@dotenvx/dotenvx 1.75.1 → 2.0.0

package/CHANGELOG.md

@@ -2,7 +2,30 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.75.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.0.0...main)
+
+## [2.0.0](https://github.com/dotenvx/dotenvx/compare/v1.76.0...v2.0.0) (2026-06-30)
+
+### Changed
+
+* BREAKING: lib/main#`set` async only ([#855](https://github.com/dotenvx/dotenvx/pull/855))
+* BREAKING: lib/main#`get` async only ([#855](https://github.com/dotenvx/dotenvx/pull/855))
+* New keyring support - for local and armor providers and to unlock future providers ([#855](https://github.com/dotenvx/dotenvx/pull/855))
+* Route `run`, `config`, and `get` through shared env and keypair resolvers backed by `@dotenvx/primitives` ([#855](https://github.com/dotenvx/dotenvx/pull/855))
+* Route `set`, `encrypt`, and `decrypt` through shared transforms that operate on primitive scan, parse, encrypt, and upsert results ([#855](https://github.com/dotenvx/dotenvx/pull/855))
+* Update library `parse` to use primitive parsing while preserving dotenvx-style encrypted value errors ([#855](https://github.com/dotenvx/dotenvx/pull/855))
+
+### Removed
+
+* BREAKING: Remove the `rotate` command (it will return in 2.1 or 2.2 soon with a more complete implementation for local and armored keys) ([#855](https://github.com/dotenvx/dotenvx/pull/855))
+* BREAKING: Remove the library `doctor`, `keypair`, and `genexample` exports from `lib/main` ([#855](https://github.com/dotenvx/dotenvx/pull/855))
+
+## [1.76.0](https://github.com/dotenvx/dotenvx/compare/v1.75.1...v1.76.0) (2026-06-24)
+
+### Changed
+
+* Support dotenvx across powershell ([#856](https://github.com/dotenvx/dotenvx/pull/856))
+* BREAKING: Remove variadic `-f`. You can still do `dotenvx run -f .env1 -f .env2` but ambiguos variadic like `dotenvx run -f .env1 .env2 ...` is removed ([#856](https://github.com/dotenvx/dotenvx/pull/856))
 
 ## [1.75.1](https://github.com/dotenvx/dotenvx/compare/v1.75.0...v1.75.1) (2026-06-20)
 

package/README.md

@@ -58,7 +58,9 @@ dotenvx encrypt
 <details><summary>with brew 🍺</summary><br>
 
 ```sh
-brew install dotenvx/brew/dotenvx
+brew tap dotenvx/brew
+brew trust dotenvx/brew
+brew install dotenvx
 dotenvx encrypt
 ```
 
@@ -2026,117 +2028,6 @@ $ dotenvx ls -ef '**/.env.prod*'
       └─ .env
 ```
 
-</details>
-<details><summary>`rotate`</summary><br>
-
-Rotate public/private keys for `.env` file and re-encrypt all encrypted values.
-
-```sh
-$ echo "HELLO=Dotenvx" > .env
-$ dotenvx encrypt
-◈ encrypted (.env)
-$ dotenvx rotate
-⟳ rotated (.env)
-```
-
-</details>
-<details><summary>`rotate -f`</summary><br>
-
-Rotate public/private keys for a specified encrypted `.env` file and re-encrypt all encrypted values.
-
-```sh
-$ echo "HELLO=Dotenvx" > .env
-$ echo "HELLO=Production" > .env.production
-
-$ dotenvx encrypt -f .env.production
-◈ encrypted (.env.production)
-$ dotenvx rotate -f .env.production
-⟳ rotated (.env.production)
-```
-
-</details>
-<details><summary>`rotate -fk`</summary><br>
-
-Specify path to `.env.keys`. This is useful with monorepos.
-
-```sh
-$ mkdir -p apps/app1
-$ echo "HELLO=Dotenvx" > apps/app1/.env
-
-$ dotenvx encrypt -fk .env.keys -f apps/app1/.env
-◈ encrypted (apps/app1/.env)
-$ dotenvx rotate -fk .env.keys -f apps/app1/.env
-⟳ rotated (apps/app1/.env)
-```
-
-</details>
-<details><summary>`rotate -k`</summary><br>
-
-Rotate the contents of a specified key inside an encrypted `.env` file.
-
-```sh
-$ echo "HELLO=Dotenvx\nHOLA=Mundo" > .env
-$ dotenvx encrypt
-◈ encrypted (.env)
-$ dotenvx rotate -k HELLO
-⟳ rotated (.env)
-```
-
-Even specify a glob pattern.
-
-```sh
-$ echo "HELLO=Dotenvx\nHOLA=Mundo" > .env
-$ dotenvx encrypt
-◈ encrypted (.env)
-$ dotenvx rotate -k "HE*"
-⟳ rotated (.env)
-```
-
-</details>
-<details><summary>`rotate -ek`</summary><br>
-
-Rotate the encrypted contents inside an encrypted `.env` file except for an excluded key.
-
-```sh
-$ echo "HELLO=Dotenvx\nHOLA=Mundo" > .env
-$ dotenvx encrypt
-◈ encrypted (.env)
-$ dotenvx rotate -ek HOLA
-⟳ rotated (.env)
-```
-
-Even specify a glob pattern.
-
-```sh
-$ echo "HELLO=Dotenvx\nHOLA=Mundo" > .env
-$ dotenvx encrypt
-◈ encrypted (.env)
-$ dotenvx rotate -ek "HO*"
-⟳ rotated (.env)
-```
-
-</details>
-<details><summary>`rotate --stdout`</summary><br>
-
-Rotate the contents of an encrypted `.env` file and send to stdout.
-
-```sh
-$ dotenvx rotate --stdout
-#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
-#/            public-key encryption for .env files          /
-#/       [how it works](https://dotenvx.com/encryption)     /
-#/----------------------------------------------------------/
-DOTENV_PUBLIC_KEY="034af93e93708b994c10f236c96ef88e47291066946cce2e8d98c9e02c741ced45"
-# .env
-HELLO="encrypted:12345"
-```
-
-or send to a file:
-
-```sh
-$ dotenvx rotate --stdout > somefile.txt
-```
-
 </details>
 <details><summary>`help`</summary><br>
 
@@ -2162,7 +2053,6 @@ Commands:
   set <KEY> <value>  set a single environment variable
   encrypt            encrypt .env file(s)
   decrypt            decrypt .env file(s)
-  rotate             rotate keypair(s) and re-encrypt .env file(s)
   keypair [KEY]      print public/private keys for .env file(s)
   ls [directory]     print all .env files in a tree structure
   gitignore          append to .gitignore
@@ -2703,7 +2593,7 @@ Programmatically get an environment variable at access/runtime.
 ```js
 // index.js
 const dotenvx = require('@dotenvx/dotenvx')
-const decryptedValue = dotenvx.get('HELLO')
+const decryptedValue = await dotenvx.get('HELLO')
 console.log(decryptedValue)
 ```
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.75.1",
+  "version": "2.0.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -43,22 +43,23 @@
   },
   "funding": "https://dotenvx.com",
   "dependencies": {
-    "@dotenvx/primitives": "^0.8.0",
+    "@dotenvx/primitives": "^1.7.0",
     "commander": "^11.1.0",
     "conf": "^10.2.0",
-    "dotenv": "^17.2.1",
+    "dotenv": "^17.4.2",
     "enquirer": "^2.4.1",
     "env-paths": "^2.2.1",
     "execa": "^5.1.1",
     "fdir": "^6.2.0",
-    "ignore": "^5.3.0",
+    "ignore": "^7.0.5",
     "object-treeify": "1.1.33",
     "open": "^8.4.2",
     "picomatch": "^4.0.4",
-    "systeminformation": "^5.22.11",
+    "synckit": "0.11.13",
+    "systeminformation": "^5.31.11",
     "undici": "^7.11.0",
-    "which": "^4.0.0",
-    "yocto-spinner": "^1.1.0"
+    "which": "^6.0.1",
+    "yocto-spinner": "^1.2.0"
   },
   "devDependencies": {
     "@yao-pkg/pkg": "^6.12.0",

package/src/cli/actions/decrypt.js

@@ -1,14 +1,15 @@
 const fsx = require('./../../lib/helpers/fsx')
 const { logger } = require('./../../shared/logger')
 
-const Decrypt = require('./../../lib/services/decrypt')
 const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
-const normalizeArmorOptions = require('./normalizeArmorOptions')
+const normalizeArmorAliases = require('./normalizeArmorAliases')
+
+const decryptTransform = require('./../../lib/transforms/decrypt')
 
 async function decrypt () {
-  const options = normalizeArmorOptions(this.opts())
+  const options = normalizeArmorAliases(this.opts())
   const spinner = await createSpinner({ ...options, text: 'decrypting' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
@@ -21,17 +22,26 @@ async function decrypt () {
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
-    if (spinner) spinner.stop()
     const {
       processedEnvs
-    } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, {
-      command: process.argv.slice(2)
-    }).run()
+    } = await decryptTransform({
+      envs,
+      ik: options.key,
+      ek: options.excludeKey,
+      fk: options.envKeysFile,
+      noArmor,
+      onStatus: (text) => {
+        if (spinner && text) {
+          spinner.text = text
+        }
+      }
+    })
+
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       if (processedEnv.error) {
         errorCount += 1
-        logger.error(processedEnv.error.messageWithHelp)
+        logger.error(processedEnv.error.messageWithHelp || processedEnv.error.message)
       } else {
         console.log(processedEnv.envSrc)
       }
@@ -44,22 +54,32 @@ async function decrypt () {
     }
   } else {
     try {
-      if (spinner) spinner.stop()
       const {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, {
-        command: process.argv.slice(2)
-      }).run()
+      } = await decryptTransform({
+        envs,
+        ik: options.key,
+        ek: options.excludeKey,
+        fk: options.envKeysFile,
+        noArmor,
+        onStatus: (text) => {
+          if (spinner && text) {
+            spinner.text = text
+          }
+        }
+      })
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`decrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)
 
         if (processedEnv.error) {
           errorCount += 1
-          logger.error(processedEnv.error.messageWithHelp)
-        } else if (processedEnv.changed) {
+          logger.error(processedEnv.error.messageWithHelp || processedEnv.error.message)
+        }
+
+        if (processedEnv.changed) {
           await fsx.writeFileX(processedEnv.filepath, processedEnv.envSrc)
 
           logger.verbose(`decrypted ${processedEnv.envFilepath} (${processedEnv.filepath})`)
@@ -69,10 +89,8 @@ async function decrypt () {
       }
 
       if (spinner) spinner.stop()
-      const armoredPrivateKeyUsed = processedEnvs.some((processedEnv) => processedEnv.armoredPrivateKeyUsed)
-      const keyUsedSuffix = armoredPrivateKeyUsed ? ' · armored ⛨' : ''
       if (changedFilepaths.length > 0) {
-        logger.success(`◇ decrypted (${changedFilepaths.join(',')})${keyUsedSuffix}`)
+        logger.success(`◇ decrypted (${changedFilepaths.join(',')})`)
       } else if (unchangedFilepaths.length > 0) {
         logger.info(`○ no change (${unchangedFilepaths})`)
       } else {

package/src/cli/actions/doctor.js

@@ -1,10 +1,10 @@
 const { logger } = require('./../../shared/logger')
-const main = require('./../../lib/main')
+const Doctor = require('./../../lib/services/doctor')
 
 function doctor (directory = '.') {
   logger.debug(`directory: ${directory}`)
 
-  const findings = main.doctor(directory)
+  const findings = new Doctor(directory).run()
   logger.debug(`findings: ${JSON.stringify(findings)}`)
 
   if (findings.length === 0) {

package/src/cli/actions/encrypt.js

@@ -1,114 +1,93 @@
 const fsx = require('./../../lib/helpers/fsx')
 const { logger } = require('./../../shared/logger')
 
-const Encrypt = require('./../../lib/services/encrypt')
+const encryptTransform = require('./../../lib/transforms/encrypt')
 
 const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
-const prompts = require('../../lib/helpers/prompts')
 const Session = require('../../db/session')
-const normalizeArmorOptions = require('./normalizeArmorOptions')
+const normalizeArmorAliases = require('./normalizeArmorAliases')
 
-function keyStorageSelector () {
-  let selected
-
-  return async function selectKeyStorage () {
-    if (selected) return selected
-
-    selected = await prompts.select({
-      message: 'Choose private key storage',
-      choices: [
-        { name: '◫ File (.env.keys)', value: 'file' },
-        { name: '⛨ Armor (armor.dotenvx.com)', value: 'armored' }
-      ]
-    }, {
-      input: process.stdin,
-      output: process.stderr
-    })
-
-    return selected
-  }
-}
-
-function encryptOptions (noArmor) {
-  const options = {}
-
-  if (!noArmor) {
-    options.selectKeyStorage = keyStorageSelector()
-  }
-
-  return options
-}
-
-async function encrypt () {
-  const options = normalizeArmorOptions(this.opts())
+async function encryptAction () {
+  const options = normalizeArmorAliases(this.opts())
   const spinner = await createSpinner({ ...options, text: 'encrypting' })
+  const sesh = new Session()
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
-  const envs = this.envs
-  const sesh = new Session()
-  const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
+  const envs = this.envs || []
+  const ik = options.key
+  const ek = options.excludeKey
+  const fk = options.envKeysFile || '.env.keys'
   const noCreate = options.create === false
+  const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
+
+  let errorCount = 0
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
-    if (spinner) spinner.stop()
-    const {
-      processedEnvs
-    } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, {
-      ...encryptOptions(noArmor),
-      command: process.argv.slice(2)
-    }).run()
+    const { processedEnvs } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate })
+
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
-      console.log(processedEnv.envSrc)
+      if (processedEnv.error) {
+        errorCount += 1
+        logger.error(processedEnv.error.messageWithHelp || processedEnv.error.message)
+      }
+      if (processedEnv.envSrc) {
+        console.log(processedEnv.envSrc)
+      }
+    }
+
+    if (errorCount > 0) {
+      process.exit(1)
+    } else {
+      process.exit(0) // exit early
     }
-    process.exit(0) // exit early
-  } else {
-    try {
-      if (spinner) spinner.stop()
-      const {
-        processedEnvs,
-        changedFilepaths,
-        unchangedFilepaths
-      } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, {
-        ...encryptOptions(noArmor),
-        command: process.argv.slice(2)
-      }).run()
+  }
 
-      for (const processedEnv of processedEnvs) {
-        logger.verbose(`encrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)
-        if (processedEnv.error) {
-          logger.warn(processedEnv.error.messageWithHelp)
-        } else if (processedEnv.changed) {
-          await fsx.writeFileX(processedEnv.filepath, processedEnv.envSrc)
+  try {
+    const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate })
 
-          logger.verbose(`encrypted ${processedEnv.envFilepath} (${processedEnv.filepath})`)
-        } else {
-          logger.verbose(`no change ${processedEnv.envFilepath} (${processedEnv.filepath})`)
-        }
-      }
+    if (keysSrc) {
+      await fsx.writeFileX(fk, keysSrc)
+    }
 
-      if (spinner) spinner.stop()
-      if (changedFilepaths.length > 0) {
-        const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
-        let msg = `◈ encrypted (${changedFilepaths.join(',')})`
-        if (remoteKeyAddedEnv) {
-          msg += ' · armored ⛨'
-        }
-        logger.success(msg)
-      } else if (unchangedFilepaths.length > 0) {
-        logger.info(`○ no change (${unchangedFilepaths})`)
+    if (spinner) spinner.stop()
+    for (const processedEnv of processedEnvs) {
+      logger.verbose(`encrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)
+      if (processedEnv.error) {
+        errorCount += 1
+        logger.error(processedEnv.error.messageWithHelp || processedEnv.error.message)
+      } else if (processedEnv.changed) {
+        await fsx.writeFileX(processedEnv.filepath, processedEnv.envSrc)
+        logger.verbose(`encrypted ${processedEnv.envFilepath} (${processedEnv.filepath})`)
       } else {
-        // do nothing - scenario when no .env files found
+        logger.verbose(`no change ${processedEnv.envFilepath} (${processedEnv.filepath})`)
       }
-    } catch (error) {
-      if (spinner) spinner.stop()
-      catchAndLog(error)
+    }
+
+    if (changedFilepaths.length > 0) {
+      // const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
+      const msg = `◈ encrypted (${changedFilepaths.join(',')})`
+      // if (remoteKeyAddedEnv) {
+      //   msg += ' · armored ⛨'
+      // }
+      logger.success(msg)
+    } else if (unchangedFilepaths.length > 0) {
+      logger.info(`○ no change (${unchangedFilepaths})`)
+    } else {
+      // do nothing - scenario when no .env files found
+    }
+
+    if (errorCount > 0) {
       process.exit(1)
     }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    catchAndLog(error)
+    process.exit(1)
   }
 }
 
-module.exports = encrypt
+module.exports = encryptAction

package/src/cli/actions/ext/genexample.js

@@ -1,6 +1,6 @@
 const fsx = require('./../../../lib/helpers/fsx')
 const path = require('path')
-const main = require('./../../../lib/main')
+const Genexample = require('./../../../lib/services/genexample')
 const { logger } = require('./../../../shared/logger')
 const catchAndLog = require('./../../../lib/helpers/catchAndLog')
 
@@ -16,7 +16,7 @@ function genexample (directory) {
       envFile,
       exampleFilepath,
       addedKeys
-    } = main.genexample(directory, options.envFile)
+    } = new Genexample(directory, options.envFile).run()
 
     logger.verbose(`loading env from ${envFile}`)
 

package/src/cli/actions/get.js

@@ -5,11 +5,11 @@ const escape = require('./../../lib/helpers/escape')
 const catchAndLog = require('./../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
-const Get = require('./../../lib/services/get')
-const normalizeArmorOptions = require('./normalizeArmorOptions')
+const getResolver = require('./../../lib/resolvers/get')
+const normalizeArmorAliases = require('./normalizeArmorAliases')
 
 async function get (key) {
-  const options = normalizeArmorOptions(this.opts())
+  const options = normalizeArmorAliases(this.opts())
   const spinner = await createSpinner({ ...options, text: 'decrypting' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
@@ -31,10 +31,19 @@ async function get (key) {
   try {
     const sesh = new Session()
     const noArmor = options.armor === false || (await sesh.noArmor())
-    if (spinner) spinner.stop()
-    const { parsed, errors } = await new Get(key, envs, options.overload, options.all, options.envKeysFile, noArmor, {
-      command: process.argv.slice(2)
-    }).run()
+    const { parsed, errors } = await getResolver({
+      key,
+      envs,
+      overload: options.overload,
+      all: options.all,
+      envKeysFile: options.envKeysFile,
+      noArmor,
+      onStatus: (text) => {
+        if (spinner && text) {
+          spinner.text = text
+        }
+      }
+    })
 
     for (const error of errors || []) {
       if (options.strict) throw error // throw immediately if strict