@dotenvx/dotenvx 2.2.2 → 2.3.0

package/CHANGELOG.md

@@ -2,7 +2,21 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.2.2...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.3.0...main)
+
+## [2.3.0](https://github.com/dotenvx/dotenvx/compare/v2.2.2...v2.3.0) (2026-07-08)
+
+### Added
+
+* Add `lock up` and `lock down` commands for password protecting private keys ([#875](https://github.com/dotenvx/dotenvx/pull/875))
+
+### Changed
+
+* BREAKING: Rename `keychain` commands to `native` to make way for windows and linux. ([#875](https://github.com/dotenvx/dotenvx/pull/875))
+
+### Removed
+
+* BREAKING: Remove `--no-ops`. Use `--no-armor`. ([#875](https://github.com/dotenvx/dotenvx/pull/875))
 
 ## [2.2.2](https://github.com/dotenvx/dotenvx/compare/v2.2.1...v2.2.2) (2026-07-08)
 

package/README.md

@@ -1385,12 +1385,12 @@ $ dotenvx run --token "$DOTENVX_ARMOR_TOKEN" -- yourcommand
 ```
 
 </details>
-<details><summary>`run --no-keychain`</summary><br>
+<details><summary>`run --no-native`</summary><br>
 
-Turn off macOS Keychain lookups.
+Turn off OS secret store lookups.
 
 ```sh
-$ dotenvx run --no-keychain -- yourcommand
+$ dotenvx run --no-native -- yourcommand
 ```
 
 </details>
@@ -1415,12 +1415,12 @@ World
 ```
 
 </details>
-<details><summary>`get KEY --no-keychain`</summary><br>
+<details><summary>`get KEY --no-native`</summary><br>
 
-Turn off macOS Keychain lookups for get.
+Turn off OS secret store lookups for get.
 
 ```sh
-$ dotenvx get HELLO --no-keychain
+$ dotenvx get HELLO --no-native
 ```
 
 </details>
@@ -1739,12 +1739,12 @@ set HELLO_PLAIN (.env)
 Keys ending in `_PLAIN` are not encrypted by `dotenvx set` or `dotenvx encrypt`.
 
 </details>
-<details><summary>`set KEY value --no-keychain`</summary><br>
+<details><summary>`set KEY value --no-native`</summary><br>
 
-Turn off macOS Keychain lookups for set.
+Turn off OS secret store lookups for set.
 
 ```sh
-$ dotenvx set HELLO Dotenvx --no-keychain
+$ dotenvx set HELLO Dotenvx --no-native
 ```
 
 </details>
@@ -1779,12 +1779,12 @@ $ dotenvx encrypt -f .env.production
 ```
 
 </details>
-<details><summary>`encrypt --no-keychain`</summary><br>
+<details><summary>`encrypt --no-native`</summary><br>
 
-Turn off macOS Keychain lookups for encrypt.
+Turn off OS secret store lookups for encrypt.
 
 ```sh
-$ dotenvx encrypt --no-keychain
+$ dotenvx encrypt --no-native
 ◈ encrypted (.env)
 ```
 
@@ -1918,12 +1918,12 @@ $ dotenvx decrypt
 ```
 
 </details>
-<details><summary>`decrypt --no-keychain`</summary><br>
+<details><summary>`decrypt --no-native`</summary><br>
 
-Turn off macOS Keychain lookups for decrypt.
+Turn off OS secret store lookups for decrypt.
 
 ```sh
-$ dotenvx decrypt --no-keychain
+$ dotenvx decrypt --no-native
 ◇ decrypted (.env)
 ```
 
@@ -2039,12 +2039,12 @@ $ dotenvx keypair
 ```
 
 </details>
-<details><summary>`keypair --no-keychain`</summary><br>
+<details><summary>`keypair --no-native`</summary><br>
 
-Turn off macOS Keychain lookups for keypair.
+Turn off OS secret store lookups for keypair.
 
 ```sh
-$ dotenvx keypair --no-keychain
+$ dotenvx keypair --no-native
 {"DOTENV_PUBLIC_KEY":"<publicKey>","DOTENV_PRIVATE_KEY":"<privateKey>"}
 ```
 
@@ -2323,52 +2323,93 @@ CMD ["/usr/local/bin/dotenvx", "run", "--", "node", "apps/backend/index.js"]
 ```
 
 </details>
-<details><summary>`keychain`</summary><br>
+<details><summary>`lock`</summary><br>
 
-Store private keys in macOS Keychain to keep them out of `.env.keys`.
+Lock private keys with a local passphrase to keep them protected inside `.env.keys`.
+
+```
+# example
+DOTENV_PRIVATE_KEY=locked:02f5b97ad58b49ae324cd4e7937bc19b251d006b31cacf46f789eeaf03f923cedc:AZIPDxKqjPLiGl5b4CqVGbR3CIBDUcqHthGaoeWLoUvxbTHJkj3jGoGWGaxFSDUJGQUmWDaExRzxKpVydYF_7qiWr1ecqksOFho5t3EMwKbqX2-y-LZO9K3a4SJaYAjDJXpn3NwG4vAt1oLmGA
+```
+
+</details>
+<details><summary>`lock up`</summary><br>
+
+Lock a private key in `.env.keys` with a local passphrase.
+
+```sh
+$ dotenvx lock up
+```
+
+Here's what a locked key looks like:
+
+```ini
+# .env.keys
+DOTENV_PRIVATE_KEY=locked:02f5b97ad58b49ae324cd4e7937bc19b251d006b31cacf46f789eeaf03f923cedc:AZIPDxKqjPLiGl5b4CqVGbR3CIBDUcqHthGaoeWLoUvxbTHJkj3jGoGWGaxFSDUJGQUmWDaExRzxKpVydYF_7qiWr1ecqksOFho5t3EMwKbqX2-y-LZO9K3a4SJaYAjDJXpn3NwG4vAt1oLmGA
+```
+
+Specify files with `-f` and `-fk`.
+
+```sh
+$ dotenvx lock up -f .env.production -fk .env.keys
+```
+
+</details>
+<details><summary>`lock down`</summary><br>
+
+Unlock a private key in `.env.keys` with its local passphrase.
+
+```sh
+$ dotenvx lock down
+```
+
+</details>
+<details><summary>`native`</summary><br>
+
+Move private keys into your OS secret store (macOS Keychain supported).
 
 Currently supported on macOS.
 
 </details>
-<details><summary>`keychain up`</summary><br>
+<details><summary>`native up`</summary><br>
 
-Move a private key from `.env.keys` into macOS Keychain.
+Move a private key from `.env.keys` into your OS secret store.
 
 ```sh
-$ dotenvx keychain up
+$ dotenvx native up
 ```
 
 Specify files with `-f` and `-fk`.
 
 ```sh
-$ dotenvx keychain up -f .env.production -fk .env.keys
+$ dotenvx native up -f .env.production -fk .env.keys
 ```
 
 </details>
-<details><summary>`keychain down`</summary><br>
+<details><summary>`native down`</summary><br>
 
-Move a private key from macOS Keychain back into `.env.keys`.
+Move a private key from your OS secret store back into `.env.keys`.
 
 ```sh
-$ dotenvx keychain down
+$ dotenvx native down
 ```
 
 </details>
-<details><summary>`keychain push`</summary><br>
+<details><summary>`native push`</summary><br>
 
-Copy a private key from `.env.keys` into macOS Keychain.
+Copy a private key from `.env.keys` into your OS secret store.
 
 ```sh
-$ dotenvx keychain push
+$ dotenvx native push
 ```
 
 </details>
-<details><summary>`keychain pull`</summary><br>
+<details><summary>`native pull`</summary><br>
 
-Copy a private key from macOS Keychain into `.env.keys`.
+Copy a private key from your OS secret store into `.env.keys`.
 
 ```sh
-$ dotenvx keychain pull
+$ dotenvx native pull
 ```
 
 </details>
@@ -2488,7 +2529,8 @@ Commands:
                      prevent including .env files in docker
  
 Professional Security: 
-  keychain                 ⌥ move private keys into macOS Keychain
+  lock                     ⊡ lock private keys with a local passphrase
+  native                   ⌥ move private keys into your OS secret store (macOS Keychain supported)
   armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]
 ```
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.2.2",
+  "version": "2.3.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/decrypt.js

@@ -4,12 +4,11 @@ const { logger } = require('./../../shared/logger')
 const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
-const normalizeArmorAliases = require('./normalizeArmorAliases')
 
 const decryptTransform = require('./../../lib/transforms/decrypt')
 
 async function decrypt () {
-  const options = normalizeArmorAliases(this.opts())
+  const options = this.opts()
   const spinner = await createSpinner({ ...options, text: 'decrypting' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
@@ -17,7 +16,7 @@ async function decrypt () {
   const envs = this.envs
   const sesh = new Session()
   const noArmor = options.armor === false || (await sesh.noArmor())
-  const noKeychain = options.keychain === false || options.noKeychain === true
+  const noKeychain = options.native === false || options.noNative === true
 
   let errorCount = 0
 

package/src/cli/actions/encrypt.js

@@ -6,10 +6,9 @@ const encryptTransform = require('./../../lib/transforms/encrypt')
 const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
-const normalizeArmorAliases = require('./normalizeArmorAliases')
 
 async function encryptAction () {
-  const options = normalizeArmorAliases(this.opts())
+  const options = this.opts()
   const spinner = await createSpinner({ ...options, text: 'encrypting' })
   const sesh = new Session()
 
@@ -21,7 +20,7 @@ async function encryptAction () {
   const fk = options.envKeysFile || '.env.keys'
   const noCreate = options.create === false
   const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
-  const noKeychain = options.keychain === false || options.noKeychain === true
+  const noKeychain = options.native === false || options.noNative === true
 
   let errorCount = 0
 

package/src/cli/actions/get.js

@@ -6,11 +6,10 @@ const catchAndLog = require('./../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
 const getResolver = require('./../../lib/resolvers/get')
-const normalizeArmorAliases = require('./normalizeArmorAliases')
 const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDotenvConfigConvention')
 
 async function get (key) {
-  const options = normalizeDotenvConfigConvention(normalizeArmorAliases(this.opts()))
+  const options = normalizeDotenvConfigConvention(this.opts())
   const spinner = await createSpinner({ ...options, text: 'decrypting' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
@@ -33,7 +32,7 @@ async function get (key) {
   try {
     const sesh = new Session()
     const noArmor = options.armor === false || (await sesh.noArmor())
-    const noKeychain = options.keychain === false || options.noKeychain === true
+    const noKeychain = options.native === false || options.noNative === true
     const { parsed, errors } = await getResolver({
       key,
       envs,

package/src/cli/actions/keychain/up.js

@@ -5,7 +5,7 @@ const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
 
 async function up () {
   const options = this.opts()
-  const spinner = await createSpinner({ ...options, text: 'keychaining' })
+  const spinner = await createSpinner({ ...options, text: 'storing' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
@@ -15,7 +15,7 @@ async function up () {
 
     if (spinner) spinner.stop()
     if (changed) {
-      logger.success(`⌥ keychained (${keyDisplay})`)
+      logger.success(`⌥ stored (${keyDisplay})`)
     } else {
       logger.info(`○ no change (${keyDisplay})`)
     }

package/src/cli/actions/keypair.js

@@ -3,10 +3,9 @@ const { logger } = require('./../../shared/logger')
 const keypairResolver = require('./../../lib/resolvers/keypair')
 const catchAndLog = require('./../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
-const normalizeArmorAliases = require('./normalizeArmorAliases')
 
 async function keypair (key) {
-  const options = normalizeArmorAliases(this.opts())
+  const options = this.opts()
   const spinner = await createSpinner({ ...options, text: 'retrieving' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
@@ -21,7 +20,7 @@ async function keypair (key) {
       envFile: options.envFile,
       envKeysFile: options.envKeysFile,
       armor: options.armor,
-      noKeychain: options.keychain === false || options.noKeychain === true,
+      noKeychain: options.native === false || options.noNative === true,
       token: options.token,
       command: process.argv.slice(2),
       onStatus: (text) => {

package/src/cli/actions/lock/down.js

@@ -0,0 +1,74 @@
+const crypto = require('crypto')
+
+const { logger } = require('../../../shared/logger')
+const LockDown = require('./../../../lib/services/lockDown')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+const prompts = require('../../../lib/helpers/prompts')
+
+function unlockedValue (lockedPrivateKey, passphrase) {
+  const parts = lockedPrivateKey.split(':')
+  const payload = Buffer.from(parts.slice(2).join(':'), 'base64url')
+  const version = payload.subarray(0, 1)[0]
+  const salt = payload.subarray(1, 17)
+  const iv = payload.subarray(17, 29)
+  const tag = payload.subarray(29, 45)
+  const ciphertext = payload.subarray(45)
+  const key = crypto.scryptSync(passphrase, salt, 32)
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv)
+
+  if (version !== 1) {
+    throw new Error('unsupported locked private key version')
+  }
+
+  decipher.setAuthTag(tag)
+
+  return Buffer.concat([
+    decipher.update(ciphertext),
+    decipher.final()
+  ]).toString('utf8')
+}
+
+async function down () {
+  const options = this.opts()
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  try {
+    const lockDown = new LockDown(options.envFile, options.envKeysFile)
+    const plan = lockDown.plan()
+    let results = plan.alreadyUnlocked
+
+    if (plan.locked.length > 0) {
+      const passphrase = await prompts.password({
+        message: 'passphrase',
+        prefix: '⊡',
+        separator: '='
+      }, {
+        input: process.stdin,
+        output: process.stderr
+      })
+
+      results = lockDown.run(lockedPrivateKey => unlockedValue(lockedPrivateKey, passphrase)).results
+    }
+
+    for (const result of results) {
+      const keyDisplay = armoredKeyDisplay(result.publicKeyValue) || result.privateKeyName
+
+      if (result.changed) {
+        logger.success(`⊡ unlocked (${keyDisplay})`)
+      } else {
+        logger.info(`○ no change (${keyDisplay})`)
+      }
+    }
+  } catch (error) {
+    if (error.code === 'PROMPT_CANCELLED') {
+      process.exit(130)
+      return
+    }
+
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = down
+module.exports.unlockedValue = unlockedValue

package/src/cli/actions/lock/up.js

@@ -0,0 +1,80 @@
+const crypto = require('crypto')
+
+const { logger } = require('../../../shared/logger')
+const LockUp = require('./../../../lib/services/lockUp')
+const armoredKeyDisplay = require('../../../lib/helpers/armoredKeyDisplay')
+const prompts = require('../../../lib/helpers/prompts')
+
+function lockedValue (privateKey, passphrase, publicKey) {
+  const salt = crypto.randomBytes(16)
+  const iv = crypto.randomBytes(12)
+  const key = crypto.scryptSync(passphrase, salt, 32)
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv)
+  const ciphertext = Buffer.concat([
+    cipher.update(privateKey, 'utf8'),
+    cipher.final()
+  ])
+  const tag = cipher.getAuthTag()
+  const payload = Buffer.concat([
+    Buffer.from([1]),
+    salt,
+    iv,
+    tag,
+    ciphertext
+  ]).toString('base64url')
+
+  return `locked:${publicKey}:${payload}`
+}
+
+async function up () {
+  const options = this.opts()
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  try {
+    const lockUp = new LockUp(options.envFile, options.envKeysFile)
+
+    const plan = lockUp.plan()
+    let results = plan.alreadyLocked.map(lockedPrivateKey => ({
+      changed: false,
+      privateKeyName: lockedPrivateKey.privateKeyName,
+      privateKeyValue: undefined,
+      lockedPrivateKeyValue: lockedPrivateKey.lockedPrivateKeyValue,
+      publicKeyValue: lockedPrivateKey.publicKeyValue,
+      alreadyLocked: true
+    }))
+
+    if (plan.matches.length > 0) {
+      const passphrase = await prompts.password({
+        message: 'passphrase',
+        prefix: '⊡',
+        separator: '='
+      }, {
+        input: process.stdin,
+        output: process.stderr
+      })
+
+      results = lockUp.run((privateKey, publicKey) => lockedValue(privateKey, passphrase, publicKey)).results
+    }
+
+    for (const result of results) {
+      const keyDisplay = armoredKeyDisplay(result.publicKeyValue) || result.privateKeyName
+
+      if (result.changed) {
+        logger.success(`⊡ locked (${keyDisplay})`)
+      } else {
+        logger.info(`○ no change (${keyDisplay})`)
+      }
+    }
+  } catch (error) {
+    if (error.code === 'PROMPT_CANCELLED') {
+      process.exit(130)
+      return
+    }
+
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = up
+module.exports.lockedValue = lockedValue

package/src/cli/actions/run.js

@@ -6,7 +6,6 @@ const envsResolver = require('./../../lib/resolvers/envs')
 const catchAndLog = require('./../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
-const normalizeArmorAliases = require('./normalizeArmorAliases')
 const normalizeDotenvConfigQuiet = require('../../lib/helpers/normalizeDotenvConfigQuiet')
 const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDotenvConfigConvention')
 
@@ -47,7 +46,7 @@ function uniqueInjectedKeys (processedEnvs) {
 }
 
 async function run () {
-  const options = normalizeDotenvConfigConvention(normalizeDotenvConfigQuiet(normalizeArmorAliases(this.opts())))
+  const options = normalizeDotenvConfigConvention(normalizeDotenvConfigQuiet(this.opts()))
 
   let commandArgs = this.args
   if (commandArgs.length < 1) {
@@ -63,7 +62,7 @@ async function run () {
 
   const sesh = new Session()
   const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
-  const noKeychain = options.keychain === false || options.noKeychain === true
+  const noKeychain = options.native === false || options.noNative === true
 
   if (commandArgs.length < 1) {
     if (spinner) spinner.stop()

package/src/cli/actions/set.js

@@ -8,10 +8,9 @@ const createSpinner = require('../../lib/helpers/createSpinner')
 const Errors = require('../../lib/helpers/errors')
 const prompts = require('../../lib/helpers/prompts')
 const Session = require('../../db/session')
-const normalizeArmorAliases = require('./normalizeArmorAliases')
 
 async function set (key, value) {
-  const options = normalizeArmorAliases(this.opts())
+  const options = this.opts()
 
   let encrypt = true
   let settingMessage = 'encrypting'
@@ -65,7 +64,7 @@ async function set (key, value) {
   const fk = options.envKeysFile || '.env.keys'
   const noCreate = options.create === false
   const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
-  const noKeychain = options.keychain === false || options.noKeychain === true
+  const noKeychain = options.native === false || options.noNative === true
 
   let errorCount = 0
 

package/src/cli/commands/armor.js

@@ -3,7 +3,7 @@ const Session = require('./../../db/session')
 
 function configureArmorCommand (armor) {
   armor
-    .description('move private keys off-device')
+    .description('move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
     .allowUnknownOption()
     .argument('[command]', 'dotenvx-armor command')
     .argument('[args...]', 'dotenvx-armor command arguments')

package/src/cli/commands/lock.js

@@ -0,0 +1,27 @@
+function configureLockCommand (lock) {
+  lock
+    .description('lock private keys with a local passphrase')
+    .action(function () {
+      this.help()
+    })
+
+  const upAction = require('./../actions/lock/up')
+  lock
+    .command('up')
+    .description('lock key in .env.keys')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
+    .action(upAction)
+
+  const downAction = require('./../actions/lock/down')
+  lock
+    .command('down')
+    .description('unlock key in .env.keys')
+    .option('-f, --env-file <path>', 'path to your env file')
+    .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
+    .action(downAction)
+
+  return lock
+}
+
+module.exports = configureLockCommand

package/src/cli/commands/{keychain.js → native.js}

@@ -1,43 +1,43 @@
-function configureKeychainCommand (keychain) {
-  keychain
-    .description('store private keys in macOS Keychain')
+function configureNativeCommand (native) {
+  native
+    .description('move private keys into your OS secret store (macOS Keychain supported)')
     .action(function () {
       this.help()
     })
 
   const upAction = require('./../actions/keychain/up')
-  keychain
+  native
     .command('up')
-    .description('store key in macOS Keychain')
+    .description('store key in OS secret store')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
     .action(upAction)
 
   const downAction = require('./../actions/keychain/down')
-  keychain
+  native
     .command('down')
-    .description('move key from macOS Keychain to .env.keys')
+    .description('move key from OS secret store to .env.keys')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
     .action(downAction)
 
   const pushAction = require('./../actions/keychain/push')
-  keychain
+  native
     .command('push')
-    .description('push key to macOS Keychain from .env.keys')
+    .description('push key to OS secret store from .env.keys')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
     .action(pushAction)
 
   const pullAction = require('./../actions/keychain/pull')
-  keychain
+  native
     .command('pull')
-    .description('pull key from macOS Keychain into .env.keys')
+    .description('pull key from OS secret store into .env.keys')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
     .action(pullAction)
 
-  return keychain
+  return native
 }
 
-module.exports = configureKeychainCommand
+module.exports = configureNativeCommand

package/src/cli/dotenvx.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 /* c8 ignore start */
-const { Command, Option } = require('commander')
+const { Command } = require('commander')
 const program = new Command()
 
 const { setLogLevel, logger } = require('../shared/logger')
@@ -73,8 +73,7 @@ program.command('run')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
   .option('--token <token>', 'set Armor ⛨ token')
   .option('--no-armor', 'disable Dotenvx Armor features')
-  .option('--no-keychain', 'disable macOS Keychain features')
-  .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
+  .option('--no-native', 'disable OS secret store features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/run').apply(this, args)
@@ -97,8 +96,7 @@ program.command('get')
   .option('--pp', 'pretty print output (alias)')
   .option('--format <type>', 'format of the output (json, shell, colon, eval)', 'json')
   .option('--no-armor', 'disable Dotenvx Armor features')
-  .option('--no-keychain', 'disable macOS Keychain features')
-  .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
+  .option('--no-native', 'disable OS secret store features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/get').apply(this, args)
@@ -118,8 +116,7 @@ program.command('set')
   .option('-p, --plain', 'store value as plain text', false)
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable Dotenvx Armor features')
-  .option('--no-keychain', 'disable macOS Keychain features')
-  .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
+  .option('--no-native', 'disable OS secret store features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/set').apply(this, args)
@@ -136,8 +133,7 @@ program.command('encrypt')
   .option('--token <token>', 'set Armor ⛨ token')
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable Dotenvx Armor features')
-  .option('--no-keychain', 'disable macOS Keychain features')
-  .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
+  .option('--no-native', 'disable OS secret store features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/encrypt').apply(this, args)
@@ -151,8 +147,7 @@ program.command('decrypt')
   .option('-k, --key <keys...>', 'keys(s) to decrypt (default: all keys in file)')
   .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from decryption (default: none)')
   .option('--no-armor', 'disable Dotenvx Armor features')
-  .option('--no-keychain', 'disable macOS Keychain features')
-  .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
+  .option('--no-native', 'disable OS secret store features')
   .option('--stdout', 'send to stdout')
   .action(function (...args) {
     this.envs = envs
@@ -167,8 +162,7 @@ program.command('keypair')
   .option('-f, --env-file <path>', 'path(s) to your env file(s)')
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('--no-armor', 'disable Dotenvx Armor features')
-  .option('--no-keychain', 'disable macOS Keychain features')
-  .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())
+  .option('--no-native', 'disable OS secret store features')
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
   .option('--format <type>', 'format of the output (json, shell, colon)', 'json')
@@ -268,11 +262,15 @@ program.command('help [command]')
 // dotenvx armor
 program.addHelpText('after', ' ')
 program.addHelpText('after', 'Professional Security: ')
-program.addHelpText('after', '  keychain                 ⌥ move private keys into macOS Keychain')
+program.addHelpText('after', '  lock                     ⊡ lock private keys with a local passphrase')
+program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store (macOS Keychain supported)')
 program.addHelpText('after', '  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
 
-// dotenvx keychain
-require('./commands/keychain')(program.command('keychain', { hidden: true }))
+// dotenvx native
+require('./commands/native')(program.command('native', { hidden: true }))
+
+// dotenvx lock
+require('./commands/lock')(program.command('lock', { hidden: true }))
 
 // dotenvx armor
 require('./commands/armor')(program.command('armor', { hidden: true }))

package/src/lib/helpers/errors.js

@@ -7,6 +7,7 @@ const ISSUE_BY_CODE = {
   DANGEROUS_DEPENDENCY_HOIST: 'https://github.com/dotenvx/dotenvx/issues/622',
   INVALID_COLOR: 'must be 256 colors',
   INVALID_CONVENTION: 'https://github.com/dotenvx/dotenvx/issues/761',
+  INVALID_PASSPHRASE: 'try again with the correct passphrase',
   INVALID_PRIVATE_KEY: 'https://github.com/dotenvx/dotenvx/issues/465',
   INVALID_PUBLIC_KEY: 'https://github.com/dotenvx/dotenvx/issues/756',
   MALFORMED_ENCRYPTED_DATA: 'https://github.com/dotenvx/dotenvx/issues/467',
@@ -157,6 +158,18 @@ class Errors {
     return e
   }
 
+  invalidPassphrase () {
+    const code = 'INVALID_PASSPHRASE'
+    const message = `[${code}] could not unlock ${this.privateKeyName || 'DOTENV_PRIVATE_KEY'} using passphrase`
+    const help = `fix: [${ISSUE_BY_CODE[code]}]`
+
+    const e = new Error(message)
+    e.code = code
+    e.help = help
+    e.messageWithHelp = `${message}. ${help}`
+    return e
+  }
+
   malformedEncryptedData () {
     const code = 'MALFORMED_ENCRYPTED_DATA'
     const message = `[${code}] could not decrypt ${this.key} because encrypted data appears malformed`

package/src/lib/helpers/executeDynamic.js

@@ -42,20 +42,6 @@ function armorBanner () {
 }
 
 function dynamicAttempts (command, forwardedArgs) {
-  if (command === 'vlt') {
-    return [
-      ['dotenvx-armor', forwardedArgs],
-      ['dotenvx-ops', forwardedArgs]
-    ]
-  }
-
-  if (command === 'ops') {
-    return [
-      ['dotenvx-armor', forwardedArgs],
-      ['dotenvx-ops', forwardedArgs]
-    ]
-  }
-
   return [[`dotenvx-${command}`, forwardedArgs]]
 }
 
@@ -85,11 +71,7 @@ function executeDynamic (program, command, rawArgs) {
   }
 
   if (result.error) {
-    if (command === 'vlt') {
-      console.log(armorBanner())
-    } else if (command === 'ops') {
-      console.log(armorBanner())
-    } else if (command === 'armor') {
+    if (command === 'armor') {
       console.log(armorBanner())
     } else {
       logger.info(`error: unknown command '${command}'`)

package/src/lib/main.d.ts

@@ -180,20 +180,12 @@ export interface DotenvConfigOptions {
   noArmor?: boolean;
 
   /**
-   * Turn off macOS Keychain features.
+   * Turn off OS secret store features.
    *
    * @default false
-   * @example require('@dotenvx/dotenvx').config({ noKeychain: true })
+   * @example require('@dotenvx/dotenvx').config({ noNative: true })
    */
-  noKeychain?: boolean;
-
-  /**
-   * Turn off Dotenvx Armor features. Alias for `noArmor`.
-   *
-   * @default false
-   * @example require('@dotenvx/dotenvx').config({ noOps: true })
-   */
-  noOps?: boolean;
+  noNative?: boolean;
 
 }
 
@@ -271,20 +263,12 @@ export interface SetOptions {
   noArmor?: boolean;
 
   /**
-   * Turn off macOS Keychain features.
+   * Turn off OS secret store features.
    *
    * @default false
-   * @example require('@dotenvx/dotenvx').set(key, value, { noKeychain: true })
+   * @example require('@dotenvx/dotenvx').set(key, value, { noNative: true })
    */
-  noKeychain?: boolean;
-
-  /**
-   * Turn off Dotenvx Armor features. Alias for `noArmor`.
-   *
-   * @default false
-   * @example require('@dotenvx/dotenvx').set(key, value, { noOps: true })
-   */
-  noOps?: boolean;
+  noNative?: boolean;
 
 }
 
@@ -364,20 +348,12 @@ export interface GetOptions {
   noArmor?: boolean;
 
   /**
-   * Turn off macOS Keychain features.
-   *
-   * @default false
-   * @example require('@dotenvx/dotenvx').get('KEY', { noKeychain: true })
-   */
-  noKeychain?: boolean;
-
-  /**
-   * Turn off Dotenvx Armor features. Alias for `noArmor`.
+   * Turn off OS secret store features.
    *
    * @default false
-   * @example require('@dotenvx/dotenvx').get('KEY', { noOps: true })
+   * @example require('@dotenvx/dotenvx').get('KEY', { noNative: true })
    */
-  noOps?: boolean;
+  noNative?: boolean;
 
 }
 

package/src/lib/main.js

@@ -380,11 +380,11 @@ const ls = function (directory, envFile, excludeEnvFile) {
 
 function resolveNoArmor (options = {}) {
   const sesh = new Session()
-  return options.noArmor === true || options.noOps === true || (!options.token && sesh.noArmorSync())
+  return options.noArmor === true || (!options.token && sesh.noArmorSync())
 }
 
 function resolveNoKeychain (options = {}) {
-  return options.noKeychain === true || options.keychain === false
+  return options.noNative === true || options.native === false
 }
 
 module.exports = {
@@ -395,7 +395,7 @@ module.exports = {
   set,
   get,
   ls,
-  // expose for libs depending on @dotenvx/dotenvx - like dotenvx-ops
+  // expose for libs depending on @dotenvx/dotenvx
   setLogLevel,
   logger,
   getColor,

package/src/lib/providers/index.js

@@ -46,7 +46,7 @@ function armorProviderForOptions (options) {
 function useKeychain (options) {
   if (process.platform !== 'darwin') return false
   if (process.env.CI) return false
-  return options.noKeychain !== true && options.keychain !== false
+  return options.noNative !== true && options.native !== false && options.noKeychain !== true
 }
 
 function useArmor (options, noArmor) {

package/src/lib/services/keychainPull.js

@@ -29,7 +29,7 @@ class KeychainPull {
     try {
       privateKey = execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
     } catch {
-      throw new Error(`[NOT_FOUND] private key not found in macOS Keychain (${armoredKeyDisplay(publicKey)}). fix: [dotenvx keychain up]`)
+      throw new Error(`[NOT_FOUND] private key not found in macOS Keychain (${armoredKeyDisplay(publicKey)}). fix: [dotenvx native up]`)
     }
 
     const result = upsertEnvKey(privateKeyName, privateKey, envKeysFile)

package/src/lib/services/lockDown.js

@@ -0,0 +1,157 @@
+const fs = require('fs')
+const { derive, publickeys, scan } = require('@dotenvx/primitives')
+
+const Errors = require('../helpers/errors')
+const upsertEnvKey = require('../helpers/upsertEnvKey')
+
+function latestValues (parsed) {
+  const result = {}
+
+  for (const [key, values] of Object.entries(parsed)) {
+    result[key] = values[values.length - 1]
+  }
+
+  return result
+}
+
+function lockedCandidates (keysSrc) {
+  const { parsed } = scan(keysSrc)
+  const values = latestValues(parsed)
+  const candidates = []
+
+  for (const [privateKeyName, privateKey] of Object.entries(values)) {
+    if (!privateKeyName.startsWith('DOTENV_PRIVATE_KEY')) continue
+    if (!privateKey.startsWith('locked:')) continue
+
+    const parts = privateKey.split(':')
+    if (parts.length < 3) continue
+
+    candidates.push({
+      privateKeyName,
+      lockedPrivateKeyValue: privateKey,
+      publicKeyValue: parts[1]
+    })
+  }
+
+  return candidates
+}
+
+function privateKeyring (keysSrc) {
+  const { parsed } = scan(keysSrc)
+  const values = latestValues(parsed)
+  const keyring = {}
+
+  for (const [privateKeyName, privateKey] of Object.entries(values)) {
+    if (!privateKeyName.startsWith('DOTENV_PRIVATE_KEY')) continue
+    if (privateKey.startsWith('locked:')) continue
+
+    try {
+      const publicKey = derive(privateKey)
+      keyring[publicKey] = { privateKeyName, privateKeyValue: privateKey }
+    } catch {}
+  }
+
+  return keyring
+}
+
+class LockDown {
+  constructor (envFile = '.env', envKeysFile = '.env.keys') {
+    this.envFile = envFile
+    this.envKeysFile = envKeysFile
+  }
+
+  lockedCandidates () {
+    const keysSrc = fs.readFileSync(this.envKeysFile, 'utf8')
+    const candidates = lockedCandidates(keysSrc)
+
+    if (candidates.length < 1) {
+      throw new Errors({ key: 'DOTENV_PRIVATE_KEY' }).missingKey()
+    }
+
+    return candidates
+  }
+
+  plan () {
+    const envSrc = fs.readFileSync(this.envFile, 'utf8')
+    const keysSrc = fs.readFileSync(this.envKeysFile, 'utf8')
+    const publicKeyValues = publickeys(envSrc)
+    const lockedByPublicKey = {}
+    const plaintextByPublicKey = privateKeyring(keysSrc)
+    const locked = []
+    const alreadyUnlocked = []
+
+    for (const lockedPrivateKey of lockedCandidates(keysSrc)) {
+      lockedByPublicKey[lockedPrivateKey.publicKeyValue] = lockedPrivateKey
+    }
+
+    for (const publicKey of publicKeyValues) {
+      const lockedPrivateKey = lockedByPublicKey[publicKey]
+      if (lockedPrivateKey) {
+        locked.push(lockedPrivateKey)
+        continue
+      }
+
+      const privateKey = plaintextByPublicKey[publicKey]
+      if (privateKey) {
+        alreadyUnlocked.push({
+          changed: false,
+          privateKeyName: privateKey.privateKeyName,
+          privateKeyValue: privateKey.privateKeyValue,
+          lockedPrivateKeyValue: undefined,
+          publicKeyValue: publicKey
+        })
+      }
+    }
+
+    if (locked.length < 1 && alreadyUnlocked.length < 1) {
+      throw new Errors({ key: 'DOTENV_PRIVATE_KEY' }).missingKey()
+    }
+
+    return { locked, alreadyUnlocked }
+  }
+
+  run (unlockPrivateKey) {
+    const { locked, alreadyUnlocked } = this.plan()
+    const results = [...alreadyUnlocked]
+
+    if (locked.length > 0 && !unlockPrivateKey) {
+      throw new Error('missing unlock private key function')
+    }
+
+    for (const lockedPrivateKey of locked) {
+      let privateKeyValue
+
+      try {
+        privateKeyValue = unlockPrivateKey(lockedPrivateKey.lockedPrivateKeyValue)
+      } catch (error) {
+        throw new Errors({ privateKeyName: lockedPrivateKey.privateKeyName }).invalidPassphrase()
+      }
+
+      const publicKeyValue = derive(privateKeyValue)
+
+      if (publicKeyValue !== lockedPrivateKey.publicKeyValue) continue
+
+      const result = upsertEnvKey(lockedPrivateKey.privateKeyName, privateKeyValue, this.envKeysFile)
+
+      results.push({
+        changed: result.changed,
+        privateKeyName: lockedPrivateKey.privateKeyName,
+        privateKeyValue,
+        lockedPrivateKeyValue: lockedPrivateKey.lockedPrivateKeyValue,
+        publicKeyValue
+      })
+    }
+
+    if (results.length < 1) {
+      throw new Errors({ key: 'DOTENV_PRIVATE_KEY' }).missingKey()
+    }
+
+    return {
+      changed: results.some(result => result.changed),
+      results
+    }
+  }
+}
+
+module.exports = LockDown
+module.exports.lockedCandidates = lockedCandidates

package/src/lib/services/lockUp.js

@@ -0,0 +1,150 @@
+const fs = require('fs')
+const { derive, publickeys, scan } = require('@dotenvx/primitives')
+
+const Errors = require('../helpers/errors')
+const upsertEnvKey = require('../helpers/upsertEnvKey')
+
+function latestValues (parsed) {
+  const result = {}
+
+  for (const [key, values] of Object.entries(parsed)) {
+    result[key] = values[values.length - 1]
+  }
+
+  return result
+}
+
+function privateKeyring (keysSrc) {
+  const { parsed } = scan(keysSrc)
+  const values = latestValues(parsed)
+  const keyring = {}
+
+  for (const [privateKeyName, privateKey] of Object.entries(values)) {
+    if (!privateKeyName.startsWith('DOTENV_PRIVATE_KEY')) continue
+
+    try {
+      const publicKey = derive(privateKey)
+      keyring[publicKey] = { privateKeyName, privateKeyValue: privateKey }
+    } catch {}
+  }
+
+  return keyring
+}
+
+function lockedKeyring (keysSrc) {
+  const { parsed } = scan(keysSrc)
+  const values = latestValues(parsed)
+  const keyring = {}
+
+  for (const [privateKeyName, privateKey] of Object.entries(values)) {
+    if (!privateKeyName.startsWith('DOTENV_PRIVATE_KEY')) continue
+    if (!privateKey.startsWith('locked:')) continue
+
+    const parts = privateKey.split(':')
+    if (parts.length < 3) continue
+
+    const publicKey = parts[1]
+    keyring[publicKey] = {
+      privateKeyName,
+      lockedPrivateKeyValue: privateKey,
+      publicKeyValue: publicKey
+    }
+  }
+
+  return keyring
+}
+
+class LockUp {
+  constructor (envFile = '.env', envKeysFile = '.env.keys') {
+    this.envFile = envFile
+    this.envKeysFile = envKeysFile
+  }
+
+  plan () {
+    const envFile = this.envFile
+    const envKeysFile = this.envKeysFile
+
+    const envSrc = fs.readFileSync(envFile, 'utf8')
+    const keysSrc = fs.readFileSync(envKeysFile, 'utf8')
+    const ring = privateKeyring(keysSrc)
+    const lockedRing = lockedKeyring(keysSrc)
+    const matches = []
+    const alreadyLocked = []
+
+    for (const publicKey of publickeys(envSrc)) {
+      const privateKey = ring[publicKey]
+      if (privateKey) {
+        matches.push({
+          privateKeyName: privateKey.privateKeyName,
+          privateKeyValue: privateKey.privateKeyValue,
+          publicKeyValue: publicKey
+        })
+        continue
+      }
+
+      const lockedPrivateKey = lockedRing[publicKey]
+      if (lockedPrivateKey) {
+        alreadyLocked.push(lockedPrivateKey)
+      }
+    }
+
+    if (matches.length < 1 && alreadyLocked.length < 1) {
+      throw new Errors({ key: 'DOTENV_PRIVATE_KEY' }).missingKey()
+    }
+
+    return { matches, alreadyLocked }
+  }
+
+  matches () {
+    const { matches } = this.plan()
+
+    if (matches.length < 1) {
+      throw new Errors({ key: 'DOTENV_PRIVATE_KEY' }).missingKey()
+    }
+
+    return matches
+  }
+
+  run (lockPrivateKey) {
+    if (!lockPrivateKey) {
+      throw new Error('missing lock private key function')
+    }
+
+    const envKeysFile = this.envKeysFile
+    const results = []
+
+    const { matches, alreadyLocked } = this.plan()
+
+    for (const privateKey of matches) {
+      const lockedPrivateKey = lockPrivateKey(privateKey.privateKeyValue, privateKey.publicKeyValue)
+      const result = upsertEnvKey(privateKey.privateKeyName, lockedPrivateKey, envKeysFile)
+
+      results.push({
+        changed: result.changed,
+        privateKeyName: privateKey.privateKeyName,
+        privateKeyValue: privateKey.privateKeyValue,
+        lockedPrivateKeyValue: lockedPrivateKey,
+        publicKeyValue: privateKey.publicKeyValue
+      })
+    }
+
+    for (const lockedPrivateKey of alreadyLocked) {
+      results.push({
+        changed: false,
+        privateKeyName: lockedPrivateKey.privateKeyName,
+        privateKeyValue: undefined,
+        lockedPrivateKeyValue: lockedPrivateKey.lockedPrivateKeyValue,
+        publicKeyValue: lockedPrivateKey.publicKeyValue,
+        alreadyLocked: true
+      })
+    }
+
+    return {
+      changed: results.some(result => result.changed),
+      results
+    }
+  }
+}
+
+module.exports = LockUp
+module.exports.privateKeyring = privateKeyring

package/src/cli/actions/normalizeArmorAliases.js

@@ -1,9 +0,0 @@
-function normalizeArmorAliases (options) {
-  if (options.ops === false) {
-    options.armor = false
-  }
-
-  return options
-}
-
-module.exports = normalizeArmorAliases