,6 +1,6 @@
 const Vlt = require('../../extensions/vlt')
 
-function opsKeypairSync (existingPublicKey, options = {}) {
+function vltKeypairSync (existingPublicKey, options = {}) {
   const kp = new Vlt().keypairSync(existingPublicKey, options)
   const publicKey = kp.public_key
   const privateKey = kp.private_key
@@ -11,4 +11,4 @@ function opsKeypairSync (existingPublicKey, options = {}) {
   }
 }
 
-module.exports = opsKeypairSync
+module.exports = vltKeypairSync

package/src/lib/helpers/executeDynamic.js

@@ -2,50 +2,28 @@ const path = require('path')
 const childProcess = require('child_process')
 const { logger } = require('../../shared/logger')
 
-function installCommandForOps () {
-  return 'curl -sfS https://dotenvx.sh/ops | sh'
-}
-
-function installCommandForVlt () {
-  return 'curl -sfS https://dotenvx.sh/vlt | sh'
-}
-
-function opsBanner (installCommand) {
+function vltBanner () {
   const lines = [
+    '                       [www.dotenvx.com/vlt]',
+    '–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––',
     '',
-    '   ██████╗ ██████╗ ███████╗',
-    '  ██╔═══██╗██╔══██╗██╔════╝',
-    '  ██║   ██║██████╔╝███████╗',
-    '  ██║   ██║██╔═══╝ ╚════██║  [www.dotenvx.com/ops]',
-    '  ╚██████╔╝██║     ███████║',
-    '   ╚═════╝ ╚═╝     ╚══════╝',
+    '                          Dotenvx + VLT ⛨',
     '',
-    '  ⛨  ARMORED KEYS: Harden your private keys.',
-    `  ⮕  install [${installCommand}]`,
-    '  ⮕  then run [dotenvx-ops login]'
-  ]
-
-  const innerWidth = Math.max(67, ...lines.map((line) => line.length))
-  const top = ` ${'_'.repeat(innerWidth)}`
-  const middle = lines.map((line) => `|${line.padEnd(innerWidth)}|`).join('\n')
-  const bottom = `|${'_'.repeat(innerWidth)}|`
-
-  return `${top}\n${middle}\n${bottom}`
-}
-
-function vltBanner (installCommand) {
-  const lines = [
+    '                           ARMORED KEYS',
+    '               Private keys. Off device. Under guard.',
     '',
-    '  ██╗   ██╗██╗  ████████╗',
-    '  ██║   ██║██║  ╚══██╔══╝',
-    '  ██║   ██║██║     ██║   ',
-    '  ╚██╗ ██╔╝██║     ██║       [www.dotenvx.com/vlt]',
-    '   ╚████╔╝ ███████╗██║   ',
-    '    ╚═══╝  ╚══════╝╚═╝   ',
+    '                                -',
     '',
-    '  ⛨  ARMORED KEYS: Harden your private keys.',
-    `  ⮕  install [${installCommand}]`,
-    '  ⮕  then run [dotenvx-vlt login]'
+    '                            Install one',
+    '             [curl -sfS https://dotenvx.sh/vlt | sh]',
+    '                 [npm i @dotenvx/dotenvx --save]',
+    '',
+    '                                -',
+    '',
+    '                              Then',
+    '                       [dotenvx armor up]',
+    '                     (sign in when prompted)',
+    ''
   ]
 
   const innerWidth = Math.max(67, ...lines.map((line) => line.length))
@@ -74,14 +52,18 @@ function executeDynamic (program, command, rawArgs) {
   const newPath = `${binPath}:${process.env.PATH}`
   const env = { ...process.env, PATH: newPath }
 
-  const result = childProcess.spawnSync(`dotenvx-${command}`, forwardedArgs, { stdio: 'inherit', env })
+  let spawnCommand = `dotenvx-${command}`
+  let result = childProcess.spawnSync(spawnCommand, forwardedArgs, { stdio: 'inherit', env })
+  if (command === 'ops' && result.error) {
+    spawnCommand = 'dotenvx-vlt'
+    result = childProcess.spawnSync(spawnCommand, forwardedArgs, { stdio: 'inherit', env })
+  }
+
   if (result.error) {
     if (command === 'vlt') {
-      const installCommand = installCommandForVlt()
-      console.log(vltBanner(installCommand))
+      console.log(vltBanner())
     } else if (command === 'ops') {
-      const installCommand = installCommandForOps()
-      console.log(opsBanner(installCommand))
+      console.log(vltBanner())
     } else {
       logger.info(`error: unknown command '${command}'`)
     }

package/src/lib/helpers/keyResolution/keyValues.js

@@ -5,7 +5,7 @@ const dotenvParse = require('./../dotenvParse')
 const keyNames = require('./keyNames')
 const readProcessKey = require('./readProcessKey')
 const readFileKey = require('./readFileKey')
-const opsKeypair = require('../cryptography/opsKeypair')
+const vltKeypair = require('../cryptography/vltKeypair')
 
 async function invertForPrivateKeyName (filepath) {
   const PUBLIC_KEY_SCHEMA = 'DOTENV_PUBLIC_KEY'
@@ -34,13 +34,14 @@ async function invertForPrivateKeyName (filepath) {
 
 async function keyValues (filepath, opts = {}) {
   let keysFilepath = opts.keysFilepath || null
-  const noOps = opts.noOps === true
+  const noVlt = opts.noVlt === true
   const names = keyNames(filepath)
   const publicKeyName = names.publicKeyName // DOTENV_PUBLIC_KEY_${ENVIRONMENT}
   let privateKeyName = names.privateKeyName // DOTENV_PRIVATE_KEY_${ENVIRONMENT}
 
   let publicKey = null
   let privateKey = null
+  let privateKeySource = null
 
   // public key: process.env first, then .env*
   publicKey = readProcessKey(publicKeyName)
@@ -70,16 +71,22 @@ async function keyValues (filepath, opts = {}) {
     }
   }
 
-  // ops
-  if (!noOps && !privateKey && publicKey && publicKey.length > 0) {
-    const kp = await opsKeypair(publicKey, { envFilepath: filepath, hooks: opts.keypairHooks })
+  // vlt
+  if (!noVlt && !privateKey && publicKey && publicKey.length > 0) {
+    const kp = await vltKeypair(publicKey, { envFilepath: filepath, hooks: opts.keypairHooks })
     privateKey = kp.privateKey
+    privateKeySource = 'vlt'
   }
 
-  return {
+  const result = {
     publicKeyValue: publicKey || null, // important to make sure name is rendered
     privateKeyValue: privateKey || null // important to make sure name is rendered
   }
+  if (privateKeySource) {
+    result.privateKeySource = privateKeySource
+  }
+
+  return result
 }
 
 module.exports = keyValues

package/src/lib/helpers/keyResolution/keyValuesFromEnvSrc.js

@@ -2,7 +2,7 @@ const path = require('path')
 
 const dotenvParse = require('./../dotenvParse')
 const readFileKeySync = require('./readFileKeySync')
-const opsKeypairSync = require('../cryptography/opsKeypairSync')
+const vltKeypairSync = require('../cryptography/vltKeypairSync')
 
 const PUBLIC_KEY_SCHEMA = 'DOTENV_PUBLIC_KEY'
 const PRIVATE_KEY_SCHEMA = 'DOTENV_PRIVATE_KEY'
@@ -25,7 +25,7 @@ function publicKeyNameFromEnvSrc (envParsed) {
 
 function keyValuesFromEnvSrc (src, privateKeyName = null, opts = {}) {
   let keysFilepath = opts.keysFilepath || null
-  const noOps = opts.noOps === true
+  const noVlt = opts.noVlt === true
   const processEnv = opts.processEnv || process.env
   const envParsed = dotenvParse(src)
 
@@ -37,6 +37,7 @@ function keyValuesFromEnvSrc (src, privateKeyName = null, opts = {}) {
   }
 
   let privateKeyValue = null
+  let privateKeySource = null
   if (privateKeyName) {
     privateKeyValue = readProcessKey(processEnv, privateKeyName)
 
@@ -51,16 +52,22 @@ function keyValuesFromEnvSrc (src, privateKeyName = null, opts = {}) {
     }
   }
 
-  if (!noOps && !privateKeyValue && publicKeyValue && publicKeyValue.length > 0) {
-    const kp = opsKeypairSync(publicKeyValue)
+  if (!noVlt && !privateKeyValue && publicKeyValue && publicKeyValue.length > 0) {
+    const kp = vltKeypairSync(publicKeyValue)
     privateKeyValue = kp.privateKey
+    privateKeySource = 'vlt'
   }
 
-  return {
+  const result = {
     publicKeyValue: publicKeyValue || null,
     privateKeyValue: privateKeyValue || null,
     privateKeyName: privateKeyName || null
   }
+  if (privateKeySource) {
+    result.privateKeySource = privateKeySource
+  }
+
+  return result
 }
 
 module.exports = keyValuesFromEnvSrc

package/src/lib/helpers/keyResolution/keyValuesSync.js

@@ -5,7 +5,7 @@ const dotenvParse = require('./../dotenvParse')
 const keyNames = require('./keyNames')
 const readProcessKey = require('./readProcessKey')
 const readFileKeySync = require('./readFileKeySync')
-const opsKeypairSync = require('../cryptography/opsKeypairSync')
+const vltKeypairSync = require('../cryptography/vltKeypairSync')
 
 function invertForPrivateKeyName (filepath) {
   const PUBLIC_KEY_SCHEMA = 'DOTENV_PUBLIC_KEY'
@@ -34,13 +34,14 @@ function invertForPrivateKeyName (filepath) {
 
 function keyValuesSync (filepath, opts = {}) {
   let keysFilepath = opts.keysFilepath || null
-  const noOps = opts.noOps === true
+  const noVlt = opts.noVlt === true
   const names = keyNames(filepath)
   const publicKeyName = names.publicKeyName // DOTENV_PUBLIC_KEY_${ENVIRONMENT}
   let privateKeyName = names.privateKeyName // DOTENV_PRIVATE_KEY_${ENVIRONMENT}
 
   let publicKey = null
   let privateKey = null
+  let privateKeySource = null
 
   // public key: process.env first, then .env*
   publicKey = readProcessKey(publicKeyName)
@@ -70,21 +71,27 @@ function keyValuesSync (filepath, opts = {}) {
     }
   }
 
-  // ops
-  if (!noOps && !privateKey && publicKey && publicKey.length > 0) {
-    const opsOptions = { envFilepath: filepath }
+  // vlt
+  if (!noVlt && !privateKey && publicKey && publicKey.length > 0) {
+    const vltOptions = { envFilepath: filepath }
     if (opts.noSpinner) {
-      opsOptions.noSpinner = true
+      vltOptions.noSpinner = true
     }
 
-    const kp = opsKeypairSync(publicKey, opsOptions)
+    const kp = vltKeypairSync(publicKey, vltOptions)
     privateKey = kp.privateKey
+    privateKeySource = 'vlt'
   }
 
-  return {
+  const result = {
     publicKeyValue: publicKey || null, // important to make sure name is rendered
     privateKeyValue: privateKey || null // important to make sure name is rendered
   }
+  if (privateKeySource) {
+    result.privateKeySource = privateKeySource
+  }
+
+  return result
 }
 
 module.exports = keyValuesSync

package/src/lib/main.js

@@ -20,7 +20,6 @@ const buildEnvs = require('./helpers/buildEnvs')
 const { determine } = require('./helpers/envResolution')
 const Parse = require('./helpers/parse')
 const fsx = require('./helpers/fsx')
-const localDisplayPath = require('./helpers/localDisplayPath')
 
 /** @type {import('./main').config} */
 const config = function (options = {}) {
@@ -48,8 +47,8 @@ const config = function (options = {}) {
     setLogVersion(options)
   }
 
-  // dotenvx-ops related
-  const noOps = resolveNoOps(options)
+  // dotenvx-vlt related
+  const noVlt = resolveNoVlt(options)
 
   try {
     let envs = buildEnvs(options)
@@ -60,7 +59,7 @@ const config = function (options = {}) {
       processedEnvs,
       readableFilepaths,
       uniqueInjectedKeys
-    } = new Run(envs, overload, processEnv, envKeysFile, noOps, {
+    } = new Run(envs, overload, processEnv, envKeysFile, noVlt, {
       noSpinner: options.noSpinner
     }).runSync()
 
@@ -180,13 +179,13 @@ const set = function (key, value, options = {}) {
 
   const envs = buildEnvs(options)
   const envKeysFilepath = options.envKeysFile
-  const noOps = resolveNoOps(options)
+  const noVlt = resolveNoVlt(options)
 
   const {
     processedEnvs,
     changedFilepaths,
     unchangedFilepaths
-  } = new Sets(key, value, envs, encrypt, envKeysFilepath, noOps).runSync()
+  } = new Sets(key, value, envs, encrypt, envKeysFilepath, noVlt).runSync()
 
   let withEncryption = ''
 
@@ -213,11 +212,8 @@ const set = function (key, value, options = {}) {
   const localKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.localPrivateKeyAdded)
   const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
 
-  if (localKeyAddedEnv) {
-    keyAddedSuffix = ` + local key (${localDisplayPath(localKeyAddedEnv.envKeysFilepath)})`
-  }
   if (remoteKeyAddedEnv) {
-    keyAddedSuffix = ' + armored key ⛨'
+    keyAddedSuffix = ' · armored ⛨'
   }
 
   if (changedFilepaths.length > 0) {
@@ -247,12 +243,12 @@ const set = function (key, value, options = {}) {
 /* @type {import('./main').get} */
 const get = function (key, options = {}) {
   const envs = buildEnvs(options)
-  const noOps = resolveNoOps(options)
+  const noVlt = resolveNoVlt(options)
 
   // ignore
   const ignore = options.ignore || []
 
-  const { parsed, errors } = new Get(key, envs, options.overload, options.all, options.envKeysFile, noOps).runSync()
+  const { parsed, errors } = new Get(key, envs, options.overload, options.all, options.envKeysFile, noVlt).runSync()
 
   for (const error of errors || []) {
     if (ignore.includes(error.code)) {
@@ -317,8 +313,8 @@ const genexample = function (directory, envFile) {
 }
 
 /** @type {import('./main').keypair} */
-const keypair = function (envFile, key, envKeysFile = null, noOps = false) {
-  const keypairs = new Keypair(envFile, envKeysFile, noOps).runSync()
+const keypair = function (envFile, key, envKeysFile = null, noVlt = false) {
+  const keypairs = new Keypair(envFile, envKeysFile, noVlt).runSync()
   if (key) {
     return keypairs[key]
   } else {
@@ -326,9 +322,9 @@ const keypair = function (envFile, key, envKeysFile = null, noOps = false) {
   }
 }
 
-function resolveNoOps (options = {}) {
+function resolveNoVlt (options = {}) {
   const sesh = new Session()
-  return options.noOps === true || options.noVlt === true || sesh.noVltSync()
+  return options.noVlt === true || options.noOps === true || sesh.noVltSync()
 }
 
 module.exports = {

package/src/lib/services/decrypt.js

@@ -25,12 +25,12 @@ const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 
 class Decrypt {
-  constructor (envs = [], key = [], excludeKey = [], envKeysFilepath = null, noOps = false) {
+  constructor (envs = [], key = [], excludeKey = [], envKeysFilepath = null, noVlt = false) {
     this.envs = determine(envs, process.env)
     this.key = key
     this.excludeKey = excludeKey
     this.envKeysFilepath = envKeysFilepath
-    this.noOps = noOps
+    this.noVlt = noVlt
 
     this.processedEnvs = []
     this.changedFilepaths = new Set()
@@ -77,9 +77,11 @@ class Decrypt {
       const envParsed = dotenvParse(envSrc, false, false, true)
 
       const { privateKeyName } = keyNames(envFilepath)
-      const { privateKeyValue } = await keyValues(envFilepath, { keysFilepath: this.envKeysFilepath, noOps: this.noOps })
+      const { privateKeyValue, privateKeySource } = await keyValues(envFilepath, { keysFilepath: this.envKeysFilepath, noVlt: this.noVlt })
 
       row.privateKey = privateKeyValue
+      row.privateKeySource = privateKeySource
+      row.armoredPrivateKeyUsed = privateKeySource === 'vlt'
       row.privateKeyName = privateKeyName
       row.changed = false // track possible changes
 

package/src/lib/services/encrypt.js

@@ -29,12 +29,12 @@ const detectEncoding = require('./../helpers/detectEncoding')
 const SAMPLE_ENV_KIT = require('./../helpers/kits/sample')
 
 class Encrypt {
-  constructor (envs = [], key = [], excludeKey = [], envKeysFilepath = null, noOps = false, noCreate = false, token = undefined, options = {}) {
+  constructor (envs = [], key = [], excludeKey = [], envKeysFilepath = null, noVlt = false, noCreate = false, token = undefined, options = {}) {
     this.envs = determine(envs, process.env)
     this.key = key
     this.excludeKey = excludeKey
     this.envKeysFilepath = envKeysFilepath
-    this.noOps = noOps
+    this.noVlt = noVlt
     this.noCreate = noCreate
     this.token = token
     this.keypairHooks = options.keypairHooks
@@ -105,7 +105,7 @@ class Encrypt {
       const { publicKeyName, privateKeyName } = keyNames(envFilepath)
       const { publicKeyValue, privateKeyValue } = await keyValues(envFilepath, {
         keysFilepath: this.envKeysFilepath,
-        noOps: this.noOps,
+        noVlt: this.noVlt,
         keypairHooks: this.keypairHooks
       })
 
@@ -115,7 +115,7 @@ class Encrypt {
           envSrc,
           envFilepath,
           keysFilepath: this.envKeysFilepath,
-          noOps: this.noOps,
+          noVlt: this.noVlt,
           token: this.token,
           keypairHooks: this.keypairHooks,
           selectKeyStorage: this.selectKeyStorage

package/src/lib/services/get.js

@@ -3,26 +3,26 @@ const Errors = require('./../helpers/errors')
 const { determine } = require('./../helpers/envResolution')
 
 class Get {
-  constructor (key, envs = [], overload = false, all = false, envKeysFilepath = null, noOps = false) {
+  constructor (key, envs = [], overload = false, all = false, envKeysFilepath = null, noVlt = false) {
     this.key = key
     this.envs = envs
     this.overload = overload
     this.all = all
     this.envKeysFilepath = envKeysFilepath
-    this.noOps = noOps
+    this.noVlt = noVlt
   }
 
   runSync () {
     const processEnv = { ...process.env }
     const envs = determine(this.envs, processEnv)
-    const { processedEnvs } = new Run(envs, this.overload, processEnv, this.envKeysFilepath, this.noOps).runSync()
+    const { processedEnvs } = new Run(envs, this.overload, processEnv, this.envKeysFilepath, this.noVlt).runSync()
     return this._result(processedEnvs, processEnv)
   }
 
   async run () {
     const processEnv = { ...process.env }
     const envs = determine(this.envs, processEnv)
-    const { processedEnvs } = await new Run(envs, this.overload, processEnv, this.envKeysFilepath, this.noOps).run()
+    const { processedEnvs } = await new Run(envs, this.overload, processEnv, this.envKeysFilepath, this.noVlt).run()
     return this._result(processedEnvs, processEnv)
   }
 

package/src/lib/services/keypair.js

@@ -5,10 +5,10 @@ const {
 } = require('./../helpers/keyResolution')
 
 class Keypair {
-  constructor (envFile = '.env', envKeysFilepath = null, noOps = false) {
+  constructor (envFile = '.env', envKeysFilepath = null, noVlt = false) {
     this.envFile = envFile
     this.envKeysFilepath = envKeysFilepath
-    this.noOps = noOps
+    this.noVlt = noVlt
   }
 
   runSync () {
@@ -17,7 +17,7 @@ class Keypair {
     const filepaths = this._filepaths()
     for (const filepath of filepaths) {
       const { publicKeyName, privateKeyName } = keyNames(filepath)
-      const { publicKeyValue, privateKeyValue } = keyValuesSync(filepath, { keysFilepath: this.envKeysFilepath, noOps: this.noOps })
+      const { publicKeyValue, privateKeyValue } = keyValuesSync(filepath, { keysFilepath: this.envKeysFilepath, noVlt: this.noVlt })
 
       out[publicKeyName] = publicKeyValue
       out[privateKeyName] = privateKeyValue
@@ -32,7 +32,7 @@ class Keypair {
     const filepaths = this._filepaths()
     for (const filepath of filepaths) {
       const { publicKeyName, privateKeyName } = keyNames(filepath)
-      const { publicKeyValue, privateKeyValue } = await keyValues(filepath, { keysFilepath: this.envKeysFilepath, noOps: this.noOps })
+      const { publicKeyValue, privateKeyValue } = await keyValues(filepath, { keysFilepath: this.envKeysFilepath, noVlt: this.noVlt })
 
       out[publicKeyName] = publicKeyValue
       out[privateKeyName] = privateKeyValue

package/src/lib/services/rotate.js

@@ -16,7 +16,7 @@ const {
 } = require('./../helpers/keyResolution')
 
 const {
-  opsKeypair,
+  vltKeypair,
   localKeypair,
   encryptValue,
   decryptKeyValue,
@@ -29,12 +29,12 @@ const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 
 class Rotate {
-  constructor (envs = [], key = [], excludeKey = [], envKeysFilepath = null, noOps = false) {
+  constructor (envs = [], key = [], excludeKey = [], envKeysFilepath = null, noVlt = false) {
     this.envs = determine(envs, process.env)
     this.key = key
     this.excludeKey = excludeKey
     this.envKeysFilepath = envKeysFilepath
-    this.noOps = noOps
+    this.noVlt = noVlt
 
     this.processedEnvs = []
     this.changedFilepaths = new Set()
@@ -83,15 +83,15 @@ class Rotate {
       const envParsed = dotenvParse(envSrc, false, false, true)
 
       const { publicKeyName, privateKeyName } = keyNames(envFilepath)
-      const { privateKeyValue } = await keyValues(envFilepath, { keysFilepath: this.envKeysFilepath, noOps: this.noOps })
+      const { privateKeyValue } = await keyValues(envFilepath, { keysFilepath: this.envKeysFilepath, noVlt: this.noVlt })
 
       let newPublicKey
       let newPrivateKey
       let envKeysFilepath
       let envKeysSrc
 
-      if (!this.noOps) {
-        const kp = await opsKeypair()
+      if (!this.noVlt) {
+        const kp = await vltKeypair()
         newPublicKey = kp.publicKey
         newPrivateKey = kp.privateKey
 
@@ -146,8 +146,8 @@ class Rotate {
       row.privateKeyName = privateKeyName
       row.privateKey = newPrivateKey
 
-      if (this.noOps) {
-        // keys src only for ops
+      if (this.noVlt) {
+        // keys src only for vlt
         envKeysSrc = append(envKeysSrc, privateKeyName, newPrivateKey) // append privateKey
         this.envKeysSources[envKeysFilepath] = envKeysSrc
         row.envKeysSrc = envKeysSrc
@@ -158,7 +158,7 @@ class Rotate {
       if (e.code === 'ENOENT') {
         const missingPath = e.path ? path.resolve(e.path) : null
         const expectedEnvKeysPath = row.envKeysFilepath ? path.resolve(row.envKeysFilepath) : null
-        if (this.noOps && expectedEnvKeysPath && missingPath === expectedEnvKeysPath) {
+        if (this.noVlt && expectedEnvKeysPath && missingPath === expectedEnvKeysPath) {
           row.error = new Errors({ envKeysFilepath: row.envKeysFilepath }).missingEnvKeysFile()
         } else {
           row.error = new Errors({ envFilepath, filepath }).missingEnvFile()

package/src/lib/services/run.js

@@ -17,12 +17,12 @@ const {
 } = require('./../helpers/keyResolution')
 
 class Run {
-  constructor (envs = [], overload = false, processEnv = process.env, envKeysFilepath = null, noOps = false, options = {}) {
+  constructor (envs = [], overload = false, processEnv = process.env, envKeysFilepath = null, noVlt = false, options = {}) {
     this.envs = envs
     this.overload = overload
     this.processEnv = processEnv
     this.envKeysFilepath = envKeysFilepath
-    this.noOps = noOps
+    this.noVlt = noVlt
     this.noSpinner = options.noSpinner
     this.keypairHooks = options.keypairHooks
 
@@ -93,8 +93,9 @@ class Run {
     try {
       const {
         privateKeyName: resolvedPrivateKeyName,
-        privateKeyValue
-      } = keyValuesFromEnvSrc(env, privateKeyName, { keysFilepath: this.envKeysFilepath, noOps: this.noOps, processEnv: this.processEnv })
+        privateKeyValue,
+        privateKeySource
+      } = keyValuesFromEnvSrc(env, privateKeyName, { keysFilepath: this.envKeysFilepath, noVlt: this.noVlt, processEnv: this.processEnv })
 
       const {
         parsed,
@@ -105,6 +106,10 @@ class Run {
 
       row.privateKeyName = resolvedPrivateKeyName
       row.privateKey = privateKeyValue
+      if (privateKeySource) {
+        row.privateKeySource = privateKeySource
+        row.armoredPrivateKeyUsed = privateKeySource === 'vlt'
+      }
       row.parsed = parsed
       row.errors = errors
       row.injected = injected
@@ -136,9 +141,9 @@ class Run {
       this.readableFilepaths.add(envFilepath)
 
       const { privateKeyName } = keyNames(filepath)
-      const { privateKeyValue } = keyValuesSync(filepath, {
+      const { privateKeyValue, privateKeySource } = keyValuesSync(filepath, {
         keysFilepath: this.envKeysFilepath,
-        noOps: this.noOps,
+        noVlt: this.noVlt,
         noSpinner: this.noSpinner
       })
 
@@ -151,6 +156,10 @@ class Run {
 
       row.privateKeyName = privateKeyName
       row.privateKey = privateKeyValue
+      if (privateKeySource) {
+        row.privateKeySource = privateKeySource
+        row.armoredPrivateKeyUsed = privateKeySource === 'vlt'
+      }
       row.src = src
       row.parsed = parsed
       row.errors = errors
@@ -185,9 +194,9 @@ class Run {
       this.readableFilepaths.add(envFilepath)
 
       const { privateKeyName } = keyNames(filepath)
-      const { privateKeyValue } = await keyValues(filepath, {
+      const { privateKeyValue, privateKeySource } = await keyValues(filepath, {
         keysFilepath: this.envKeysFilepath,
-        noOps: this.noOps,
+        noVlt: this.noVlt,
         keypairHooks: this.keypairHooks
       })
 
@@ -200,6 +209,10 @@ class Run {
 
       row.privateKeyName = privateKeyName
       row.privateKey = privateKeyValue
+      if (privateKeySource) {
+        row.privateKeySource = privateKeySource
+        row.armoredPrivateKeyUsed = privateKeySource === 'vlt'
+      }
       row.src = src
       row.parsed = parsed
       row.errors = errors

package/src/lib/services/sets.js

@@ -34,13 +34,13 @@ function allValuesForKey (envSrc, key) {
 }
 
 class Sets {
-  constructor (key, value, envs = [], encrypt = true, envKeysFilepath = null, noOps = false, noCreate = false) {
+  constructor (key, value, envs = [], encrypt = true, envKeysFilepath = null, noVlt = false, noCreate = false) {
     this.envs = determine(envs, process.env)
     this.key = key
     this.value = value
     this.encrypt = encrypt
     this.envKeysFilepath = envKeysFilepath
-    this.noOps = noOps
+    this.noVlt = noVlt
     this.noCreate = noCreate
 
     this.processedEnvs = []
@@ -131,11 +131,11 @@ class Sets {
         let privateKey
 
         const { publicKeyName, privateKeyName } = keyNames(filepath)
-        const { publicKeyValue, privateKeyValue } = keyValuesSync(filepath, { keysFilepath: this.envKeysFilepath, noOps: this.noOps })
+        const { publicKeyValue, privateKeyValue } = keyValuesSync(filepath, { keysFilepath: this.envKeysFilepath, noVlt: this.noVlt })
 
         // first pass - provisionSync
         if (!privateKeyValue && !publicKeyValue) {
-          const prov = provisionSync({ envSrc, envFilepath, keysFilepath: this.envKeysFilepath, noOps: this.noOps })
+          const prov = provisionSync({ envSrc, envFilepath, keysFilepath: this.envKeysFilepath, noVlt: this.noVlt })
           envSrc = prov.envSrc
           publicKey = prov.publicKey
           privateKey = prov.privateKey
@@ -238,11 +238,11 @@ class Sets {
         let privateKey
 
         const { publicKeyName, privateKeyName } = keyNames(filepath)
-        const { publicKeyValue, privateKeyValue } = await keyValues(filepath, { keysFilepath: this.envKeysFilepath, noOps: this.noOps })
+        const { publicKeyValue, privateKeyValue } = await keyValues(filepath, { keysFilepath: this.envKeysFilepath, noVlt: this.noVlt })
 
         // first pass - provision
         if (!privateKeyValue && !publicKeyValue) {
-          const prov = await provision({ envSrc, envFilepath, keysFilepath: this.envKeysFilepath, noOps: this.noOps })
+          const prov = await provision({ envSrc, envFilepath, keysFilepath: this.envKeysFilepath, noVlt: this.noVlt })
           envSrc = prov.envSrc
           publicKey = prov.publicKey
           privateKey = prov.privateKey