@dotenvx/dotenvx 1.69.1 → 1.69.2

package/CHANGELOG.md

@@ -2,7 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.69.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.69.2...main)
+
+## [1.69.2](https://github.com/dotenvx/dotenvx/compare/v1.69.1...v1.69.2) (2026-05-29)
+
+### Changed
+
+* Minor messaging improvements, especially if using armored keys ([#825](https://github.com/dotenvx/dotenvx/pull/825))
 
 ## [1.69.1](https://github.com/dotenvx/dotenvx/compare/v1.69.0...v1.69.1) (2026-05-25)
 

package/README.md

@@ -1,4 +1,4 @@
-[![dotenvx](https://dotenvx.com/banner.png)](https://dotenvx.com)
+[![dotenvx](https://dotenvx.com/banner.png?v2)](https://dotenvx.com)
 
 *a secure dotenv*–from the creator of [`dotenv`](https://github.com/motdotla/dotenv).
 
@@ -1289,7 +1289,7 @@ $ dotenvx run -fk .env.keys -f apps/app1/.env -- yourcommand
 </details>
 <details><summary>`run --no-vlt`</summary><br>
 
-Turn off [Dotenvx Vlt Ops](https://dotenvx.com/vlt) features.
+Turn off [Dotenvx VLT ⛨](https://dotenvx.com/vlt) features.
 
 ```sh
 $ dotenvx run --no-vlt -- yourcommand
@@ -1624,7 +1624,7 @@ $ dotenvx encrypt -f .env.production
 </details>
 <details><summary>`encrypt --no-vlt`</summary><br>
 
-Turn off [Dotenvx Vlt Ops](https://dotenvx.com/vlt) features for encrypt.
+Turn off [Dotenvx VLT ⛨](https://dotenvx.com/vlt) features for encrypt.
 
 ```sh
 $ dotenvx encrypt --no-vlt
@@ -2550,7 +2550,7 @@ $ dotenvx run --convention=nextjs -- node index.js
 </details>
 <details><summary>`config(noVlt:)` - noVlt</summary><br>
 
-Turn off [Dotenvx Vlt Ops](https://dotenvx.com/vlt) features.
+Turn off [Dotenvx VLT ⛨](https://dotenvx.com/vlt) features.
 
 ```js
 // index.js
@@ -2650,14 +2650,14 @@ This is known as *Decryption at Access* and is written about in [the whitepaper]
 
 &nbsp;
 
-## Vlt Ops ⛨
+## VLT ⛨
 
-[![dotenvx-vlt](https://dotenvx.com/dotenvx-vlt-banner.png)](https://dotenvx.com/vlt)
+[![dotenvx-vlt](https://dotenvx.com/dotenvx-vlt-banner.png?v2)](https://dotenvx.com/vlt)
 
 ```
 ⛨ ARMORED KEYS: Harden your private keys.
 ⮕ install [curl -sfS https://dotenvx.sh/vlt | sh]
-⮕ then run [dotenvx-vlt login]
+⮕ then run [dotenvx vlt login]
 ```
 
 [Learn more](https://dotenvx.com/vlt)

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.69.1",
+  "version": "1.69.2",
   "name": "@dotenvx/dotenvx",
   "description": "secrets for agents–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/decrypt.js

@@ -63,8 +63,10 @@ async function decrypt () {
       }
 
       if (spinner) spinner.stop()
+      const armoredPrivateKeyUsed = processedEnvs.some((processedEnv) => processedEnv.armoredPrivateKeyUsed)
+      const keyUsedSuffix = armoredPrivateKeyUsed ? ' · armored ⛨' : ''
       if (changedFilepaths.length > 0) {
-        logger.success(`◇ decrypted (${changedFilepaths.join(',')})`)
+        logger.success(`◇ decrypted (${changedFilepaths.join(',')})${keyUsedSuffix}`)
       } else if (unchangedFilepaths.length > 0) {
         logger.info(`○ no change (${unchangedFilepaths})`)
       } else {

package/src/cli/actions/encrypt.js

@@ -4,7 +4,6 @@ const { logger } = require('./../../shared/logger')
 const Encrypt = require('./../../lib/services/encrypt')
 
 const catchAndLog = require('../../lib/helpers/catchAndLog')
-const localDisplayPath = require('../../lib/helpers/localDisplayPath')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const prompts = require('../../lib/helpers/prompts')
 const Session = require('../../db/session')
@@ -37,10 +36,10 @@ function keyStorageSelector (spinner) {
 
     if (spinner) spinner.stop()
     selected = await prompts.select({
-      message: 'Select key storage',
+      message: 'Choose private key storage',
       choices: [
-        { name: 'Local (.env.keys)', value: 'local' },
-        { name: 'Armored ⛨', value: 'armored' }
+        { name: '◫ File (.env.keys)', value: 'file' },
+        { name: '⛨ Armor (vlt.dotenvx.com)', value: 'armored' }
       ]
     }, {
       input: process.stdin,
@@ -108,15 +107,10 @@ async function encrypt () {
 
       if (spinner) spinner.stop()
       if (changedFilepaths.length > 0) {
-        const localKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.localPrivateKeyAdded)
         const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
         let msg = `◈ encrypted (${changedFilepaths.join(',')})`
-        if (localKeyAddedEnv) {
-          const envKeysFilepath = localDisplayPath(localKeyAddedEnv.envKeysFilepath)
-          msg += ` + local key (${envKeysFilepath})`
-        }
         if (remoteKeyAddedEnv) {
-          msg += ' + armored key ⛨'
+          msg += ' · armored ⛨'
         }
         logger.success(msg)
       } else if (unchangedFilepaths.length > 0) {

package/src/cli/actions/rotate.js

@@ -5,7 +5,6 @@ const Rotate = require('./../../lib/services/rotate')
 
 const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
-const localDisplayPath = require('../../lib/helpers/localDisplayPath')
 const Session = require('../../db/session')
 const normalizeVltOptions = require('./normalizeVltOptions')
 
@@ -59,16 +58,11 @@ async function rotate () {
 
       if (spinner) spinner.stop()
       if (changedFilepaths.length > 0) {
-        const localKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.localPrivateKeyAdded)
         const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
 
         let msg = `⟳ rotated (${changedFilepaths.join(',')})`
-        if (localKeyAddedEnv) {
-          const envKeysFilepath = localDisplayPath(localKeyAddedEnv.envKeysFilepath)
-          msg += ` + local key (${envKeysFilepath})`
-        }
         if (remoteKeyAddedEnv) {
-          msg += ' + armored key ⛨'
+          msg += ' · armored ⛨'
         }
         logger.success(msg)
       } else if (unchangedFilepaths.length > 0) {

package/src/cli/actions/run.js

@@ -56,9 +56,6 @@ async function run () {
       uniqueInjectedKeys
     } = await new Run(envs, options.overload, process.env, options.envKeysFile, noVlt, {
       keypairHooks: {
-        before: () => {
-          if (spinner) spinner.start('retrieving')
-        },
         after: () => {
           if (spinner) spinner.start('injecting')
         }
@@ -114,8 +111,11 @@ async function run () {
       msg += ` from --env flag${readableStrings.length > 1 ? 's' : ''}`
     }
 
+    const armoredPrivateKeyUsed = processedEnvs.some((processedEnv) => processedEnv.armoredPrivateKeyUsed)
+    const keyUsedSuffix = armoredPrivateKeyUsed ? ' · armored ⛨' : ''
+
     if (spinner) spinner.stop()
-    logger.successv(msg)
+    logger.success(`⟐ ${msg}${keyUsedSuffix}`)
   } catch (error) {
     if (spinner) spinner.stop()
     catchAndLog(error)

package/src/cli/actions/set.js

@@ -3,7 +3,6 @@ const { logger } = require('./../../shared/logger')
 
 const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
-const localDisplayPath = require('../../lib/helpers/localDisplayPath')
 const Session = require('../../db/session')
 const Sets = require('./../../lib/services/sets')
 const normalizeVltOptions = require('./normalizeVltOptions')
@@ -59,11 +58,8 @@ async function set (key, value) {
     const localKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.localPrivateKeyAdded)
     const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
     let keyAddedSuffix = ''
-    if (localKeyAddedEnv) {
-      keyAddedSuffix = ` + local key (${localDisplayPath(localKeyAddedEnv.envKeysFilepath)})`
-    }
     if (remoteKeyAddedEnv) {
-      keyAddedSuffix = ' + armored key ⛨'
+      keyAddedSuffix = ' · armored ⛨'
     }
 
     if (spinner) spinner.stop()
@@ -73,7 +69,7 @@ async function set (key, value) {
       } else {
         logger.success(`◇ set ${key} (${changedFilepaths.join(',')})`)
       }
-    } else if (encrypt && localKeyAddedEnv) { // TODO: this needs to take into account remoteKeyAddedEnv
+    } else if (encrypt && localKeyAddedEnv) {
       const localKeyAddedEnvFilepath = localKeyAddedEnv.envFilepath || changedFilepaths[0] || '.env'
       logger.success(`◈ encrypted ${key} (${localKeyAddedEnvFilepath})${keyAddedSuffix}`)
     } else if (unchangedFilepaths.length > 0) {

package/src/cli/dotenvx.js

@@ -202,12 +202,12 @@ program.command('doctor', { hidden: true })
   })
 
 // dotenvx login
-program.command('login')
-  .description('log in to unlock ⛨ ARMORED KEYS ✦ BETA')
+program.command('login', { hidden: true })
+  .description('')
   .allowUnknownOption()
   .action(() => {
-    const rawArgs = ['ops', 'login', ...process.argv.slice(3)]
-    executeDynamic(program, 'ops', rawArgs)
+    const rawArgs = ['vlt', 'login', ...process.argv.slice(3)]
+    executeDynamic(program, 'vlt', rawArgs)
   })
 
 // dotenvx logout
@@ -215,8 +215,8 @@ program.command('logout', { hidden: true })
   .description('log out of your dotenvx account')
   .allowUnknownOption()
   .action(() => {
-    const rawArgs = ['ops', 'logout', ...process.argv.slice(3)]
-    executeDynamic(program, 'ops', rawArgs)
+    const rawArgs = ['vlt', 'logout', ...process.argv.slice(3)]
+    executeDynamic(program, 'vlt', rawArgs)
   })
 
 // dotenvx armor
@@ -224,8 +224,8 @@ program.command('armor', { hidden: true })
   .description('ARMORED KEYS ⛨')
   .allowUnknownOption()
   .action((args) => {
-    const rawArgs = ['ops', 'armor', ...process.argv.slice(3)]
-    executeDynamic(program, 'ops', rawArgs)
+    const rawArgs = ['vlt', 'armor', ...process.argv.slice(3)]
+    executeDynamic(program, 'vlt', rawArgs)
   })
 
 // dotenvx help
@@ -247,8 +247,9 @@ program.command('help [command]')
 // dotenvx vlt ops
 program.addHelpText('after', ' ')
 program.addHelpText('after', 'Advanced: ')
-program.addHelpText('after', '  vlt                ⛨  Vlt Ops [www.dotenvx.com/vlt]')
-program.addHelpText('after', '  ext                🔌 extensions')
+program.addHelpText('after', '  login')
+program.addHelpText('after', '  vlt                      ⛨ ARMORED KEYS [www.dotenvx.com/vlt]')
+program.addHelpText('after', '  ext                      ⊕ extensions')
 
 // dotenvx ext
 program.addCommand(require('./commands/ext'))

package/src/lib/helpers/cryptography/mutateKeysSrc.js

@@ -2,7 +2,7 @@ const FIRST_TIME_KEYS_SRC = [
   '#/------------------!DOTENV_PRIVATE_KEYS!-------------------/',
   '#/ private decryption keys. DO NOT commit to source control /',
   '#/     [how it works](https://dotenvx.com/encryption)       /',
-  '#/        harden private keys: `dotenvx armor up`           /',
+  '#/          ⛨ ARMORED KEYS: `dotenvx armor up`              /',
   '#/----------------------------------------------------------/'
 ].join('\n')
 

package/src/lib/helpers/cryptography/mutateKeysSrcSync.js

@@ -2,7 +2,7 @@ const FIRST_TIME_KEYS_SRC = [
   '#/------------------!DOTENV_PRIVATE_KEYS!-------------------/',
   '#/ private decryption keys. DO NOT commit to source control /',
   '#/     [how it works](https://dotenvx.com/encryption)       /',
-  '#/        harden private keys: `dotenvx armor up`           /',
+  '#/          ⛨ ARMORED KEYS: `dotenvx armor up`              /',
   '#/----------------------------------------------------------/'
 ].join('\n')
 

package/src/lib/helpers/executeDynamic.js

@@ -2,23 +2,28 @@ const path = require('path')
 const childProcess = require('child_process')
 const { logger } = require('../../shared/logger')
 
-function installCommandForVlt () {
-  return 'curl -sfS https://dotenvx.sh/vlt | sh'
-}
-
-function vltBanner (installCommand) {
+function vltBanner () {
   const lines = [
+    '                       [www.dotenvx.com/vlt]',
+    '–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––',
+    '',
+    '                          Dotenvx + VLT ⛨',
+    '',
+    '                           ARMORED KEYS',
+    '               Private keys. Off device. Under guard.',
     '',
-    '  ██╗   ██╗██╗  ████████╗',
-    '  ██║   ██║██║  ╚══██╔══╝',
-    '  ██║   ██║██║     ██║   ',
-    '  ╚██╗ ██╔╝██║     ██║       [www.dotenvx.com/vlt]',
-    '   ╚████╔╝ ███████╗██║   ',
-    '    ╚═══╝  ╚══════╝╚═╝   ',
+    '                                -',
     '',
-    '  ⛨  ARMORED KEYS: Harden your private keys.',
-    `  ⮕  install [${installCommand}]`,
-    '  ⮕  then run [dotenvx-vlt login]'
+    '                            Install one',
+    '             [curl -sfS https://dotenvx.sh/vlt | sh]',
+    '                 [npm i @dotenvx/dotenvx --save]',
+    '',
+    '                                -',
+    '',
+    '                              Then',
+    '                       [dotenvx armor up]',
+    '                     (sign in when prompted)',
+    ''
   ]
 
   const innerWidth = Math.max(67, ...lines.map((line) => line.length))
@@ -47,14 +52,18 @@ function executeDynamic (program, command, rawArgs) {
   const newPath = `${binPath}:${process.env.PATH}`
   const env = { ...process.env, PATH: newPath }
 
-  const result = childProcess.spawnSync(`dotenvx-${command}`, forwardedArgs, { stdio: 'inherit', env })
+  let spawnCommand = `dotenvx-${command}`
+  let result = childProcess.spawnSync(spawnCommand, forwardedArgs, { stdio: 'inherit', env })
+  if (command === 'ops' && result.error) {
+    spawnCommand = 'dotenvx-vlt'
+    result = childProcess.spawnSync(spawnCommand, forwardedArgs, { stdio: 'inherit', env })
+  }
+
   if (result.error) {
     if (command === 'vlt') {
-      const installCommand = installCommandForVlt()
-      console.log(vltBanner(installCommand))
+      console.log(vltBanner())
     } else if (command === 'ops') {
-      const installCommand = installCommandForVlt()
-      console.log(vltBanner(installCommand))
+      console.log(vltBanner())
     } else {
       logger.info(`error: unknown command '${command}'`)
     }

package/src/lib/helpers/keyResolution/keyValues.js

@@ -41,6 +41,7 @@ async function keyValues (filepath, opts = {}) {
 
   let publicKey = null
   let privateKey = null
+  let privateKeySource = null
 
   // public key: process.env first, then .env*
   publicKey = readProcessKey(publicKeyName)
@@ -74,12 +75,18 @@ async function keyValues (filepath, opts = {}) {
   if (!noVlt && !privateKey && publicKey && publicKey.length > 0) {
     const kp = await vltKeypair(publicKey, { envFilepath: filepath, hooks: opts.keypairHooks })
     privateKey = kp.privateKey
+    privateKeySource = 'vlt'
   }
 
-  return {
+  const result = {
     publicKeyValue: publicKey || null, // important to make sure name is rendered
     privateKeyValue: privateKey || null // important to make sure name is rendered
   }
+  if (privateKeySource) {
+    result.privateKeySource = privateKeySource
+  }
+
+  return result
 }
 
 module.exports = keyValues

package/src/lib/helpers/keyResolution/keyValuesFromEnvSrc.js

@@ -37,6 +37,7 @@ function keyValuesFromEnvSrc (src, privateKeyName = null, opts = {}) {
   }
 
   let privateKeyValue = null
+  let privateKeySource = null
   if (privateKeyName) {
     privateKeyValue = readProcessKey(processEnv, privateKeyName)
 
@@ -54,13 +55,19 @@ function keyValuesFromEnvSrc (src, privateKeyName = null, opts = {}) {
   if (!noVlt && !privateKeyValue && publicKeyValue && publicKeyValue.length > 0) {
     const kp = vltKeypairSync(publicKeyValue)
     privateKeyValue = kp.privateKey
+    privateKeySource = 'vlt'
   }
 
-  return {
+  const result = {
     publicKeyValue: publicKeyValue || null,
     privateKeyValue: privateKeyValue || null,
     privateKeyName: privateKeyName || null
   }
+  if (privateKeySource) {
+    result.privateKeySource = privateKeySource
+  }
+
+  return result
 }
 
 module.exports = keyValuesFromEnvSrc

package/src/lib/helpers/keyResolution/keyValuesSync.js

@@ -41,6 +41,7 @@ function keyValuesSync (filepath, opts = {}) {
 
   let publicKey = null
   let privateKey = null
+  let privateKeySource = null
 
   // public key: process.env first, then .env*
   publicKey = readProcessKey(publicKeyName)
@@ -79,12 +80,18 @@ function keyValuesSync (filepath, opts = {}) {
 
     const kp = vltKeypairSync(publicKey, vltOptions)
     privateKey = kp.privateKey
+    privateKeySource = 'vlt'
   }
 
-  return {
+  const result = {
     publicKeyValue: publicKey || null, // important to make sure name is rendered
     privateKeyValue: privateKey || null // important to make sure name is rendered
   }
+  if (privateKeySource) {
+    result.privateKeySource = privateKeySource
+  }
+
+  return result
 }
 
 module.exports = keyValuesSync

package/src/lib/main.js

@@ -20,7 +20,6 @@ const buildEnvs = require('./helpers/buildEnvs')
 const { determine } = require('./helpers/envResolution')
 const Parse = require('./helpers/parse')
 const fsx = require('./helpers/fsx')
-const localDisplayPath = require('./helpers/localDisplayPath')
 
 /** @type {import('./main').config} */
 const config = function (options = {}) {
@@ -213,11 +212,8 @@ const set = function (key, value, options = {}) {
   const localKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.localPrivateKeyAdded)
   const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
 
-  if (localKeyAddedEnv) {
-    keyAddedSuffix = ` + local key (${localDisplayPath(localKeyAddedEnv.envKeysFilepath)})`
-  }
   if (remoteKeyAddedEnv) {
-    keyAddedSuffix = ' + armored key ⛨'
+    keyAddedSuffix = ' · armored ⛨'
   }
 
   if (changedFilepaths.length > 0) {

package/src/lib/services/decrypt.js

@@ -77,9 +77,11 @@ class Decrypt {
       const envParsed = dotenvParse(envSrc, false, false, true)
 
       const { privateKeyName } = keyNames(envFilepath)
-      const { privateKeyValue } = await keyValues(envFilepath, { keysFilepath: this.envKeysFilepath, noVlt: this.noVlt })
+      const { privateKeyValue, privateKeySource } = await keyValues(envFilepath, { keysFilepath: this.envKeysFilepath, noVlt: this.noVlt })
 
       row.privateKey = privateKeyValue
+      row.privateKeySource = privateKeySource
+      row.armoredPrivateKeyUsed = privateKeySource === 'vlt'
       row.privateKeyName = privateKeyName
       row.changed = false // track possible changes
 

package/src/lib/services/run.js

@@ -93,7 +93,8 @@ class Run {
     try {
       const {
         privateKeyName: resolvedPrivateKeyName,
-        privateKeyValue
+        privateKeyValue,
+        privateKeySource
       } = keyValuesFromEnvSrc(env, privateKeyName, { keysFilepath: this.envKeysFilepath, noVlt: this.noVlt, processEnv: this.processEnv })
 
       const {
@@ -105,6 +106,10 @@ class Run {
 
       row.privateKeyName = resolvedPrivateKeyName
       row.privateKey = privateKeyValue
+      if (privateKeySource) {
+        row.privateKeySource = privateKeySource
+        row.armoredPrivateKeyUsed = privateKeySource === 'vlt'
+      }
       row.parsed = parsed
       row.errors = errors
       row.injected = injected
@@ -136,7 +141,7 @@ class Run {
       this.readableFilepaths.add(envFilepath)
 
       const { privateKeyName } = keyNames(filepath)
-      const { privateKeyValue } = keyValuesSync(filepath, {
+      const { privateKeyValue, privateKeySource } = keyValuesSync(filepath, {
         keysFilepath: this.envKeysFilepath,
         noVlt: this.noVlt,
         noSpinner: this.noSpinner
@@ -151,6 +156,10 @@ class Run {
 
       row.privateKeyName = privateKeyName
       row.privateKey = privateKeyValue
+      if (privateKeySource) {
+        row.privateKeySource = privateKeySource
+        row.armoredPrivateKeyUsed = privateKeySource === 'vlt'
+      }
       row.src = src
       row.parsed = parsed
       row.errors = errors
@@ -185,7 +194,7 @@ class Run {
       this.readableFilepaths.add(envFilepath)
 
       const { privateKeyName } = keyNames(filepath)
-      const { privateKeyValue } = await keyValues(filepath, {
+      const { privateKeyValue, privateKeySource } = await keyValues(filepath, {
         keysFilepath: this.envKeysFilepath,
         noVlt: this.noVlt,
         keypairHooks: this.keypairHooks
@@ -200,6 +209,10 @@ class Run {
 
       row.privateKeyName = privateKeyName
       row.privateKey = privateKeyValue
+      if (privateKeySource) {
+        row.privateKeySource = privateKeySource
+        row.armoredPrivateKeyUsed = privateKeySource === 'vlt'
+      }
       row.src = src
       row.parsed = parsed
       row.errors = errors