@dotenvx/dotenvx 1.72.0 → 1.73.1

package/CHANGELOG.md

@@ -2,7 +2,21 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.72.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.73.1...main)
+
+## [1.73.1](https://github.com/dotenvx/dotenvx/compare/v1.73.0...v1.73.1) (2026-06-16)
+
+### Changed
+
+* Give update available notification only for armor commands ([#840](https://github.com/dotenvx/dotenvx/pull/840))
+
+## [1.73.0](https://github.com/dotenvx/dotenvx/compare/v1.72.0...v1.73.0) (2026-06-16)
+
+### Added
+
+* Add `dotenvx armor` commands directly inside dotenvx ([#839](https://github.com/dotenvx/dotenvx/pull/839))
+
+> `dotenvx` remains local-first: `armor` commands are optional under professional security section
 
 ## [1.72.0](https://github.com/dotenvx/dotenvx/compare/v1.71.3...v1.72.0) (2026-06-15)
 

package/README.md

@@ -11,7 +11,7 @@
  
 
 
-### Quickstart [![npm version](https://img.shields.io/npm/v/@dotenvx/dotenvx.svg)](https://www.npmjs.com/package/@dotenvx/dotenvx) [![downloads](https://img.shields.io/npm/dw/@dotenvx/dotenvx)](https://www.npmjs.com/package/@dotenvx/dotenvx) [![test suite](https://img.shields.io/endpoint?url=https://gist.githubusercontent.com/motdotenv/bb76445765a9731e7d824a6efdf53524/raw/dotenvxTestCount.json)](https://github.com/dotenvx/dotenvx/tree/main/tests) 
+### Quickstart [![npm version](https://img.shields.io/npm/v/@dotenvx/dotenvx.svg)](https://www.npmjs.com/package/@dotenvx/dotenvx) [![downloads](https://img.shields.io/npm/dw/@dotenvx/dotenvx)](https://www.npmjs.com/package/@dotenvx/dotenvx)
 
 Install and use it in code just like `dotenv`.
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.72.0",
+  "version": "1.73.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -36,7 +36,6 @@
     "standard": "standard",
     "standard:fix": "standard --fix",
     "test": "tap run --test-env=DOTENVX_NO_ARMOR=true --allow-empty-coverage --disable-coverage --timeout=60000",
-    "test-coverage": "tap run --test-env=DOTENVX_NO_ARMOR=true --show-full-coverage --timeout=60000",
     "testshell": "bash shellspec",
     "release:check": "npm test && npm run testshell",
     "prerelease": "npm run release:check",

package/src/cli/actions/armor/down.js

@@ -0,0 +1,37 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorDown = require('./../../../lib/services/armorDown')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function down () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'dearmoring' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const { changed, privateKeyName, publicKeyValue } = await new ArmorDown(hostname, token, devicePublicKey, options.envFile, options.team).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`◇ dearmored to .env.keys (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = down

package/src/cli/actions/armor/move.js

@@ -0,0 +1,42 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorMove = require('./../../../lib/services/armorMove')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function move () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'moving' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const {
+      changed,
+      privateKeyName,
+      publicKeyValue,
+      team
+    } = await new ArmorMove(hostname, token, devicePublicKey, options.envFile).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`⛨ moved to ${team} (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = move

package/src/cli/actions/armor/pull.js

@@ -0,0 +1,37 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorPull = require('./../../../lib/services/armorPull')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function pull () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'pulling' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const { changed, privateKeyName, publicKeyValue } = await new ArmorPull(hostname, token, devicePublicKey, options.envFile, options.team).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`◇ pulled to .env.keys (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = pull

package/src/cli/actions/armor/push.js

@@ -0,0 +1,37 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorPush = require('./../../../lib/services/armorPush')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function push () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'pushing' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const { changed, privateKeyName, publicKeyValue } = await new ArmorPush(hostname, token, devicePublicKey, options.envFile, options.team).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`⛨ pushed (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = push

package/src/cli/actions/armor/up.js

@@ -0,0 +1,37 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('./../../../db/session')
+const ArmorUp = require('./../../../lib/services/armorUp')
+const createSpinner = require('../../../lib/helpers/createSpinner')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+
+async function up () {
+  const options = this.opts()
+  const spinner = await createSpinner({ ...options, text: 'armoring' })
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const sesh = new Session()
+  await sesh.notifyUpdate()
+  const hostname = options.hostname || sesh.hostname()
+  const token = options.token || sesh.token()
+
+  try {
+    const devicePublicKey = sesh.devicePublicKey()
+
+    const { changed, privateKeyName, publicKeyValue } = await new ArmorUp(hostname, token, devicePublicKey, options.envFile, options.team).run()
+    const keyDisplay = armoredKeyDisplay(publicKeyValue) || privateKeyName
+
+    if (spinner) spinner.stop()
+    if (changed) {
+      logger.success(`⛨ armored (${keyDisplay})`)
+    } else {
+      logger.info(`○ no change (${keyDisplay})`)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = up

package/src/cli/actions/login.js

@@ -18,7 +18,6 @@ async function login () {
   logger.debug(`options: ${JSON.stringify(options)}`)
 
   const sesh = new Session()
-  await sesh.notifyUpdate()
   const hostname = options.hostname || sesh.hostname()
   let cleanupOpenKeyListener = () => {}
 

package/src/cli/commands/armor.js

@@ -0,0 +1,72 @@
+const executeDynamic = require('./../../lib/helpers/executeDynamic')
+const Session = require('./../../db/session')
+
+function configureArmorCommand (armor) {
+  armor
+    .description('move private keys off-device')
+    .allowUnknownOption()
+    .argument('[command]', 'dotenvx-armor command')
+    .argument('[args...]', 'dotenvx-armor command arguments')
+    .action(async function (command, args) {
+      if (command) {
+        return executeDynamic(armor, 'armor', [command, ...(args || [])])
+      }
+
+      const sesh = new Session()
+      await sesh.notifyUpdate()
+      this.help()
+    })
+
+  // dotenvx armor up
+  const upAction = require('./../actions/armor/up')
+  armor
+    .command('up')
+    .description('armor key')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .option('--team <team>', 'team to armor private key for')
+    .action(upAction)
+
+  // dotenvx armor down
+  const downAction = require('./../actions/armor/down')
+  armor
+    .command('down')
+    .description('dearmor key')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .option('--team <team>', 'team to dearmor private key from')
+    .action(downAction)
+
+  // dotenvx armor push
+  const pushAction = require('./../actions/armor/push')
+  armor
+    .command('push')
+    .description('push armored key (from .env.keys)')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .option('--team <team>', 'team to push armored private key for')
+    .action(pushAction)
+
+  // dotenvx armor pull
+  const pullAction = require('./../actions/armor/pull')
+  armor
+    .command('pull')
+    .description('pull armored key (into .env.keys)')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .option('--team <team>', 'team to pull armored private key from')
+    .action(pullAction)
+
+  // dotenvx armor move
+  const moveAction = require('./../actions/armor/move')
+  armor
+    .command('move')
+    .description('move armored key (to other team)')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('--token <token>', 'set token')
+    .action(moveAction)
+
+  return armor
+}
+
+module.exports = configureArmorCommand

package/src/cli/dotenvx.js

@@ -244,6 +244,9 @@ program.addHelpText('after', '  logout                   log out of connected se
 program.addHelpText('after', '  armor                    ⛨ move private keys off-device [www.dotenvx.com/armor]')
 program.addHelpText('after', '  ext                      ⊕ extensions')
 
+// dotenvx armor
+require('./commands/armor')(program.command('armor', { hidden: true }))
+
 // dotenvx ext
 program.addCommand(require('./commands/ext'))
 

package/src/db/session.js

@@ -4,23 +4,51 @@ const Conf = require('conf')
 const dotenv = require('dotenv')
 const envPaths = require('env-paths')
 
-const Armor = require('./../lib/extensions/armor')
 const jsonToEnv = require('./../lib/helpers/jsonToEnv')
+const packageJson = require('./../lib/helpers/packageJson')
+const { http } = require('./../lib/helpers/http')
 const { logger } = require('./../shared/logger')
 
+const HOURS_24 = 60 * 60 * 24 * 1000
+const VERSION_URL = 'https://dotenvx.sh/VERSION'
+
 const ARMOR = {
   HOSTNAME: 'DOTENVX_ARMOR_HOSTNAME',
   USER: 'DOTENVX_ARMOR_USER',
   USERNAME: 'DOTENVX_ARMOR_USERNAME',
-  TOKEN: 'DOTENVX_ARMOR_TOKEN',
-  ON: 'DOTENVX_ARMOR_ON',
-  VERSION: 'DOTENVX_ARMOR_VERSION',
-  VERSION_LAST_CHECK: 'DOTENVX_ARMOR_VERSION_LAST_CHECK'
+  TOKEN: 'DOTENVX_ARMOR_TOKEN'
+}
+
+const DOTENVX = {
+  VERSION: 'DOTENVX_VERSION',
+  VERSION_LAST_CHECK: 'DOTENVX_VERSION_LAST_CHECK'
+}
+
+function normalizeVersion (version) {
+  return String(version || '').trim().replace(/^v/, '')
+}
+
+function parseVersion (version) {
+  return normalizeVersion(version).split('.').map(part => Number.parseInt(part, 10) || 0)
+}
+
+function versionGreaterThan (left, right) {
+  const leftParts = parseVersion(left)
+  const rightParts = parseVersion(right)
+
+  for (let i = 0; i < Math.max(leftParts.length, rightParts.length); i++) {
+    const leftPart = leftParts[i] || 0
+    const rightPart = rightParts[i] || 0
+
+    if (leftPart > rightPart) return true
+    if (leftPart < rightPart) return false
+  }
+
+  return false
 }
 
 class Session {
   constructor () {
-    this.armor = new Armor()
     this._store = null
   }
 
@@ -74,7 +102,7 @@ class Session {
 
   status () {
     // if logged in
-    if (this.username() && this.token() && this.on()) {
+    if (this.username() && this.token()) {
       return 'on'
     }
 
@@ -91,6 +119,13 @@ class Session {
     return store.get(ARMOR[key])
   }
 
+  readDotenvxSetting (key) {
+    const store = this.openStore()
+    if (!store) return undefined
+
+    return store.get(DOTENVX[key])
+  }
+
   hostname () {
     return this.readSetting('HOSTNAME') || 'https://armor.dotenvx.com'
   }
@@ -112,14 +147,6 @@ class Session {
     return this._store ? this._store.path : this._configPath()
   }
 
-  on () {
-    return (this.readSetting('ON') || 'true') === 'true'
-  }
-
-  off () {
-    return (this.readSetting('ON') || 'true') === 'false'
-  }
-
   async systemInformation () {
     const si = require('systeminformation')
     const system = await si.system()
@@ -132,21 +159,64 @@ class Session {
     }
   }
 
+  //
+  // Notify Update
+  //
   async notifyUpdate () {
-    // native login keeps this lightweight; sidecar commands still handle full update messaging
+    try {
+      const store = this.openStore()
+      if (!store) return
+
+      logger.debug('checking if update available')
+
+      const lastCheck = Number(this.readDotenvxSetting('VERSION_LAST_CHECK') || 0)
+      const now = Date.now()
+
+      if ((lastCheck + HOURS_24) >= now) return
+
+      let remote = packageJson.version
+
+      try {
+        logger.debug('fetching latest available dotenvx version')
+        const response = await http(VERSION_URL)
+        remote = normalizeVersion(await response.body.text())
+        logger.debug(`latest dotenvx version: ${remote}`)
+        store.set(DOTENVX.VERSION, remote)
+      } catch (error) {
+        logger.debug(error.message)
+      }
+
+      store.set(DOTENVX.VERSION_LAST_CHECK, now)
+
+      if (versionGreaterThan(remote, packageJson.version)) {
+        console.error('⛆ update available [npm install @dotenvx/dotenvx@latest]')
+      }
+    } catch (error) {
+      logger.debug(error.message)
+    }
   }
 
   //
   // armor status helpers
   //
   async noArmor () {
-    const status = await this.armor.status()
+    if (process.env.DOTENVX_NO_ARMOR === 'true') {
+      logger.debug('armor: off')
+      return true
+    }
+
+    const status = this.status()
     logger.debug(`armor: ${status}`)
     return status === 'off'
   }
 
   noArmorSync () {
-    const status = this.armor.statusSync()
+    if (process.env.DOTENVX_NO_ARMOR === 'true') {
+      logger.debug('armor: off')
+      return true
+    }
+
+    const status = this.status()
     logger.debug(`armor: ${status}`)
     return status === 'off'
   }
@@ -176,7 +246,6 @@ class Session {
     store.set(ARMOR.USERNAME, username)
     store.set(ARMOR.TOKEN, accessToken)
     store.set(ARMOR.HOSTNAME, hostname)
-    store.set(ARMOR.ON, 'true')
 
     return accessToken
   }
@@ -201,9 +270,8 @@ class Session {
     store.delete(ARMOR.USERNAME)
     store.delete(ARMOR.TOKEN)
     store.delete(ARMOR.HOSTNAME)
-    store.delete(ARMOR.ON)
-    store.delete(ARMOR.VERSION)
-    store.delete(ARMOR.VERSION_LAST_CHECK)
+    store.delete(DOTENVX.VERSION)
+    store.delete(DOTENVX.VERSION_LAST_CHECK)
     return true
   }
 }

package/src/lib/api/getAccount.js

@@ -0,0 +1,32 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+
+class GetAccount {
+  constructor (hostname, token) {
+    this.hostname = hostname
+    this.token = token
+  }
+
+  async run () {
+    const token = this.token
+    const url = `${this.hostname}/api/account`
+
+    const resp = await http(url, {
+      method: 'GET',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      }
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = GetAccount

package/src/lib/api/postArmorDown.js

@@ -0,0 +1,48 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+const packageJson = require('../helpers/packageJson')
+const normalizeToken = require('../helpers/normalizeToken')
+
+class PostArmorDown {
+  constructor (hostname, token, devicePublicKey, publicKey, team) {
+    this.hostname = hostname
+    this.token = token
+    this.devicePublicKey = devicePublicKey
+    this.publicKey = publicKey
+    this.team = team
+  }
+
+  async run () {
+    const token = normalizeToken(this.token)
+    const devicePublicKey = this.devicePublicKey
+    const publicKey = this.publicKey
+    const team = this.team
+    const url = `${this.hostname}/api/armor/down`
+
+    const body = {
+      device_public_key: devicePublicKey,
+      cli_version: packageJson.version,
+      public_key: publicKey,
+      team
+    }
+
+    const resp = await http(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(body)
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostArmorDown

package/src/lib/api/postArmorMove.js

@@ -0,0 +1,48 @@
+const { http } = require('../helpers/http')
+const buildApiError = require('../helpers/buildApiError')
+const packageJson = require('../helpers/packageJson')
+const normalizeToken = require('../helpers/normalizeToken')
+
+class PostArmorMove {
+  constructor (hostname, token, devicePublicKey, publicKey, team) {
+    this.hostname = hostname
+    this.token = token
+    this.devicePublicKey = devicePublicKey
+    this.publicKey = publicKey
+    this.team = team
+  }
+
+  async run () {
+    const token = normalizeToken(this.token)
+    const devicePublicKey = this.devicePublicKey
+    const publicKey = this.publicKey
+    const team = this.team
+    const url = `${this.hostname}/api/armor/move`
+
+    const body = {
+      device_public_key: devicePublicKey,
+      cli_version: packageJson.version,
+      public_key: publicKey,
+      team
+    }
+
+    const resp = await http(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(body)
+    })
+
+    const json = await resp.body.json()
+
+    if (resp.statusCode >= 400) {
+      throw buildApiError(resp.statusCode, json)
+    }
+
+    return json
+  }
+}
+
+module.exports = PostArmorMove