@dotenvx/dotenvx 2.15.0 → 2.16.0

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.15.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.16.0...main)
+
+## [2.16.0](https://github.com/dotenvx/dotenvx/compare/v2.15.1...v2.16.0) (2026-07-21)
+
+### Added
+
+* Add support for `-ek` and `-ik` to `dotenvx get` ([#913](https://github.com/dotenvx/dotenvx/pull/913))
+
+## [2.15.1](https://github.com/dotenvx/dotenvx/compare/v2.15.0...v2.15.1) (2026-07-20)
+
+### Changed
+
+* Better communicate time waiting on 1password with elapsed time ([#909](https://github.com/dotenvx/dotenvx/pull/909))
 
 ## [2.15.0](https://github.com/dotenvx/dotenvx/compare/v2.14.0...v2.15.0) (2026-07-20)
 

package/README.md

@@ -1848,6 +1848,30 @@ $ dotenvx get
 {"HELLO":"World"}
 ```
 
+</details>
+<details><summary>`get -ik`</summary><br>
+
+Include only matching keys by passing `--include-key`. Glob patterns are supported.
+
+```sh
+$ echo "HELLO=World\nHOLA=Mundo\nGOODBYE=World" > .env
+
+$ dotenvx get -ik "H*"
+{"HELLO":"World","HOLA":"Mundo"}
+```
+
+</details>
+<details><summary>`get -ek`</summary><br>
+
+Exclude matching keys by passing `--exclude-key`. Glob patterns are supported.
+
+```sh
+$ echo "DOTENV_PUBLIC_KEY=public\nHELLO=World" > .env
+
+$ dotenvx get --format=eval-export -ek "DOTENV_PUBLIC_KEY*"
+export HELLO='World'
+```
+
 </details>
 <details><summary>`get --format shell`</summary><br>
 
@@ -3412,53 +3436,26 @@ Set `mask: 0` to fully mask values.
 
 &nbsp;
 
-## Guides
+## Quickstarts
 
-> Go deeper with `dotenvx` – detailed framework and platform guides.
+> Encrypt and run secrets in your language, framework, or tool.
 >
 
-* [Languages](https://dotenvx.com/docs#languages)
-  * [Node.js](https://dotenvx.com/docs/languages/nodejs)
-  * [Python](https://dotenvx.com/docs/languages/python)
-  * [Ruby](https://dotenvx.com/docs/languages/ruby)
-  * [Go](https://dotenvx.com/docs/languages/go)
-  * [PHP](https://dotenvx.com/docs/languages/php)
-  * [Rust](https://dotenvx.com/docs/languages/rust)
-* [Frameworks](https://dotenvx.com/docs#frameworks)
-  * [Astro](https://dotenvx.com/docs/secrets-in-astro)
-  * [Expo](https://dotenvx.com/docs/secrets-in-expo)
-  * [Express](https://dotenvx.com/docs/frameworks/express)
-  * [Next](https://dotenvx.com/docs/frameworks/next)
-  * [Remix](https://dotenvx.com/docs/frameworks/remix)
-  * [Flask](https://dotenvx.com/docs/frameworks/flask)
-  * [Sinatra](https://dotenvx.com/docs/frameworks/sinatra)
-  * [Rocket](https://dotenvx.com/docs/frameworks/rocket)
-* [Platforms](https://dotenvx.com/docs#platforms)
-  * [Digital Ocean](https://dotenvx.com/docs/platforms/digital-ocean)
-  * [Docker](https://dotenvx.com/docs/platforms/docker)
-  * [Fly](https://dotenvx.com/docs/platforms/fly)
-  * [Heroku](https://dotenvx.com/docs/platforms/heroku)
-  * [Netlify](https://dotenvx.com/docs/platforms/netlify)
-  * [Vercel](https://dotenvx.com/docs/platforms/vercel)
-  * [Railway](https://dotenvx.com/docs/platforms/railway)
-  * [Render](https://dotenvx.com/docs/platforms/render)
-* [CI/CDs](https://dotenvx.com/docs#cis)
-  * [GitHub Actions](https://dotenvx.com/docs/cis/github-actions)
-* [Password Managers](https://dotenvx.com/docs#password-managers)
-  * [1Password](https://dotenvx.com/docs/guides/1password)
-* [Background Jobs](https://dotenvx.com/docs#background-jobs)
-  * [Trigger.dev](https://dotenvx.com/docs/background-jobs/triggerdotdev)
-* [Package Managers](https://dotenvx.com/docs#package-managers)
-  * [NPM](https://dotenvx.com/docs/package-managers/npm)
-  * [PNPM](https://dotenvx.com/docs/package-managers/pnpm)
-* [Process Managers](https://dotenvx.com/docs#process-managers)
-  * [PM2](https://dotenvx.com/docs/process-managers/pm2)
-* [Monorepos](https://dotenvx.com/docs#monorepos)
-  * [Nx](https://dotenvx.com/docs/monorepos/nx)
-  * [Turborepo](https://dotenvx.com/docs/monorepos/turborepo)
-* [Concepts](https://dotenvx.com/docs#concepts)
-  * [.env](https://dotenvx.com/docs/env-file)
-  * [.env.keys](https://dotenvx.com/docs/env-keys-file)
+* [Claude](https://dotenvx.com/docs/secrets-in-claude)
+* [Codex](https://dotenvx.com/docs/secrets-in-codex)
+* [1Password](https://dotenvx.com/docs/secrets-in-1password)
+* [Node.js](https://dotenvx.com/docs/secrets-in-nodejs)
+* [Next.js](https://dotenvx.com/docs/secrets-in-nextjs)
+* [Express](https://dotenvx.com/docs/secrets-in-express)
+* [Astro](https://dotenvx.com/docs/secrets-in-astro)
+* [Expo](https://dotenvx.com/docs/secrets-in-expo)
+* [Python](https://dotenvx.com/docs/secrets-in-python)
+* [Ruby](https://dotenvx.com/docs/secrets-in-ruby)
+* [Go](https://dotenvx.com/docs/secrets-in-go)
+* [PHP](https://dotenvx.com/docs/secrets-in-php)
+* [Rust](https://dotenvx.com/docs/secrets-in-rust)
+
+[Browse all quickstarts](https://dotenvx.com/docs)
 
 &nbsp;
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.15.0",
+  "version": "2.16.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/curl.js

@@ -0,0 +1,70 @@
+const { logger } = require('../../shared/logger')
+const Session = require('../../db/session')
+const { http } = require('../../lib/helpers/http')
+const catchAndLog = require('../../lib/helpers/catchAndLog')
+
+function requestUrl (value, hostname) {
+  const url = new URL(value)
+  const trusted = new URL(hostname)
+
+  if (url.origin !== trusted.origin) {
+    throw new Error(`refusing to send Armor token to [${url.origin}]. expected [${trusted.origin}]`)
+  }
+
+  if (url.username || url.password) {
+    throw new Error('refusing URL containing credentials')
+  }
+
+  return url.toString()
+}
+
+function requestBody (value) {
+  if (value === undefined) return undefined
+
+  try {
+    return JSON.stringify(JSON.parse(value))
+  } catch {
+    throw new Error('invalid JSON passed to [--data]')
+  }
+}
+
+function outputBody (value) {
+  try {
+    return JSON.stringify(JSON.parse(value), null, 2)
+  } catch {
+    return value
+  }
+}
+
+async function curl () {
+  try {
+    const options = this.opts()
+    const session = new Session()
+    const token = options.token || session.token()
+    if (!token) throw new Error('missing token. Try [dotenvx login].')
+
+    const body = requestBody(options.data)
+    const method = (options.request || (body === undefined ? 'GET' : 'POST')).toUpperCase()
+    const url = requestUrl(this.args[0], session.hostname())
+    const headers = {
+      Authorization: `Bearer ${token}`,
+      Accept: 'application/json'
+    }
+    if (body !== undefined) headers['Content-Type'] = 'application/json'
+
+    logger.debug(`request [${method} ${url}]`)
+    const response = await http(url, { method, headers, body })
+    const text = await response.body.text()
+    console.log(outputBody(text))
+
+    if (response.statusCode >= 400) process.exitCode = 1
+  } catch (error) {
+    catchAndLog(error)
+    process.exit(1)
+  }
+}
+
+module.exports = curl
+module.exports.requestUrl = requestUrl
+module.exports.requestBody = requestBody
+module.exports.outputBody = outputBody

package/src/cli/actions/get.js

@@ -9,6 +9,7 @@ const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDote
 const buildCommandEnvs = require('../../lib/helpers/buildCommandEnvs')
 const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
 const mask = require('../../lib/helpers/mask')
+const filterKeys = require('../../lib/helpers/filterKeys')
 
 async function get (key) {
   const options = normalizeDotenvConfigConvention(this.opts())
@@ -30,7 +31,7 @@ async function get (key) {
     const sesh = new Session()
     const noArmor = options.armor === false || (await sesh.noArmor())
     const noKeychain = options.native === false || options.noNative === true
-    const { parsed, errors } = await getResolver({
+    const { parsed: resolved, errors } = await getResolver({
       key,
       envs,
       overload: options.overload,
@@ -46,6 +47,7 @@ async function get (key) {
         }
       }
     })
+    const parsed = filterKeys(resolved, options.includeKey, options.excludeKey)
 
     for (const error of errors || []) {
       if (options.strict) throw error // throw immediately if strict

package/src/cli/dotenvx.js

@@ -94,6 +94,8 @@ program.command('get')
   .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
   .option('-a, --all', 'include all machine envs as well')
+  .option('-ik, --include-key <includeKeys...>', 'keys(s) to include in output (default: all)')
+  .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from output (default: none)')
   .option('--mask [characters]', 'mask values, optionally setting visible characters')
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
@@ -258,6 +260,17 @@ program.command('update')
     return require('./actions/update').apply(this, args)
   })
 
+// dotenvx curl
+program.command('curl', { hidden: true })
+  .description('make an authenticated dotenvx API request')
+  .argument('<url>', 'dotenvx API URL')
+  .option('-X, --request <method>', 'HTTP request method')
+  .option('--data <json>', 'JSON request body')
+  .option('--token <token>', 'set Armor ⛨ token')
+  .action(function (...args) {
+    return require('./actions/curl').apply(this, args)
+  })
+
 // dotenvx login (compatibility alias for dotenvx armor login)
 program.command('login', { hidden: true })
   .description('log in to move keys off-device, share with your team, and audit access')

package/src/lib/helpers/createElapsedStatus.js

@@ -0,0 +1,17 @@
+function createElapsedStatus (onStatus, text) {
+  if (!onStatus) return () => {}
+
+  let elapsed = 0
+  onStatus(text)
+
+  const timer = setInterval(() => {
+    elapsed += 1
+    onStatus(`${text} (${elapsed}s)`)
+  }, 1000)
+
+  if (timer.unref) timer.unref()
+
+  return () => clearInterval(timer)
+}
+
+module.exports = createElapsedStatus

package/src/lib/helpers/filterKeys.js

@@ -0,0 +1,15 @@
+const { match } = require('@dotenvx/primitives')
+
+function filterKeys (parsed, includeKeys, excludeKeys) {
+  const include = includeKeys && match(includeKeys)
+  const exclude = excludeKeys && match(excludeKeys)
+
+  return Object.fromEntries(Object.entries(parsed).filter(([key]) => {
+    if (include && !include(key)) return false
+    if (exclude && exclude(key)) return false
+
+    return true
+  }))
+}
+
+module.exports = filterKeys

package/src/lib/helpers/resolveBitwardenPassword.js

@@ -2,6 +2,7 @@ const { execFile, execFileSync } = require('child_process')
 const Errors = require('./errors')
 const prompts = require('./prompts')
 const createSpinner = require('./createSpinner')
+const createElapsedStatus = require('./createElapsedStatus')
 
 const FIELDS = new Set(['username', 'password', 'uri'])
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
@@ -47,6 +48,7 @@ async function session (options) {
       output: process.stderr
     })
     createSpinner.resume()
+    if (options.startStatus) options.startStatus()
     const passwordEnv = 'DOTENVX_BITWARDEN_PASSWORD'
     options.session = secretValue(await execFileAsync('bw', ['unlock', '--passwordenv', passwordEnv, '--raw'], {
       encoding: 'utf8',
@@ -92,23 +94,36 @@ async function resolveBitwardenPassword (parsed, options = {}) {
   const errors = []
   const unresolved = []
   options.session = options.session || process.env.BW_SESSION
-
-  for (const [key, value] of Object.entries(parsed)) {
-    if (!isSecretReference(value)) continue
-
-    try {
-      const { itemId, field } = parseSecretReference(value)
-      const bwSession = await session(options)
-      const stdout = await execFileAsync('bw', ['get', field, itemId], {
-        encoding: 'utf8',
-        windowsHide: true,
-        env: { ...process.env, BW_SESSION: bwSession }
-      })
-      parsed[key] = secretValue(stdout)
-    } catch (error) {
-      errors.push(resolutionError(key, error))
-      unresolved.push(key)
-      delete parsed[key]
+  let stopStatus
+  const startStatus = () => {
+    if (!stopStatus) stopStatus = createElapsedStatus(options.onStatus, 'awaiting bitwarden')
+  }
+  options.startStatus = startStatus
+
+  try {
+    for (const [key, value] of Object.entries(parsed)) {
+      if (!isSecretReference(value)) continue
+
+      try {
+        const { itemId, field } = parseSecretReference(value)
+        if (options.session) startStatus()
+        const bwSession = await session(options)
+        const stdout = await execFileAsync('bw', ['get', field, itemId], {
+          encoding: 'utf8',
+          windowsHide: true,
+          env: { ...process.env, BW_SESSION: bwSession }
+        })
+        parsed[key] = secretValue(stdout)
+      } catch (error) {
+        errors.push(resolutionError(key, error))
+        unresolved.push(key)
+        delete parsed[key]
+      }
+    }
+  } finally {
+    if (stopStatus) {
+      stopStatus()
+      if (options.onStatus) options.onStatus('injecting')
     }
   }
 

package/src/lib/helpers/resolveOnePassword.js

@@ -1,5 +1,6 @@
 const { execFile, execFileSync } = require('child_process')
 const Errors = require('./errors')
+const createElapsedStatus = require('./createElapsedStatus')
 
 function execFileAsync (command, args, options) {
   return new Promise((resolve, reject) => {
@@ -22,23 +23,34 @@ function resolutionError (key, error) {
   return new Errors({ message }).onePasswordFailed()
 }
 
-async function resolveOnePassword (parsed) {
+async function resolveOnePassword (parsed, options = {}) {
   const errors = []
   const unresolved = []
+  const hasSecretReferences = Object.values(parsed).some(isSecretReference)
+  const stopStatus = hasSecretReferences
+    ? createElapsedStatus(options.onStatus, 'awaiting 1password')
+    : null
 
-  for (const [key, value] of Object.entries(parsed)) {
-    if (!isSecretReference(value)) continue
+  try {
+    for (const [key, value] of Object.entries(parsed)) {
+      if (!isSecretReference(value)) continue
 
-    try {
-      const stdout = await execFileAsync('op', ['read', value, '--no-newline'], {
-        encoding: 'utf8',
-        windowsHide: true
-      })
-      parsed[key] = stdout
-    } catch (error) {
-      errors.push(resolutionError(key, error))
-      unresolved.push(key)
-      delete parsed[key]
+      try {
+        const stdout = await execFileAsync('op', ['read', value, '--no-newline'], {
+          encoding: 'utf8',
+          windowsHide: true
+        })
+        parsed[key] = stdout
+      } catch (error) {
+        errors.push(resolutionError(key, error))
+        unresolved.push(key)
+        delete parsed[key]
+      }
+    }
+  } finally {
+    if (stopStatus) {
+      stopStatus()
+      if (options.onStatus) options.onStatus('injecting')
     }
   }
 

package/src/lib/resolvers/envs.js

@@ -72,7 +72,7 @@ function buildParseOptions ({ processEnv, overload, envKeysFilepath, provider, d
   return options
 }
 
-async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, no1Password, noBitwarden }) {
+async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, no1Password, noBitwarden, onStatus }) {
   const row = {}
   row.type = TYPE_ENV
   row.string = env.value
@@ -104,14 +104,14 @@ async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider
     row.existed = existed || {}
 
     if (!no1Password) {
-      const result = await resolveOnePassword(row.injected)
+      const result = await resolveOnePassword(row.injected, { onStatus })
       row.errors.push(...result.errors)
       for (const key of result.unresolved) delete row.parsed[key]
       Object.assign(row.parsed, row.injected)
     }
 
     if (!noBitwarden) {
-      const passwordResult = await resolveBitwardenPassword(row.injected)
+      const passwordResult = await resolveBitwardenPassword(row.injected, { onStatus })
       row.errors.push(...passwordResult.errors)
       for (const key of passwordResult.unresolved) delete row.parsed[key]
 
@@ -180,7 +180,7 @@ function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider,
   return row
 }
 
-async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths, no1Password, noBitwarden }) {
+async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths, no1Password, noBitwarden, onStatus }) {
   const row = {}
   row.type = TYPE_ENV_FILE
   row.filepath = env.value
@@ -215,14 +215,14 @@ async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, prov
     row.existed = existed || {}
 
     if (!no1Password) {
-      const result = await resolveOnePassword(row.injected)
+      const result = await resolveOnePassword(row.injected, { onStatus })
       row.errors.push(...result.errors)
       for (const key of result.unresolved) delete row.parsed[key]
       Object.assign(row.parsed, row.injected)
     }
 
     if (!noBitwarden) {
-      const passwordResult = await resolveBitwardenPassword(row.injected)
+      const passwordResult = await resolveBitwardenPassword(row.injected, { onStatus })
       row.errors.push(...passwordResult.errors)
       for (const key of passwordResult.unresolved) delete row.parsed[key]
 
@@ -320,7 +320,8 @@ async function envs (options = {}) {
         decryptor,
         readableFilepaths,
         no1Password: options.no1Password,
-        noBitwarden: options.noBitwarden
+        noBitwarden: options.noBitwarden,
+        onStatus: options.onStatus
       }))
     } else if (env.type === TYPE_ENV) {
       processedEnvs.push(await injectEnv({
@@ -331,7 +332,8 @@ async function envs (options = {}) {
         provider,
         decryptor,
         no1Password: options.no1Password,
-        noBitwarden: options.noBitwarden
+        noBitwarden: options.noBitwarden,
+        onStatus: options.onStatus
       }))
     }
   }