@dotenvx/dotenvx 1.71.3 → 1.72.0

package/CHANGELOG.md

@@ -2,7 +2,15 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.71.3...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.72.0...main)
+
+## [1.72.0](https://github.com/dotenvx/dotenvx/compare/v1.71.3...v1.72.0) (2026-06-15)
+
+### Added
+
+* Move `armor login` command to first class `dotenvx login` command. ([#836](https://github.com/dotenvx/dotenvx/pull/836))
+* `dotenvx` remains local-first: login is optional and only needed when you want Armor features like moving keys off-device, team sharing, and audit access.
+* Patch 2 high severity dependencies ([#837](https://github.com/dotenvx/dotenvx/pull/837))
 
 ## [1.71.3](https://github.com/dotenvx/dotenvx/compare/v1.71.2...v1.71.3) (2026-06-11)
 

package/README.md

@@ -2119,8 +2119,8 @@ Commands:
   run                inject env at runtime [dotenvx run -- yourcommand]
   get [KEY]          return a single environment variable
   set <KEY> <value>  set a single environment variable
-  encrypt            convert .env file(s) to encrypted .env file(s)
-  decrypt            convert encrypted .env file(s) to plain .env file(s)
+  encrypt            encrypt .env file(s)
+  decrypt            decrypt .env file(s)
   keypair [KEY]      print public/private keys for .env file(s)
   ls [directory]     print all .env files in a tree structure
  

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.71.3",
+  "version": "1.72.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -45,21 +45,26 @@
   "funding": "https://dotenvx.com",
   "dependencies": {
     "commander": "^11.1.0",
+    "conf": "^10.2.0",
     "dotenv": "^17.2.1",
     "eciesjs": "^0.4.10",
     "enquirer": "^2.4.1",
+    "env-paths": "^2.2.1",
     "execa": "^5.1.1",
     "fdir": "^6.2.0",
     "ignore": "^5.3.0",
     "object-treeify": "1.1.33",
+    "open": "^8.4.2",
     "picomatch": "^4.0.4",
+    "systeminformation": "^5.22.11",
+    "undici": "^7.11.0",
     "which": "^4.0.0",
     "yocto-spinner": "^1.1.0"
   },
   "devDependencies": {
-    "@yao-pkg/pkg": "^6.14.2",
+    "@yao-pkg/pkg": "^6.12.0",
     "capture-console": "^1.0.2",
-    "esbuild": "^0.25.8",
+    "esbuild": "^0.28.1",
     "proxyquire": "^2.1.3",
     "sinon": "^14.0.1",
     "standard": "^17.1.0",

package/src/cli/actions/decrypt.js

@@ -13,8 +13,8 @@ async function decrypt () {
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
-  const sesh = new Session()
   const envs = this.envs
+  const sesh = new Session()
   const noArmor = options.armor === false || (await sesh.noArmor())
 
   let errorCount = 0

package/src/cli/actions/encrypt.js

@@ -46,8 +46,8 @@ async function encrypt () {
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
-  const sesh = new Session()
   const envs = this.envs
+  const sesh = new Session()
   const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
   const noCreate = options.create === false
 

package/src/cli/actions/login.js

@@ -0,0 +1,63 @@
+const { logger } = require('../../shared/logger')
+
+const Session = require('../../db/session')
+const Login = require('../../lib/services/login')
+const LoginPoll = require('../../lib/services/loginPoll')
+
+const createSpinner = require('../../lib/helpers/createSpinner')
+const formatCode = require('../../lib/helpers/formatCode')
+const listenForOpenKey = require('../../lib/helpers/listenForOpenKey')
+const openUrl = require('../../lib/helpers/openUrl')
+
+const FRAMES = ['◐', '◓', '◑', '◒']
+
+async function login () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'logging in', frames: FRAMES })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  let cleanupOpenKeyListener = () => {}
+
+  try {
+    const {
+      deviceCode,
+      userCode,
+      verificationUri,
+      verificationUriComplete,
+      interval
+    } = await new Login(hostname).run()
+
+    const promptMessage = `◌ press Enter to open [${verificationUri}] and enter code [${formatCode(userCode)}]...`
+
+    logger.debug(`POST ${hostname} with deviceCode ${deviceCode} at interval ${interval}`)
+    logger.info(promptMessage)
+
+    // begin polling
+    const pollPromise = new LoginPoll(hostname, deviceCode, interval).run()
+    cleanupOpenKeyListener = listenForOpenKey(() => openUrl(verificationUriComplete))
+    const data = await pollPromise
+
+    cleanupOpenKeyListener()
+    if (spinner) spinner.stop()
+    logger.success(`◉ logged in (${data.username})`)
+    process.exit(0)
+  } catch (error) {
+    cleanupOpenKeyListener()
+    if (spinner) spinner.stop()
+    if (error.message) {
+      logger.error(error.message)
+    } else {
+      logger.error(error)
+    }
+    if (error.stack) {
+      logger.debug(error.stack)
+    }
+    process.exit(1)
+  }
+}
+
+module.exports = login

package/src/cli/actions/logout.js

@@ -0,0 +1,36 @@
+const { logger } = require('../../shared/logger')
+
+const Session = require('../../db/session')
+const Logout = require('../../lib/services/logout')
+const createSpinner = require('../../lib/helpers/createSpinner')
+
+const FRAMES = ['◐', '◓', '◑', '◒']
+
+async function logout () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'logging out', frames: FRAMES })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  const hostname = options.hostname || sesh.hostname()
+
+  try {
+    const data = await new Logout(hostname).run()
+    if (spinner) spinner.stop()
+    logger.success(`◌ logged out (${data.username})`)
+  } catch (error) {
+    if (spinner) spinner.stop()
+    if (error.message) {
+      logger.error(error.message)
+    } else {
+      logger.error(error)
+    }
+    if (error.stack) {
+      logger.debug(error.stack)
+    }
+    process.exit(1)
+  }
+}
+
+module.exports = logout

package/src/cli/actions/normalizeArmorOptions.js

@@ -1,8 +1,7 @@
 function normalizeArmorOptions (options) {
-  if (options.armor === false || options.ops === false || options.vlt === false) {
+  if (options.armor === false || options.ops === false) {
     options.armor = false
     options.ops = false
-    options.vlt = false
   }
 
   return options

package/src/cli/actions/set.js

@@ -24,9 +24,9 @@ async function set (key, value) {
   logger.debug(`options: ${JSON.stringify(options)}`)
 
   try {
-    const sesh = new Session()
     const envs = this.envs
     const envKeysFilepath = options.envKeysFile
+    const sesh = new Session()
     const noArmor = options.armor === false || (await sesh.noArmor())
     const noCreate = options.create === false
 

package/src/cli/dotenvx.js

@@ -72,7 +72,6 @@ program.command('run')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
   .option('--token <token>', 'set Armor ⛨ token')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .action(function (...args) {
     this.envs = envs
@@ -96,7 +95,6 @@ program.command('get')
   .option('--pp', 'pretty print output (alias)')
   .option('--format <type>', 'format of the output (json, shell, colon, eval)', 'json')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .action(function (...args) {
     this.envs = envs
@@ -117,7 +115,6 @@ program.command('set')
   .option('-p, --plain', 'store value as plain text', false)
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .action(function (...args) {
     this.envs = envs
@@ -126,7 +123,7 @@ program.command('set')
 
 // dotenvx encrypt
 program.command('encrypt')
-  .description('convert .env file(s) to encrypted .env file(s)')
+  .description('encrypt .env file(s)')
   .option('-f, --env-file <paths...>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('-k, --key <keys...>', 'keys(s) to encrypt (default: all keys in file)')
@@ -135,7 +132,6 @@ program.command('encrypt')
   .option('--token <token>', 'set Armor ⛨ token')
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .action(function (...args) {
     this.envs = envs
@@ -144,13 +140,12 @@ program.command('encrypt')
 
 // dotenvx decrypt
 program.command('decrypt')
-  .description('convert encrypted .env file(s) to plain .env file(s)')
+  .description('decrypt .env file(s)')
   .option('-f, --env-file <paths...>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('-k, --key <keys...>', 'keys(s) to decrypt (default: all keys in file)')
   .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from decryption (default: none)')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .option('--stdout', 'send to stdout')
   .action(function (...args) {
@@ -166,7 +161,6 @@ program.command('rotate')
   .option('-k, --key <keys...>', 'keys(s) to encrypt (default: all keys in file)')
   .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from encryption (default: none)')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .option('--stdout', 'send to stdout')
   .action(function (...args) {
@@ -182,7 +176,6 @@ program.command('keypair')
   .option('-f, --env-file <paths...>', 'path(s) to your env file(s)')
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
@@ -211,20 +204,20 @@ program.command('doctor', { hidden: true })
 
 // dotenvx login
 program.command('login', { hidden: true })
-  .description('')
+  .description('log in to move keys off-device, share with your team, and audit access')
   .allowUnknownOption()
-  .action(() => {
-    const rawArgs = ['armor', 'login', ...process.argv.slice(3)]
-    executeDynamic(program, 'armor', rawArgs)
+  .option('--hostname <hostname>', 'set Armor ⛨ hostname')
+  .action(function (...args) {
+    return require('./actions/login').apply(this, args)
   })
 
 // dotenvx logout
 program.command('logout', { hidden: true })
-  .description('log out of your dotenvx account')
+  .description('log out of connected security features')
   .allowUnknownOption()
-  .action(() => {
-    const rawArgs = ['armor', 'logout', ...process.argv.slice(3)]
-    executeDynamic(program, 'armor', rawArgs)
+  .option('--hostname <hostname>', 'set Armor ⛨ hostname')
+  .action(function (...args) {
+    return require('./actions/logout').apply(this, args)
   })
 
 // dotenvx help
@@ -245,8 +238,10 @@ program.command('help [command]')
 
 // dotenvx armor
 program.addHelpText('after', ' ')
-program.addHelpText('after', 'Advanced: ')
-program.addHelpText('after', '  armor                    ⛨ ARMORED KEYS [www.dotenvx.com/armor]')
+program.addHelpText('after', 'Professional Security: ')
+program.addHelpText('after', '  login                    log in to move keys off-device, share with your team, and audit access')
+program.addHelpText('after', '  logout                   log out of connected security features')
+program.addHelpText('after', '  armor                    ⛨ move private keys off-device [www.dotenvx.com/armor]')
 program.addHelpText('after', '  ext                      ⊕ extensions')
 
 // dotenvx ext

package/src/db/device.js

@@ -0,0 +1,73 @@
+const Conf = require('conf')
+const { PrivateKey } = require('eciesjs')
+
+const encryptDeviceValue = require('./../lib/helpers/encryptDeviceValue')
+const decryptDeviceValue = require('./../lib/helpers/decryptDeviceValue')
+
+class Device {
+  constructor () {
+    this.store = new Conf({
+      cwd: process.env.DOTENVX_CONFIG || undefined,
+      projectName: 'dotenvx',
+      configName: '.device-key',
+      projectSuffix: '',
+      fileExtension: '',
+      encryptionKey: 'dotenvxpro dotenvxpro dotenvxpro' // backwards compatible
+    })
+  }
+
+  touch () {
+    const _privateKey = this.privateKey()
+    const _publicKey = this.publicKey()
+
+    return {
+      privateKey: _privateKey,
+      publicKey: _publicKey
+    }
+  }
+
+  configPath () {
+    return this.store.path
+  }
+
+  privateKey () {
+    const currentPrivateKey = this.store.get('private_key/1')
+    if (currentPrivateKey && currentPrivateKey.length > 0) {
+      this.store.set('private_key/1', currentPrivateKey)
+
+      return currentPrivateKey
+    }
+
+    // generate privateKey for the first time
+    const kp = new PrivateKey()
+    const _privateKey = kp.secret.toString('hex')
+
+    this.store.set('private_key/1', _privateKey)
+
+    return _privateKey
+  }
+
+  publicKey () {
+    // must have private key to try and get public key
+    const privateKeyHex = this.privateKey()
+    if (!privateKeyHex || privateKeyHex.length < 1) {
+      return ''
+    }
+
+    // create keyPair object from hex string
+    const _privateKey = new PrivateKey(Buffer.from(privateKeyHex, 'hex'))
+
+    // compute publicKey from privateKey
+    return _privateKey.publicKey.toHex()
+  }
+
+  encrypt (value) {
+    return encryptDeviceValue(value, this.publicKey())
+  }
+
+  decrypt (value) {
+    return decryptDeviceValue(value, this.privateKey())
+  }
+}
+
+module.exports = Device

package/src/db/session.js

@@ -1,9 +1,139 @@
+const fs = require('fs')
+const path = require('path')
+const Conf = require('conf')
+const dotenv = require('dotenv')
+const envPaths = require('env-paths')
+
 const Armor = require('./../lib/extensions/armor')
+const jsonToEnv = require('./../lib/helpers/jsonToEnv')
 const { logger } = require('./../shared/logger')
 
+const ARMOR = {
+  HOSTNAME: 'DOTENVX_ARMOR_HOSTNAME',
+  USER: 'DOTENVX_ARMOR_USER',
+  USERNAME: 'DOTENVX_ARMOR_USERNAME',
+  TOKEN: 'DOTENVX_ARMOR_TOKEN',
+  ON: 'DOTENVX_ARMOR_ON',
+  VERSION: 'DOTENVX_ARMOR_VERSION',
+  VERSION_LAST_CHECK: 'DOTENVX_ARMOR_VERSION_LAST_CHECK'
+}
+
 class Session {
   constructor () {
     this.armor = new Armor()
+    this._store = null
+  }
+
+  _configPath () {
+    const cwd = process.env.DOTENVX_CONFIG || this._defaultConfigCwd()
+    return path.resolve(cwd, '.env')
+  }
+
+  _defaultConfigCwd () {
+    return envPaths('dotenvx', { suffix: '' }).config
+  }
+
+  _configExists () {
+    return fs.existsSync(this._configPath())
+  }
+
+  _newStore () {
+    return new Conf({
+      cwd: process.env.DOTENVX_CONFIG || undefined,
+      projectName: 'dotenvx',
+      configName: '.env',
+      projectSuffix: '',
+      fileExtension: '',
+      serialize: function (json) {
+        return jsonToEnv(json)
+      },
+      // Convert .env format to an object
+      deserialize: function (env) {
+        return dotenv.parse(env)
+      }
+    })
+  }
+
+  createStore () {
+    if (!this._store) this._store = this._newStore()
+    return this._store
+  }
+
+  openStore () {
+    if (!this._store && !this._configExists()) {
+      return null
+    }
+
+    if (!this._store) this._store = this._newStore()
+    return this._store
+  }
+
+  get store () {
+    return this.openStore()
+  }
+
+  status () {
+    // if logged in
+    if (this.username() && this.token() && this.on()) {
+      return 'on'
+    }
+
+    return 'off'
+  }
+
+  //
+  // Get
+  //
+  readSetting (key) {
+    const store = this.openStore()
+    if (!store) return undefined
+
+    return store.get(ARMOR[key])
+  }
+
+  hostname () {
+    return this.readSetting('HOSTNAME') || 'https://armor.dotenvx.com'
+  }
+
+  username () {
+    return this.readSetting('USERNAME') || undefined
+  }
+
+  token () {
+    return this.readSetting('TOKEN') || undefined
+  }
+
+  devicePublicKey () {
+    const Device = require('./device')
+    return new Device().publicKey()
+  }
+
+  path () {
+    return this._store ? this._store.path : this._configPath()
+  }
+
+  on () {
+    return (this.readSetting('ON') || 'true') === 'true'
+  }
+
+  off () {
+    return (this.readSetting('ON') || 'true') === 'false'
+  }
+
+  async systemInformation () {
+    const si = require('systeminformation')
+    const system = await si.system()
+    const osInfo = await si.osInfo()
+
+    return {
+      system_uuid: system.uuid,
+      os_platform: osInfo.platform,
+      os_arch: osInfo.arch
+    }
+  }
+
+  async notifyUpdate () {
+    // native login keeps this lightweight; sidecar commands still handle full update messaging
   }
 
   //
@@ -20,6 +150,62 @@ class Session {
     logger.debug(`armor: ${status}`)
     return status === 'off'
   }
+
+  //
+  // Set/Delete
+  //
+  login (hostname, id, username, accessToken) {
+    if (!hostname) {
+      throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx login]')
+    }
+
+    if (!id) {
+      throw new Error('DOTENVX_ARMOR_USER not set. Run [dotenvx login]')
+    }
+
+    if (!username) {
+      throw new Error('DOTENVX_ARMOR_USERNAME not set. Run [dotenvx login]')
+    }
+
+    if (!accessToken) {
+      throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx login]')
+    }
+
+    const store = this.createStore()
+    store.set(ARMOR.USER, id)
+    store.set(ARMOR.USERNAME, username)
+    store.set(ARMOR.TOKEN, accessToken)
+    store.set(ARMOR.HOSTNAME, hostname)
+    store.set(ARMOR.ON, 'true')
+
+    return accessToken
+  }
+
+  logout (hostname, id, accessToken) {
+    if (!hostname) {
+      throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx login]')
+    }
+
+    if (!id) {
+      throw new Error('DOTENVX_ARMOR_USER not set. Run [dotenvx login]')
+    }
+
+    if (!accessToken) {
+      throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx login]')
+    }
+
+    const store = this.openStore()
+    if (!store) return true
+
+    store.delete(ARMOR.USER)
+    store.delete(ARMOR.USERNAME)
+    store.delete(ARMOR.TOKEN)
+    store.delete(ARMOR.HOSTNAME)
+    store.delete(ARMOR.ON)
+    store.delete(ARMOR.VERSION)
+    store.delete(ARMOR.VERSION_LAST_CHECK)
+    return true
+  }
 }
 
 module.exports = Session

package/src/lib/api/postLogout.js

@@ -0,0 +1,34 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+const normalizeToken = require('../helpers/normalizeToken')
+
+class PostLogout {
+  constructor (hostname, token) {
+    this.hostname = hostname
+    this.token = token
+  }
+
+  async run () {
+    const token = normalizeToken(this.token)
+    const url = `${this.hostname}/api/logout`
+
+    const resp = await http(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({})
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostLogout

package/src/lib/api/postOauthDeviceCode.js

@@ -0,0 +1,38 @@
+const { http } = require('../helpers/http')
+const buildOauthError = require('../helpers/buildOauthError')
+
+const OAUTH_CLIENT_ID = 'oac_dotenvxcli'
+
+class PostOauthDeviceCode {
+  constructor (hostname, devicePublicKey, systemInformation, dotenvxProjectId = null) {
+    this.hostname = hostname
+    this.devicePublicKey = devicePublicKey
+    this.systemInformation = systemInformation
+    this.dotenvxProjectId = dotenvxProjectId
+  }
+
+  async run () {
+    const resp = await http(`${this.hostname}/oauth/device/code`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        client_id: OAUTH_CLIENT_ID,
+        device_public_key: this.devicePublicKey,
+        system_information: this.systemInformation,
+        dotenvx_project_id: this.dotenvxProjectId
+      })
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildOauthError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostOauthDeviceCode

package/src/lib/api/postOauthToken.js

@@ -0,0 +1,35 @@
+const { http } = require('../helpers/http')
+const buildOauthError = require('../helpers/buildOauthError')
+
+const OAUTH_CLIENT_ID = 'oac_dotenvxcli'
+
+class PostOauthToken {
+  constructor (hostname, deviceCode) {
+    this.hostname = hostname
+    this.deviceCode = deviceCode
+  }
+
+  async run () {
+    const resp = await http(`${this.hostname}/oauth/token`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        client_id: OAUTH_CLIENT_ID,
+        device_code: this.deviceCode,
+        grant_type: 'urn:ietf:params:oauth:grant-type:device_code'
+      })
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildOauthError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostOauthToken

package/src/lib/helpers/buildApiError.js

@@ -0,0 +1,16 @@
+function buildApiError (statusCode, json) {
+  const code = json.error.code || statusCode.toString()
+  const message = `[${code}] ${json.error.message}`
+  const help = `[${code}] ${json.error.help || JSON.stringify(json)}`
+  const meta = json.error.meta
+
+  const error = new Error(message)
+  error.code = code
+  error.help = help
+  error.meta = meta
+  error.json = json
+
+  return error
+}
+
+module.exports = buildApiError

package/src/lib/helpers/buildOauthError.js

@@ -0,0 +1,14 @@
+function buildOauthError (statusCode, json) {
+  const code = json.error
+  const message = `[${code}] ${json.error_description}`
+  const help = `[${code}] ${JSON.stringify(json)}`
+
+  const error = new Error(message)
+  error.code = code
+  error.help = help
+  error.statusCode = statusCode
+
+  return error
+}
+
+module.exports = buildOauthError

package/src/lib/helpers/createSpinner.js

@@ -4,7 +4,7 @@ const FRAME_INTERVAL_MS = 80
 async function createSpinner (options = {}) {
   const stream = process.stderr
   const hasCursorControls = typeof stream.cursorTo === 'function' && typeof stream.clearLine === 'function'
-  const enabled = Boolean(stream.isTTY && hasCursorControls && !options.quiet && !options.verbose && !options.debug)
+  const enabled = Boolean(stream.isTTY && hasCursorControls && options.spinner !== false && !options.quiet && !options.verbose && !options.debug)
   if (!enabled) return null
 
   const text = options.text || 'thinking'

package/src/lib/helpers/decryptDeviceValue.js

@@ -0,0 +1,10 @@
+const { decrypt } = require('eciesjs')
+
+function decryptDeviceValue (value, privateKey) {
+  const secret = Buffer.from(privateKey, 'hex')
+  const ciphertext = Buffer.from(value, 'base64')
+
+  return decrypt(secret, ciphertext).toString()
+}
+
+module.exports = decryptDeviceValue

package/src/lib/helpers/encryptDeviceValue.js

@@ -0,0 +1,9 @@
+const { encrypt } = require('eciesjs')
+
+function encryptDeviceValue (value, publicKey) {
+  const ciphertext = encrypt(publicKey, Buffer.from(value))
+
+  return Buffer.from(ciphertext, 'hex').toString('base64')
+}
+
+module.exports = encryptDeviceValue

package/src/lib/helpers/formatCode.js

@@ -0,0 +1,11 @@
+function formatCode (str) {
+  const parts = []
+
+  for (let i = 0; i < str.length; i += 4) {
+    parts.push(str.substring(i, i + 4))
+  }
+
+  return parts.join('-')
+}
+
+module.exports = formatCode

package/src/lib/helpers/http.js

@@ -0,0 +1,7 @@
+const { request } = require('undici')
+
+async function http (url, opts = {}) {
+  return await request(url, opts)
+}
+
+module.exports = { http }

package/src/lib/helpers/jsonToEnv.js

@@ -0,0 +1,7 @@
+function jsonToEnv (json) {
+  return Object.entries(json).map(function ([key, value]) {
+    return key + '=' + `"${value}"`
+  }).join('\n')
+}
+
+module.exports = jsonToEnv

package/src/lib/helpers/listenForOpenKey.js

@@ -0,0 +1,46 @@
+function listenForOpenKey (onOpen) {
+  const stdin = process.stdin
+  if (!stdin.isTTY) return () => {}
+
+  const canSetRawMode = typeof stdin.setRawMode === 'function'
+  const wasRawMode = Boolean(stdin.isRaw)
+  let didHandleOpenChoice = false
+
+  const cleanup = () => {
+    stdin.off('data', onData)
+    if (canSetRawMode) stdin.setRawMode(wasRawMode)
+    stdin.pause()
+  }
+
+  const onData = (chunk) => {
+    const key = String(chunk)
+    const lower = key.toLowerCase()
+
+    if (key === '\u0003') {
+      cleanup()
+      process.kill(process.pid, 'SIGINT')
+      return
+    }
+
+    if (key === '\r' || key === '\n' || lower === 'y') {
+      if (!didHandleOpenChoice) {
+        didHandleOpenChoice = true
+        Promise.resolve(onOpen()).catch(() => {})
+      }
+      return
+    }
+
+    if (lower === 'n') {
+      cleanup()
+      process.kill(process.pid, 'SIGINT')
+    }
+  }
+
+  if (canSetRawMode) stdin.setRawMode(true)
+  stdin.resume()
+  stdin.on('data', onData)
+
+  return cleanup
+}
+
+module.exports = listenForOpenKey

package/src/lib/helpers/normalizeToken.js

@@ -0,0 +1,5 @@
+function normalizeToken (token) {
+  return token == null ? '' : token
+}
+
+module.exports = normalizeToken

package/src/lib/helpers/openUrl.js

@@ -0,0 +1,7 @@
+const open = require('open')
+
+async function openUrl (url) {
+  return await open(url, { wait: false })
+}
+
+module.exports = openUrl

package/src/lib/main.d.ts

@@ -179,14 +179,6 @@ export interface DotenvConfigOptions {
    */
   noArmor?: boolean;
 
-  /**
-   * Turn off Dotenvx Armor features. Alias for `noArmor`.
-   *
-   * @default false
-   * @example require('@dotenvx/dotenvx').config({ noVlt: true })
-   */
-  noVlt?: boolean;
-
   /**
    * Turn off Dotenvx Armor features. Alias for `noArmor`.
    *
@@ -270,14 +262,6 @@ export interface SetOptions {
    */
   noArmor?: boolean;
 
-  /**
-   * Turn off Dotenvx Armor features. Alias for `noArmor`.
-   *
-   * @default false
-   * @example require('@dotenvx/dotenvx').set(key, value, { noVlt: true })
-   */
-  noVlt?: boolean;
-
   /**
    * Turn off Dotenvx Armor features. Alias for `noArmor`.
    *
@@ -363,14 +347,6 @@ export interface GetOptions {
    */
   noArmor?: boolean;
 
-  /**
-   * Turn off Dotenvx Armor features. Alias for `noArmor`.
-   *
-   * @default false
-   * @example require('@dotenvx/dotenvx').get('KEY', { noVlt: true })
-   */
-  noVlt?: boolean;
-
   /**
    * Turn off Dotenvx Armor features. Alias for `noArmor`.
    *

package/src/lib/main.js

@@ -325,7 +325,7 @@ const keypair = function (envFile, key, envKeysFile = null, noArmor = false) {
 
 function resolveNoArmor (options = {}) {
   const sesh = new Session()
-  return options.noArmor === true || options.noVlt === true || options.noOps === true || (!options.token && sesh.noArmorSync())
+  return options.noArmor === true || options.noOps === true || (!options.token && sesh.noArmorSync())
 }
 
 module.exports = {

package/src/lib/services/login.js

@@ -0,0 +1,26 @@
+const Session = require('../../db/session')
+const PostOauthDeviceCode = require('../api/postOauthDeviceCode')
+
+class Login {
+  constructor (hostname) {
+    this.hostname = hostname
+  }
+
+  async run () {
+    const sesh = new Session()
+    const devicePublicKey = sesh.devicePublicKey()
+    const systemInformation = await sesh.systemInformation()
+
+    const data = await new PostOauthDeviceCode(this.hostname, devicePublicKey, systemInformation).run()
+
+    return {
+      deviceCode: data.device_code,
+      userCode: data.user_code,
+      verificationUri: data.verification_uri,
+      verificationUriComplete: data.verification_uri_complete,
+      interval: data.interval
+    }
+  }
+}
+
+module.exports = Login

package/src/lib/services/loginPoll.js

@@ -0,0 +1,35 @@
+const Session = require('../../db/session')
+const PostOauthToken = require('../api/postOauthToken')
+
+class LoginPoll {
+  constructor (hostname, deviceCode, interval) {
+    this.hostname = hostname
+    this.deviceCode = deviceCode
+    this.interval = interval
+  }
+
+  async run () {
+    const sesh = new Session()
+
+    while (true) {
+      try {
+        const data = await new PostOauthToken(this.hostname, this.deviceCode).run()
+
+        if (data.access_token) {
+          sesh.login(this.hostname, data.id, data.username, data.access_token)
+          return data
+        }
+
+        await new Promise(resolve => setTimeout(resolve, this.interval * 1000))
+      } catch (error) {
+        if (error.code === 'authorization_pending') {
+          await new Promise(resolve => setTimeout(resolve, (this.interval + 1) * 1000))
+        } else {
+          throw error
+        }
+      }
+    }
+  }
+}
+
+module.exports = LoginPoll

package/src/lib/services/logout.js

@@ -0,0 +1,26 @@
+const Session = require('../../db/session')
+const PostLogout = require('../api/postLogout')
+
+class Logout {
+  constructor (hostname) {
+    this.hostname = hostname
+  }
+
+  async run () {
+    const sesh = new Session()
+    const token = sesh.token()
+
+    const data = await new PostLogout(this.hostname, token).run()
+
+    const id = data.id
+    const username = data.username
+    const accessToken = data.access_token
+    const settingsDevicesUrl = `${this.hostname}/settings/devices`
+
+    sesh.logout(this.hostname, id, accessToken)
+
+    return { username, accessToken, settingsDevicesUrl }
+  }
+}
+
+module.exports = Logout