@dotenvx/dotenvx 1.74.3 → 1.75.1

package/CHANGELOG.md

@@ -2,7 +2,30 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.74.3...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.75.1...main)
+
+## [1.75.1](https://github.com/dotenvx/dotenvx/compare/v1.75.0...v1.75.1) (2026-06-20)
+
+### Changed
+
+* Publish as named binaries ([#851](https://github.com/dotenvx/dotenvx/pull/851))
+
+### Removed
+
+* Remove references to `dotenvx-vlt` (now dotenvx-armor) ([#849](https://github.com/dotenvx/dotenvx/pull/849))
+
+## [1.75.0](https://github.com/dotenvx/dotenvx/compare/v1.74.4...v1.75.0) (2026-06-19)
+
+### Changed
+
+* Swap in `@dotenvx/primitives` ([#848](https://github.com/dotenvx/dotenvx/pull/848))
+* `ext` commands become first-class([#847](https://github.com/dotenvx/dotenvx/pull/847))
+
+## [1.74.4](https://github.com/dotenvx/dotenvx/compare/v1.74.3...v1.74.4) (2026-06-19)
+
+### Removed
+
+* Remove separately published `@dotenvx/next-env` from this repo ([#846](https://github.com/dotenvx/dotenvx/pull/846))
 
 ## [1.74.3](https://github.com/dotenvx/dotenvx/compare/v1.74.2...v1.74.3) (2026-06-19)
 

package/README.md

@@ -150,6 +150,47 @@ $ dotenvx run -- npx tsx index.ts
 Hello Dotenvx
 ```
 
+</details>
+<details><summary>Next.js ▲</summary><br>
+
+Install Dotenvx and `@dotenvx/next-env`.
+
+```sh
+$ npm install @dotenvx/dotenvx
+$ npm install @dotenvx/next-env
+```
+
+Override `@next/env` in your `package.json`.
+
+```json
+{
+  "overrides": {
+    "@next/env": "npm:@dotenvx/next-env"
+  }
+}
+```
+
+Encrypt your `.env` file.
+
+```sh
+$ npx dotenvx encrypt
+◈ encrypted (.env)
+```
+
+Your encrypted secrets are automatically injected and readable in Next.js.
+
+```ts
+import { NextResponse } from 'next/server'
+
+export async function GET() {
+  return NextResponse.json({
+    HELLO: process.env.HELLO
+  })
+}
+```
+
+Set `DOTENV_PRIVATE_KEY` in production before deploying.
+
 </details>
 <details><summary>Cloudflare Workers ⛅️</summary><br>
 
@@ -1613,7 +1654,7 @@ $ echo "HELLO=Dotenvx" > .env
 
 $ dotenvx encrypt
 ◈ encrypted (.env) + local key (.env.keys)
-⮕  next run [dotenvx ext gitignore --pattern .env.keys] to gitignore .env.keys
+⮕  next run [dotenvx gitignore --pattern .env.keys] to gitignore .env.keys
 ⮕  next run [DOTENV_PRIVATE_KEY='122...0b8' dotenvx run -- yourcommand] to test decryption locally
 ```
 
@@ -1628,7 +1669,7 @@ $ echo "HELLO=Production" > .env.production
 
 $ dotenvx encrypt -f .env.production
 ◈ encrypted (.env.production) + local key (.env.keys)
-⮕  next run [dotenvx ext gitignore --pattern .env.keys] to gitignore .env.keys
+⮕  next run [dotenvx gitignore --pattern .env.keys] to gitignore .env.keys
 ⮕  next run [DOTENV_PRIVATE_KEY='bff...bc4' dotenvx run -- yourcommand] to test decryption locally
 ```
 
@@ -2121,12 +2162,19 @@ Commands:
   set <KEY> <value>  set a single environment variable
   encrypt            encrypt .env file(s)
   decrypt            decrypt .env file(s)
+  rotate             rotate keypair(s) and re-encrypt .env file(s)
   keypair [KEY]      print public/private keys for .env file(s)
   ls [directory]     print all .env files in a tree structure
+  gitignore          append to .gitignore
+  precommit [directory]
+                     prevent committing .env files to code
+  prebuild [directory]
+                     prevent including .env files in docker
  
-Advanced: 
-  pro                          🏆 pro
-  ext                          🔌 extensions
+Professional Security: 
+  login                    log in to move keys off-device, share with your team, and audit access
+  logout                   log out of connected security features
+  armor                    ⛨ move private keys off-device [www.dotenvx.com/armor]
 ```
 
 You can get more detailed help per command with `dotenvx help COMMAND`.
@@ -2174,9 +2222,9 @@ X.X.X
 
 </details>
 
-### Extensions 🔌
+### Utilities
 
-CLI extensions.
+Additional workflow helpers.
 
 <details><summary>`ext genexample`</summary><br>
 
@@ -2233,47 +2281,47 @@ HELLO=""
 ```
 
 </details>
-<details><summary>`ext gitignore`</summary><br>
+<details><summary>`gitignore`</summary><br>
 
 Gitignore your `.env` files.
 
 ```sh
-$ dotenvx ext gitignore
+$ dotenvx gitignore
 ▣ ignored .env* (.gitignore)
 ```
 
 </details>
-<details><summary>`ext gitignore --pattern`</summary><br>
+<details><summary>`gitignore --pattern`</summary><br>
 
 Gitignore specific pattern(s) of `.env` files.
 
 ```sh
-$ dotenvx ext gitignore --pattern .env.keys
+$ dotenvx gitignore --pattern .env.keys
 ▣ ignored .env.keys (.gitignore)
 ```
 
 </details>
-<details><summary>`ext precommit`</summary><br>
+<details><summary>`precommit`</summary><br>
 
 Prevent `.env` files from being committed to code.
 
 ```sh
-$ dotenvx ext precommit
+$ dotenvx precommit
 ▣ .env files (1) protected (encrypted or gitignored)
 ```
 
 </details>
-<details><summary>`ext precommit --install`</summary><br>
+<details><summary>`precommit --install`</summary><br>
 
 Install a shell script to `.git/hooks/pre-commit` to prevent accidentally committing any `.env` files to source control.
 
 ```sh
-$ dotenvx ext precommit --install
-▣ dotenvx ext precommit installed [.git/hooks/pre-commit]
+$ dotenvx precommit --install
+▣ dotenvx precommit installed [.git/hooks/pre-commit]
 ```
 
 </details>
-<details><summary>`ext precommit directory`</summary><br>
+<details><summary>`precommit directory`</summary><br>
 
 Prevent `.env` files from being committed to code inside a specified path to a directory.
 
@@ -2282,12 +2330,12 @@ $ echo "HELLO=Dotenvx" > .env
 $ mkdir -p apps/backend
 $ echo "HELLO=Backend" > apps/backend/.env
 
-$ dotenvx ext precommit apps/backend
+$ dotenvx precommit apps/backend
 ▣ apps/backend/.env not protected (encrypted or gitignored)
 ```
 
 </details>
-<details><summary>`ext prebuild`</summary><br>
+<details><summary>`prebuild`</summary><br>
 
 Prevent `.env` files from being built into your docker containers.
 
@@ -2302,12 +2350,12 @@ COPY --from=dotenv/dotenvx:latest /usr/local/bin/dotenvx /bin/local/bin
 
 # ... orther container commands
 
-RUN dotenvx ext prebuild
+RUN dotenvx prebuild
 CMD ["/usr/local/bin/dotenvx", "run", "--", "node", "index.js"]
 ```
 
 </details>
-<details><summary>`ext prebuild directory`</summary><br>
+<details><summary>`prebuild directory`</summary><br>
 
 Prevent `.env` files from being built into your docker containers inside a specified path to a directory.
 
@@ -2322,7 +2370,7 @@ COPY --from=dotenv/dotenvx:latest /usr/local/bin/dotenvx /bin/local/bin
 
 # ... orther container commands
 
-RUN dotenvx ext prebuild apps/backend
+RUN dotenvx prebuild apps/backend
 CMD ["/usr/local/bin/dotenvx", "run", "--", "node", "apps/backend/index.js"]
 ```
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.74.3",
+  "version": "1.75.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -43,10 +43,10 @@
   },
   "funding": "https://dotenvx.com",
   "dependencies": {
+    "@dotenvx/primitives": "^0.8.0",
     "commander": "^11.1.0",
     "conf": "^10.2.0",
     "dotenv": "^17.2.1",
-    "eciesjs": "^0.4.10",
     "enquirer": "^2.4.1",
     "env-paths": "^2.2.1",
     "execa": "^5.1.1",

package/src/cli/commands/ext.js

@@ -39,7 +39,7 @@ ext.command('genexample')
 
 // dotenvx ext gitignore
 ext.command('gitignore')
-  .description('append to .gitignore file (and if existing, .dockerignore, .npmignore, and .vercelignore)')
+  .description('append to .gitignore')
   .addHelpText('after', examples.gitignore)
   .option('--pattern <patterns...>', 'pattern(s) to gitignore', ['.env*'])
   .action(function (...args) {
@@ -48,7 +48,7 @@ ext.command('gitignore')
 
 // dotenvx ext prebuild
 ext.command('prebuild')
-  .description('prevent including .env files in docker builds')
+  .description('prevent including .env files in docker')
   .addHelpText('after', examples.prebuild)
   .argument('[directory]', 'directory to prevent including .env files from', '.')
   .action(function (...args) {

package/src/cli/dotenvx.js

@@ -194,6 +194,34 @@ program.command('ls')
     return require('./actions/ls').apply(this, args)
   })
 
+// dotenvx gitignore
+program.command('gitignore')
+  .description('append to .gitignore')
+  .addHelpText('after', examples.gitignore)
+  .option('--pattern <patterns...>', 'pattern(s) to gitignore', ['.env*'])
+  .action(function (...args) {
+    return require('./actions/ext/gitignore').apply(this, args)
+  })
+
+// dotenvx precommit
+program.command('precommit')
+  .description('prevent committing .env files to code')
+  .addHelpText('after', examples.precommit)
+  .argument('[directory]', 'directory to prevent committing .env files from', '.')
+  .option('-i, --install', 'install to .git/hooks/pre-commit')
+  .action(function (...args) {
+    return require('./actions/ext/precommit').apply(this, args)
+  })
+
+// dotenvx prebuild
+program.command('prebuild')
+  .description('prevent including .env files in docker')
+  .addHelpText('after', examples.prebuild)
+  .argument('[directory]', 'directory to prevent including .env files from', '.')
+  .action(function (...args) {
+    return require('./actions/ext/prebuild').apply(this, args)
+  })
+
 // dotenvx doctor
 program.command('doctor', { hidden: true })
   .description('scan for dotenv loaders')
@@ -242,7 +270,6 @@ program.addHelpText('after', 'Professional Security: ')
 program.addHelpText('after', '  login                    log in to move keys off-device, share with your team, and audit access')
 program.addHelpText('after', '  logout                   log out of connected security features')
 program.addHelpText('after', '  armor                    ⛨ move private keys off-device [www.dotenvx.com/armor]')
-program.addHelpText('after', '  ext                      ⊕ extensions')
 
 // dotenvx armor
 require('./commands/armor')(program.command('armor', { hidden: true }))
@@ -250,30 +277,6 @@ require('./commands/armor')(program.command('armor', { hidden: true }))
 // dotenvx ext
 program.addCommand(require('./commands/ext'))
 
-//
-// MOVED
-//
-program.command('prebuild')
-  .description('DEPRECATED: moved to [dotenvx ext prebuild]')
-  .addHelpText('after', examples.prebuild)
-  .argument('[directory]', 'directory to prevent including .env files from', '.')
-  .action(function (...args) {
-    logger.warn('DEPRECATION NOTICE: [prebuild] has moved to [dotenvx ext prebuild]')
-
-    require('./actions/ext/prebuild').apply(this, args)
-  })
-
-program.command('precommit')
-  .description('DEPRECATED: moved to [dotenvx ext precommit]')
-  .addHelpText('after', examples.precommit)
-  .argument('[directory]', 'directory to prevent committing .env files from', '.')
-  .option('-i, --install', 'install to .git/hooks/pre-commit')
-  .action(function (...args) {
-    logger.warn('DEPRECATION NOTICE: [precommit] has moved to [dotenvx ext precommit]')
-
-    require('./actions/ext/precommit').apply(this, args)
-  })
-
 // override helpInformation to hide DEPRECATED and 'ext' commands
 program.helpInformation = function () {
   const originalHelp = Command.prototype.helpInformation.call(this)
@@ -286,8 +289,7 @@ program.helpInformation = function () {
   const filteredLines = lines.filter(line =>
     !line.includes('DEPRECATED') &&
     !line.includes('help [command]') &&
-    !line.includes('🔌 extensions') &&
-    !/^\s*ls\b/.test(line)
+    !line.includes('🔌 extensions')
   )
 
   return filteredLines.join('\n')

package/src/cli/examples.js

@@ -27,14 +27,14 @@ const precommit = function () {
 Examples:
 
   \`\`\`
-  $ dotenvx ext precommit
-  $ dotenvx ext precommit --install
+  $ dotenvx precommit
+  $ dotenvx precommit --install
   \`\`\`
 
 Try it:
 
   \`\`\`
-  $ dotenvx ext precommit
+  $ dotenvx precommit
   [dotenvx@0.45.0][precommit] success
   \`\`\`
   `
@@ -45,13 +45,13 @@ const prebuild = function () {
 Examples:
 
   \`\`\`
-  $ dotenvx ext prebuild
+  $ dotenvx prebuild
   \`\`\`
 
 Try it:
 
   \`\`\`
-  $ dotenvx ext prebuild
+  $ dotenvx prebuild
   [dotenvx@0.10.0][prebuild] success
   \`\`\`
   `
@@ -62,14 +62,14 @@ const gitignore = function () {
 Examples:
 
   \`\`\`
-  $ dotenvx ext gitignore
-  $ dotenvx ext gitignore --pattern .env.keys
+  $ dotenvx gitignore
+  $ dotenvx gitignore --pattern .env.keys
   \`\`\`
 
   Try it:
 
   \`\`\`
-  $ dotenvx ext gitignore
+  $ dotenvx gitignore
   ▣ ignored .env* (.gitignore)
   \`\`\`
   `

package/src/db/device.js

@@ -1,5 +1,5 @@
 const Conf = require('conf')
-const { PrivateKey } = require('eciesjs')
+const { derive, keypair } = require('@dotenvx/primitives')
 
 const encryptDeviceValue = require('./../lib/helpers/encryptDeviceValue')
 const decryptDeviceValue = require('./../lib/helpers/decryptDeviceValue')
@@ -38,9 +38,7 @@ class Device {
       return currentPrivateKey
     }
 
-    // generate privateKey for the first time
-    const kp = new PrivateKey()
-    const _privateKey = kp.secret.toString('hex')
+    const _privateKey = keypair().privateKey
 
     this.store.set('private_key/1', _privateKey)
 
@@ -54,11 +52,7 @@ class Device {
       return ''
     }
 
-    // create keyPair object from hex string
-    const _privateKey = new PrivateKey(Buffer.from(privateKeyHex, 'hex'))
-
-    // compute publicKey from privateKey
-    return _privateKey.publicKey.toHex()
+    return derive(privateKeyHex)
   }
 
   encrypt (value) {

package/src/lib/helpers/append.js

@@ -1,5 +1,5 @@
 const quotes = require('./quotes')
-const dotenvParse = require('./dotenvParse')
+const { scan } = require('@dotenvx/primitives')
 const escapeForRegex = require('./escapeForRegex')
 const escapeDollarSigns = require('./escapeDollarSigns')
 
@@ -7,11 +7,12 @@ function append (src, key, appendValue) {
   let output
   let newPart = ''
 
-  const parsed = dotenvParse(src, true, true) // skip expanding \n and skip converting \r\n
+  const { parsed } = scan(src, { expandDoubleQuotedNewlines: false, convertWindowsNewlines: false })
   const _quotes = quotes(src)
   if (Object.prototype.hasOwnProperty.call(parsed, key)) {
     const quote = _quotes[key]
-    const originalValue = parsed[key]
+    const values = parsed[key]
+    const originalValue = values[values.length - 1]
 
     newPart += `${key}=${quote}${originalValue},${appendValue}${quote}`
 

package/src/lib/helpers/cryptography/decryptKeyValue.js

@@ -1,9 +1,13 @@
-const { decrypt } = require('eciesjs')
+const { decrypt } = require('@dotenvx/primitives')
 
 const Errors = require('./../errors')
 
 const PREFIX = 'encrypted:'
 
+function primitiveMessage (error) {
+  return error.message.replace(/^\[[A-Z_]+\] /, '')
+}
+
 function decryptKeyValue (key, value, privateKeyName, privateKey) {
   let decryptedValue
   let decryptionError
@@ -18,23 +22,19 @@ function decryptKeyValue (key, value, privateKeyName, privateKey) {
   } else {
     const privateKeys = privateKey.split(',')
     for (const privKey of privateKeys) {
-      const secret = Buffer.from(privKey, 'hex')
-      const encoded = value.substring(PREFIX.length)
-      const ciphertext = Buffer.from(encoded, 'base64')
-
       try {
-        decryptedValue = decrypt(secret, ciphertext).toString()
+        decryptedValue = decrypt(privKey, value)
         decryptionError = null // reset to null error (scenario for multiple private keys)
         break
       } catch (e) {
-        if (e.message === 'Invalid private key') {
+        if (e.code === 'INVALID_PRIVATE_KEY') {
           decryptionError = new Errors({ key, privateKeyName, privateKey }).invalidPrivateKey()
-        } else if (e.message === 'Unsupported state or unable to authenticate data') {
+        } else if (e.code === 'WRONG_PRIVATE_KEY') {
           decryptionError = new Errors({ key, privateKeyName, privateKey }).wrongPrivateKey()
-        } else if (e.message === 'Point of length 65 was invalid. Expected 33 compressed bytes or 65 uncompressed bytes') {
+        } else if (e.code === 'MALFORMED_ENCRYPTED_DATA' || primitiveMessage(e).startsWith('bad point:')) {
           decryptionError = new Errors({ key, privateKeyName, privateKey }).malformedEncryptedData()
         } else {
-          decryptionError = new Errors({ key, privateKeyName, privateKey, message: e.message }).decryptionFailed()
+          decryptionError = new Errors({ key, privateKeyName, privateKey, message: primitiveMessage(e) }).decryptionFailed()
         }
       }
     }

package/src/lib/helpers/cryptography/encryptValue.js

@@ -1,12 +1,7 @@
-const { encrypt } = require('eciesjs')
-
-const PREFIX = 'encrypted:'
+const { encrypt } = require('@dotenvx/primitives')
 
 function encryptValue (value, publicKey) {
-  const ciphertext = encrypt(publicKey, Buffer.from(value))
-  const encoded = Buffer.from(ciphertext, 'hex').toString('base64') // base64 encode ciphertext
-
-  return `${PREFIX}${encoded}`
+  return encrypt(publicKey, value)
 }
 
 module.exports = encryptValue

package/src/lib/helpers/cryptography/index.js

@@ -4,15 +4,11 @@ module.exports = {
   localKeypair: require('./localKeypair'),
   encryptValue: require('./encryptValue'),
   decryptKeyValue: require('./decryptKeyValue'),
-  isEncrypted: require('./isEncrypted'),
   isPublicKey: require('./isPublicKey'),
   mutateKeysSrc: require('./mutateKeysSrc'),
   mutateKeysSrcSync: require('./mutateKeysSrcSync'),
   provision: require('./provision'),
   provisionSync: require('./provisionSync'),
   provisionWithPrivateKey: require('./provisionWithPrivateKey'),
-  mutateSrc: require('./mutateSrc'),
-
-  // other
-  isFullyEncrypted: require('./../isFullyEncrypted')
+  mutateSrc: require('./mutateSrc')
 }

package/src/lib/helpers/cryptography/localKeypair.js

@@ -1,21 +1,14 @@
-const { PrivateKey } = require('eciesjs')
+const { derive, keypair } = require('@dotenvx/primitives')
 
 function localKeypair (existingPrivateKey) {
-  let kp
-
   if (existingPrivateKey) {
-    kp = new PrivateKey(Buffer.from(existingPrivateKey, 'hex'))
-  } else {
-    kp = new PrivateKey()
+    return {
+      publicKey: derive(existingPrivateKey),
+      privateKey: existingPrivateKey
+    }
   }
 
-  const publicKey = kp.publicKey.toHex()
-  const privateKey = kp.secret.toString('hex')
-
-  return {
-    publicKey,
-    privateKey
-  }
+  return keypair()
 }
 
 module.exports = localKeypair

package/src/lib/helpers/decryptDeviceValue.js

@@ -1,10 +1,7 @@
-const { decrypt } = require('eciesjs')
+const { decrypt } = require('@dotenvx/primitives')
 
 function decryptDeviceValue (value, privateKey) {
-  const secret = Buffer.from(privateKey, 'hex')
-  const ciphertext = Buffer.from(value, 'base64')
-
-  return decrypt(secret, ciphertext).toString()
+  return decrypt(privateKey, value, { prefix: false })
 }
 
 module.exports = decryptDeviceValue

package/src/lib/helpers/encryptDeviceValue.js

@@ -1,9 +1,7 @@
-const { encrypt } = require('eciesjs')
+const { encrypt } = require('@dotenvx/primitives')
 
 function encryptDeviceValue (value, publicKey) {
-  const ciphertext = encrypt(publicKey, Buffer.from(value))
-
-  return Buffer.from(ciphertext, 'hex').toString('base64')
+  return encrypt(publicKey, value, { prefix: false })
 }
 
 module.exports = encryptDeviceValue

package/src/lib/helpers/executeDynamic.js

@@ -45,7 +45,6 @@ function dynamicAttempts (command, forwardedArgs) {
   if (command === 'vlt') {
     return [
       ['dotenvx-armor', forwardedArgs],
-      ['dotenvx-vlt', forwardedArgs],
       ['dotenvx-ops', forwardedArgs]
     ]
   }
@@ -53,8 +52,7 @@ function dynamicAttempts (command, forwardedArgs) {
   if (command === 'ops') {
     return [
       ['dotenvx-armor', forwardedArgs],
-      ['dotenvx-ops', forwardedArgs],
-      ['dotenvx-vlt', forwardedArgs]
+      ['dotenvx-ops', forwardedArgs]
     ]
   }
 

package/src/lib/helpers/installPrecommitHook.js

@@ -6,10 +6,10 @@ const HOOK_SCRIPT = `#!/bin/sh
 
 if command -v dotenvx 2>&1 >/dev/null
 then
-  dotenvx ext precommit
+  dotenvx precommit
 elif npx dotenvx -V >/dev/null 2>&1
 then
-  npx dotenvx ext precommit
+  npx dotenvx precommit
 else
   if [ -t 2 ]; then
     RED="$(printf '\\033[31m')"
@@ -19,7 +19,7 @@ else
     RESET=""
   fi
 
-  printf "%s☠ 'dotenvx ext precommit' command not found (.git/hooks/precommit) fix: [curl -sfS https://dotenvx.sh | sh]%s\n" "$RED" "$RESET" >&2
+  printf "%s☠ 'dotenvx precommit' command not found (.git/hooks/precommit) fix: [curl -sfS https://dotenvx.sh | sh]%s\n" "$RED" "$RESET" >&2
   exit 1
 fi
 `
@@ -35,17 +35,19 @@ class InstallPrecommitHook {
     try {
       // Check if the pre-commit file already exists
       if (this._exists()) {
+        const currentHook = this._currentHook()
+
         // Check if 'dotenvx precommit' already exists in the file
-        if (this._currentHook().includes('dotenvx ext precommit')) {
+        if (currentHook.includes('dotenvx precommit') || currentHook.includes('dotenvx ext precommit')) {
           // do nothing
-          successMessage = `▣ dotenvx ext precommit exists [${this.hookPath}]`
+          successMessage = `▣ dotenvx precommit exists [${this.hookPath}]`
         } else {
           this._appendHook()
-          successMessage = `▣ dotenvx ext precommit appended [${this.hookPath}]`
+          successMessage = `▣ dotenvx precommit appended [${this.hookPath}]`
         }
       } else {
         this._createHook()
-        successMessage = `▣ dotenvx ext precommit installed [${this.hookPath}]`
+        successMessage = `▣ dotenvx precommit installed [${this.hookPath}]`
       }
 
       return {

package/src/lib/helpers/keyResolution/keyValues.js

@@ -1,7 +1,7 @@
 const path = require('path')
+const { scan } = require('@dotenvx/primitives')
 
 const fsx = require('./../fsx')
-const dotenvParse = require('./../dotenvParse')
 const keyNamesForEnvFile = require('./keyNamesForEnvFile')
 const readProcessKey = require('./readProcessKey')
 const readFileKey = require('./readFileKey')
@@ -16,7 +16,7 @@ async function invertForPrivateKeyName (filepath) {
   }
 
   const envSrc = await fsx.readFileX(filepath)
-  const envParsed = dotenvParse(envSrc)
+  const { parsed: envParsed } = scan(envSrc)
 
   let publicKeyName
   for (const keyName of Object.keys(envParsed)) {

package/src/lib/helpers/keyResolution/keyValuesFromEnvSrc.js

@@ -1,6 +1,6 @@
 const path = require('path')
+const { scan } = require('@dotenvx/primitives')
 
-const dotenvParse = require('./../dotenvParse')
 const readFileKeySync = require('./readFileKeySync')
 const armorKeypairSync = require('../cryptography/armorKeypairSync')
 
@@ -23,14 +23,19 @@ function publicKeyNameFromEnvSrc (envParsed) {
   return null
 }
 
+function finalValue (parsed, keyName) {
+  const values = parsed[keyName]
+  return values ? values[values.length - 1] : undefined
+}
+
 function keyValuesFromEnvSrc (src, privateKeyName = null, opts = {}) {
   let keysFilepath = opts.keysFilepath || null
   const noArmor = opts.noArmor === true
   const processEnv = opts.processEnv || process.env
-  const envParsed = dotenvParse(src)
+  const { parsed: envParsed } = scan(src)
 
   const publicKeyName = publicKeyNameFromEnvSrc(envParsed)
-  const publicKeyValue = publicKeyName ? readProcessKey(processEnv, publicKeyName) || envParsed[publicKeyName] || null : null
+  const publicKeyValue = publicKeyName ? readProcessKey(processEnv, publicKeyName) || finalValue(envParsed, publicKeyName) || null : null
 
   if (!privateKeyName && publicKeyName) {
     privateKeyName = publicKeyName.replace(PUBLIC_KEY_SCHEMA, PRIVATE_KEY_SCHEMA)

package/src/lib/helpers/keyResolution/keyValuesSync.js

@@ -1,7 +1,7 @@
 const path = require('path')
+const { scan } = require('@dotenvx/primitives')
 
 const fsx = require('./../fsx')
-const dotenvParse = require('./../dotenvParse')
 const keyNamesForEnvFile = require('./keyNamesForEnvFile')
 const readProcessKey = require('./readProcessKey')
 const readFileKeySync = require('./readFileKeySync')
@@ -16,7 +16,7 @@ function invertForPrivateKeyName (filepath) {
   }
 
   const envSrc = fsx.readFileXSync(filepath)
-  const envParsed = dotenvParse(envSrc)
+  const { parsed: envParsed } = scan(envSrc)
 
   let publicKeyName
   for (const keyName of Object.keys(envParsed)) {

package/src/lib/helpers/keyResolution/readFileKey.js

@@ -1,5 +1,5 @@
 const fsx = require('./../fsx')
-const dotenvParse = require('./../dotenvParse')
+const { scan } = require('@dotenvx/primitives')
 
 async function readFileKey (keyName, filepath) {
   if (!(await fsx.exists(filepath))) {
@@ -7,10 +7,12 @@ async function readFileKey (keyName, filepath) {
   }
 
   const src = await fsx.readFileX(filepath)
-  const parsed = dotenvParse(src)
+  const { parsed } = scan(src)
+  const values = parsed[keyName]
 
-  if (parsed[keyName] && parsed[keyName].length > 0) {
-    return parsed[keyName]
+  if (values && values.length > 0) {
+    const value = values[values.length - 1]
+    return value || undefined
   }
 }
 

package/src/lib/helpers/keyResolution/readFileKeySync.js

@@ -1,13 +1,15 @@
 const fsx = require('./../fsx')
-const dotenvParse = require('./../dotenvParse')
+const { scan } = require('@dotenvx/primitives')
 
 function readFileKeySync (keyName, filepath) {
   if (fsx.existsSync(filepath)) {
     const src = fsx.readFileXSync(filepath)
-    const parsed = dotenvParse(src)
+    const { parsed } = scan(src)
+    const values = parsed[keyName]
 
-    if (parsed[keyName] && parsed[keyName].length > 0) {
-      return parsed[keyName]
+    if (values && values.length > 0) {
+      const value = values[values.length - 1]
+      return value || undefined
     }
   }
 }

package/src/lib/helpers/keypairMetadata.js

@@ -1,7 +1,7 @@
 const path = require('path')
 const fs = require('fs')
 const execa = require('execa')
-const dotenvParse = require('./dotenvParse')
+const { scan } = require('@dotenvx/primitives')
 const canonicalEnvFilename = require('./canonicalEnvFilename')
 const environment = require('./envResolution/environment')
 const sanitizeCommandForMetadata = require('./sanitizeCommandForMetadata')
@@ -56,7 +56,7 @@ function envKeys (envFile) {
     return null
   }
 
-  const parsed = dotenvParse(src)
+  const { parsed } = scan(src)
 
   if (!parsed || Object.keys(parsed).length === 0) return null
 

package/src/lib/helpers/parse.js

@@ -1,5 +1,5 @@
 const decryptKeyValue = require('./cryptography/decryptKeyValue')
-const isEncrypted = require('./cryptography/isEncrypted')
+const { encrypted } = require('@dotenvx/primitives')
 const evalKeyValue = require('./evalKeyValue')
 const resolveEscapeSequences = require('./resolveEscapeSequences')
 
@@ -45,7 +45,7 @@ class Parse {
         this.errors.push(e)
       }
 
-      const encryptedPrefixed = isEncrypted(this.parsed[key]) // do not eval encrypted prefix
+      const encryptedPrefixed = encrypted(this.parsed[key]) // do not eval encrypted prefix
 
       // eval empty, double, or backticks
       let evaled = false

package/src/lib/helpers/readEnvKey.js

@@ -1,5 +1,5 @@
 const fs = require('fs')
-const dotenvParse = require('./dotenvParse')
+const { scan } = require('@dotenvx/primitives')
 const Errors = require('./errors')
 
 function ignored (error, options) {
@@ -17,8 +17,9 @@ function readEnvKey (key, filepath, options = {}) {
     return undefined
   }
 
-  const parsed = dotenvParse(src)
-  const value = parsed[key]
+  const { parsed } = scan(src)
+  const values = parsed[key]
+  const value = values ? values[values.length - 1] : undefined
   if (value === undefined) {
     const error = new Errors({ key }).missingKey()
     if (ignored(error, options)) return undefined

package/src/lib/helpers/replace.js

@@ -1,4 +1,4 @@
-const dotenvParse = require('./dotenvParse')
+const { scan } = require('@dotenvx/primitives')
 const escapeForRegex = require('./escapeForRegex')
 
 function replaceExistingValue (src, key, originalValue, replaceValue) {
@@ -45,7 +45,7 @@ function replace (src, key, replaceValue) {
   let output
   let newPart = ''
 
-  const parsed = dotenvParse(src, true, true, true) // skip expanding \n and skip converting \r\n
+  const { parsed } = scan(src, { expandDoubleQuotedNewlines: false, convertWindowsNewlines: false })
   if (Object.prototype.hasOwnProperty.call(parsed, key)) {
     const allValues = parsed[key]
     let duplicateOutput = src

package/src/lib/services/armorPush.js

@@ -1,4 +1,4 @@
-const { PrivateKey } = require('eciesjs')
+const { derive } = require('@dotenvx/primitives')
 const prompts = require('../helpers/prompts')
 const PostArmorPush = require('../api/postArmorPush')
 const keyNamesForEnvFile = require('../helpers/keyResolution/keyNamesForEnvFile')
@@ -7,7 +7,7 @@ const teamChoicesFromMeta = require('../helpers/teamChoicesFromMeta')
 
 function publicKeyFromPrivateKey (privateKey) {
   try {
-    return new PrivateKey(Buffer.from(privateKey, 'hex')).publicKey.toHex()
+    return derive(privateKey)
   } catch {
     return ''
   }

package/src/lib/services/decrypt.js

@@ -1,6 +1,7 @@
 const fsx = require('./../helpers/fsx')
 const path = require('path')
 const picomatch = require('picomatch')
+const { encrypted, scan } = require('@dotenvx/primitives')
 
 const TYPE_ENV_FILE = 'envFile'
 
@@ -16,12 +17,10 @@ const {
 } = require('./../helpers/keyResolution')
 
 const {
-  decryptKeyValue,
-  isEncrypted
+  decryptKeyValue
 } = require('./../helpers/cryptography')
 
 const replace = require('./../helpers/replace')
-const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 
 class Decrypt {
@@ -75,7 +74,7 @@ class Decrypt {
     try {
       const encoding = await detectEncoding(filepath)
       let envSrc = await fsx.readFileX(filepath, { encoding })
-      const envParsed = dotenvParse(envSrc, false, false, true)
+      const envParsed = scan(envSrc).parsed
 
       const { privateKeyName } = keyNamesForEnvFile(envFilepath)
       const { privateKeyValue, privateKeySource } = await keyValues(envFilepath, {
@@ -101,12 +100,12 @@ class Decrypt {
           continue
         }
 
-        const encrypted = values.some(value => isEncrypted(value))
-        if (encrypted) {
+        const hasEncrypted = values.some(value => encrypted(value))
+        if (hasEncrypted) {
           row.keys.push(key) // track key(s)
 
           const decryptedValues = values.map(value => {
-            if (!isEncrypted(value)) {
+            if (!encrypted(value)) {
               return value
             }
 

package/src/lib/services/encrypt.js

@@ -1,6 +1,7 @@
 const fsx = require('./../helpers/fsx')
 const path = require('path')
 const picomatch = require('picomatch')
+const { encrypted, scan } = require('@dotenvx/primitives')
 
 const TYPE_ENV_FILE = 'envFile'
 
@@ -17,14 +18,12 @@ const {
 
 const {
   encryptValue,
-  isEncrypted,
   isPublicKey,
   provision,
   provisionWithPrivateKey
 } = require('./../helpers/cryptography')
 
 const replace = require('./../helpers/replace')
-const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 const SAMPLE_ENV_KIT = require('./../helpers/kits/sample')
 
@@ -97,7 +96,7 @@ class Encrypt {
         row.kitCreated = 'sample'
         row.changed = true
       }
-      const envParsed = dotenvParse(envSrc, false, false, true)
+      const envParsed = scan(envSrc).parsed
 
       let publicKey
       let privateKey
@@ -151,12 +150,12 @@ class Encrypt {
           continue
         }
 
-        const encrypted = values.every(value => isEncrypted(value) || isPublicKey(key))
-        if (!encrypted) {
+        const fullyEncrypted = values.every(value => encrypted(value) || isPublicKey(key))
+        if (!fullyEncrypted) {
           row.keys.push(key) // track key(s)
 
           const encryptedValues = values.map(value => {
-            if (isEncrypted(value) || isPublicKey(key)) {
+            if (encrypted(value) || isPublicKey(key)) {
               return value
             }
 

package/src/lib/services/genexample.js

@@ -4,7 +4,19 @@ const path = require('path')
 const Errors = require('../helpers/errors')
 const findEnvFiles = require('../helpers/findEnvFiles')
 const replace = require('../helpers/replace')
-const dotenvParse = require('../helpers/dotenvParse')
+const { scan } = require('@dotenvx/primitives')
+
+function finalValues (src) {
+  const { parsed } = scan(src)
+  const result = {}
+
+  for (const key in parsed) {
+    const values = parsed[key]
+    result[key] = values[values.length - 1]
+  }
+
+  return result
+}
 
 class Genexample {
   constructor (directory = '.', envFile) {
@@ -34,13 +46,13 @@ class Genexample {
       const filepath = path.resolve(this.directory, envFilepath)
       if (!fsx.existsSync(filepath)) {
         const error = new Errors({ envFilepath, filepath }).missingEnvFile()
-        error.help = `? add it with [echo "HELLO=World" > ${envFilepath}] and then run [dotenvx genexample]`
+        error.help = `? add it with [echo "HELLO=World" > ${envFilepath}] and then run [dotenvx ext genexample]`
         throw error
       }
 
       // get the original src
       let src = fsx.readFileXSync(filepath)
-      const parsed = dotenvParse(src)
+      const parsed = finalValues(src)
       for (const key in parsed) {
         // used later
         keys.add(key)
@@ -65,7 +77,7 @@ class Genexample {
       // it already exists (which means the user might have it modified a way in which they prefer, so replace exampleSrc with their existing .env.example)
       exampleSrc = fsx.readFileXSync(this.exampleFilepath)
 
-      const parsed = dotenvParse(exampleSrc)
+      const parsed = finalValues(exampleSrc)
       for (const key of [...keys]) {
         if (key in parsed) {
           preExisted[key] = parsed[key]

package/src/lib/services/prebuild.js

@@ -5,8 +5,8 @@ const ignore = require('ignore')
 
 const Ls = require('../services/ls')
 const Errors = require('../helpers/errors')
+const { sealed } = require('@dotenvx/primitives')
 
-const isFullyEncrypted = require('./../helpers/isFullyEncrypted')
 const MISSING_DOCKERIGNORE = '.env.keys' // by default only ignore .env.keys. all other .env* files COULD be included - as long as they are encrypted
 
 class Prebuild {
@@ -47,22 +47,22 @@ class Prebuild {
         if (file === '.env.example' || file === '.env.x') {
           const warning = new Errors({
             message: `${file} ignored (should not be)`,
-            help: `fix: [dotenvx ext gitignore --pattern !${file}]`
+            help: `fix: [dotenvx gitignore --pattern !${file}]`
           }).custom()
           warnings.push(warning)
         }
       } else {
         if (file !== '.env.example' && file !== '.env.x') {
           const src = fsx.readFileXSync(file)
-          const encrypted = isFullyEncrypted(src)
+          const encrypted = sealed(src)
 
           // if contents are encrypted don't raise an error
           if (!encrypted) {
             let errorMsg = `${file} not encrypted/dockerignored`
-            let errorHelp = `fix: [dotenvx encrypt -f ${file}] or [dotenvx ext gitignore --pattern ${file}]`
+            let errorHelp = `fix: [dotenvx encrypt -f ${file}] or [dotenvx gitignore --pattern ${file}]`
             if (file.includes('.env.keys')) {
               errorMsg = `${file} not dockerignored`
-              errorHelp = `fix: [dotenvx ext gitignore --pattern ${file}]`
+              errorHelp = `fix: [dotenvx gitignore --pattern ${file}]`
             }
 
             throw new Errors({ message: errorMsg, help: errorHelp }).custom()

package/src/lib/services/precommit.js

@@ -4,8 +4,8 @@ const path = require('path')
 const ignore = require('ignore')
 
 const Ls = require('../services/ls')
+const { sealed } = require('@dotenvx/primitives')
 
-const isFullyEncrypted = require('./../helpers/isFullyEncrypted')
 const InstallPrecommitHook = require('./../helpers/installPrecommitHook')
 const Errors = require('./../helpers/errors')
 const childProcess = require('child_process')
@@ -63,22 +63,22 @@ class Precommit {
             if (file === '.env.example' || file === '.env.x') {
               const warning = new Errors({
                 message: `${file} ignored (should not be)`,
-                help: `fix: [dotenvx ext gitignore --pattern !${file}]`
+                help: `fix: [dotenvx gitignore --pattern !${file}]`
               }).custom()
               warnings.push(warning)
             }
           } else {
             if (file !== '.env.example' && file !== '.env.x') {
               const src = fsx.readFileXSync(file)
-              const encrypted = isFullyEncrypted(src)
+              const encrypted = sealed(src)
 
               // if contents are encrypted don't raise an error
               if (!encrypted) {
                 let errorMsg = `${file} not encrypted/gitignored`
-                let errorHelp = `fix: [dotenvx encrypt -f ${file}] or [dotenvx ext gitignore --pattern ${file}]`
+                let errorHelp = `fix: [dotenvx encrypt -f ${file}] or [dotenvx gitignore --pattern ${file}]`
                 if (file.includes('.env.keys')) {
                   errorMsg = `${file} not gitignored`
-                  errorHelp = `fix: [dotenvx ext gitignore --pattern ${file}]`
+                  errorHelp = `fix: [dotenvx gitignore --pattern ${file}]`
                 }
 
                 throw new Errors({ message: errorMsg, help: errorHelp }).custom()

package/src/lib/services/rotate.js

@@ -1,6 +1,7 @@
 const fsx = require('./../helpers/fsx')
 const path = require('path')
 const picomatch = require('picomatch')
+const { encrypted, scan } = require('@dotenvx/primitives')
 
 const TYPE_ENV_FILE = 'envFile'
 
@@ -19,13 +20,11 @@ const {
   armorKeypair,
   localKeypair,
   encryptValue,
-  decryptKeyValue,
-  isEncrypted
+  decryptKeyValue
 } = require('./../helpers/cryptography')
 
 const append = require('./../helpers/append')
 const replace = require('./../helpers/replace')
-const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 
 class Rotate {
@@ -81,7 +80,7 @@ class Rotate {
     try {
       const encoding = await detectEncoding(filepath)
       let envSrc = await fsx.readFileX(filepath, { encoding })
-      const envParsed = dotenvParse(envSrc, false, false, true)
+      const envParsed = scan(envSrc).parsed
 
       const { publicKeyName, privateKeyName } = keyNamesForEnvFile(envFilepath)
       const { privateKeyValue } = await keyValues(envFilepath, {
@@ -134,7 +133,7 @@ class Rotate {
           continue
         }
 
-        const value = [...values].reverse().find(value => isEncrypted(value))
+        const value = [...values].reverse().find(value => encrypted(value))
         if (value) { // only re-encrypt those already encrypted
           row.keys.push(key) // track key(s)
 

package/src/lib/services/sets.js

@@ -1,5 +1,6 @@
 const fsx = require('./../helpers/fsx')
 const path = require('path')
+const { encrypted, scan } = require('@dotenvx/primitives')
 
 const TYPE_ENV_FILE = 'envFile'
 
@@ -18,19 +19,22 @@ const {
 const {
   encryptValue,
   decryptKeyValue,
-  isEncrypted,
   provision,
   provisionSync,
   provisionWithPrivateKey
 } = require('./../helpers/cryptography')
 
 const replace = require('./../helpers/replace')
-const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 const detectEncodingSync = require('./../helpers/detectEncodingSync')
 
 function allValuesForKey (envSrc, key) {
-  return dotenvParse(envSrc, false, false, true)[key] || []
+  return scan(envSrc).parsed[key] || []
+}
+
+function finalValueForKey (envSrc, key) {
+  const values = allValuesForKey(envSrc, key)
+  return values.length > 0 ? values[values.length - 1] : null
 }
 
 class Sets {
@@ -119,12 +123,11 @@ class Sets {
         seededWithInitialKey = true
       }
 
-      const envParsed = dotenvParse(envSrc)
-      row.originalValue = envParsed[row.key] || null
+      row.originalValue = finalValueForKey(envSrc, row.key)
       if (seededWithInitialKey) {
         row.originalValue = null
       }
-      const wasPlainText = !isEncrypted(row.originalValue)
+      const wasPlainText = !encrypted(row.originalValue)
       this.readableFilepaths.add(envFilepath)
 
       if (this.encrypt) {
@@ -236,12 +239,11 @@ class Sets {
         seededWithInitialKey = true
       }
 
-      const envParsed = dotenvParse(envSrc)
-      row.originalValue = envParsed[row.key] || null
+      row.originalValue = finalValueForKey(envSrc, row.key)
       if (seededWithInitialKey) {
         row.originalValue = null
       }
-      const wasPlainText = !isEncrypted(row.originalValue)
+      const wasPlainText = !encrypted(row.originalValue)
       this.readableFilepaths.add(envFilepath)
 
       if (this.encrypt) {

package/src/lib/helpers/cryptography/isEncrypted.js

@@ -1,7 +0,0 @@
-const ENCRYPTION_PATTERN = /^encrypted:.+/
-
-function isEncrypted (value) {
-  return ENCRYPTION_PATTERN.test(value)
-}
-
-module.exports = isEncrypted

package/src/lib/helpers/dotenvParse.js

@@ -1,55 +0,0 @@
-// historical dotenv.parse - https://github.com/motdotla/dotenv)
-const LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg
-
-function dotenvParse (src, skipExpandForDoubleQuotes = false, skipConvertingWindowsNewlines = false, collectAllValues = false) {
-  const obj = {}
-
-  // Convert buffer to string
-  let lines = src.toString()
-
-  // Convert line breaks to same format
-  if (!skipConvertingWindowsNewlines) {
-    lines = lines.replace(/\r\n?/mg, '\n')
-  }
-
-  let match
-  while ((match = LINE.exec(lines)) != null) {
-    const key = match[1]
-
-    // Default undefined or null to empty string
-    let value = (match[2] || '')
-
-    // Remove whitespace
-    value = value.trim()
-
-    // Check if double quoted
-    const maybeQuote = value[0]
-
-    // Remove surrounding quotes
-    value = value.replace(/^(['"`])([\s\S]*)\1$/mg, '$2')
-
-    // Expand newlines if double quoted
-    if (maybeQuote === '"' && !skipExpandForDoubleQuotes) {
-      value = value.replace(/\\n/g, '\n') // newline
-      value = value.replace(/\\r/g, '\r') // carriage return
-      value = value.replace(/\\t/g, '\t') // tabs
-    }
-
-    if (collectAllValues) {
-      // handle scenario where user mistakenly includes plaintext duplicate in .env:
-      //
-      // # .env
-      // HELLO="World"
-      // HELLO="encrypted:1234"
-      obj[key] = obj[key] || []
-      obj[key].push(value)
-    } else {
-      // Add to object
-      obj[key] = value
-    }
-  }
-
-  return obj
-}
-
-module.exports = dotenvParse

package/src/lib/helpers/isFullyEncrypted.js

@@ -1,27 +0,0 @@
-const dotenvParse = require('./dotenvParse')
-const isEncrypted = require('./cryptography/isEncrypted')
-const isPublicKey = require('./cryptography/isPublicKey')
-
-function isFullyEncrypted (src) {
-  const parsed = dotenvParse(src, false, false, true) // collect all values
-
-  for (const [key, values] of Object.entries(parsed)) {
-    // handle scenario where user mistakenly includes plaintext duplicate in .env:
-    //
-    // # .env
-    // HELLO="World"
-    // HELLO="encrypted:1234"
-    //
-    // key => [value1, ...]
-    for (const value of values) {
-      const result = isEncrypted(value) || isPublicKey(key)
-      if (!result) {
-        return false
-      }
-    }
-  }
-
-  return true
-}
-
-module.exports = isFullyEncrypted