@dotenvx/dotenvx 2.2.0 → 2.2.2

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.2.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.2.2...main)
+
+## [2.2.2](https://github.com/dotenvx/dotenvx/compare/v2.2.1...v2.2.2) (2026-07-08)
+
+### Changed
+
+* Move `login` and `logout` under armor ([#874](https://github.com/dotenvx/dotenvx/pull/874))
+
+## [2.2.1](https://github.com/dotenvx/dotenvx/compare/v2.2.0...v2.2.1) (2026-07-08)
+
+### Changed
+
+* Move `genexample` to top level commands ([#873](https://github.com/dotenvx/dotenvx/pull/873))
 
 ## [2.2.0](https://github.com/dotenvx/dotenvx/compare/v2.1.5...v2.2.0) (2026-07-07)
 

package/README.md

@@ -1384,6 +1384,15 @@ Set Armor ⛨ token for retrieving armored private keys.
 $ dotenvx run --token "$DOTENVX_ARMOR_TOKEN" -- yourcommand
 ```
 
+</details>
+<details><summary>`run --no-keychain`</summary><br>
+
+Turn off macOS Keychain lookups.
+
+```sh
+$ dotenvx run --no-keychain -- yourcommand
+```
+
 </details>
 <details><summary>`run --no-armor`</summary><br>
 
@@ -1393,8 +1402,6 @@ Turn off [Dotenvx Armor ⛨](https://dotenvx.com/armor) features.
 $ dotenvx run --no-armor -- yourcommand
 ```
 
-`--no-vlt` and `--no-ops` are deprecated aliases.
-
 </details>
 <details><summary>`get KEY`</summary><br>
 
@@ -1407,6 +1414,15 @@ $ dotenvx get HELLO
 World
 ```
 
+</details>
+<details><summary>`get KEY --no-keychain`</summary><br>
+
+Turn off macOS Keychain lookups for get.
+
+```sh
+$ dotenvx get HELLO --no-keychain
+```
+
 </details>
 <details><summary>`get KEY -f`</summary><br>
 
@@ -1722,6 +1738,15 @@ set HELLO_PLAIN (.env)
 
 Keys ending in `_PLAIN` are not encrypted by `dotenvx set` or `dotenvx encrypt`.
 
+</details>
+<details><summary>`set KEY value --no-keychain`</summary><br>
+
+Turn off macOS Keychain lookups for set.
+
+```sh
+$ dotenvx set HELLO Dotenvx --no-keychain
+```
+
 </details>
 <details><summary>`encrypt`</summary><br>
 
@@ -1753,6 +1778,16 @@ $ dotenvx encrypt -f .env.production
 ⮕  next run [DOTENV_PRIVATE_KEY='bff...bc4' dotenvx run -- yourcommand] to test decryption locally
 ```
 
+</details>
+<details><summary>`encrypt --no-keychain`</summary><br>
+
+Turn off macOS Keychain lookups for encrypt.
+
+```sh
+$ dotenvx encrypt --no-keychain
+◈ encrypted (.env)
+```
+
 </details>
 <details><summary>`encrypt --no-armor`</summary><br>
 
@@ -1763,8 +1798,6 @@ $ dotenvx encrypt --no-armor
 ◈ encrypted (.env)
 ```
 
-`--no-vlt` and `--no-ops` are deprecated aliases.
-
 </details>
 <details><summary>`encrypt -fk`</summary><br>
 
@@ -1884,6 +1917,16 @@ $ dotenvx decrypt
 ◇ decrypted (.env)
 ```
 
+</details>
+<details><summary>`decrypt --no-keychain`</summary><br>
+
+Turn off macOS Keychain lookups for decrypt.
+
+```sh
+$ dotenvx decrypt --no-keychain
+◇ decrypted (.env)
+```
+
 </details>
 <details><summary>`decrypt -f`</summary><br>
 
@@ -1995,6 +2038,16 @@ $ dotenvx keypair
 {"DOTENV_PUBLIC_KEY":"<publicKey>","DOTENV_PRIVATE_KEY":"<privateKey>"}
 ```
 
+</details>
+<details><summary>`keypair --no-keychain`</summary><br>
+
+Turn off macOS Keychain lookups for keypair.
+
+```sh
+$ dotenvx keypair --no-keychain
+{"DOTENV_PUBLIC_KEY":"<publicKey>","DOTENV_PRIVATE_KEY":"<privateKey>"}
+```
+
 </details>
 <details><summary>`keypair -f`</summary><br>
 
@@ -2121,101 +2174,14 @@ $ dotenvx ls -ef '**/.env.prod*'
 ```
 
 </details>
-<details><summary>`help`</summary><br>
-
-Output help for `dotenvx`.
-
-```sh
-$ dotenvx help
-Usage: dotenvx run -- yourcommand
-
-a secure dotenv–from the creator of `dotenv`
-
-Options:
-  -l, --log-level <level>      set log level (default: "info")
-  -q, --quiet                  sets log level to error
-  -v, --verbose                sets log level to verbose
-  -d, --debug                  sets log level to debug
-  -V, --version                output the version number
-  -h, --help                   display help for command
-
-Commands:
-  run                inject env at runtime [dotenvx run -- yourcommand]
-  get [KEY]          return a single environment variable
-  set <KEY> <value>  set a single environment variable
-  encrypt            encrypt .env file(s)
-  decrypt            decrypt .env file(s)
-  keypair [KEY]      print public/private keys for .env file(s)
-  ls [directory]     print all .env files in a tree structure
-  gitignore          append to .gitignore
-  precommit [directory]
-                     prevent committing .env files to code
-  prebuild [directory]
-                     prevent including .env files in docker
- 
-Professional Security: 
-  login                    log in to move keys off-device, share with your team, and audit access
-  logout                   log out of connected security features
-  armor                    ⛨ move private keys off-device [www.dotenvx.com/armor]
-```
-
-You can get more detailed help per command with `dotenvx help COMMAND`.
-
-```sh
-$ dotenvx help run
-Usage: @dotenvx/dotenvx run [options]
-
-inject env at runtime [dotenvx run -- yourcommand]
-
-Options:
-  -e, --env <strings...>            environment variable(s) set as string (example: "HELLO=Dotenvx") (default: [])
-  -f, --env-file <paths...>         path(s) to your env file(s) (default: [])
-  -fv, --env-vault-file <paths...>  path(s) to your .env.vault file(s) (default: [])
-  -o, --overload                    override existing env variables
-  --convention <name>               load a .env convention (available conventions: ['nextjs'])
-  -h, --help                        display help for command
-
-Examples:
-
-  $ dotenvx run -- npm run dev
-  $ dotenvx run -- flask --app index run
-  $ dotenvx run -- php artisan serve
-  $ dotenvx run -- bin/rails s
-
-Try it:
-
-  $ echo "HELLO=Dotenvx" > .env
-  $ echo "console.log('Hello ' + process.env.HELLO)" > index.js
-
-  $ dotenvx run -- node index.js
-  [dotenvx@1.X.X] injecting env (1) from .env
-  Hello Dotenvx
-```
-
-</details>
-<details><summary>`--version`</summary><br>
-
-Check current version of `dotenvx`.
-
-```sh
-$ dotenvx --version
-X.X.X
-```
-
-</details>
-
-### Utilities
-
-Additional workflow helpers.
-
-<details><summary>`ext genexample`</summary><br>
+<details><summary>`genexample`</summary><br>
 
 In one command, generate a `.env.example` file from your current `.env` file contents.
 
 ```sh
 $ echo "HELLO=Dotenvx" > .env
 
-$ dotenvx ext genexample
+$ dotenvx genexample
 ▣ generated (.env.example)
 ```
 
@@ -2225,7 +2191,7 @@ HELLO=""
 ```
 
 </details>
-<details><summary>`ext genexample -f`</summary><br>
+<details><summary>`genexample -f`</summary><br>
 
 Pass multiple `.env` files to generate your `.env.example` file from the combination of their contents.
 
@@ -2233,7 +2199,7 @@ Pass multiple `.env` files to generate your `.env.example` file from the combina
 $ echo "HELLO=Dotenvx" > .env
 $ echo "DB_HOST=example.com" > .env.production
 
-$ dotenvx ext genexample -f .env -f .env.production
+$ dotenvx genexample -f .env -f .env.production
 ▣ generated (.env.example)
 ```
 
@@ -2244,7 +2210,7 @@ DB_HOST=""
 ```
 
 </details>
-<details><summary>`ext genexample directory`</summary><br>
+<details><summary>`genexample directory`</summary><br>
 
 Generate a `.env.example` file inside the specified directory. Useful for monorepos.
 
@@ -2253,7 +2219,7 @@ $ echo "HELLO=Dotenvx" > .env
 $ mkdir -p apps/backend
 $ echo "HELLO=Backend" > apps/backend/.env
 
-$ dotenvx ext genexample apps/backend
+$ dotenvx genexample apps/backend
 ▣ generated (.env.example)
 ```
 
@@ -2357,17 +2323,217 @@ CMD ["/usr/local/bin/dotenvx", "run", "--", "node", "apps/backend/index.js"]
 ```
 
 </details>
-<details><summary>`ext scan`</summary><br>
+<details><summary>`keychain`</summary><br>
+
+Store private keys in macOS Keychain to keep them out of `.env.keys`.
+
+Currently supported on macOS.
+
+</details>
+<details><summary>`keychain up`</summary><br>
+
+Move a private key from `.env.keys` into macOS Keychain.
+
+```sh
+$ dotenvx keychain up
+```
+
+Specify files with `-f` and `-fk`.
+
+```sh
+$ dotenvx keychain up -f .env.production -fk .env.keys
+```
+
+</details>
+<details><summary>`keychain down`</summary><br>
+
+Move a private key from macOS Keychain back into `.env.keys`.
+
+```sh
+$ dotenvx keychain down
+```
+
+</details>
+<details><summary>`keychain push`</summary><br>
+
+Copy a private key from `.env.keys` into macOS Keychain.
+
+```sh
+$ dotenvx keychain push
+```
+
+</details>
+<details><summary>`keychain pull`</summary><br>
+
+Copy a private key from macOS Keychain into `.env.keys`.
+
+```sh
+$ dotenvx keychain pull
+```
+
+</details>
+<details><summary>`armor`</summary><br>
+
+Move private keys into [Dotenvx Armor ⛨](https://dotenvx.com/armor) for off-device storage, sharing with your team, and audited access.
+
+</details>
+<details><summary>`armor up`</summary><br>
+
+Move a private key from `.env.keys` into Dotenvx Armor.
+
+```sh
+$ dotenvx armor login
+$ dotenvx armor up
+```
+
+Specify environment and team.
+
+```sh
+$ dotenvx armor up -f .env.production --team acme
+```
+
+</details>
+<details><summary>`armor down`</summary><br>
+
+Move a private key from Dotenvx Armor back into `.env.keys`.
+
+```sh
+$ dotenvx armor down
+```
+
+</details>
+<details><summary>`armor push`</summary><br>
+
+Copy a private key from `.env.keys` into Dotenvx Armor.
+
+```sh
+$ dotenvx armor push
+```
+
+</details>
+<details><summary>`armor pull`</summary><br>
+
+Copy a private key from Dotenvx Armor into `.env.keys`.
+
+```sh
+$ dotenvx armor pull
+```
+
+Use a token when running non-interactively.
+
+```sh
+$ dotenvx armor pull -f .env.production --token "$DOTENVX_ARMOR_TOKEN"
+```
+
+</details>
+<details><summary>`armor move`</summary><br>
+
+Move an armored key to another team.
+
+```sh
+$ dotenvx armor move --team acme
+```
+
+</details>
+<details><summary>`armor login`</summary><br>
+
+Log in to Dotenvx Armor.
+
+```sh
+$ dotenvx armor login
+```
+
+</details>
+<details><summary>`armor logout`</summary><br>
+
+Log out of Dotenvx Armor.
+
+```sh
+$ dotenvx armor logout
+```
+
+</details>
+<details><summary>`help`</summary><br>
+
+Output help for `dotenvx`.
+
+```sh
+$ dotenvx help
+Usage: dotenvx run -- yourcommand
+
+a secure dotenv–from the creator of `dotenv`
+
+Options:
+  -l, --log-level <level>      set log level (default: "info")
+  -q, --quiet                  sets log level to error
+  -v, --verbose                sets log level to verbose
+  -d, --debug                  sets log level to debug
+  -V, --version                output the version number
+  -h, --help                   display help for command
+
+Commands:
+  run                inject env at runtime [dotenvx run -- yourcommand]
+  get [KEY]          return a single environment variable
+  set <KEY> <value>  set a single environment variable
+  encrypt            encrypt .env file(s)
+  decrypt            decrypt .env file(s)
+  keypair [KEY]      print public/private keys for .env file(s)
+  ls [directory]     print all .env files in a tree structure
+  genexample [directory]
+                     generate .env.example
+  gitignore          append to .gitignore
+  precommit [directory]
+                     prevent committing .env files to code
+  prebuild [directory]
+                     prevent including .env files in docker
+ 
+Professional Security: 
+  keychain                 ⌥ move private keys into macOS Keychain
+  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]
+```
 
-Scan for leaked secrets.
+You can get more detailed help per command with `dotenvx help COMMAND`.
 
 ```sh
-$ dotenvx ext scan
-100 commits scanned.
-no leaks found
+$ dotenvx help run
+Usage: @dotenvx/dotenvx run [options]
+
+inject env at runtime [dotenvx run -- yourcommand]
+
+Options:
+  -e, --env <strings...>            environment variable(s) set as string (example: "HELLO=Dotenvx") (default: [])
+  -f, --env-file <paths...>         path(s) to your env file(s) (default: [])
+  -fv, --env-vault-file <paths...>  path(s) to your .env.vault file(s) (default: [])
+  -o, --overload                    override existing env variables
+  --convention <name>               load a .env convention (available conventions: ['nextjs'])
+  -h, --help                        display help for command
+
+Examples:
+
+  $ dotenvx run -- npm run dev
+  $ dotenvx run -- flask --app index run
+  $ dotenvx run -- php artisan serve
+  $ dotenvx run -- bin/rails s
+
+Try it:
+
+  $ echo "HELLO=Dotenvx" > .env
+  $ echo "console.log('Hello ' + process.env.HELLO)" > index.js
+
+  $ dotenvx run -- node index.js
+  [dotenvx@1.X.X] injecting env (1) from .env
+  Hello Dotenvx
 ```
 
-Uses [gitleaks](https://gitleaks.io) under the hood.
+</details>
+<details><summary>`--version`</summary><br>
+
+Check current version of `dotenvx`.
+
+```sh
+$ dotenvx --version
+X.X.X
+```
 
 </details>
 
@@ -2614,8 +2780,6 @@ Turn off [Dotenvx Armor ⛨](https://dotenvx.com/armor) features.
 require('@dotenvx/dotenvx').config({noArmor: true})
 ```
 
-`noVlt` and `noOps` are deprecated aliases.
-
 </details>
 <details><summary>`parse(src)`</summary><br>
 
@@ -2723,18 +2887,6 @@ This is known as *Decryption at Access* and is written about in [the whitepaper]
 
 &nbsp;
 
-## Whitepaper
-
-> **Dotenvx: Reducing Secrets Risk with Cryptographic Separation**
->
-> Abstract. An ideal secrets solution would not only centralize secrets but also contain the fallout of a breach. While secrets managers offer centralized storage and distribution, their design creates a large blast radius, risking exposure of thousands or even millions of secrets. We propose a solution that reduces the blast radius by splitting secrets management into two distinct components: an encrypted secrets file and a separate decryption key.
->
-> ...
->
-> [Read the whitepaper](https://dotenvx.com/dotenvx.pdf)
-
-&nbsp;
-
 ## Guides
 
 > Go deeper with `dotenvx` – detailed framework and platform guides.
@@ -2766,6 +2918,9 @@ This is known as *Decryption at Access* and is written about in [the whitepaper]
   * [Render](https://dotenvx.com/docs/platforms/render)
 * [CI/CDs](https://dotenvx.com/docs#cis)
   * [GitHub Actions](https://dotenvx.com/docs/cis/github-actions)
+* [Password Managers](https://dotenvx.com/docs#password-managers)
+  * [1Password](https://dotenvx.com/docs/guides/1password)
+  * [Bitwarden](https://dotenvx.com/docs/guides/bitwarden)
 * [Background Jobs](https://dotenvx.com/docs#background-jobs)
   * [Trigger.dev](https://dotenvx.com/docs/background-jobs/triggerdotdev)
 * [Package Managers](https://dotenvx.com/docs#package-managers)

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.2.0",
+  "version": "2.2.2",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -36,7 +36,7 @@
     "standard": "standard",
     "standard:fix": "standard --fix",
     "test": "tap run --test-env=DOTENVX_NO_ARMOR=true --allow-empty-coverage --disable-coverage --timeout=60000",
-    "testshell": "bash shellspec",
+    "testshell": "shellspec --shell /bin/bash",
     "release:check": "npm test && npm run testshell",
     "prerelease": "npm run release:check",
     "release": "npm run release:check && standard-version"

package/src/cli/commands/armor.js

@@ -66,6 +66,24 @@ function configureArmorCommand (armor) {
     .option('--token <token>', 'set token')
     .action(moveAction)
 
+  // dotenvx armor login
+  const loginAction = require('./../actions/login')
+  armor
+    .command('login')
+    .description('log in to Dotenvx Armor')
+    .allowUnknownOption()
+    .option('--hostname <hostname>', 'set Armor ⛨ hostname')
+    .action(loginAction)
+
+  // dotenvx armor logout
+  const logoutAction = require('./../actions/logout')
+  armor
+    .command('logout')
+    .description('log out of Dotenvx Armor')
+    .allowUnknownOption()
+    .option('--hostname <hostname>', 'set Armor ⛨ hostname')
+    .action(logoutAction)
+
   return armor
 }
 

package/src/cli/dotenvx.js

@@ -186,6 +186,15 @@ program.command('ls')
     return require('./actions/ls').apply(this, args)
   })
 
+// dotenvx genexample
+program.command('genexample')
+  .description('generate .env.example')
+  .argument('[directory]', 'directory to generate from', '.')
+  .option('-f, --env-file <paths...>', 'path(s) to your env file(s)', '.env')
+  .action(function (...args) {
+    return require('./actions/ext/genexample').apply(this, args)
+  })
+
 // dotenvx gitignore
 program.command('gitignore')
   .description('append to .gitignore')
@@ -222,7 +231,7 @@ program.command('doctor', { hidden: true })
     return require('./actions/doctor').apply(this, args)
   })
 
-// dotenvx login
+// dotenvx login (compatibility alias for dotenvx armor login)
 program.command('login', { hidden: true })
   .description('log in to move keys off-device, share with your team, and audit access')
   .allowUnknownOption()
@@ -231,7 +240,7 @@ program.command('login', { hidden: true })
     return require('./actions/login').apply(this, args)
   })
 
-// dotenvx logout
+// dotenvx logout (compatibility alias for dotenvx armor logout)
 program.command('logout', { hidden: true })
   .description('log out of connected security features')
   .allowUnknownOption()
@@ -259,8 +268,6 @@ program.command('help [command]')
 // dotenvx armor
 program.addHelpText('after', ' ')
 program.addHelpText('after', 'Professional Security: ')
-program.addHelpText('after', '  login                    log in to move keys off-device, share with your team, and audit access')
-program.addHelpText('after', '  logout                   log out of connected security features')
 program.addHelpText('after', '  keychain                 ⌥ move private keys into macOS Keychain')
 program.addHelpText('after', '  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
 

package/src/db/session.js

@@ -226,19 +226,19 @@ class Session {
   //
   login (hostname, id, username, accessToken) {
     if (!hostname) {
-      throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx armor login]')
     }
 
     if (!id) {
-      throw new Error('DOTENVX_ARMOR_USER not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_USER not set. Run [dotenvx armor login]')
     }
 
     if (!username) {
-      throw new Error('DOTENVX_ARMOR_USERNAME not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_USERNAME not set. Run [dotenvx armor login]')
     }
 
     if (!accessToken) {
-      throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx armor login]')
     }
 
     const store = this.createStore()
@@ -252,15 +252,15 @@ class Session {
 
   logout (hostname, id, accessToken) {
     if (!hostname) {
-      throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx armor login]')
     }
 
     if (!id) {
-      throw new Error('DOTENVX_ARMOR_USER not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_USER not set. Run [dotenvx armor login]')
     }
 
     if (!accessToken) {
-      throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx login]')
+      throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx armor login]')
     }
 
     const store = this.openStore()

package/src/lib/services/genexample.js

@@ -45,7 +45,7 @@ class Genexample {
       const filepath = path.resolve(this.directory, envFilepath)
       if (!fsx.existsSync(filepath)) {
         const error = new Errors({ envFilepath, filepath }).missingEnvFile()
-        error.help = `? add it with [echo "HELLO=World" > ${envFilepath}] and then run [dotenvx ext genexample]`
+        error.help = `? add it with [echo "HELLO=World" > ${envFilepath}] and then run [dotenvx genexample]`
         throw error
       }