@dotenvx/dotenvx 1.71.3 → 1.73.0

package/CHANGELOG.md

@@ -2,7 +2,23 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.71.3...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.73.0...main)
+
+## [1.73.0](https://github.com/dotenvx/dotenvx/compare/v1.72.0...v1.73.0) (2026-06-16)
+
+### Added
+
+* Add `dotenvx armor` commands directly inside dotenvx ([#839](https://github.com/dotenvx/dotenvx/pull/839))
+
+> `dotenvx` remains local-first: `armor` commands are optional under professional security section
+
+## [1.72.0](https://github.com/dotenvx/dotenvx/compare/v1.71.3...v1.72.0) (2026-06-15)
+
+### Added
+
+* Move `armor login` command to first class `dotenvx login` command. ([#836](https://github.com/dotenvx/dotenvx/pull/836))
+* `dotenvx` remains local-first: login is optional and only needed when you want Armor features like moving keys off-device, team sharing, and audit access.
+* Patch 2 high severity dependencies ([#837](https://github.com/dotenvx/dotenvx/pull/837))
 
 ## [1.71.3](https://github.com/dotenvx/dotenvx/compare/v1.71.2...v1.71.3) (2026-06-11)
 

package/README.md

@@ -11,7 +11,7 @@
  
 
 
-### Quickstart [![npm version](https://img.shields.io/npm/v/@dotenvx/dotenvx.svg)](https://www.npmjs.com/package/@dotenvx/dotenvx) [![downloads](https://img.shields.io/npm/dw/@dotenvx/dotenvx)](https://www.npmjs.com/package/@dotenvx/dotenvx) [![test suite](https://img.shields.io/endpoint?url=https://gist.githubusercontent.com/motdotenv/bb76445765a9731e7d824a6efdf53524/raw/dotenvxTestCount.json)](https://github.com/dotenvx/dotenvx/tree/main/tests) 
+### Quickstart [![npm version](https://img.shields.io/npm/v/@dotenvx/dotenvx.svg)](https://www.npmjs.com/package/@dotenvx/dotenvx) [![downloads](https://img.shields.io/npm/dw/@dotenvx/dotenvx)](https://www.npmjs.com/package/@dotenvx/dotenvx)
 
 Install and use it in code just like `dotenv`.
 
@@ -2119,8 +2119,8 @@ Commands:
   run                inject env at runtime [dotenvx run -- yourcommand]
   get [KEY]          return a single environment variable
   set <KEY> <value>  set a single environment variable
-  encrypt            convert .env file(s) to encrypted .env file(s)
-  decrypt            convert encrypted .env file(s) to plain .env file(s)
+  encrypt            encrypt .env file(s)
+  decrypt            decrypt .env file(s)
   keypair [KEY]      print public/private keys for .env file(s)
   ls [directory]     print all .env files in a tree structure
  

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.71.3",
+  "version": "1.73.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -36,7 +36,6 @@
     "standard": "standard",
     "standard:fix": "standard --fix",
     "test": "tap run --test-env=DOTENVX_NO_ARMOR=true --allow-empty-coverage --disable-coverage --timeout=60000",
-    "test-coverage": "tap run --test-env=DOTENVX_NO_ARMOR=true --show-full-coverage --timeout=60000",
     "testshell": "bash shellspec",
     "release:check": "npm test && npm run testshell",
     "prerelease": "npm run release:check",
@@ -45,21 +44,26 @@
   "funding": "https://dotenvx.com",
   "dependencies": {
     "commander": "^11.1.0",
+    "conf": "^10.2.0",
     "dotenv": "^17.2.1",
     "eciesjs": "^0.4.10",
     "enquirer": "^2.4.1",
+    "env-paths": "^2.2.1",
     "execa": "^5.1.1",
     "fdir": "^6.2.0",
     "ignore": "^5.3.0",
     "object-treeify": "1.1.33",
+    "open": "^8.4.2",
     "picomatch": "^4.0.4",
+    "systeminformation": "^5.22.11",
+    "undici": "^7.11.0",
     "which": "^4.0.0",
     "yocto-spinner": "^1.1.0"
   },
   "devDependencies": {
-    "@yao-pkg/pkg": "^6.14.2",
+    "@yao-pkg/pkg": "^6.12.0",
     "capture-console": "^1.0.2",
-    "esbuild": "^0.25.8",
+    "esbuild": "^0.28.1",
     "proxyquire": "^2.1.3",
     "sinon": "^14.0.1",
     "standard": "^17.1.0",

package/src/cli/actions/armor/down.js

@@ -0,0 +1,37 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorDown = require('./../../../lib/services/armorDown')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function down () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'dearmoring' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const { changed, privateKeyName, publicKeyValue } = await new ArmorDown(hostname, token, devicePublicKey, options.envFile, options.team).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`◇ dearmored to .env.keys (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = down

package/src/cli/actions/armor/move.js

@@ -0,0 +1,42 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorMove = require('./../../../lib/services/armorMove')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function move () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'moving' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const {
+      changed,
+      privateKeyName,
+      publicKeyValue,
+      team
+    } = await new ArmorMove(hostname, token, devicePublicKey, options.envFile).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`⛨ moved to ${team} (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = move

package/src/cli/actions/armor/pull.js

@@ -0,0 +1,37 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorPull = require('./../../../lib/services/armorPull')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function pull () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'pulling' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const { changed, privateKeyName, publicKeyValue } = await new ArmorPull(hostname, token, devicePublicKey, options.envFile, options.team).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`◇ pulled to .env.keys (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = pull

package/src/cli/actions/armor/push.js

@@ -0,0 +1,37 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorPush = require('./../../../lib/services/armorPush')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function push () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'pushing' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const { changed, privateKeyName, publicKeyValue } = await new ArmorPush(hostname, token, devicePublicKey, options.envFile, options.team).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`⛨ pushed (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = push

package/src/cli/actions/armor/up.js

@@ -0,0 +1,37 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorUp = require('./../../../lib/services/armorUp')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function up () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'armoring' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const { changed, privateKeyName, publicKeyValue } = await new ArmorUp(hostname, token, devicePublicKey, options.envFile, options.team).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`⛨ armored (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = up

package/src/cli/actions/decrypt.js

@@ -13,8 +13,8 @@ async function decrypt () {
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
-  const sesh = new Session()
   const envs = this.envs
+  const sesh = new Session()
   const noArmor = options.armor === false || (await sesh.noArmor())
 
   let errorCount = 0

package/src/cli/actions/encrypt.js

@@ -46,8 +46,8 @@ async function encrypt () {
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
-  const sesh = new Session()
   const envs = this.envs
+  const sesh = new Session()
   const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
   const noCreate = options.create === false
 

package/src/cli/actions/login.js

@@ -0,0 +1,63 @@
+const { logger } = require('../../shared/logger')
+
+const Session = require('../../db/session')
+const Login = require('../../lib/services/login')
+const LoginPoll = require('../../lib/services/loginPoll')
+
+const createSpinner = require('../../lib/helpers/createSpinner')
+const formatCode = require('../../lib/helpers/formatCode')
+const listenForOpenKey = require('../../lib/helpers/listenForOpenKey')
+const openUrl = require('../../lib/helpers/openUrl')
+
+const FRAMES = ['◐', '◓', '◑', '◒']
+
+async function login () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'logging in', frames: FRAMES })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  let cleanupOpenKeyListener = () => {}
+
+  try {
+    const {
+      deviceCode,
+      userCode,
+      verificationUri,
+      verificationUriComplete,
+      interval
+    } = await new Login(hostname).run()
+
+    const promptMessage = `◌ press Enter to open [${verificationUri}] and enter code [${formatCode(userCode)}]...`
+
+    logger.debug(`POST ${hostname} with deviceCode ${deviceCode} at interval ${interval}`)
+    logger.info(promptMessage)
+
+    // begin polling
+    const pollPromise = new LoginPoll(hostname, deviceCode, interval).run()
+    cleanupOpenKeyListener = listenForOpenKey(() => openUrl(verificationUriComplete))
+    const data = await pollPromise
+
+    cleanupOpenKeyListener()
+    if (spinner) spinner.stop()
+    logger.success(`◉ logged in (${data.username})`)
+    process.exit(0)
+  } catch (error) {
+    cleanupOpenKeyListener()
+    if (spinner) spinner.stop()
+    if (error.message) {
+      logger.error(error.message)
+    } else {
+      logger.error(error)
+    }
+    if (error.stack) {
+      logger.debug(error.stack)
+    }
+    process.exit(1)
+  }
+}
+
+module.exports = login

package/src/cli/actions/logout.js

@@ -0,0 +1,36 @@
+const { logger } = require('../../shared/logger')
+
+const Session = require('../../db/session')
+const Logout = require('../../lib/services/logout')
+const createSpinner = require('../../lib/helpers/createSpinner')
+
+const FRAMES = ['◐', '◓', '◑', '◒']
+
+async function logout () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'logging out', frames: FRAMES })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  const hostname = options.hostname || sesh.hostname()
+
+  try {
+    const data = await new Logout(hostname).run()
+    if (spinner) spinner.stop()
+    logger.success(`◌ logged out (${data.username})`)
+  } catch (error) {
+    if (spinner) spinner.stop()
+    if (error.message) {
+      logger.error(error.message)
+    } else {
+      logger.error(error)
+    }
+    if (error.stack) {
+      logger.debug(error.stack)
+    }
+    process.exit(1)
+  }
+}
+
+module.exports = logout

package/src/cli/actions/normalizeArmorOptions.js

@@ -1,8 +1,7 @@
 function normalizeArmorOptions (options) {
-  if (options.armor === false || options.ops === false || options.vlt === false) {
+  if (options.armor === false || options.ops === false) {
     options.armor = false
     options.ops = false
-    options.vlt = false
   }
 
   return options

package/src/cli/actions/set.js

@@ -24,9 +24,9 @@ async function set (key, value) {
   logger.debug(`options: ${JSON.stringify(options)}`)
 
   try {
-    const sesh = new Session()
     const envs = this.envs
     const envKeysFilepath = options.envKeysFile
+    const sesh = new Session()
     const noArmor = options.armor === false || (await sesh.noArmor())
     const noCreate = options.create === false
 

package/src/cli/commands/armor.js

@@ -0,0 +1,72 @@
+const Session = require('./../../db/session')
+const executeDynamic = require('./../../lib/helpers/executeDynamic')
+
+function configureArmorCommand (armor) {
+  armor
+    .description('move private keys off-device')
+    .allowUnknownOption()
+    .argument('[command]', 'dotenvx-armor command')
+    .argument('[args...]', 'dotenvx-armor command arguments')
+    .action(async function (command, args) {
+      if (command) {
+        return executeDynamic(armor, 'armor', [command, ...(args || [])])
+      }
+
+      const sesh = new Session()
+      await sesh.notifyUpdate()
+      this.help()
+    })
+
+  // dotenvx armor up
+  const upAction = require('./../actions/armor/up')
+  armor
+    .command('up')
+    .description('armor key')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .option('--team <team>', 'team to armor private key for')
+    .action(upAction)
+
+  // dotenvx armor down
+  const downAction = require('./../actions/armor/down')
+  armor
+    .command('down')
+    .description('dearmor key')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .option('--team <team>', 'team to dearmor private key from')
+    .action(downAction)
+
+  // dotenvx armor push
+  const pushAction = require('./../actions/armor/push')
+  armor
+    .command('push')
+    .description('push armored key (from .env.keys)')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .option('--team <team>', 'team to push armored private key for')
+    .action(pushAction)
+
+  // dotenvx armor pull
+  const pullAction = require('./../actions/armor/pull')
+  armor
+    .command('pull')
+    .description('pull armored key (into .env.keys)')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .option('--team <team>', 'team to pull armored private key from')
+    .action(pullAction)
+
+  // dotenvx armor move
+  const moveAction = require('./../actions/armor/move')
+  armor
+    .command('move')
+    .description('move armored key (to other team)')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .action(moveAction)
+
+  return armor
+}
+
+module.exports = configureArmorCommand

package/src/cli/dotenvx.js

@@ -72,7 +72,6 @@ program.command('run')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
   .option('--token <token>', 'set Armor ⛨ token')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .action(function (...args) {
     this.envs = envs
@@ -96,7 +95,6 @@ program.command('get')
   .option('--pp', 'pretty print output (alias)')
   .option('--format <type>', 'format of the output (json, shell, colon, eval)', 'json')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .action(function (...args) {
     this.envs = envs
@@ -117,7 +115,6 @@ program.command('set')
   .option('-p, --plain', 'store value as plain text', false)
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .action(function (...args) {
     this.envs = envs
@@ -126,7 +123,7 @@ program.command('set')
 
 // dotenvx encrypt
 program.command('encrypt')
-  .description('convert .env file(s) to encrypted .env file(s)')
+  .description('encrypt .env file(s)')
   .option('-f, --env-file <paths...>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('-k, --key <keys...>', 'keys(s) to encrypt (default: all keys in file)')
@@ -135,7 +132,6 @@ program.command('encrypt')
   .option('--token <token>', 'set Armor ⛨ token')
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .action(function (...args) {
     this.envs = envs
@@ -144,13 +140,12 @@ program.command('encrypt')
 
 // dotenvx decrypt
 program.command('decrypt')
-  .description('convert encrypted .env file(s) to plain .env file(s)')
+  .description('decrypt .env file(s)')
   .option('-f, --env-file <paths...>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('-k, --key <keys...>', 'keys(s) to decrypt (default: all keys in file)')
   .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from decryption (default: none)')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .option('--stdout', 'send to stdout')
   .action(function (...args) {
@@ -166,7 +161,6 @@ program.command('rotate')
   .option('-k, --key <keys...>', 'keys(s) to encrypt (default: all keys in file)')
   .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from encryption (default: none)')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .option('--stdout', 'send to stdout')
   .action(function (...args) {
@@ -182,7 +176,6 @@ program.command('keypair')
   .option('-f, --env-file <paths...>', 'path(s) to your env file(s)')
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('--no-armor', 'disable dotenvx-armor features')
-  .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
@@ -211,20 +204,20 @@ program.command('doctor', { hidden: true })
 
 // dotenvx login
 program.command('login', { hidden: true })
-  .description('')
+  .description('log in to move keys off-device, share with your team, and audit access')
   .allowUnknownOption()
-  .action(() => {
-    const rawArgs = ['armor', 'login', ...process.argv.slice(3)]
-    executeDynamic(program, 'armor', rawArgs)
+  .option('--hostname <hostname>', 'set Armor ⛨ hostname')
+  .action(function (...args) {
+    return require('./actions/login').apply(this, args)
   })
 
 // dotenvx logout
 program.command('logout', { hidden: true })
-  .description('log out of your dotenvx account')
+  .description('log out of connected security features')
   .allowUnknownOption()
-  .action(() => {
-    const rawArgs = ['armor', 'logout', ...process.argv.slice(3)]
-    executeDynamic(program, 'armor', rawArgs)
+  .option('--hostname <hostname>', 'set Armor ⛨ hostname')
+  .action(function (...args) {
+    return require('./actions/logout').apply(this, args)
   })
 
 // dotenvx help
@@ -245,10 +238,15 @@ program.command('help [command]')
 
 // dotenvx armor
 program.addHelpText('after', ' ')
-program.addHelpText('after', 'Advanced: ')
-program.addHelpText('after', '  armor                    ⛨ ARMORED KEYS [www.dotenvx.com/armor]')
+program.addHelpText('after', 'Professional Security: ')
+program.addHelpText('after', '  login                    log in to move keys off-device, share with your team, and audit access')
+program.addHelpText('after', '  logout                   log out of connected security features')
+program.addHelpText('after', '  armor                    ⛨ move private keys off-device [www.dotenvx.com/armor]')
 program.addHelpText('after', '  ext                      ⊕ extensions')
 
+// dotenvx armor
+require('./commands/armor')(program.command('armor', { hidden: true }))
+
 // dotenvx ext
 program.addCommand(require('./commands/ext'))