@dotenvx/dotenvx 1.72.0 → 1.73.0

package/CHANGELOG.md

@@ -2,7 +2,15 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.72.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.73.0...main)
+
+## [1.73.0](https://github.com/dotenvx/dotenvx/compare/v1.72.0...v1.73.0) (2026-06-16)
+
+### Added
+
+* Add `dotenvx armor` commands directly inside dotenvx ([#839](https://github.com/dotenvx/dotenvx/pull/839))
+
+> `dotenvx` remains local-first: `armor` commands are optional under professional security section
 
 ## [1.72.0](https://github.com/dotenvx/dotenvx/compare/v1.71.3...v1.72.0) (2026-06-15)
 

package/README.md

@@ -11,7 +11,7 @@
  
 
 
-### Quickstart [![npm version](https://img.shields.io/npm/v/@dotenvx/dotenvx.svg)](https://www.npmjs.com/package/@dotenvx/dotenvx) [![downloads](https://img.shields.io/npm/dw/@dotenvx/dotenvx)](https://www.npmjs.com/package/@dotenvx/dotenvx) [![test suite](https://img.shields.io/endpoint?url=https://gist.githubusercontent.com/motdotenv/bb76445765a9731e7d824a6efdf53524/raw/dotenvxTestCount.json)](https://github.com/dotenvx/dotenvx/tree/main/tests) 
+### Quickstart [![npm version](https://img.shields.io/npm/v/@dotenvx/dotenvx.svg)](https://www.npmjs.com/package/@dotenvx/dotenvx) [![downloads](https://img.shields.io/npm/dw/@dotenvx/dotenvx)](https://www.npmjs.com/package/@dotenvx/dotenvx)
 
 Install and use it in code just like `dotenv`.
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.72.0",
+  "version": "1.73.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -36,7 +36,6 @@
     "standard": "standard",
     "standard:fix": "standard --fix",
     "test": "tap run --test-env=DOTENVX_NO_ARMOR=true --allow-empty-coverage --disable-coverage --timeout=60000",
-    "test-coverage": "tap run --test-env=DOTENVX_NO_ARMOR=true --show-full-coverage --timeout=60000",
     "testshell": "bash shellspec",
     "release:check": "npm test && npm run testshell",
     "prerelease": "npm run release:check",

package/src/cli/actions/armor/down.js

@@ -0,0 +1,37 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorDown = require('./../../../lib/services/armorDown')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function down () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'dearmoring' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const { changed, privateKeyName, publicKeyValue } = await new ArmorDown(hostname, token, devicePublicKey, options.envFile, options.team).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`◇ dearmored to .env.keys (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = down

package/src/cli/actions/armor/move.js

@@ -0,0 +1,42 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorMove = require('./../../../lib/services/armorMove')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function move () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'moving' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const {
+      changed,
+      privateKeyName,
+      publicKeyValue,
+      team
+    } = await new ArmorMove(hostname, token, devicePublicKey, options.envFile).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`⛨ moved to ${team} (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = move

package/src/cli/actions/armor/pull.js

@@ -0,0 +1,37 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorPull = require('./../../../lib/services/armorPull')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function pull () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'pulling' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const { changed, privateKeyName, publicKeyValue } = await new ArmorPull(hostname, token, devicePublicKey, options.envFile, options.team).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`◇ pulled to .env.keys (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = pull

package/src/cli/actions/armor/push.js

@@ -0,0 +1,37 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorPush = require('./../../../lib/services/armorPush')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function push () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'pushing' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const { changed, privateKeyName, publicKeyValue } = await new ArmorPush(hostname, token, devicePublicKey, options.envFile, options.team).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`⛨ pushed (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = push

package/src/cli/actions/armor/up.js

@@ -0,0 +1,37 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorUp = require('./../../../lib/services/armorUp')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function up () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'armoring' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const { changed, privateKeyName, publicKeyValue } = await new ArmorUp(hostname, token, devicePublicKey, options.envFile, options.team).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`⛨ armored (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = up

package/src/cli/commands/armor.js

@@ -0,0 +1,72 @@
+const Session = require('./../../db/session')
+const executeDynamic = require('./../../lib/helpers/executeDynamic')
+
+function configureArmorCommand (armor) {
+  armor
+    .description('move private keys off-device')
+    .allowUnknownOption()
+    .argument('[command]', 'dotenvx-armor command')
+    .argument('[args...]', 'dotenvx-armor command arguments')
+    .action(async function (command, args) {
+      if (command) {
+        return executeDynamic(armor, 'armor', [command, ...(args || [])])
+      }
+
+      const sesh = new Session()
+      await sesh.notifyUpdate()
+      this.help()
+    })
+
+  // dotenvx armor up
+  const upAction = require('./../actions/armor/up')
+  armor
+    .command('up')
+    .description('armor key')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .option('--team <team>', 'team to armor private key for')
+    .action(upAction)
+
+  // dotenvx armor down
+  const downAction = require('./../actions/armor/down')
+  armor
+    .command('down')
+    .description('dearmor key')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .option('--team <team>', 'team to dearmor private key from')
+    .action(downAction)
+
+  // dotenvx armor push
+  const pushAction = require('./../actions/armor/push')
+  armor
+    .command('push')
+    .description('push armored key (from .env.keys)')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .option('--team <team>', 'team to push armored private key for')
+    .action(pushAction)
+
+  // dotenvx armor pull
+  const pullAction = require('./../actions/armor/pull')
+  armor
+    .command('pull')
+    .description('pull armored key (into .env.keys)')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .option('--team <team>', 'team to pull armored private key from')
+    .action(pullAction)
+
+  // dotenvx armor move
+  const moveAction = require('./../actions/armor/move')
+  armor
+    .command('move')
+    .description('move armored key (to other team)')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .action(moveAction)
+
+  return armor
+}
+
+module.exports = configureArmorCommand

package/src/cli/dotenvx.js

@@ -244,6 +244,9 @@ program.addHelpText('after', '  logout                   log out of connected se
 program.addHelpText('after', '  armor                    ⛨ move private keys off-device [www.dotenvx.com/armor]')
 program.addHelpText('after', '  ext                      ⊕ extensions')
 
+// dotenvx armor
+require('./commands/armor')(program.command('armor', { hidden: true }))
+
 // dotenvx ext
 program.addCommand(require('./commands/ext'))
 

package/src/db/session.js

@@ -4,7 +4,6 @@ const Conf = require('conf')
 const dotenv = require('dotenv')
 const envPaths = require('env-paths')
 
-const Armor = require('./../lib/extensions/armor')
 const jsonToEnv = require('./../lib/helpers/jsonToEnv')
 const { logger } = require('./../shared/logger')
 
@@ -13,14 +12,12 @@ const ARMOR = {
   USER: 'DOTENVX_ARMOR_USER',
   USERNAME: 'DOTENVX_ARMOR_USERNAME',
   TOKEN: 'DOTENVX_ARMOR_TOKEN',
-  ON: 'DOTENVX_ARMOR_ON',
   VERSION: 'DOTENVX_ARMOR_VERSION',
   VERSION_LAST_CHECK: 'DOTENVX_ARMOR_VERSION_LAST_CHECK'
 }
 
 class Session {
   constructor () {
-    this.armor = new Armor()
     this._store = null
   }
 
@@ -74,7 +71,7 @@ class Session {
 
   status () {
     // if logged in
-    if (this.username() && this.token() && this.on()) {
+    if (this.username() && this.token()) {
       return 'on'
     }
 
@@ -112,14 +109,6 @@ class Session {
     return this._store ? this._store.path : this._configPath()
   }
 
-  on () {
-    return (this.readSetting('ON') || 'true') === 'true'
-  }
-
-  off () {
-    return (this.readSetting('ON') || 'true') === 'false'
-  }
-
   async systemInformation () {
     const si = require('systeminformation')
     const system = await si.system()
@@ -140,13 +129,23 @@ class Session {
   // armor status helpers
   //
   async noArmor () {
-    const status = await this.armor.status()
+    if (process.env.DOTENVX_NO_ARMOR === 'true') {
+      logger.debug('armor: off')
+      return true
+    }
+
+    const status = this.status()
     logger.debug(`armor: ${status}`)
     return status === 'off'
   }
 
   noArmorSync () {
-    const status = this.armor.statusSync()
+    if (process.env.DOTENVX_NO_ARMOR === 'true') {
+      logger.debug('armor: off')
+      return true
+    }
+
+    const status = this.status()
     logger.debug(`armor: ${status}`)
     return status === 'off'
   }
@@ -176,7 +175,6 @@ class Session {
     store.set(ARMOR.USERNAME, username)
     store.set(ARMOR.TOKEN, accessToken)
     store.set(ARMOR.HOSTNAME, hostname)
-    store.set(ARMOR.ON, 'true')
 
     return accessToken
   }
@@ -201,7 +199,6 @@ class Session {
     store.delete(ARMOR.USERNAME)
     store.delete(ARMOR.TOKEN)
     store.delete(ARMOR.HOSTNAME)
-    store.delete(ARMOR.ON)
     store.delete(ARMOR.VERSION)
     store.delete(ARMOR.VERSION_LAST_CHECK)
     return true

package/src/lib/api/getAccount.js

@@ -0,0 +1,32 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+
+class GetAccount {
+  constructor (hostname, token) {
+    this.hostname = hostname
+    this.token = token
+  }
+
+  async run () {
+    const token = this.token
+    const url = `${this.hostname}/api/account`
+
+    const resp = await http(url, {
+      method: 'GET',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      }
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = GetAccount

package/src/lib/api/postArmorDown.js

@@ -0,0 +1,48 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+const packageJson = require('../helpers/packageJson')
+const normalizeToken = require('../helpers/normalizeToken')
+
+class PostArmorDown {
+  constructor (hostname, token, devicePublicKey, publicKey, team) {
+    this.hostname = hostname
+    this.token = token
+    this.devicePublicKey = devicePublicKey
+    this.publicKey = publicKey
+    this.team = team
+  }
+
+  async run () {
+    const token = normalizeToken(this.token)
+    const devicePublicKey = this.devicePublicKey
+    const publicKey = this.publicKey
+    const team = this.team
+    const url = `${this.hostname}/api/armor/down`
+
+    const body = {
+      device_public_key: devicePublicKey,
+      cli_version: packageJson.version,
+      public_key: publicKey,
+      team
+    }
+
+    const resp = await http(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(body)
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostArmorDown

package/src/lib/api/postArmorMove.js

@@ -0,0 +1,48 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+const packageJson = require('../helpers/packageJson')
+const normalizeToken = require('../helpers/normalizeToken')
+
+class PostArmorMove {
+  constructor (hostname, token, devicePublicKey, publicKey, team) {
+    this.hostname = hostname
+    this.token = token
+    this.devicePublicKey = devicePublicKey
+    this.publicKey = publicKey
+    this.team = team
+  }
+
+  async run () {
+    const token = normalizeToken(this.token)
+    const devicePublicKey = this.devicePublicKey
+    const publicKey = this.publicKey
+    const team = this.team
+    const url = `${this.hostname}/api/armor/move`
+
+    const body = {
+      device_public_key: devicePublicKey,
+      cli_version: packageJson.version,
+      public_key: publicKey,
+      team
+    }
+
+    const resp = await http(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(body)
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostArmorMove

package/src/lib/api/postArmorPull.js

@@ -0,0 +1,48 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+const packageJson = require('../helpers/packageJson')
+const normalizeToken = require('../helpers/normalizeToken')
+
+class PostArmorPull {
+  constructor (hostname, token, devicePublicKey, publicKey, team) {
+    this.hostname = hostname
+    this.token = token
+    this.devicePublicKey = devicePublicKey
+    this.publicKey = publicKey
+    this.team = team
+  }
+
+  async run () {
+    const token = normalizeToken(this.token)
+    const devicePublicKey = this.devicePublicKey
+    const publicKey = this.publicKey
+    const team = this.team
+    const url = `${this.hostname}/api/armor/pull`
+
+    const body = {
+      device_public_key: devicePublicKey,
+      cli_version: packageJson.version,
+      public_key: publicKey,
+      team
+    }
+
+    const resp = await http(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(body)
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostArmorPull

package/src/lib/api/postArmorPush.js

@@ -0,0 +1,48 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+const packageJson = require('../helpers/packageJson')
+const normalizeToken = require('../helpers/normalizeToken')
+
+class PostArmorPush {
+  constructor (hostname, token, devicePublicKey, privateKey, team) {
+    this.hostname = hostname
+    this.token = token
+    this.devicePublicKey = devicePublicKey
+    this.privateKey = privateKey
+    this.team = team
+  }
+
+  async run () {
+    const token = normalizeToken(this.token)
+    const devicePublicKey = this.devicePublicKey
+    const privateKey = this.privateKey
+    const team = this.team
+    const url = `${this.hostname}/api/armor/push`
+
+    const body = {
+      device_public_key: devicePublicKey,
+      cli_version: packageJson.version,
+      private_key: privateKey,
+      team
+    }
+
+    const resp = await http(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(body)
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostArmorPush