@dotenvx/dotenvx 1.70.0 → 1.71.1

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.70.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.71.1...main)
+
+## [1.71.1](https://github.com/dotenvx/dotenvx/compare/v1.71.0...v1.71.1) (2026-06-08)
+
+### Changed
+
+* stderr changed to `inherit` for dotenvx-armor integration ([#833](https://github.com/dotenvx/dotenvx/pull/833))
+
+## [1.71.0](https://github.com/dotenvx/dotenvx/compare/v1.70.0...v1.71.0) (2026-06-01)
+
+### Added
+
+* Add optional automation `--token` support for Armor ⛨ users ([#831](https://github.com/dotenvx/dotenvx/pull/831))
 
 ## [1.70.0](https://github.com/dotenvx/dotenvx/compare/v1.69.2...v1.70.0) (2026-05-31)
 

package/README.md

@@ -1286,6 +1286,15 @@ $ dotenvx set HELLO Dotenvx -fk .env.keys -f apps/app1/.env
 $ dotenvx run -fk .env.keys -f apps/app1/.env -- yourcommand
 ```
 
+</details>
+<details><summary>`run --token`</summary><br>
+
+Set Armor ⛨ token for retrieving armored private keys.
+
+```sh
+$ dotenvx run --token "$DOTENVX_ARMOR_TOKEN" -- yourcommand
+```
+
 </details>
 <details><summary>`run --no-armor`</summary><br>
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.70.0",
+  "version": "1.71.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/encrypt.js

@@ -9,32 +9,12 @@ const prompts = require('../../lib/helpers/prompts')
 const Session = require('../../db/session')
 const normalizeArmorOptions = require('./normalizeArmorOptions')
 
-function keypairSpinnerHooks (spinner) {
-  let stoppedForArmor = false
-
-  return {
-    onStderr: () => {
-      if (spinner && !stoppedForArmor) {
-        spinner.stop()
-        stoppedForArmor = true
-      }
-    },
-    after: () => {
-      if (spinner && stoppedForArmor) {
-        spinner.start('encrypting')
-        stoppedForArmor = false
-      }
-    }
-  }
-}
-
-function keyStorageSelector (spinner) {
+function keyStorageSelector () {
   let selected
 
   return async function selectKeyStorage () {
     if (selected) return selected
 
-    if (spinner) spinner.stop()
     selected = await prompts.select({
       message: 'Choose private key storage',
       choices: [
@@ -45,19 +25,16 @@ function keyStorageSelector (spinner) {
       input: process.stdin,
       output: process.stderr
     })
-    if (spinner) spinner.start('encrypting')
 
     return selected
   }
 }
 
-function encryptOptions (spinner, noArmor) {
-  const options = {
-    keypairHooks: keypairSpinnerHooks(spinner)
-  }
+function encryptOptions (noArmor) {
+  const options = {}
 
   if (!noArmor) {
-    options.selectKeyStorage = keyStorageSelector(spinner)
+    options.selectKeyStorage = keyStorageSelector()
   }
 
   return options
@@ -76,9 +53,10 @@ async function encrypt () {
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
+    if (spinner) spinner.stop()
     const {
       processedEnvs
-    } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, encryptOptions(spinner, noArmor)).run()
+    } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, encryptOptions(noArmor)).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       console.log(processedEnv.envSrc)
@@ -86,11 +64,12 @@ async function encrypt () {
     process.exit(0) // exit early
   } else {
     try {
+      if (spinner) spinner.stop()
       const {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, encryptOptions(spinner, noArmor)).run()
+      } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, encryptOptions(noArmor)).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`encrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)

package/src/cli/actions/keypair.js

@@ -18,6 +18,7 @@ async function keypair (key) {
 
   const sesh = new Session()
   const noArmor = options.armor === false || await sesh.noArmor()
+  if (spinner) spinner.stop()
   const keypairs = await new Keypair(options.envFile, options.envKeysFile, noArmor).run()
   const results = key ? keypairs[key] : keypairs
 

package/src/cli/actions/run.js

@@ -22,7 +22,7 @@ async function run () {
   const ignore = options.ignore || []
 
   const sesh = new Session()
-  const noArmor = options.armor === false || (await sesh.noArmor())
+  const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
 
   if (commandArgs.length < 1) {
     if (spinner) spinner.stop()
@@ -48,6 +48,7 @@ async function run () {
       envs = this.envs
     }
     envs = determine(envs, process.env)
+    if (spinner) spinner.stop()
 
     const {
       processedEnvs,
@@ -55,11 +56,7 @@ async function run () {
       readableFilepaths,
       uniqueInjectedKeys
     } = await new Run(envs, options.overload, process.env, options.envKeysFile, noArmor, {
-      keypairHooks: {
-        after: () => {
-          if (spinner) spinner.start('injecting')
-        }
-      }
+      token: options.token
     }).run()
 
     for (const processedEnv of processedEnvs) {

package/src/cli/dotenvx.js

@@ -70,6 +70,7 @@ program.command('run')
   .option('--strict', 'process.exit(1) on any errors', false)
   .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
+  .option('--token <token>', 'set Armor ⛨ token')
   .option('--no-armor', 'disable dotenvx-armor features')
   .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())

package/src/lib/extensions/armor.js

@@ -46,9 +46,7 @@ class Armor {
     if (publicKey) args.push(publicKey)
 
     try {
-      return JSON.parse(await this._execInteractive(binary, args, {
-        onStderr: options.onStderr
-      }))
+      return JSON.parse(await this._execInteractive(binary, args))
     } catch (_e) {
       return {}
     }
@@ -113,26 +111,17 @@ class Armor {
     return childProcess.execFileSync(binary, args).toString().trim()
   }
 
-  _execInteractive (binary, args, options = {}) {
+  _execInteractive (binary, args) {
     return new Promise((resolve, reject) => {
       const spawnOptions = {
-        stdio: ['inherit', 'pipe', 'pipe']
+        stdio: ['inherit', 'pipe', 'inherit']
       }
       const subprocess = childProcess.spawn(binary, args, spawnOptions)
       let stdout = ''
-      let sawStderr = false
 
       subprocess.stdout.on('data', (data) => {
         stdout += data.toString()
       })
-      subprocess.stderr.on('data', (data) => {
-        if (!sawStderr) {
-          sawStderr = true
-          if (options.onStderr) options.onStderr()
-        }
-
-        process.stderr.write(data)
-      })
       subprocess.on('error', reject)
       subprocess.on('close', (code) => {
         if (code !== 0) {

package/src/lib/helpers/cryptography/armorKeypair.js

@@ -1,22 +1,12 @@
 const Armor = require('../../extensions/armor')
 
 async function armorKeypair (existingPublicKey, options = {}) {
-  const hooks = options.hooks || {}
-  if (hooks.before) await hooks.before()
-
   const keypairOptions = {
     token: options.token,
     envFilepath: options.envFilepath
   }
-  if (hooks.onStderr) keypairOptions.onStderr = hooks.onStderr
-  if (hooks.before || hooks.onStderr || hooks.after) keypairOptions.noSpinner = true
 
-  let kp
-  try {
-    kp = await new Armor().keypair(existingPublicKey, keypairOptions)
-  } finally {
-    if (hooks.after) await hooks.after()
-  }
+  const kp = await new Armor().keypair(existingPublicKey, keypairOptions)
 
   const publicKey = kp.public_key
   const privateKey = kp.private_key

package/src/lib/helpers/cryptography/provision.js

@@ -4,7 +4,7 @@ const armorKeypair = require('./armorKeypair')
 const localKeypair = require('./localKeypair')
 const { keyNames } = require('../keyResolution')
 
-async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, keypairHooks, selectKeyStorage }) {
+async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, selectKeyStorage }) {
   noArmor = noArmor !== false
   if (!noArmor && selectKeyStorage) {
     noArmor = await selectKeyStorage() !== 'armored'
@@ -24,7 +24,8 @@ async function provision ({ envSrc, envFilepath, keysFilepath, noArmor, token, k
     publicKey = kp.publicKey
     privateKey = kp.privateKey
   } else {
-    const kp = await armorKeypair(undefined, { token, envFilepath, hooks: keypairHooks })
+    const armorOptions = { token, envFilepath }
+    const kp = await armorKeypair(undefined, armorOptions)
     publicKey = kp.publicKey
     privateKey = kp.privateKey
   }

package/src/lib/helpers/keyResolution/keyValues.js

@@ -73,7 +73,11 @@ async function keyValues (filepath, opts = {}) {
 
   // armor
   if (!noArmor && !privateKey && publicKey && publicKey.length > 0) {
-    const kp = await armorKeypair(publicKey, { envFilepath: filepath, hooks: opts.keypairHooks })
+    const armorOptions = { envFilepath: filepath }
+    if (opts.token) {
+      armorOptions.token = opts.token
+    }
+    const kp = await armorKeypair(publicKey, armorOptions)
     privateKey = kp.privateKey
     privateKeySource = 'armor'
   }

package/src/lib/helpers/keyResolution/keyValuesFromEnvSrc.js

@@ -53,7 +53,11 @@ function keyValuesFromEnvSrc (src, privateKeyName = null, opts = {}) {
   }
 
   if (!noArmor && !privateKeyValue && publicKeyValue && publicKeyValue.length > 0) {
-    const kp = armorKeypairSync(publicKeyValue)
+    const armorOptions = {}
+    if (opts.token) {
+      armorOptions.token = opts.token
+    }
+    const kp = armorKeypairSync(publicKeyValue, armorOptions)
     privateKeyValue = kp.privateKey
     privateKeySource = 'armor'
   }

package/src/lib/helpers/keyResolution/keyValuesSync.js

@@ -74,6 +74,9 @@ function keyValuesSync (filepath, opts = {}) {
   // armor
   if (!noArmor && !privateKey && publicKey && publicKey.length > 0) {
     const armorOptions = { envFilepath: filepath }
+    if (opts.token) {
+      armorOptions.token = opts.token
+    }
     if (opts.noSpinner) {
       armorOptions.noSpinner = true
     }

package/src/lib/main.d.ts

@@ -154,6 +154,13 @@ export interface DotenvConfigOptions {
    */
   noSpinner?: boolean;
 
+  /**
+   * Set Armor token.
+   *
+   * @example require('@dotenvx/dotenvx').config({ token: process.env.DOTENVX_ARMOR_TOKEN })
+   */
+  token?: string;
+
   logLevel?:
     | 'error'
     | 'warn'

package/src/lib/main.js

@@ -60,7 +60,8 @@ const config = function (options = {}) {
       readableFilepaths,
       uniqueInjectedKeys
     } = new Run(envs, overload, processEnv, envKeysFile, noArmor, {
-      noSpinner: options.noSpinner
+      noSpinner: options.noSpinner,
+      token: options.token
     }).runSync()
 
     let lastError
@@ -324,7 +325,7 @@ const keypair = function (envFile, key, envKeysFile = null, noArmor = false) {
 
 function resolveNoArmor (options = {}) {
   const sesh = new Session()
-  return options.noArmor === true || options.noVlt === true || options.noOps === true || sesh.noArmorSync()
+  return options.noArmor === true || options.noVlt === true || options.noOps === true || (!options.token && sesh.noArmorSync())
 }
 
 module.exports = {

package/src/lib/services/encrypt.js

@@ -37,7 +37,6 @@ class Encrypt {
     this.noArmor = noArmor
     this.noCreate = noCreate
     this.token = token
-    this.keypairHooks = options.keypairHooks
     this.selectKeyStorage = options.selectKeyStorage
 
     this.processedEnvs = []
@@ -105,8 +104,7 @@ class Encrypt {
       const { publicKeyName, privateKeyName } = keyNames(envFilepath)
       const { publicKeyValue, privateKeyValue } = await keyValues(envFilepath, {
         keysFilepath: this.envKeysFilepath,
-        noArmor: this.noArmor,
-        keypairHooks: this.keypairHooks
+        noArmor: this.noArmor
       })
 
       // first pass - provision
@@ -117,7 +115,6 @@ class Encrypt {
           keysFilepath: this.envKeysFilepath,
           noArmor: this.noArmor,
           token: this.token,
-          keypairHooks: this.keypairHooks,
           selectKeyStorage: this.selectKeyStorage
         })
         envSrc = prov.envSrc

package/src/lib/services/run.js

@@ -24,7 +24,7 @@ class Run {
     this.envKeysFilepath = envKeysFilepath
     this.noArmor = noArmor
     this.noSpinner = options.noSpinner
-    this.keypairHooks = options.keypairHooks
+    this.token = options.token
 
     this.processedEnvs = []
     this.readableFilepaths = new Set()
@@ -95,7 +95,7 @@ class Run {
         privateKeyName: resolvedPrivateKeyName,
         privateKeyValue,
         privateKeySource
-      } = keyValuesFromEnvSrc(env, privateKeyName, { keysFilepath: this.envKeysFilepath, noArmor: this.noArmor, processEnv: this.processEnv })
+      } = keyValuesFromEnvSrc(env, privateKeyName, { keysFilepath: this.envKeysFilepath, noArmor: this.noArmor, processEnv: this.processEnv, token: this.token })
 
       const {
         parsed,
@@ -144,7 +144,8 @@ class Run {
       const { privateKeyValue, privateKeySource } = keyValuesSync(filepath, {
         keysFilepath: this.envKeysFilepath,
         noArmor: this.noArmor,
-        noSpinner: this.noSpinner
+        noSpinner: this.noSpinner,
+        token: this.token
       })
 
       const {
@@ -197,7 +198,7 @@ class Run {
       const { privateKeyValue, privateKeySource } = await keyValues(filepath, {
         keysFilepath: this.envKeysFilepath,
         noArmor: this.noArmor,
-        keypairHooks: this.keypairHooks
+        token: this.token
       })
 
       const {