@dotenvx/dotenvx 2.15.1 → 2.16.1

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.15.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.16.1...main)
+
+## [2.16.1](https://github.com/dotenvx/dotenvx/compare/v2.16.0...v2.16.1) (2026-07-21)
+
+### Changed
+
+* Fix: Do not report child error - let child do so. ([#914](https://github.com/dotenvx/dotenvx/pull/914))
+
+## [2.16.0](https://github.com/dotenvx/dotenvx/compare/v2.15.1...v2.16.0) (2026-07-21)
+
+### Added
+
+* Add support for `-ek` and `-ik` to `dotenvx get` ([#913](https://github.com/dotenvx/dotenvx/pull/913))
 
 ## [2.15.1](https://github.com/dotenvx/dotenvx/compare/v2.15.0...v2.15.1) (2026-07-20)
 

package/README.md

@@ -1848,6 +1848,30 @@ $ dotenvx get
 {"HELLO":"World"}
 ```
 
+</details>
+<details><summary>`get -ik`</summary><br>
+
+Include only matching keys by passing `--include-key`. Glob patterns are supported.
+
+```sh
+$ echo "HELLO=World\nHOLA=Mundo\nGOODBYE=World" > .env
+
+$ dotenvx get -ik "H*"
+{"HELLO":"World","HOLA":"Mundo"}
+```
+
+</details>
+<details><summary>`get -ek`</summary><br>
+
+Exclude matching keys by passing `--exclude-key`. Glob patterns are supported.
+
+```sh
+$ echo "DOTENV_PUBLIC_KEY=public\nHELLO=World" > .env
+
+$ dotenvx get --format=eval-export -ek "DOTENV_PUBLIC_KEY*"
+export HELLO='World'
+```
+
 </details>
 <details><summary>`get --format shell`</summary><br>
 
@@ -3412,53 +3436,26 @@ Set `mask: 0` to fully mask values.
 
 &nbsp;
 
-## Guides
+## Quickstarts
 
-> Go deeper with `dotenvx` – detailed framework and platform guides.
+> Encrypt and run secrets in your language, framework, or tool.
 >
 
-* [Languages](https://dotenvx.com/docs#languages)
-  * [Node.js](https://dotenvx.com/docs/languages/nodejs)
-  * [Python](https://dotenvx.com/docs/languages/python)
-  * [Ruby](https://dotenvx.com/docs/languages/ruby)
-  * [Go](https://dotenvx.com/docs/languages/go)
-  * [PHP](https://dotenvx.com/docs/languages/php)
-  * [Rust](https://dotenvx.com/docs/languages/rust)
-* [Frameworks](https://dotenvx.com/docs#frameworks)
-  * [Astro](https://dotenvx.com/docs/secrets-in-astro)
-  * [Expo](https://dotenvx.com/docs/secrets-in-expo)
-  * [Express](https://dotenvx.com/docs/frameworks/express)
-  * [Next](https://dotenvx.com/docs/frameworks/next)
-  * [Remix](https://dotenvx.com/docs/frameworks/remix)
-  * [Flask](https://dotenvx.com/docs/frameworks/flask)
-  * [Sinatra](https://dotenvx.com/docs/frameworks/sinatra)
-  * [Rocket](https://dotenvx.com/docs/frameworks/rocket)
-* [Platforms](https://dotenvx.com/docs#platforms)
-  * [Digital Ocean](https://dotenvx.com/docs/platforms/digital-ocean)
-  * [Docker](https://dotenvx.com/docs/platforms/docker)
-  * [Fly](https://dotenvx.com/docs/platforms/fly)
-  * [Heroku](https://dotenvx.com/docs/platforms/heroku)
-  * [Netlify](https://dotenvx.com/docs/platforms/netlify)
-  * [Vercel](https://dotenvx.com/docs/platforms/vercel)
-  * [Railway](https://dotenvx.com/docs/platforms/railway)
-  * [Render](https://dotenvx.com/docs/platforms/render)
-* [CI/CDs](https://dotenvx.com/docs#cis)
-  * [GitHub Actions](https://dotenvx.com/docs/cis/github-actions)
-* [Password Managers](https://dotenvx.com/docs#password-managers)
-  * [1Password](https://dotenvx.com/docs/guides/1password)
-* [Background Jobs](https://dotenvx.com/docs#background-jobs)
-  * [Trigger.dev](https://dotenvx.com/docs/background-jobs/triggerdotdev)
-* [Package Managers](https://dotenvx.com/docs#package-managers)
-  * [NPM](https://dotenvx.com/docs/package-managers/npm)
-  * [PNPM](https://dotenvx.com/docs/package-managers/pnpm)
-* [Process Managers](https://dotenvx.com/docs#process-managers)
-  * [PM2](https://dotenvx.com/docs/process-managers/pm2)
-* [Monorepos](https://dotenvx.com/docs#monorepos)
-  * [Nx](https://dotenvx.com/docs/monorepos/nx)
-  * [Turborepo](https://dotenvx.com/docs/monorepos/turborepo)
-* [Concepts](https://dotenvx.com/docs#concepts)
-  * [.env](https://dotenvx.com/docs/env-file)
-  * [.env.keys](https://dotenvx.com/docs/env-keys-file)
+* [Claude](https://dotenvx.com/docs/secrets-in-claude)
+* [Codex](https://dotenvx.com/docs/secrets-in-codex)
+* [1Password](https://dotenvx.com/docs/secrets-in-1password)
+* [Node.js](https://dotenvx.com/docs/secrets-in-nodejs)
+* [Next.js](https://dotenvx.com/docs/secrets-in-nextjs)
+* [Express](https://dotenvx.com/docs/secrets-in-express)
+* [Astro](https://dotenvx.com/docs/secrets-in-astro)
+* [Expo](https://dotenvx.com/docs/secrets-in-expo)
+* [Python](https://dotenvx.com/docs/secrets-in-python)
+* [Ruby](https://dotenvx.com/docs/secrets-in-ruby)
+* [Go](https://dotenvx.com/docs/secrets-in-go)
+* [PHP](https://dotenvx.com/docs/secrets-in-php)
+* [Rust](https://dotenvx.com/docs/secrets-in-rust)
+
+[Browse all quickstarts](https://dotenvx.com/docs)
 
 &nbsp;
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.15.1",
+  "version": "2.16.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/curl.js

@@ -0,0 +1,70 @@
+const { logger } = require('../../shared/logger')
+const Session = require('../../db/session')
+const { http } = require('../../lib/helpers/http')
+const catchAndLog = require('../../lib/helpers/catchAndLog')
+
+function requestUrl (value, hostname) {
+  const url = new URL(value)
+  const trusted = new URL(hostname)
+
+  if (url.origin !== trusted.origin) {
+    throw new Error(`refusing to send Armor token to [${url.origin}]. expected [${trusted.origin}]`)
+  }
+
+  if (url.username || url.password) {
+    throw new Error('refusing URL containing credentials')
+  }
+
+  return url.toString()
+}
+
+function requestBody (value) {
+  if (value === undefined) return undefined
+
+  try {
+    return JSON.stringify(JSON.parse(value))
+  } catch {
+    throw new Error('invalid JSON passed to [--data]')
+  }
+}
+
+function outputBody (value) {
+  try {
+    return JSON.stringify(JSON.parse(value), null, 2)
+  } catch {
+    return value
+  }
+}
+
+async function curl () {
+  try {
+    const options = this.opts()
+    const session = new Session()
+    const token = options.token || session.token()
+    if (!token) throw new Error('missing token. Try [dotenvx login].')
+
+    const body = requestBody(options.data)
+    const method = (options.request || (body === undefined ? 'GET' : 'POST')).toUpperCase()
+    const url = requestUrl(this.args[0], session.hostname())
+    const headers = {
+      Authorization: `Bearer ${token}`,
+      Accept: 'application/json'
+    }
+    if (body !== undefined) headers['Content-Type'] = 'application/json'
+
+    logger.debug(`request [${method} ${url}]`)
+    const response = await http(url, { method, headers, body })
+    const text = await response.body.text()
+    console.log(outputBody(text))
+
+    if (response.statusCode >= 400) process.exitCode = 1
+  } catch (error) {
+    catchAndLog(error)
+    process.exit(1)
+  }
+}
+
+module.exports = curl
+module.exports.requestUrl = requestUrl
+module.exports.requestBody = requestBody
+module.exports.outputBody = outputBody

package/src/cli/actions/get.js

@@ -9,6 +9,7 @@ const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDote
 const buildCommandEnvs = require('../../lib/helpers/buildCommandEnvs')
 const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
 const mask = require('../../lib/helpers/mask')
+const filterKeys = require('../../lib/helpers/filterKeys')
 
 async function get (key) {
   const options = normalizeDotenvConfigConvention(this.opts())
@@ -30,7 +31,7 @@ async function get (key) {
     const sesh = new Session()
     const noArmor = options.armor === false || (await sesh.noArmor())
     const noKeychain = options.native === false || options.noNative === true
-    const { parsed, errors } = await getResolver({
+    const { parsed: resolved, errors } = await getResolver({
       key,
       envs,
       overload: options.overload,
@@ -46,6 +47,7 @@ async function get (key) {
         }
       }
     })
+    const parsed = filterKeys(resolved, options.includeKey, options.excludeKey)
 
     for (const error of errors || []) {
       if (options.strict) throw error // throw immediately if strict

package/src/cli/dotenvx.js

@@ -94,6 +94,8 @@ program.command('get')
   .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
   .option('-a, --all', 'include all machine envs as well')
+  .option('-ik, --include-key <includeKeys...>', 'keys(s) to include in output (default: all)')
+  .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from output (default: none)')
   .option('--mask [characters]', 'mask values, optionally setting visible characters')
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
@@ -258,6 +260,17 @@ program.command('update')
     return require('./actions/update').apply(this, args)
   })
 
+// dotenvx curl
+program.command('curl', { hidden: true })
+  .description('make an authenticated dotenvx API request')
+  .argument('<url>', 'dotenvx API URL')
+  .option('-X, --request <method>', 'HTTP request method')
+  .option('--data <json>', 'JSON request body')
+  .option('--token <token>', 'set Armor ⛨ token')
+  .action(function (...args) {
+    return require('./actions/curl').apply(this, args)
+  })
+
 // dotenvx login (compatibility alias for dotenvx armor login)
 program.command('login', { hidden: true })
   .description('log in to move keys off-device, share with your team, and audit access')

package/src/lib/helpers/executeCommand.js

@@ -174,14 +174,18 @@ async function executeCommand (commandArgs, env, sensitiveValues = []) {
 
     if (exitCode !== 0) {
       logger.debug(`received exitCode ${exitCode}`)
-      throw new Errors({ exitCode }).commandExitedWithCode()
+      const error = new Errors({ exitCode }).commandExitedWithCode()
+      error.exitCode = exitCode
+      throw error
     }
   } catch (error) {
+    const commandExited = Number.isInteger(error.exitCode) && (error.code === 'COMMAND_EXITED_WITH_CODE' || error.command)
+
     // no color on these errors as they can be standard errors for things like jest exiting with exitCode 1 for a single failed test.
     if (!['SIGINT', 'SIGTERM'].includes(signalSent || error.signal)) {
       if (error.code === 'ENOENT') {
         logger.error(`Unknown command: ${error.command}`)
-      } else {
+      } else if (!commandExited) {
         logger.error(redactOutput(error.message, sensitiveValues))
       }
     }

package/src/lib/helpers/filterKeys.js

@@ -0,0 +1,15 @@
+const { match } = require('@dotenvx/primitives')
+
+function filterKeys (parsed, includeKeys, excludeKeys) {
+  const include = includeKeys && match(includeKeys)
+  const exclude = excludeKeys && match(excludeKeys)
+
+  return Object.fromEntries(Object.entries(parsed).filter(([key]) => {
+    if (include && !include(key)) return false
+    if (exclude && exclude(key)) return false
+
+    return true
+  }))
+}
+
+module.exports = filterKeys