@dotenvx/dotenvx 1.74.3 → 1.75.0

package/CHANGELOG.md

@@ -2,7 +2,20 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.74.3...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.75.0...main)
+
+## [1.75.0](https://github.com/dotenvx/dotenvx/compare/v1.74.4...v1.75.0) (2026-06-19)
+
+### Changed
+
+* Swap in `@dotenvx/primitives` ([#848](https://github.com/dotenvx/dotenvx/pull/848))
+* `ext` commands become first-class([#847](https://github.com/dotenvx/dotenvx/pull/847))
+
+## [1.74.4](https://github.com/dotenvx/dotenvx/compare/v1.74.3...v1.74.4) (2026-06-19)
+
+### Removed
+
+* Remove separately published `@dotenvx/next-env` from this repo ([#846](https://github.com/dotenvx/dotenvx/pull/846))
 
 ## [1.74.3](https://github.com/dotenvx/dotenvx/compare/v1.74.2...v1.74.3) (2026-06-19)
 

package/README.md

@@ -150,6 +150,47 @@ $ dotenvx run -- npx tsx index.ts
 Hello Dotenvx
 ```
 
+</details>
+<details><summary>Next.js ▲</summary><br>
+
+Install Dotenvx and `@dotenvx/next-env`.
+
+```sh
+$ npm install @dotenvx/dotenvx
+$ npm install @dotenvx/next-env
+```
+
+Override `@next/env` in your `package.json`.
+
+```json
+{
+  "overrides": {
+    "@next/env": "npm:@dotenvx/next-env"
+  }
+}
+```
+
+Encrypt your `.env` file.
+
+```sh
+$ npx dotenvx encrypt
+◈ encrypted (.env)
+```
+
+Your encrypted secrets are automatically injected and readable in Next.js.
+
+```ts
+import { NextResponse } from 'next/server'
+
+export async function GET() {
+  return NextResponse.json({
+    HELLO: process.env.HELLO
+  })
+}
+```
+
+Set `DOTENV_PRIVATE_KEY` in production before deploying.
+
 </details>
 <details><summary>Cloudflare Workers ⛅️</summary><br>
 
@@ -1613,7 +1654,7 @@ $ echo "HELLO=Dotenvx" > .env
 
 $ dotenvx encrypt
 ◈ encrypted (.env) + local key (.env.keys)
-⮕  next run [dotenvx ext gitignore --pattern .env.keys] to gitignore .env.keys
+⮕  next run [dotenvx gitignore --pattern .env.keys] to gitignore .env.keys
 ⮕  next run [DOTENV_PRIVATE_KEY='122...0b8' dotenvx run -- yourcommand] to test decryption locally
 ```
 
@@ -1628,7 +1669,7 @@ $ echo "HELLO=Production" > .env.production
 
 $ dotenvx encrypt -f .env.production
 ◈ encrypted (.env.production) + local key (.env.keys)
-⮕  next run [dotenvx ext gitignore --pattern .env.keys] to gitignore .env.keys
+⮕  next run [dotenvx gitignore --pattern .env.keys] to gitignore .env.keys
 ⮕  next run [DOTENV_PRIVATE_KEY='bff...bc4' dotenvx run -- yourcommand] to test decryption locally
 ```
 
@@ -2121,12 +2162,19 @@ Commands:
   set <KEY> <value>  set a single environment variable
   encrypt            encrypt .env file(s)
   decrypt            decrypt .env file(s)
+  rotate             rotate keypair(s) and re-encrypt .env file(s)
   keypair [KEY]      print public/private keys for .env file(s)
   ls [directory]     print all .env files in a tree structure
+  gitignore          append to .gitignore
+  precommit [directory]
+                     prevent committing .env files to code
+  prebuild [directory]
+                     prevent including .env files in docker
  
-Advanced: 
-  pro                          🏆 pro
-  ext                          🔌 extensions
+Professional Security: 
+  login                    log in to move keys off-device, share with your team, and audit access
+  logout                   log out of connected security features
+  armor                    ⛨ move private keys off-device [www.dotenvx.com/armor]
 ```
 
 You can get more detailed help per command with `dotenvx help COMMAND`.
@@ -2174,9 +2222,9 @@ X.X.X
 
 </details>
 
-### Extensions 🔌
+### Utilities
 
-CLI extensions.
+Additional workflow helpers.
 
 <details><summary>`ext genexample`</summary><br>
 
@@ -2233,47 +2281,47 @@ HELLO=""
 ```
 
 </details>
-<details><summary>`ext gitignore`</summary><br>
+<details><summary>`gitignore`</summary><br>
 
 Gitignore your `.env` files.
 
 ```sh
-$ dotenvx ext gitignore
+$ dotenvx gitignore
 ▣ ignored .env* (.gitignore)
 ```
 
 </details>
-<details><summary>`ext gitignore --pattern`</summary><br>
+<details><summary>`gitignore --pattern`</summary><br>
 
 Gitignore specific pattern(s) of `.env` files.
 
 ```sh
-$ dotenvx ext gitignore --pattern .env.keys
+$ dotenvx gitignore --pattern .env.keys
 ▣ ignored .env.keys (.gitignore)
 ```
 
 </details>
-<details><summary>`ext precommit`</summary><br>
+<details><summary>`precommit`</summary><br>
 
 Prevent `.env` files from being committed to code.
 
 ```sh
-$ dotenvx ext precommit
+$ dotenvx precommit
 ▣ .env files (1) protected (encrypted or gitignored)
 ```
 
 </details>
-<details><summary>`ext precommit --install`</summary><br>
+<details><summary>`precommit --install`</summary><br>
 
 Install a shell script to `.git/hooks/pre-commit` to prevent accidentally committing any `.env` files to source control.
 
 ```sh
-$ dotenvx ext precommit --install
-▣ dotenvx ext precommit installed [.git/hooks/pre-commit]
+$ dotenvx precommit --install
+▣ dotenvx precommit installed [.git/hooks/pre-commit]
 ```
 
 </details>
-<details><summary>`ext precommit directory`</summary><br>
+<details><summary>`precommit directory`</summary><br>
 
 Prevent `.env` files from being committed to code inside a specified path to a directory.
 
@@ -2282,12 +2330,12 @@ $ echo "HELLO=Dotenvx" > .env
 $ mkdir -p apps/backend
 $ echo "HELLO=Backend" > apps/backend/.env
 
-$ dotenvx ext precommit apps/backend
+$ dotenvx precommit apps/backend
 ▣ apps/backend/.env not protected (encrypted or gitignored)
 ```
 
 </details>
-<details><summary>`ext prebuild`</summary><br>
+<details><summary>`prebuild`</summary><br>
 
 Prevent `.env` files from being built into your docker containers.
 
@@ -2302,12 +2350,12 @@ COPY --from=dotenv/dotenvx:latest /usr/local/bin/dotenvx /bin/local/bin
 
 # ... orther container commands
 
-RUN dotenvx ext prebuild
+RUN dotenvx prebuild
 CMD ["/usr/local/bin/dotenvx", "run", "--", "node", "index.js"]
 ```
 
 </details>
-<details><summary>`ext prebuild directory`</summary><br>
+<details><summary>`prebuild directory`</summary><br>
 
 Prevent `.env` files from being built into your docker containers inside a specified path to a directory.
 
@@ -2322,7 +2370,7 @@ COPY --from=dotenv/dotenvx:latest /usr/local/bin/dotenvx /bin/local/bin
 
 # ... orther container commands
 
-RUN dotenvx ext prebuild apps/backend
+RUN dotenvx prebuild apps/backend
 CMD ["/usr/local/bin/dotenvx", "run", "--", "node", "apps/backend/index.js"]
 ```
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.74.3",
+  "version": "1.75.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -43,10 +43,10 @@
   },
   "funding": "https://dotenvx.com",
   "dependencies": {
+    "@dotenvx/primitives": "^0.7.1",
     "commander": "^11.1.0",
     "conf": "^10.2.0",
     "dotenv": "^17.2.1",
-    "eciesjs": "^0.4.10",
     "enquirer": "^2.4.1",
     "env-paths": "^2.2.1",
     "execa": "^5.1.1",

package/src/cli/commands/ext.js

@@ -39,7 +39,7 @@ ext.command('genexample')
 
 // dotenvx ext gitignore
 ext.command('gitignore')
-  .description('append to .gitignore file (and if existing, .dockerignore, .npmignore, and .vercelignore)')
+  .description('append to .gitignore')
   .addHelpText('after', examples.gitignore)
   .option('--pattern <patterns...>', 'pattern(s) to gitignore', ['.env*'])
   .action(function (...args) {
@@ -48,7 +48,7 @@ ext.command('gitignore')
 
 // dotenvx ext prebuild
 ext.command('prebuild')
-  .description('prevent including .env files in docker builds')
+  .description('prevent including .env files in docker')
   .addHelpText('after', examples.prebuild)
   .argument('[directory]', 'directory to prevent including .env files from', '.')
   .action(function (...args) {

package/src/cli/dotenvx.js

@@ -194,6 +194,34 @@ program.command('ls')
     return require('./actions/ls').apply(this, args)
   })
 
+// dotenvx gitignore
+program.command('gitignore')
+  .description('append to .gitignore')
+  .addHelpText('after', examples.gitignore)
+  .option('--pattern <patterns...>', 'pattern(s) to gitignore', ['.env*'])
+  .action(function (...args) {
+    return require('./actions/ext/gitignore').apply(this, args)
+  })
+
+// dotenvx precommit
+program.command('precommit')
+  .description('prevent committing .env files to code')
+  .addHelpText('after', examples.precommit)
+  .argument('[directory]', 'directory to prevent committing .env files from', '.')
+  .option('-i, --install', 'install to .git/hooks/pre-commit')
+  .action(function (...args) {
+    return require('./actions/ext/precommit').apply(this, args)
+  })
+
+// dotenvx prebuild
+program.command('prebuild')
+  .description('prevent including .env files in docker')
+  .addHelpText('after', examples.prebuild)
+  .argument('[directory]', 'directory to prevent including .env files from', '.')
+  .action(function (...args) {
+    return require('./actions/ext/prebuild').apply(this, args)
+  })
+
 // dotenvx doctor
 program.command('doctor', { hidden: true })
   .description('scan for dotenv loaders')
@@ -242,7 +270,6 @@ program.addHelpText('after', 'Professional Security: ')
 program.addHelpText('after', '  login                    log in to move keys off-device, share with your team, and audit access')
 program.addHelpText('after', '  logout                   log out of connected security features')
 program.addHelpText('after', '  armor                    ⛨ move private keys off-device [www.dotenvx.com/armor]')
-program.addHelpText('after', '  ext                      ⊕ extensions')
 
 // dotenvx armor
 require('./commands/armor')(program.command('armor', { hidden: true }))
@@ -250,30 +277,6 @@ require('./commands/armor')(program.command('armor', { hidden: true }))
 // dotenvx ext
 program.addCommand(require('./commands/ext'))
 
-//
-// MOVED
-//
-program.command('prebuild')
-  .description('DEPRECATED: moved to [dotenvx ext prebuild]')
-  .addHelpText('after', examples.prebuild)
-  .argument('[directory]', 'directory to prevent including .env files from', '.')
-  .action(function (...args) {
-    logger.warn('DEPRECATION NOTICE: [prebuild] has moved to [dotenvx ext prebuild]')
-
-    require('./actions/ext/prebuild').apply(this, args)
-  })
-
-program.command('precommit')
-  .description('DEPRECATED: moved to [dotenvx ext precommit]')
-  .addHelpText('after', examples.precommit)
-  .argument('[directory]', 'directory to prevent committing .env files from', '.')
-  .option('-i, --install', 'install to .git/hooks/pre-commit')
-  .action(function (...args) {
-    logger.warn('DEPRECATION NOTICE: [precommit] has moved to [dotenvx ext precommit]')
-
-    require('./actions/ext/precommit').apply(this, args)
-  })
-
 // override helpInformation to hide DEPRECATED and 'ext' commands
 program.helpInformation = function () {
   const originalHelp = Command.prototype.helpInformation.call(this)
@@ -286,8 +289,7 @@ program.helpInformation = function () {
   const filteredLines = lines.filter(line =>
     !line.includes('DEPRECATED') &&
     !line.includes('help [command]') &&
-    !line.includes('🔌 extensions') &&
-    !/^\s*ls\b/.test(line)
+    !line.includes('🔌 extensions')
   )
 
   return filteredLines.join('\n')

package/src/cli/examples.js

@@ -27,14 +27,14 @@ const precommit = function () {
 Examples:
 
   \`\`\`
-  $ dotenvx ext precommit
-  $ dotenvx ext precommit --install
+  $ dotenvx precommit
+  $ dotenvx precommit --install
   \`\`\`
 
 Try it:
 
   \`\`\`
-  $ dotenvx ext precommit
+  $ dotenvx precommit
   [dotenvx@0.45.0][precommit] success
   \`\`\`
   `
@@ -45,13 +45,13 @@ const prebuild = function () {
 Examples:
 
   \`\`\`
-  $ dotenvx ext prebuild
+  $ dotenvx prebuild
   \`\`\`
 
 Try it:
 
   \`\`\`
-  $ dotenvx ext prebuild
+  $ dotenvx prebuild
   [dotenvx@0.10.0][prebuild] success
   \`\`\`
   `
@@ -62,14 +62,14 @@ const gitignore = function () {
 Examples:
 
   \`\`\`
-  $ dotenvx ext gitignore
-  $ dotenvx ext gitignore --pattern .env.keys
+  $ dotenvx gitignore
+  $ dotenvx gitignore --pattern .env.keys
   \`\`\`
 
   Try it:
 
   \`\`\`
-  $ dotenvx ext gitignore
+  $ dotenvx gitignore
   ▣ ignored .env* (.gitignore)
   \`\`\`
   `

package/src/db/device.js

@@ -1,5 +1,5 @@
 const Conf = require('conf')
-const { PrivateKey } = require('eciesjs')
+const { derive, keypair } = require('@dotenvx/primitives')
 
 const encryptDeviceValue = require('./../lib/helpers/encryptDeviceValue')
 const decryptDeviceValue = require('./../lib/helpers/decryptDeviceValue')
@@ -38,9 +38,7 @@ class Device {
       return currentPrivateKey
     }
 
-    // generate privateKey for the first time
-    const kp = new PrivateKey()
-    const _privateKey = kp.secret.toString('hex')
+    const _privateKey = keypair().privateKey
 
     this.store.set('private_key/1', _privateKey)
 
@@ -54,11 +52,7 @@ class Device {
       return ''
     }
 
-    // create keyPair object from hex string
-    const _privateKey = new PrivateKey(Buffer.from(privateKeyHex, 'hex'))
-
-    // compute publicKey from privateKey
-    return _privateKey.publicKey.toHex()
+    return derive(privateKeyHex)
   }
 
   encrypt (value) {

package/src/lib/helpers/cryptography/decryptKeyValue.js

@@ -1,9 +1,13 @@
-const { decrypt } = require('eciesjs')
+const { decrypt } = require('@dotenvx/primitives')
 
 const Errors = require('./../errors')
 
 const PREFIX = 'encrypted:'
 
+function primitiveMessage (error) {
+  return error.message.replace(/^\[[A-Z_]+\] /, '')
+}
+
 function decryptKeyValue (key, value, privateKeyName, privateKey) {
   let decryptedValue
   let decryptionError
@@ -18,23 +22,19 @@ function decryptKeyValue (key, value, privateKeyName, privateKey) {
   } else {
     const privateKeys = privateKey.split(',')
     for (const privKey of privateKeys) {
-      const secret = Buffer.from(privKey, 'hex')
-      const encoded = value.substring(PREFIX.length)
-      const ciphertext = Buffer.from(encoded, 'base64')
-
       try {
-        decryptedValue = decrypt(secret, ciphertext).toString()
+        decryptedValue = decrypt(privKey, value)
         decryptionError = null // reset to null error (scenario for multiple private keys)
         break
       } catch (e) {
-        if (e.message === 'Invalid private key') {
+        if (e.code === 'INVALID_PRIVATE_KEY') {
           decryptionError = new Errors({ key, privateKeyName, privateKey }).invalidPrivateKey()
-        } else if (e.message === 'Unsupported state or unable to authenticate data') {
+        } else if (e.code === 'WRONG_PRIVATE_KEY') {
           decryptionError = new Errors({ key, privateKeyName, privateKey }).wrongPrivateKey()
-        } else if (e.message === 'Point of length 65 was invalid. Expected 33 compressed bytes or 65 uncompressed bytes') {
+        } else if (e.code === 'MALFORMED_ENCRYPTED_DATA' || primitiveMessage(e).startsWith('bad point:')) {
           decryptionError = new Errors({ key, privateKeyName, privateKey }).malformedEncryptedData()
         } else {
-          decryptionError = new Errors({ key, privateKeyName, privateKey, message: e.message }).decryptionFailed()
+          decryptionError = new Errors({ key, privateKeyName, privateKey, message: primitiveMessage(e) }).decryptionFailed()
         }
       }
     }

package/src/lib/helpers/cryptography/encryptValue.js

@@ -1,12 +1,7 @@
-const { encrypt } = require('eciesjs')
-
-const PREFIX = 'encrypted:'
+const { encrypt } = require('@dotenvx/primitives')
 
 function encryptValue (value, publicKey) {
-  const ciphertext = encrypt(publicKey, Buffer.from(value))
-  const encoded = Buffer.from(ciphertext, 'hex').toString('base64') // base64 encode ciphertext
-
-  return `${PREFIX}${encoded}`
+  return encrypt(publicKey, value)
 }
 
 module.exports = encryptValue

package/src/lib/helpers/cryptography/index.js

@@ -4,7 +4,6 @@ module.exports = {
   localKeypair: require('./localKeypair'),
   encryptValue: require('./encryptValue'),
   decryptKeyValue: require('./decryptKeyValue'),
-  isEncrypted: require('./isEncrypted'),
   isPublicKey: require('./isPublicKey'),
   mutateKeysSrc: require('./mutateKeysSrc'),
   mutateKeysSrcSync: require('./mutateKeysSrcSync'),

package/src/lib/helpers/cryptography/localKeypair.js

@@ -1,21 +1,14 @@
-const { PrivateKey } = require('eciesjs')
+const { derive, keypair } = require('@dotenvx/primitives')
 
 function localKeypair (existingPrivateKey) {
-  let kp
-
   if (existingPrivateKey) {
-    kp = new PrivateKey(Buffer.from(existingPrivateKey, 'hex'))
-  } else {
-    kp = new PrivateKey()
+    return {
+      publicKey: derive(existingPrivateKey),
+      privateKey: existingPrivateKey
+    }
   }
 
-  const publicKey = kp.publicKey.toHex()
-  const privateKey = kp.secret.toString('hex')
-
-  return {
-    publicKey,
-    privateKey
-  }
+  return keypair()
 }
 
 module.exports = localKeypair

package/src/lib/helpers/decryptDeviceValue.js

@@ -1,10 +1,7 @@
-const { decrypt } = require('eciesjs')
+const { decrypt } = require('@dotenvx/primitives')
 
 function decryptDeviceValue (value, privateKey) {
-  const secret = Buffer.from(privateKey, 'hex')
-  const ciphertext = Buffer.from(value, 'base64')
-
-  return decrypt(secret, ciphertext).toString()
+  return decrypt(privateKey, value, { prefix: false })
 }
 
 module.exports = decryptDeviceValue

package/src/lib/helpers/encryptDeviceValue.js

@@ -1,9 +1,7 @@
-const { encrypt } = require('eciesjs')
+const { encrypt } = require('@dotenvx/primitives')
 
 function encryptDeviceValue (value, publicKey) {
-  const ciphertext = encrypt(publicKey, Buffer.from(value))
-
-  return Buffer.from(ciphertext, 'hex').toString('base64')
+  return encrypt(publicKey, value, { prefix: false })
 }
 
 module.exports = encryptDeviceValue

package/src/lib/helpers/installPrecommitHook.js

@@ -6,10 +6,10 @@ const HOOK_SCRIPT = `#!/bin/sh
 
 if command -v dotenvx 2>&1 >/dev/null
 then
-  dotenvx ext precommit
+  dotenvx precommit
 elif npx dotenvx -V >/dev/null 2>&1
 then
-  npx dotenvx ext precommit
+  npx dotenvx precommit
 else
   if [ -t 2 ]; then
     RED="$(printf '\\033[31m')"
@@ -19,7 +19,7 @@ else
     RESET=""
   fi
 
-  printf "%s☠ 'dotenvx ext precommit' command not found (.git/hooks/precommit) fix: [curl -sfS https://dotenvx.sh | sh]%s\n" "$RED" "$RESET" >&2
+  printf "%s☠ 'dotenvx precommit' command not found (.git/hooks/precommit) fix: [curl -sfS https://dotenvx.sh | sh]%s\n" "$RED" "$RESET" >&2
   exit 1
 fi
 `
@@ -35,17 +35,19 @@ class InstallPrecommitHook {
     try {
       // Check if the pre-commit file already exists
       if (this._exists()) {
+        const currentHook = this._currentHook()
+
         // Check if 'dotenvx precommit' already exists in the file
-        if (this._currentHook().includes('dotenvx ext precommit')) {
+        if (currentHook.includes('dotenvx precommit') || currentHook.includes('dotenvx ext precommit')) {
           // do nothing
-          successMessage = `▣ dotenvx ext precommit exists [${this.hookPath}]`
+          successMessage = `▣ dotenvx precommit exists [${this.hookPath}]`
         } else {
           this._appendHook()
-          successMessage = `▣ dotenvx ext precommit appended [${this.hookPath}]`
+          successMessage = `▣ dotenvx precommit appended [${this.hookPath}]`
         }
       } else {
         this._createHook()
-        successMessage = `▣ dotenvx ext precommit installed [${this.hookPath}]`
+        successMessage = `▣ dotenvx precommit installed [${this.hookPath}]`
       }
 
       return {

package/src/lib/helpers/isFullyEncrypted.js

@@ -1,5 +1,5 @@
+const { encrypted } = require('@dotenvx/primitives')
 const dotenvParse = require('./dotenvParse')
-const isEncrypted = require('./cryptography/isEncrypted')
 const isPublicKey = require('./cryptography/isPublicKey')
 
 function isFullyEncrypted (src) {
@@ -14,7 +14,7 @@ function isFullyEncrypted (src) {
     //
     // key => [value1, ...]
     for (const value of values) {
-      const result = isEncrypted(value) || isPublicKey(key)
+      const result = encrypted(value) || isPublicKey(key)
       if (!result) {
         return false
       }

package/src/lib/helpers/parse.js

@@ -1,5 +1,5 @@
 const decryptKeyValue = require('./cryptography/decryptKeyValue')
-const isEncrypted = require('./cryptography/isEncrypted')
+const { encrypted } = require('@dotenvx/primitives')
 const evalKeyValue = require('./evalKeyValue')
 const resolveEscapeSequences = require('./resolveEscapeSequences')
 
@@ -45,7 +45,7 @@ class Parse {
         this.errors.push(e)
       }
 
-      const encryptedPrefixed = isEncrypted(this.parsed[key]) // do not eval encrypted prefix
+      const encryptedPrefixed = encrypted(this.parsed[key]) // do not eval encrypted prefix
 
       // eval empty, double, or backticks
       let evaled = false

package/src/lib/services/armorPush.js

@@ -1,4 +1,4 @@
-const { PrivateKey } = require('eciesjs')
+const { derive } = require('@dotenvx/primitives')
 const prompts = require('../helpers/prompts')
 const PostArmorPush = require('../api/postArmorPush')
 const keyNamesForEnvFile = require('../helpers/keyResolution/keyNamesForEnvFile')
@@ -7,7 +7,7 @@ const teamChoicesFromMeta = require('../helpers/teamChoicesFromMeta')
 
 function publicKeyFromPrivateKey (privateKey) {
   try {
-    return new PrivateKey(Buffer.from(privateKey, 'hex')).publicKey.toHex()
+    return derive(privateKey)
   } catch {
     return ''
   }

package/src/lib/services/decrypt.js

@@ -1,6 +1,7 @@
 const fsx = require('./../helpers/fsx')
 const path = require('path')
 const picomatch = require('picomatch')
+const { encrypted } = require('@dotenvx/primitives')
 
 const TYPE_ENV_FILE = 'envFile'
 
@@ -16,8 +17,7 @@ const {
 } = require('./../helpers/keyResolution')
 
 const {
-  decryptKeyValue,
-  isEncrypted
+  decryptKeyValue
 } = require('./../helpers/cryptography')
 
 const replace = require('./../helpers/replace')
@@ -101,12 +101,12 @@ class Decrypt {
           continue
         }
 
-        const encrypted = values.some(value => isEncrypted(value))
-        if (encrypted) {
+        const hasEncrypted = values.some(value => encrypted(value))
+        if (hasEncrypted) {
           row.keys.push(key) // track key(s)
 
           const decryptedValues = values.map(value => {
-            if (!isEncrypted(value)) {
+            if (!encrypted(value)) {
               return value
             }
 

package/src/lib/services/encrypt.js

@@ -1,6 +1,7 @@
 const fsx = require('./../helpers/fsx')
 const path = require('path')
 const picomatch = require('picomatch')
+const { encrypted } = require('@dotenvx/primitives')
 
 const TYPE_ENV_FILE = 'envFile'
 
@@ -17,7 +18,6 @@ const {
 
 const {
   encryptValue,
-  isEncrypted,
   isPublicKey,
   provision,
   provisionWithPrivateKey
@@ -151,12 +151,12 @@ class Encrypt {
           continue
         }
 
-        const encrypted = values.every(value => isEncrypted(value) || isPublicKey(key))
-        if (!encrypted) {
+        const fullyEncrypted = values.every(value => encrypted(value) || isPublicKey(key))
+        if (!fullyEncrypted) {
           row.keys.push(key) // track key(s)
 
           const encryptedValues = values.map(value => {
-            if (isEncrypted(value) || isPublicKey(key)) {
+            if (encrypted(value) || isPublicKey(key)) {
               return value
             }
 

package/src/lib/services/genexample.js

@@ -34,7 +34,7 @@ class Genexample {
       const filepath = path.resolve(this.directory, envFilepath)
       if (!fsx.existsSync(filepath)) {
         const error = new Errors({ envFilepath, filepath }).missingEnvFile()
-        error.help = `? add it with [echo "HELLO=World" > ${envFilepath}] and then run [dotenvx genexample]`
+        error.help = `? add it with [echo "HELLO=World" > ${envFilepath}] and then run [dotenvx ext genexample]`
         throw error
       }
 

package/src/lib/services/prebuild.js

@@ -47,7 +47,7 @@ class Prebuild {
         if (file === '.env.example' || file === '.env.x') {
           const warning = new Errors({
             message: `${file} ignored (should not be)`,
-            help: `fix: [dotenvx ext gitignore --pattern !${file}]`
+            help: `fix: [dotenvx gitignore --pattern !${file}]`
           }).custom()
           warnings.push(warning)
         }
@@ -59,10 +59,10 @@ class Prebuild {
           // if contents are encrypted don't raise an error
           if (!encrypted) {
             let errorMsg = `${file} not encrypted/dockerignored`
-            let errorHelp = `fix: [dotenvx encrypt -f ${file}] or [dotenvx ext gitignore --pattern ${file}]`
+            let errorHelp = `fix: [dotenvx encrypt -f ${file}] or [dotenvx gitignore --pattern ${file}]`
             if (file.includes('.env.keys')) {
               errorMsg = `${file} not dockerignored`
-              errorHelp = `fix: [dotenvx ext gitignore --pattern ${file}]`
+              errorHelp = `fix: [dotenvx gitignore --pattern ${file}]`
             }
 
             throw new Errors({ message: errorMsg, help: errorHelp }).custom()

package/src/lib/services/precommit.js

@@ -63,7 +63,7 @@ class Precommit {
             if (file === '.env.example' || file === '.env.x') {
               const warning = new Errors({
                 message: `${file} ignored (should not be)`,
-                help: `fix: [dotenvx ext gitignore --pattern !${file}]`
+                help: `fix: [dotenvx gitignore --pattern !${file}]`
               }).custom()
               warnings.push(warning)
             }
@@ -75,10 +75,10 @@ class Precommit {
               // if contents are encrypted don't raise an error
               if (!encrypted) {
                 let errorMsg = `${file} not encrypted/gitignored`
-                let errorHelp = `fix: [dotenvx encrypt -f ${file}] or [dotenvx ext gitignore --pattern ${file}]`
+                let errorHelp = `fix: [dotenvx encrypt -f ${file}] or [dotenvx gitignore --pattern ${file}]`
                 if (file.includes('.env.keys')) {
                   errorMsg = `${file} not gitignored`
-                  errorHelp = `fix: [dotenvx ext gitignore --pattern ${file}]`
+                  errorHelp = `fix: [dotenvx gitignore --pattern ${file}]`
                 }
 
                 throw new Errors({ message: errorMsg, help: errorHelp }).custom()

package/src/lib/services/rotate.js

@@ -1,6 +1,7 @@
 const fsx = require('./../helpers/fsx')
 const path = require('path')
 const picomatch = require('picomatch')
+const { encrypted } = require('@dotenvx/primitives')
 
 const TYPE_ENV_FILE = 'envFile'
 
@@ -19,8 +20,7 @@ const {
   armorKeypair,
   localKeypair,
   encryptValue,
-  decryptKeyValue,
-  isEncrypted
+  decryptKeyValue
 } = require('./../helpers/cryptography')
 
 const append = require('./../helpers/append')
@@ -134,7 +134,7 @@ class Rotate {
           continue
         }
 
-        const value = [...values].reverse().find(value => isEncrypted(value))
+        const value = [...values].reverse().find(value => encrypted(value))
         if (value) { // only re-encrypt those already encrypted
           row.keys.push(key) // track key(s)
 

package/src/lib/services/sets.js

@@ -1,5 +1,6 @@
 const fsx = require('./../helpers/fsx')
 const path = require('path')
+const { encrypted } = require('@dotenvx/primitives')
 
 const TYPE_ENV_FILE = 'envFile'
 
@@ -18,7 +19,6 @@ const {
 const {
   encryptValue,
   decryptKeyValue,
-  isEncrypted,
   provision,
   provisionSync,
   provisionWithPrivateKey
@@ -124,7 +124,7 @@ class Sets {
       if (seededWithInitialKey) {
         row.originalValue = null
       }
-      const wasPlainText = !isEncrypted(row.originalValue)
+      const wasPlainText = !encrypted(row.originalValue)
       this.readableFilepaths.add(envFilepath)
 
       if (this.encrypt) {
@@ -241,7 +241,7 @@ class Sets {
       if (seededWithInitialKey) {
         row.originalValue = null
       }
-      const wasPlainText = !isEncrypted(row.originalValue)
+      const wasPlainText = !encrypted(row.originalValue)
       this.readableFilepaths.add(envFilepath)
 
       if (this.encrypt) {

package/src/lib/helpers/cryptography/isEncrypted.js

@@ -1,7 +0,0 @@
-const ENCRYPTION_PATTERN = /^encrypted:.+/
-
-function isEncrypted (value) {
-  return ENCRYPTION_PATTERN.test(value)
-}
-
-module.exports = isEncrypted