@dotenvx/dotenvx 1.71.2 → 1.72.0

package/CHANGELOG.md

@@ -2,7 +2,21 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.71.2...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.72.0...main)
+
+## [1.72.0](https://github.com/dotenvx/dotenvx/compare/v1.71.3...v1.72.0) (2026-06-15)
+
+### Added
+
+* Move `armor login` command to first class `dotenvx login` command. ([#836](https://github.com/dotenvx/dotenvx/pull/836))
+* `dotenvx` remains local-first: login is optional and only needed when you want Armor features like moving keys off-device, team sharing, and audit access.
+* Patch 2 high severity dependencies ([#837](https://github.com/dotenvx/dotenvx/pull/837))
+
+## [1.71.3](https://github.com/dotenvx/dotenvx/compare/v1.71.2...v1.71.3) (2026-06-11)
+
+### Changed
+
+* Forward command to Dotenvx Armor Key Guard approvals ([#835](https://github.com/dotenvx/dotenvx/pull/835))
 
 ## [1.71.2](https://github.com/dotenvx/dotenvx/compare/v1.71.1...v1.71.2) (2026-06-08)
 

package/README.md

@@ -2119,8 +2119,8 @@ Commands:
   run                inject env at runtime [dotenvx run -- yourcommand]
   get [KEY]          return a single environment variable
   set <KEY> <value>  set a single environment variable
-  encrypt            convert .env file(s) to encrypted .env file(s)
-  decrypt            convert encrypted .env file(s) to plain .env file(s)
+  encrypt            encrypt .env file(s)
+  decrypt            decrypt .env file(s)
   keypair [KEY]      print public/private keys for .env file(s)
   ls [directory]     print all .env files in a tree structure
  

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.71.2",
+  "version": "1.72.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -45,21 +45,26 @@
   "funding": "https://dotenvx.com",
   "dependencies": {
     "commander": "^11.1.0",
+    "conf": "^10.2.0",
     "dotenv": "^17.2.1",
     "eciesjs": "^0.4.10",
     "enquirer": "^2.4.1",
+    "env-paths": "^2.2.1",
     "execa": "^5.1.1",
     "fdir": "^6.2.0",
     "ignore": "^5.3.0",
     "object-treeify": "1.1.33",
+    "open": "^8.4.2",
     "picomatch": "^4.0.4",
+    "systeminformation": "^5.22.11",
+    "undici": "^7.11.0",
     "which": "^4.0.0",
     "yocto-spinner": "^1.1.0"
   },
   "devDependencies": {
-    "@yao-pkg/pkg": "^6.14.2",
+    "@yao-pkg/pkg": "^6.12.0",
     "capture-console": "^1.0.2",
-    "esbuild": "^0.25.8",
+    "esbuild": "^0.28.1",
     "proxyquire": "^2.1.3",
     "sinon": "^14.0.1",
     "standard": "^17.1.0",

package/src/cli/actions/decrypt.js

@@ -13,8 +13,8 @@ async function decrypt () {
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
-  const sesh = new Session()
   const envs = this.envs
+  const sesh = new Session()
   const noArmor = options.armor === false || (await sesh.noArmor())
 
   let errorCount = 0
@@ -24,7 +24,9 @@ async function decrypt () {
     if (spinner) spinner.stop()
     const {
       processedEnvs
-    } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor).run()
+    } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, {
+      command: process.argv.slice(2)
+    }).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       if (processedEnv.error) {
@@ -47,7 +49,9 @@ async function decrypt () {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor).run()
+      } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, {
+        command: process.argv.slice(2)
+      }).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`decrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)

package/src/cli/actions/encrypt.js

@@ -46,8 +46,8 @@ async function encrypt () {
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
-  const sesh = new Session()
   const envs = this.envs
+  const sesh = new Session()
   const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
   const noCreate = options.create === false
 
@@ -56,7 +56,10 @@ async function encrypt () {
     if (spinner) spinner.stop()
     const {
       processedEnvs
-    } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, encryptOptions(noArmor)).run()
+    } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, {
+      ...encryptOptions(noArmor),
+      command: process.argv.slice(2)
+    }).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       console.log(processedEnv.envSrc)
@@ -69,7 +72,10 @@ async function encrypt () {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, encryptOptions(noArmor)).run()
+      } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, {
+        ...encryptOptions(noArmor),
+        command: process.argv.slice(2)
+      }).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`encrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)

package/src/cli/actions/get.js

@@ -32,7 +32,9 @@ async function get (key) {
     const sesh = new Session()
     const noArmor = options.armor === false || (await sesh.noArmor())
     if (spinner) spinner.stop()
-    const { parsed, errors } = await new Get(key, envs, options.overload, options.all, options.envKeysFile, noArmor).run()
+    const { parsed, errors } = await new Get(key, envs, options.overload, options.all, options.envKeysFile, noArmor, {
+      command: process.argv.slice(2)
+    }).run()
 
     for (const error of errors || []) {
       if (options.strict) throw error // throw immediately if strict

package/src/cli/actions/keypair.js

@@ -19,7 +19,9 @@ async function keypair (key) {
   const sesh = new Session()
   const noArmor = options.armor === false || await sesh.noArmor()
   if (spinner) spinner.stop()
-  const keypairs = await new Keypair(options.envFile, options.envKeysFile, noArmor).run()
+  const keypairs = await new Keypair(options.envFile, options.envKeysFile, noArmor, {
+    command: process.argv.slice(2)
+  }).run()
   const results = key ? keypairs[key] : keypairs
 
   if (spinner) spinner.stop()

package/src/cli/actions/login.js

@@ -0,0 +1,63 @@
+const { logger } = require('../../shared/logger')
+
+const Session = require('../../db/session')
+const Login = require('../../lib/services/login')
+const LoginPoll = require('../../lib/services/loginPoll')
+
+const createSpinner = require('../../lib/helpers/createSpinner')
+const formatCode = require('../../lib/helpers/formatCode')
+const listenForOpenKey = require('../../lib/helpers/listenForOpenKey')
+const openUrl = require('../../lib/helpers/openUrl')
+
+const FRAMES = ['◐', '◓', '◑', '◒']
+
+async function login () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'logging in', frames: FRAMES })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  let cleanupOpenKeyListener = () => {}
+
+  try {
+    const {
+      deviceCode,
+      userCode,
+      verificationUri,
+      verificationUriComplete,
+      interval
+    } = await new Login(hostname).run()
+
+    const promptMessage = `◌ press Enter to open [${verificationUri}] and enter code [${formatCode(userCode)}]...`
+
+    logger.debug(`POST ${hostname} with deviceCode ${deviceCode} at interval ${interval}`)
+    logger.info(promptMessage)
+
+    // begin polling
+    const pollPromise = new LoginPoll(hostname, deviceCode, interval).run()
+    cleanupOpenKeyListener = listenForOpenKey(() => openUrl(verificationUriComplete))
+    const data = await pollPromise
+
+    cleanupOpenKeyListener()
+    if (spinner) spinner.stop()
+    logger.success(`◉ logged in (${data.username})`)
+    process.exit(0)
+  } catch (error) {
+    cleanupOpenKeyListener()
+    if (spinner) spinner.stop()
+    if (error.message) {
+      logger.error(error.message)
+    } else {
+      logger.error(error)
+    }
+    if (error.stack) {
+      logger.debug(error.stack)
+    }
+    process.exit(1)
+  }
+}
+
+module.exports = login

package/src/cli/actions/logout.js

@@ -0,0 +1,36 @@
+const { logger } = require('../../shared/logger')
+
+const Session = require('../../db/session')
+const Logout = require('../../lib/services/logout')
+const createSpinner = require('../../lib/helpers/createSpinner')
+
+const FRAMES = ['◐', '◓', '◑', '◒']
+
+async function logout () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'logging out', frames: FRAMES })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  const hostname = options.hostname || sesh.hostname()
+
+  try {
+    const data = await new Logout(hostname).run()
+    if (spinner) spinner.stop()
+    logger.success(`◌ logged out (${data.username})`)
+  } catch (error) {
+    if (spinner) spinner.stop()
+    if (error.message) {
+      logger.error(error.message)
+    } else {
+      logger.error(error)
+    }
+    if (error.stack) {
+      logger.debug(error.stack)
+    }
+    process.exit(1)
+  }
+}
+
+module.exports = logout

package/src/cli/actions/normalizeArmorOptions.js

@@ -1,8 +1,7 @@
 function normalizeArmorOptions (options) {
-  if (options.armor === false || options.ops === false || options.vlt === false) {
+  if (options.armor === false || options.ops === false) {
     options.armor = false
     options.ops = false
-    options.vlt = false
   }
 
   return options

package/src/cli/actions/rotate.js

@@ -23,7 +23,9 @@ async function rotate () {
     if (spinner) spinner.stop()
     const {
       processedEnvs
-    } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noArmor).run()
+    } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, {
+      command: process.argv.slice(2)
+    }).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       console.log(processedEnv.envSrc)
@@ -40,7 +42,9 @@ async function rotate () {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noArmor).run()
+      } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, {
+        command: process.argv.slice(2)
+      }).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`rotating ${processedEnv.envFilepath} (${processedEnv.filepath})`)

package/src/cli/actions/run.js

@@ -56,7 +56,8 @@ async function run () {
       readableFilepaths,
       uniqueInjectedKeys
     } = await new Run(envs, options.overload, process.env, options.envKeysFile, noArmor, {
-      token: options.token
+      token: options.token,
+      command: commandArgs
     }).run()
 
     for (const processedEnv of processedEnvs) {

package/src/cli/actions/set.js

@@ -24,9 +24,9 @@ async function set (key, value) {
   logger.debug(`options: ${JSON.stringify(options)}`)
 
   try {
-    const sesh = new Session()
     const envs = this.envs
     const envKeysFilepath = options.envKeysFile
+    const sesh = new Session()
     const noArmor = options.armor === false || (await sesh.noArmor())
     const noCreate = options.create === false
 
@@ -35,7 +35,9 @@ async function set (key, value) {
       processedEnvs,
       changedFilepaths,
       unchangedFilepaths
-    } = await new Sets(key, value, envs, encrypt, envKeysFilepath, noArmor, noCreate).run()
+    } = await new Sets(key, value, envs, encrypt, envKeysFilepath, noArmor, noCreate, {
+      command: process.argv.slice(2)
+    }).run()
 
     let withEncryption = ''
 

package/src/cli/dotenvx.js

@@ -72,7 +72,6 @@ program.command('run')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
   .option('--token <token>', 'set Armor ⛨ token')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .action(function (...args) {
     this.envs = envs
@@ -96,7 +95,6 @@ program.command('get')
   .option('--pp', 'pretty print output (alias)')
   .option('--format <type>', 'format of the output (json, shell, colon, eval)', 'json')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .action(function (...args) {
     this.envs = envs
@@ -117,7 +115,6 @@ program.command('set')
   .option('-p, --plain', 'store value as plain text', false)
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .action(function (...args) {
     this.envs = envs
@@ -126,7 +123,7 @@ program.command('set')
 
 // dotenvx encrypt
 program.command('encrypt')
-  .description('convert .env file(s) to encrypted .env file(s)')
+  .description('encrypt .env file(s)')
   .option('-f, --env-file <paths...>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('-k, --key <keys...>', 'keys(s) to encrypt (default: all keys in file)')
@@ -135,7 +132,6 @@ program.command('encrypt')
   .option('--token <token>', 'set Armor ⛨ token')
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .action(function (...args) {
     this.envs = envs
@@ -144,13 +140,12 @@ program.command('encrypt')
 
 // dotenvx decrypt
 program.command('decrypt')
-  .description('convert encrypted .env file(s) to plain .env file(s)')
+  .description('decrypt .env file(s)')
   .option('-f, --env-file <paths...>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('-k, --key <keys...>', 'keys(s) to decrypt (default: all keys in file)')
   .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from decryption (default: none)')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .option('--stdout', 'send to stdout')
   .action(function (...args) {
@@ -166,7 +161,6 @@ program.command('rotate')
   .option('-k, --key <keys...>', 'keys(s) to encrypt (default: all keys in file)')
   .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from encryption (default: none)')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .option('--stdout', 'send to stdout')
   .action(function (...args) {
@@ -182,7 +176,6 @@ program.command('keypair')
   .option('-f, --env-file <paths...>', 'path(s) to your env file(s)')
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
@@ -211,20 +204,20 @@ program.command('doctor', { hidden: true })
 
 // dotenvx login
 program.command('login', { hidden: true })
-  .description('')
+  .description('log in to move keys off-device, share with your team, and audit access')
   .allowUnknownOption()
-  .action(() => {
-    const rawArgs = ['armor', 'login', ...process.argv.slice(3)]
-    executeDynamic(program, 'armor', rawArgs)
+  .option('--hostname <hostname>', 'set Armor ⛨ hostname')
+  .action(function (...args) {
+    return require('./actions/login').apply(this, args)
   })
 
 // dotenvx logout
 program.command('logout', { hidden: true })
-  .description('log out of your dotenvx account')
+  .description('log out of connected security features')
   .allowUnknownOption()
-  .action(() => {
-    const rawArgs = ['armor', 'logout', ...process.argv.slice(3)]
-    executeDynamic(program, 'armor', rawArgs)
+  .option('--hostname <hostname>', 'set Armor ⛨ hostname')
+  .action(function (...args) {
+    return require('./actions/logout').apply(this, args)
   })
 
 // dotenvx help
@@ -245,8 +238,10 @@ program.command('help [command]')
 
 // dotenvx armor
 program.addHelpText('after', ' ')
-program.addHelpText('after', 'Advanced: ')
-program.addHelpText('after', '  armor                    ⛨ ARMORED KEYS [www.dotenvx.com/armor]')
+program.addHelpText('after', 'Professional Security: ')
+program.addHelpText('after', '  login                    log in to move keys off-device, share with your team, and audit access')
+program.addHelpText('after', '  logout                   log out of connected security features')
+program.addHelpText('after', '  armor                    ⛨ move private keys off-device [www.dotenvx.com/armor]')
 program.addHelpText('after', '  ext                      ⊕ extensions')
 
 // dotenvx ext

package/src/db/device.js

@@ -0,0 +1,73 @@
+const Conf = require('conf')
+const { PrivateKey } = require('eciesjs')
+
+const encryptDeviceValue = require('./../lib/helpers/encryptDeviceValue')
+const decryptDeviceValue = require('./../lib/helpers/decryptDeviceValue')
+
+class Device {
+  constructor () {
+    this.store = new Conf({
+      cwd: process.env.DOTENVX_CONFIG || undefined,
+      projectName: 'dotenvx',
+      configName: '.device-key',
+      projectSuffix: '',
+      fileExtension: '',
+      encryptionKey: 'dotenvxpro dotenvxpro dotenvxpro' // backwards compatible
+    })
+  }
+
+  touch () {
+    const _privateKey = this.privateKey()
+    const _publicKey = this.publicKey()
+
+    return {
+      privateKey: _privateKey,
+      publicKey: _publicKey
+    }
+  }
+
+  configPath () {
+    return this.store.path
+  }
+
+  privateKey () {
+    const currentPrivateKey = this.store.get('private_key/1')
+    if (currentPrivateKey && currentPrivateKey.length > 0) {
+      this.store.set('private_key/1', currentPrivateKey)
+
+      return currentPrivateKey
+    }
+
+    // generate privateKey for the first time
+    const kp = new PrivateKey()
+    const _privateKey = kp.secret.toString('hex')
+
+    this.store.set('private_key/1', _privateKey)
+
+    return _privateKey
+  }
+
+  publicKey () {
+    // must have private key to try and get public key
+    const privateKeyHex = this.privateKey()
+    if (!privateKeyHex || privateKeyHex.length < 1) {
+      return ''
+    }
+
+    // create keyPair object from hex string
+    const _privateKey = new PrivateKey(Buffer.from(privateKeyHex, 'hex'))
+
+    // compute publicKey from privateKey
+    return _privateKey.publicKey.toHex()
+  }
+
+  encrypt (value) {
+    return encryptDeviceValue(value, this.publicKey())
+  }
+
+  decrypt (value) {
+    return decryptDeviceValue(value, this.privateKey())
+  }
+}
+
+module.exports = Device