@dotenvx/dotenvx 2.17.4 → 2.18.1

package/CHANGELOG.md

@@ -2,7 +2,17 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.17.4...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.18.1...main)
+
+## [2.18.1](https://github.com/dotenvx/dotenvx/compare/v2.18.0...v2.18.1) (2026-07-26)
+
+* Patch injected message when preset `encrypted:` value ([#927](https://github.com/dotenvx/dotenvx/issues/927))
+
+## [2.18.0](https://github.com/dotenvx/dotenvx/compare/v2.17.4...v2.18.0) (2026-07-25)
+
+### Added
+
+* Make authenticated API calls to the Dotenvx Armor API with `dotenvx curl`. Allows you to control your Dotenvx Armor account directly from your agent inside Codex, Claude, etc. ([#923](https://github.com/dotenvx/dotenvx/pull/923))
 
 ## [2.17.4](https://github.com/dotenvx/dotenvx/compare/v2.17.3...v2.17.4) (2026-07-24)
 

package/README.md

@@ -3497,25 +3497,68 @@ Set `mask: 0` to fully mask values.
 
  
 
-### Settings ⚙️
+### More
 
-There are global settings available that can be configured as environment variables.
+<details><summary>Settings ⚙️</summary><br>
 
-<details><summary>Environment variables</summary><br>
+There are global settings available that can be configured as environment variables.
 
 ```ini
-# dotenvx native settings
+# config
 DOTENV_CONFIG_CONVENTION= # set to a default convention like 'nextjs' or 'flow'
 DOTENV_CONFIG_IGNORE= # MISSING_ENV_FILE,OTHER
 DOTENV_CONFIG_QUIET= # set to "true" to default to --quiet
+
+# armor
+DOTENVX_ARMOR_TOKEN= # for api calls
 DOTENVX_NO_ARMOR= # set to "true" to turn off Armor support
+
+# 1password
 DOTENVX_NO_1PASSWORD= # set to "true" to turn off 1Password support
-DOTENVX_NO_BITWARDEN= # set to "true" to turn off Bitwarden support
 
-# other machine settings respected by dotenvx
+# bitwarden
+DOTENVX_NO_BITWARDEN= # set to "true" to turn off Bitwarden support
 BW_SESSION= # set to bitwarden session token to bypass password prompt
 ```
 
+</details>
+<details><summary>Error Codes 🚨</summary><br>
+
+Dotenvx errors begin with a stable code in square brackets like `[MISSING_ENV_FILE]`.
+
+```ini
+# error codes
+1PASSWORD_FAILED= # a value could not be resolved with the 1Password CLI
+ACCESS_APPROVAL_TIMEOUT= # an Armor access-approval request timed out
+BITWARDEN_FAILED= # a value could not be resolved with the Bitwarden CLI
+COMMAND_EXITED_WITH_CODE= # the command run by dotenvx exited with a non-zero status
+COMMAND_SUBSTITUTION_FAILED= # a $(command) expression in an environment value could not be evaluated
+DECRYPTION_FAILED= # an encrypted value could not be decrypted
+FILE_NOT_WRITABLE= # dotenvx could not write to the target file
+INVALID_COLOR= # the requested terminal color is invalid
+INVALID_CONVENTION= # the requested environment-file convention is invalid
+INVALID_PASSPHRASE= # a locked private key could not be unlocked with the supplied passphrase
+INVALID_PRIVATE_KEY= # a private key is malformed or otherwise invalid
+INVALID_PUBLIC_KEY= # a public key is malformed or otherwise invalid
+MALFORMED_ENCRYPTED_DATA= # the encrypted value is malformed
+MISPAIRED_PRIVATE_KEY= # a private key does not match the existing public key
+MISSING_DIRECTORY= # the requested directory does not exist
+MISSING_ENV_EXAMPLE= # the required .env.example file does not exist
+MISSING_ENV_FILE= # a requested environment file does not exist
+MISSING_ENV_FILES= # no .env* files were found
+MISSING_ENV_KEYS_FILE= # the requested .env.keys file does not exist
+MISSING_KEY= # a requested environment key does not exist
+MISSING_LOG_LEVEL= # the requested log level is not supported
+MISSING_PRIVATE_KEY= # the private key required to decrypt a value is missing
+MISSING_PUBLIC_KEY= # the public key required to encrypt a value is missing
+MISSING_REQUIRED= # validation detail for which required variables are missing; surfaced by VALIDATION_FAILED
+MISSING_VALUE= # no value was supplied for a key
+NOT_FOUND= # a private key was not found in the native secret store
+PRECOMMIT_HOOK_MODIFY_FAILED= # dotenvx could not update the pre-commit hook
+VALIDATION_FAILED= # one or more required variables declared by .env.example are missing
+WRONG_PRIVATE_KEY= # the supplied private key cannot decrypt the value
+```
+
 </details>
 
 &nbsp;

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.17.4",
+  "version": "2.18.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -52,7 +52,7 @@
   },
   "funding": "https://dotenvx.com",
   "dependencies": {
-    "@dotenvx/primitives": "^2.1.0",
+    "@dotenvx/primitives": "^2.1.1",
     "@dotenvx/tooling": "^1.0.3",
     "yocto-spinner": "^1.2.1"
   },
@@ -62,9 +62,13 @@
     "esbuild": "^0.28.1",
     "proxyquire": "^2.1.3",
     "sinon": "^14.0.1",
-    "standard": "^17.1.0",
+    "standard": "^17.1.2",
     "standard-version": "^9.5.0",
-    "tap": "^21.0.1"
+    "tap": "^21.7.4"
+  },
+  "overrides": {
+    "brace-expansion": "^5.0.8",
+    "minimatch": "^10.2.5"
   },
   "publishConfig": {
     "access": "public",

package/src/cli/commands/ext.js

@@ -1,6 +1,6 @@
 const { Command } = require('@dotenvx/tooling')
 
-const examples = require('./../examples')
+const help = require('./../help')
 const executeExtension = require('../../lib/helpers/executeExtension')
 const removeDynamicHelpSection = require('../../lib/helpers/removeDynamicHelpSection')
 
@@ -41,7 +41,7 @@ ext.command('genexample')
 // dotenvx ext gitignore
 ext.command('gitignore')
   .description('append to .gitignore')
-  .addHelpText('after', examples.gitignore)
+  .addHelpText('after', help.gitignore)
   .option('--pattern <patterns...>', 'pattern(s) to gitignore', ['.env*'])
   .action(function (...args) {
     return require('./../actions/ext/gitignore').apply(this, args)
@@ -50,7 +50,7 @@ ext.command('gitignore')
 // dotenvx ext prebuild
 ext.command('prebuild')
   .description('prevent including .env files in docker')
-  .addHelpText('after', examples.prebuild)
+  .addHelpText('after', help.prebuild)
   .argument('[directory]', 'directory to prevent including .env files from', '.')
   .action(function (...args) {
     return require('./../actions/ext/prebuild').apply(this, args)
@@ -59,7 +59,7 @@ ext.command('prebuild')
 // dotenvx ext precommit
 ext.command('precommit')
   .description('prevent committing .env files to code')
-  .addHelpText('after', examples.precommit)
+  .addHelpText('after', help.precommit)
   .argument('[directory]', 'directory to prevent committing .env files from', '.')
   .option('-i, --install', 'install to .git/hooks/pre-commit')
   .action(function (...args) {

package/src/cli/dotenvx.js

@@ -5,7 +5,7 @@ const { Command } = require('@dotenvx/tooling')
 const program = new Command()
 
 const { setLogLevel } = require('../shared/logger')
-const examples = require('./examples')
+const help = require('./help')
 const packageJson = require('./../lib/helpers/packageJson')
 const executeDynamic = require('./../lib/helpers/executeDynamic')
 const removeDynamicHelpSection = require('./../lib/helpers/removeDynamicHelpSection')
@@ -60,7 +60,7 @@ program
 // dotenvx run -- node index.js
 program.command('run')
   .description('inject env at runtime [dotenvx run -- yourcommand]')
-  .addHelpText('after', examples.run)
+  .addHelpText('after', help.run)
   .option('-e, --env <strings...>', 'environment variable(s) set as string (example: "HELLO=World")', collectEnvs('env'), [])
   .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
   .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
@@ -113,7 +113,7 @@ program.command('get')
 program.command('set')
   .usage('<KEY> [value] [options]')
   .description('encrypt a single environment variable')
-  .addHelpText('after', examples.set)
+  .addHelpText('after', help.set)
   .allowUnknownOption()
   .argument('KEY', 'KEY')
   .argument('[value]', 'value')
@@ -211,7 +211,7 @@ program.command('validate')
 // dotenvx gitignore
 program.command('gitignore')
   .description('append to .gitignore')
-  .addHelpText('after', examples.gitignore)
+  .addHelpText('after', help.gitignore)
   .option('--pattern <patterns...>', 'pattern(s) to gitignore', ['.env*'])
   .action(function (...args) {
     return require('./actions/ext/gitignore').apply(this, args)
@@ -229,7 +229,7 @@ program.command('genexample')
 // dotenvx precommit
 program.command('precommit')
   .description('prevent committing .env files to code')
-  .addHelpText('after', examples.precommit)
+  .addHelpText('after', help.precommit)
   .argument('[directory]', 'directory to prevent committing .env files from', '.')
   .option('-i, --install', 'install to .git/hooks/pre-commit')
   .action(function (...args) {
@@ -239,7 +239,7 @@ program.command('precommit')
 // dotenvx prebuild
 program.command('prebuild')
   .description('prevent including .env files in docker')
-  .addHelpText('after', examples.prebuild)
+  .addHelpText('after', help.prebuild)
   .argument('[directory]', 'directory to prevent including .env files from', '.')
   .action(function (...args) {
     return require('./actions/ext/prebuild').apply(this, args)
@@ -260,17 +260,6 @@ program.command('update')
     return require('./actions/update').apply(this, args)
   })
 
-// dotenvx curl
-program.command('curl', { hidden: true })
-  .description('make an authenticated dotenvx API request')
-  .argument('<url>', 'dotenvx API URL')
-  .option('-X, --request <method>', 'HTTP request method')
-  .option('--data <json>', 'JSON request body')
-  .option('--token <token>', 'set Armor ⛨ token')
-  .action(function (...args) {
-    return require('./actions/curl').apply(this, args)
-  })
-
 // dotenvx login (compatibility alias for dotenvx armor login)
 program.command('login', { hidden: true })
   .description('log in to move keys off-device, share with your team, and audit access')
@@ -289,6 +278,18 @@ program.command('logout', { hidden: true })
     return require('./actions/logout').apply(this, args)
   })
 
+// dotenvx curl
+program.command('curl', { hidden: true })
+  .description('Dotenvx Armor API')
+  .addHelpText('after', help.curl)
+  .argument('<url>', '(run dotenvx run --help for list of urls)')
+  .option('-X, --request <method>', 'HTTP request method')
+  .option('--data <json>', 'JSON request body')
+  .option('--token <token>', 'set token')
+  .action(function (...args) {
+    return require('./actions/curl').apply(this, args)
+  })
+
 // dotenvx help
 program.command('help [command]')
   .description('display help for command')
@@ -311,6 +312,7 @@ program.addHelpText('after', 'Professional Security: ')
 program.addHelpText('after', '  lock                     ⊡ lock private keys with a local passphrase')
 program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store')
 program.addHelpText('after', '  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
+program.addHelpText('after', '  curl                     ⛨ call authenticated api to Dotenvx Armor [www.dotenvx.com/armor]')
 
 // dotenvx native
 require('./commands/native')(program.command('native', { hidden: true }))

package/src/cli/{examples.js → help.js}

@@ -90,10 +90,43 @@ Examples:
   `
 }
 
+const curl = function () {
+  return `
+Endpoints:
+
+  GET    /api/account
+  GET    /api/armor/keypairs
+  GET    /api/armor/keypairs/:public_key
+  POST   /api/armor/keypairs/:public_key/settings/guard
+  POST   /api/armor/keypairs/:public_key/settings/enclave
+  GET    /api/teams
+  GET    /api/teams/:team
+  GET    /api/teams/:team/members
+  GET    /api/teams/:team/invitations
+  POST   /api/teams/:team/invitations
+  DELETE /api/teams/:team/invitations/:id
+
+Examples:
+
+  dotenvx curl https://armor.dotenvx.com/api/account
+  dotenvx curl https://armor.dotenvx.com/api/armor/keypairs
+  dotenvx curl https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY
+  dotenvx curl https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/settings/guard --data '{"value":true}'
+  dotenvx curl https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/settings/enclave --data '{"value":true}'
+  dotenvx curl https://armor.dotenvx.com/api/teams
+  dotenvx curl https://armor.dotenvx.com/api/teams/TEAM
+  dotenvx curl https://armor.dotenvx.com/api/teams/TEAM/members
+  dotenvx curl https://armor.dotenvx.com/api/teams/TEAM/members
+  dotenvx curl https://armor.dotenvx.com/api/teams/TEAM/invitations --data '{"email":"person@example.com","role":"member"}'
+  dotenvx curl https://armor.dotenvx.com/api/teams/TEAM/invitations/123 --request DELETE
+  `
+}
+
 module.exports = {
   run,
   precommit,
   prebuild,
   gitignore,
-  set
+  set,
+  curl
 }

package/src/lib/helpers/buildApiError.js

@@ -1,12 +1,15 @@
 function buildApiError (statusCode, json) {
   const code = json.error.code || statusCode.toString()
   const message = `[${code}] ${json.error.message}`
-  const help = `[${code}] ${json.error.help || JSON.stringify(json)}`
+  const help = json.error.help ? `fix: [${json.error.help}]` : `[${code}] ${JSON.stringify(json)}`
   const meta = json.error.meta
 
   const error = new Error(message)
   error.code = code
   error.help = help
+  if (json.error.help) {
+    error.messageWithHelp = `${message}. ${help}`
+  }
   error.meta = meta
   error.json = json