@dotenvx/dotenvx 2.21.0 → 2.23.0

package/CHANGELOG.md

@@ -2,7 +2,28 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.21.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.23.0...main)
+
+## [2.23.0](https://github.com/dotenvx/dotenvx/compare/v2.22.0...v2.23.0) (2026-08-31)
+
+### Added
+
+* Support comma-separated env file paths with `-f` and the `config({ path })` option. Example: `dotenvx run -f .env.local,.env -- node index.js`
+* Add `DOTENV_PATH` (or `DOTENV_F`) to support the same. Example: `DOTENV_PATH=.env.local,.env`
+
+### Changed
+
+* Rename `DOTENV_CONFIG_*` variables to `DOTENV_CONVENTION`, `DOTENV_IGNORE`, and `DOTENV_QUIET`, while retaining their existing `DOTENV_CONFIG_*` names as fallbacks
+
+## [2.22.0](https://github.com/dotenvx/dotenvx/compare/v2.21.0...v2.22.0) (2026-08-27)
+
+### Added
+
+* Install verified binaries directly from GitHub Releases ([#956](https://github.com/dotenvx/dotenvx/pull/956))
+
+### Changed
+
+* Fall back to `~/.local/bin` when `/usr/local/bin` is not writable ([#955](https://github.com/dotenvx/dotenvx/pull/955))
 
 ## [2.21.0](https://github.com/dotenvx/dotenvx/compare/v2.20.1...v2.21.0) (2026-08-10)
 

package/README.md

@@ -122,7 +122,7 @@ Hello World # with dotenvx
 > :-D
 ```
 
-see [quickstart guides](https://dotenvx.com/docs/quickstart)
+see [quickstart guides](https://dotenvx.com/docs/quickstarts)
 
 More examples
 
@@ -186,7 +186,7 @@ $ dotenvx run --redact -- agent -p --force 'Run `dotenvx get HELLO` and echo bac
 Hello [REDACTED]
 ```
 
-see [Cursor redaction guide](https://dotenvx.com/docs/secrets-in-cursor)
+see [Cursor redaction guide](https://dotenvx.com/docs/cursor)
 
 </details>
 <details><summary>1Password 🔐</summary><br>
@@ -199,7 +199,7 @@ $ dotenvx run -- sh -c 'echo Hello $HELLO'
 Hello World
 ```
 
-see [1Password guide](https://dotenvx.com/docs/secrets-in-1password)
+see [1Password guide](https://dotenvx.com/docs/1password)
 
 </details>
 <details><summary>Bitwarden 🛡️</summary><br>
@@ -272,7 +272,7 @@ export async function GET() {
 }
 ```
 
-see [astro guide](https://dotenvx.com/docs/secrets-in-astro)
+see [astro guide](https://dotenvx.com/docs/astro)
 
 </details>
 <details><summary>Expo 🧭</summary><br>
@@ -292,7 +292,7 @@ Preface Expo scripts with `dotenvx run --`.
 }
 ```
 
-see [expo guide](https://dotenvx.com/docs/secrets-in-expo)
+see [expo guide](https://dotenvx.com/docs/expo)
 
 </details>
 <details><summary>Next.js ▲</summary><br>
@@ -413,7 +413,7 @@ $ dotenvx run -- python3 index.py
 Hello World
 ```
 
-see [extended python guide](https://dotenvx.com/docs/quickstart)
+see [extended python guide](https://dotenvx.com/docs/python)
 
 </details>
 <details><summary>PHP 🐘</summary><br>
@@ -426,7 +426,7 @@ $ dotenvx run -- php index.php
 Hello World
 ```
 
-see [extended php guide](https://dotenvx.com/docs/quickstart)
+see [extended php guide](https://dotenvx.com/docs/php)
 
 </details>
 <details><summary>Ruby 💎</summary><br>
@@ -439,7 +439,7 @@ $ dotenvx run -- ruby index.rb
 Hello World
 ```
 
-see [extended ruby guide](https://dotenvx.com/docs/quickstart)
+see [extended ruby guide](https://dotenvx.com/docs/ruby)
 
 </details>
 <details><summary>Go 🐹</summary><br>
@@ -452,7 +452,7 @@ $ dotenvx run -- go run main.go
 Hello World
 ```
 
-see [extended go guide](https://dotenvx.com/docs/quickstart)
+see [extended go guide](https://dotenvx.com/docs/go)
 
 </details>
 <details><summary>Rust 🦀</summary><br>
@@ -465,7 +465,7 @@ $ dotenvx run -- cargo run
 Hello World
 ```
 
-see [extended rust guide](https://dotenvx.com/docs/quickstart)
+see [extended rust guide](https://dotenvx.com/docs/rust)
 
 </details>
 <details><summary>Java ☕️</summary><br>
@@ -552,7 +552,7 @@ $ dotenvx run -- bin/rails s
 $ dotenvx run -- php artisan serve
 ```
 
-see [framework guides](https://dotenvx.com/docs#frameworks)
+see [framework guides](https://dotenvx.com/docs/quickstarts)
 
 </details>
 <details><summary>Docker 🐳</summary><br>
@@ -570,7 +570,7 @@ RUN curl -fsS https://dotenvx.sh/install.sh | sh
 CMD ["/usr/local/bin/dotenvx", "run", "--", "echo", "Hello $HELLO"]
 ```
 
-see [docker guide](https://dotenvx.com/docs/platforms/docker)
+see [docker guide](https://dotenvx.com/docs/docker)
 
 </details>
 <details><summary>CI/CDs 🐙</summary><br>
@@ -592,7 +592,7 @@ jobs:
         DOTENV_KEY: ${{ secrets.DOTENV_KEY }}
 ```
 
-see [github actions guide](https://dotenvx.com/docs/cis/github-actions)
+see [github actions guide](https://dotenvx.com/docs/github-actions)
 
 </details>
 <details><summary>Platforms</summary><br>
@@ -608,7 +608,7 @@ RUN curl -fsS https://dotenvx.sh | sh
 npm install @dotenvx/dotenvx --save
 ```
 
-see [platform guides](https://dotenvx.com/docs#platforms)
+see [platform guides](https://dotenvx.com/docs/platforms)
 
 </details>
 <details><summary>Process Managers</summary><br>
@@ -620,7 +620,7 @@ see [platform guides](https://dotenvx.com/docs#platforms)
 },
 ```
 
-see [process manager guides](https://dotenvx.com/docs#process-managers)
+see [process manager guides](https://dotenvx.com/docs/process-managers/pm2)
 
 </details>
 <details><summary>npx</summary><br>
@@ -814,10 +814,10 @@ $ dotenvx run -f .env.production --quiet -- node index.js
 Hello production
 ```
 
-You can also set `DOTENV_CONFIG_QUIET=true`.
+You can also set `DOTENV_QUIET=true`.
 
 ```sh
-$ DOTENV_CONFIG_QUIET=true dotenvx run -f .env.production -- node index.js
+$ DOTENV_QUIET=true dotenvx run -f .env.production -- node index.js
 Hello production
 ```
 
@@ -1530,10 +1530,10 @@ $ dotenvx run -f .env.production --quiet -- node index.js
 Hello production
 ```
 
-You can also set `DOTENV_CONFIG_QUIET=true`.
+You can also set `DOTENV_QUIET=true`.
 
 ```sh
-$ DOTENV_CONFIG_QUIET=true dotenvx run -f .env.production -- node index.js
+$ DOTENV_QUIET=true dotenvx run -f .env.production -- node index.js
 Hello production
 ```
 
@@ -1603,10 +1603,10 @@ $ dotenvx run -f .env.missing --ignore=MISSING_ENV_FILE -- node index.js
 ...
 ```
 
-You can also set `DOTENV_CONFIG_IGNORE="MISSING_ENV_FILE"`. It is parsed as a comma-separated list.
+You can also set `DOTENV_IGNORE="MISSING_ENV_FILE"`. It is parsed as a comma-separated list.
 
 ```sh
-$ DOTENV_CONFIG_IGNORE="MISSING_ENV_FILE,OTHER_ERROR_CODE" dotenvx run -f .env.missing -- node index.js
+$ DOTENV_IGNORE="MISSING_ENV_FILE,OTHER_ERROR_CODE" dotenvx run -f .env.missing -- node index.js
 ```
 </details>
 <details><summary>`run --convention=nextjs`</summary><br>
@@ -1625,10 +1625,10 @@ $ dotenvx run --convention=nextjs -- node index.js
 Hello development local
 ```
 
-You can also set `DOTENV_CONFIG_CONVENTION=nextjs`.
+You can also set `DOTENV_CONVENTION=nextjs`.
 
 ```sh
-$ DOTENV_CONFIG_CONVENTION=nextjs dotenvx run -- node index.js
+$ DOTENV_CONVENTION=nextjs dotenvx run -- node index.js
 [dotenvx@1.X.X] injecting env (1) from .env.development.local, .env.local, .env.development, .env
 Hello development local
 ```
@@ -1663,10 +1663,10 @@ $ NODE_ENV=development dotenvx run --convention=flow -- node index.js
 Hello development local
 ```
 
-You can also set `DOTENV_CONFIG_CONVENTION=flow`.
+You can also set `DOTENV_CONVENTION=flow`.
 
 ```sh
-$ NODE_ENV=development DOTENV_CONFIG_CONVENTION=flow dotenvx run -- node index.js
+$ NODE_ENV=development DOTENV_CONVENTION=flow dotenvx run -- node index.js
 [dotenvx@1.X.X] injecting env (1) from .env.development.local, .env.development, .env.local, .env
 Hello development local
 ```
@@ -1794,10 +1794,10 @@ Ignore multiple error codes by separating them with spaces.
 $ dotenvx get HELLO --ignore=MISSING_ENV_FILE MISSING_KEY
 ```
 
-You can also set `DOTENV_CONFIG_IGNORE`. Its value is a comma-separated list.
+You can also set `DOTENV_IGNORE`. Its value is a comma-separated list.
 
 ```sh
-$ DOTENV_CONFIG_IGNORE=MISSING_ENV_FILE,OTHER dotenvx get HELLO
+$ DOTENV_IGNORE=MISSING_ENV_FILE,OTHER dotenvx get HELLO
 ```
 
 </details>
@@ -1887,10 +1887,10 @@ $ dotenvx get HELLO --convention=nextjs
 development local
 ```
 
-You can also set `DOTENV_CONFIG_CONVENTION=nextjs`.
+You can also set `DOTENV_CONVENTION=nextjs`.
 
 ```sh
-$ DOTENV_CONFIG_CONVENTION=nextjs dotenvx get HELLO
+$ DOTENV_CONVENTION=nextjs dotenvx get HELLO
 development local
 ```
 
@@ -1920,10 +1920,10 @@ $ NODE_ENV=development dotenvx get HELLO --convention=flow
 development local
 ```
 
-You can also set `DOTENV_CONFIG_CONVENTION=flow`.
+You can also set `DOTENV_CONVENTION=flow`.
 
 ```sh
-$ NODE_ENV=development DOTENV_CONFIG_CONVENTION=flow dotenvx get HELLO
+$ NODE_ENV=development DOTENV_CONVENTION=flow dotenvx get HELLO
 development local
 ```
 
@@ -2395,7 +2395,7 @@ $ echo "HELLO=World" > .env
 $ dotenvx encrypt --stdout
 #/-------------------[DOTENV_PUBLIC_KEY]--------------------/
 #/            public-key encryption for .env files          /
-#/       [how it works](https://dotenvx.com/encryption)     /
+#/       [how it works](https://dotenvx.com/docs/quickstart/encryption)     /
 #/----------------------------------------------------------/
 DOTENV_PUBLIC_KEY="034af93e93708b994c10f236c96ef88e47291066946cce2e8d98c9e02c741ced45"
 # .env
@@ -2527,7 +2527,7 @@ Decrypt the contents of an encrypted `.env` file and send to stdout.
 $ dotenvx decrypt --stdout
 #/-------------------[DOTENV_PUBLIC_KEY]--------------------/
 #/            public-key encryption for .env files          /
-#/       [how it works](https://dotenvx.com/encryption)     /
+#/       [how it works](https://dotenvx.com/docs/quickstart/encryption)     /
 #/----------------------------------------------------------/
 DOTENV_PUBLIC_KEY="034af93e93708b994c10f236c96ef88e47291066946cce2e8d98c9e02c741ced45"
 # .env
@@ -2801,10 +2801,10 @@ Ignore multiple error codes by separating them with spaces.
 $ dotenvx validate --ignore=MISSING_ENV_FILE MISSING_ENV_EXAMPLE
 ```
 
-You can also set `DOTENV_CONFIG_IGNORE`. Its value is a comma-separated list.
+You can also set `DOTENV_IGNORE`. Its value is a comma-separated list.
 
 ```sh
-$ DOTENV_CONFIG_IGNORE=MISSING_ENV_FILE,OTHER dotenvx validate
+$ DOTENV_IGNORE=MISSING_ENV_FILE,OTHER dotenvx validate
 ```
 
 </details>
@@ -3413,10 +3413,10 @@ Error: [MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)
 Hello World
 ```
 
-You can also set `DOTENV_CONFIG_QUIET=true`.
+You can also set `DOTENV_QUIET=true`.
 
 ```sh
-$ DOTENV_CONFIG_QUIET=true node index.js
+$ DOTENV_QUIET=true node index.js
 Error: [MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)
 Hello World
 ```
@@ -3521,10 +3521,10 @@ This is equivalent to using `--convention=nextjs` with the CLI:
 $ dotenvx run --convention=nextjs -- node index.js
 ```
 
-You can also set `DOTENV_CONFIG_CONVENTION=nextjs`.
+You can also set `DOTENV_CONVENTION=nextjs`.
 
 ```sh
-$ DOTENV_CONFIG_CONVENTION=nextjs node index.js
+$ DOTENV_CONVENTION=nextjs node index.js
 ```
 
 </details>
@@ -3727,9 +3727,16 @@ There are global settings available that can be configured as environment variab
 
 ```ini
 # config
-DOTENV_CONFIG_CONVENTION= # set to a default convention like 'nextjs' or 'flow'
-DOTENV_CONFIG_IGNORE= # MISSING_ENV_FILE,OTHER
-DOTENV_CONFIG_QUIET= # set to "true" to default to --quiet
+DOTENV_CONVENTION= # set to a default convention like 'nextjs' or 'flow'
+DOTENV_PATH= # path to your env file; comma-separate multiple paths
+DOTENV_F= # synonym for DOTENV_PATH
+DOTENV_IGNORE= # MISSING_ENV_FILE,OTHER
+DOTENV_QUIET= # set to "true" to default to --quiet
+
+# legacy aliases (still supported)
+DOTENV_CONFIG_CONVENTION=
+DOTENV_CONFIG_IGNORE=
+DOTENV_CONFIG_QUIET=
 
 # armor
 DOTENVX_ARMOR_TOKEN= # for api calls
@@ -3804,22 +3811,22 @@ WRONG_PRIVATE_KEY= # the supplied private key cannot decrypt the value
 > Encrypt and run secrets in your language, framework, or tool.
 >
 
-* [Claude](https://dotenvx.com/docs/secrets-in-claude)
-* [Codex](https://dotenvx.com/docs/secrets-in-codex)
-* [1Password](https://dotenvx.com/docs/secrets-in-1password)
-* [Bitwarden](https://dotenvx.com/docs/secrets-in-bitwarden)
-* [Node.js](https://dotenvx.com/docs/secrets-in-nodejs)
-* [Next.js](https://dotenvx.com/docs/secrets-in-nextjs)
-* [Express](https://dotenvx.com/docs/secrets-in-express)
-* [Astro](https://dotenvx.com/docs/secrets-in-astro)
-* [Expo](https://dotenvx.com/docs/secrets-in-expo)
-* [Python](https://dotenvx.com/docs/secrets-in-python)
-* [Ruby](https://dotenvx.com/docs/secrets-in-ruby)
-* [Go](https://dotenvx.com/docs/secrets-in-go)
-* [PHP](https://dotenvx.com/docs/secrets-in-php)
-* [Rust](https://dotenvx.com/docs/secrets-in-rust)
-
-[Browse all quickstarts](https://dotenvx.com/docs)
+* [Claude](https://dotenvx.com/docs/claude)
+* [Codex](https://dotenvx.com/docs/codex)
+* [1Password](https://dotenvx.com/docs/1password)
+* [Bitwarden](https://dotenvx.com/docs/bitwarden)
+* [Node.js](https://dotenvx.com/docs/nodejs)
+* [Next.js](https://dotenvx.com/docs/nextjs)
+* [Express](https://dotenvx.com/docs/express)
+* [Astro](https://dotenvx.com/docs/astro)
+* [Expo](https://dotenvx.com/docs/expo)
+* [Python](https://dotenvx.com/docs/python)
+* [Ruby](https://dotenvx.com/docs/ruby)
+* [Go](https://dotenvx.com/docs/go)
+* [PHP](https://dotenvx.com/docs/php)
+* [Rust](https://dotenvx.com/docs/rust)
+
+[Browse all quickstarts](https://dotenvx.com/docs/quickstarts)
 
 &nbsp;
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.21.0",
+  "version": "2.23.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/get.js

@@ -7,6 +7,7 @@ const Session = require('../../db/session')
 const getResolver = require('./../../lib/resolvers/get')
 const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDotenvConfigConvention')
 const normalizeDotenvConfigIgnore = require('../../lib/helpers/normalizeDotenvConfigIgnore')
+const normalizeDotenvConfigPath = require('../../lib/helpers/normalizeDotenvConfigPath')
 const buildCommandEnvs = require('../../lib/helpers/buildCommandEnvs')
 const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
 const mask = require('../../lib/helpers/mask')
@@ -26,7 +27,7 @@ async function get (key) {
   const ignore = options.ignore || []
   let errorCount = 0
 
-  const envs = buildCommandEnvs(this.envs, options.convention)
+  const envs = buildCommandEnvs(normalizeDotenvConfigPath(this.envs), options.convention)
 
   try {
     const sesh = new Session()

package/src/cli/actions/run.js

@@ -9,6 +9,7 @@ const Session = require('../../db/session')
 const normalizeDotenvConfigQuiet = require('../../lib/helpers/normalizeDotenvConfigQuiet')
 const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDotenvConfigConvention')
 const normalizeDotenvConfigIgnore = require('../../lib/helpers/normalizeDotenvConfigIgnore')
+const normalizeDotenvConfigPath = require('../../lib/helpers/normalizeDotenvConfigPath')
 const buildCommandEnvs = require('../../lib/helpers/buildCommandEnvs')
 const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
 const mask = require('../../lib/helpers/mask')
@@ -106,7 +107,7 @@ async function run () {
   }
 
   try {
-    let envs = buildCommandEnvs(this.envs, options.convention)
+    let envs = buildCommandEnvs(normalizeDotenvConfigPath(this.envs), options.convention)
     envs = determine(envs, process.env)
 
     const {

package/src/cli/dotenvx.js

@@ -16,8 +16,15 @@ const normalizeDotenvConfigQuiet = require('./../lib/helpers/normalizeDotenvConf
 const envs = []
 function collectEnvs (type) {
   return function (value, previous) {
-    envs.push({ type, value })
-    return (previous || []).concat([value])
+    const values = type === 'envFile'
+      ? value.split(',').map(item => item.trim()).filter(Boolean)
+      : [value]
+
+    for (const item of values) {
+      envs.push({ type, value: item })
+    }
+
+    return (previous || []).concat(values)
   }
 }
 
@@ -331,11 +338,13 @@ program.command('help [command]')
     }
   })
 
-// dotenvx armor
+// security sections (hidden commands advertised here)
 program.addHelpText('after', ' ')
-program.addHelpText('after', 'Professional Security: ')
+program.addHelpText('after', 'Better Security:')
 program.addHelpText('after', '  lock                     ⊡ lock private keys with a local passphrase')
 program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store')
+program.addHelpText('after', ' ')
+program.addHelpText('after', 'For Security Teams:')
 program.addHelpText('after', '  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
 program.addHelpText('after', '  curl                     ⛨ call authenticated api Dotenvx Armor [www.dotenvx.com/armor]')
 

package/src/cli/help.js

@@ -108,30 +108,62 @@ Endpoints:
   GET    /api/account
   GET    /api/armor/keypairs
   GET    /api/armor/keypairs/:public_key
+  POST   /api/armor/keypairs/:public_key/name
+  POST   /api/armor/keypairs/:public_key/members/:member_id/grant
+  POST   /api/armor/keypairs/:public_key/members/:member_id/revoke
   POST   /api/armor/keypairs/:public_key/settings/guard
   POST   /api/armor/keypairs/:public_key/settings/enclave
   GET    /api/teams
   GET    /api/teams/:team
   GET    /api/teams/:team/members
+  POST   /api/teams/:team/members/:member_id/keypairs/:public_key/grant
+  POST   /api/teams/:team/members/:member_id/keypairs/:public_key/revoke
   GET    /api/teams/:team/invitations
   POST   /api/teams/:team/invitations
-  DELETE /api/teams/:team/invitations/:id
+  POST   /api/teams/:team/invitations/:id/cancel
+  GET    /api/join_requests
+  POST   /api/join_requests
+  POST   /api/join_requests/:id/cancel
+  GET    /api/teams/:team/join_requests
+  POST   /api/teams/:team/join_requests/:id/accept
+  POST   /api/teams/:team/join_requests/:id/decline
+  POST   /api/armor/:team/settings/join_requests
   GET    /api/logs?team=:team
 
 Examples:
 
   dotenvx curl "https://armor.dotenvx.com/api/account"
   dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs"
+  dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs?page=1&per=100"
+  dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs?sort=name_asc"
+  dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs?sort=public_key_desc"
   dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY"
+  dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/name" --data '{"name":"Production"}'
+  dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/name" --data '{"name":null}'
+  dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/members/123/grant" --request POST
+  dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/members/123/revoke" --request POST
   dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/settings/guard" --data '{"value":true}'
+  dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/settings/guard" --data '{"value":false}'
   dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/settings/enclave" --data '{"value":true}'
+  dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/settings/enclave" --data '{"value":false}'
   dotenvx curl "https://armor.dotenvx.com/api/teams"
   dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM"
   dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/members"
-  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/members"
+  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/members/123/keypairs/PUBLIC_KEY/grant" --request POST
+  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/members/123/keypairs/PUBLIC_KEY/revoke" --request POST
+  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/invitations"
   dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/invitations" --data '{"email":"person@example.com","role":"member"}'
-  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/invitations/123" --request DELETE
+  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/invitations/123/cancel" --request POST
+  dotenvx curl "https://armor.dotenvx.com/api/join_requests"
+  dotenvx curl "https://armor.dotenvx.com/api/join_requests" --data '{"team":"TEAM"}'
+  dotenvx curl "https://armor.dotenvx.com/api/join_requests/123/cancel" --request POST
+  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/join_requests"
+  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/join_requests/123/accept" --data '{"role":"member"}'
+  dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/join_requests/123/decline" --request POST
+  dotenvx curl "https://armor.dotenvx.com/api/armor/TEAM/settings/join_requests" --data '{"value":true}'
   dotenvx curl "https://armor.dotenvx.com/api/logs?team=TEAM"
+  dotenvx curl "https://armor.dotenvx.com/api/logs?team=TEAM&action=keypair/access&actor=USERNAME&result=success&resource=keypair/KEYPAIR_ID&page=1&per=100"
+  dotenvx curl "https://armor.dotenvx.com/api/logs?team=TEAM&actor=missing&resource=missing"
   `
 }
 

package/src/lib/helpers/dotenvOptionPaths.js

@@ -5,7 +5,11 @@ function dotenvOptionPaths (options) {
 
   if (options && options.path) {
     if (!Array.isArray(options.path)) {
-      optionPaths = [resolveHome(options.path)]
+      if (typeof options.path === 'string') {
+        optionPaths = options.path.split(',').map(filepath => filepath.trim()).filter(Boolean).map(resolveHome)
+      } else {
+        optionPaths = [resolveHome(options.path)]
+      }
     } else {
       optionPaths = [] // reset default
 

package/src/lib/helpers/isTeamRequiredError.js

@@ -0,0 +1,10 @@
+const TEAM_REQUIRED_CODES = new Set([
+  'TEAM_REQUIRED',
+  'DOTENVX_TEAM_REQUIRED'
+])
+
+function isTeamRequiredError (error) {
+  return Boolean(error && TEAM_REQUIRED_CODES.has(error.code))
+}
+
+module.exports = isTeamRequiredError

package/src/lib/helpers/normalizeDotenvConfigConvention.js

@@ -1,8 +1,10 @@
 function normalizeDotenvConfigConvention (
   /** @type {import('../main').DotenvConfigOptions} */ options
 ) {
-  if (!options.convention && process.env.DOTENV_CONFIG_CONVENTION) {
-    options.convention = process.env.DOTENV_CONFIG_CONVENTION
+  const convention = process.env.DOTENV_CONVENTION || process.env.DOTENV_CONFIG_CONVENTION
+
+  if (!options.convention && convention) {
+    options.convention = convention
   }
 
   return options

package/src/lib/helpers/normalizeDotenvConfigIgnore.js

@@ -1,7 +1,8 @@
 function normalizeDotenvConfigIgnore (
   /** @type {import('../main').DotenvConfigOptions} */ options
 ) {
-  const configIgnore = (process.env.DOTENV_CONFIG_IGNORE || '')
+  const configuredIgnore = process.env.DOTENV_IGNORE ?? process.env.DOTENV_CONFIG_IGNORE ?? ''
+  const configIgnore = configuredIgnore
     .split(',')
     .map(code => code.trim())
     .filter(Boolean)

package/src/lib/helpers/normalizeDotenvConfigPath.js

@@ -0,0 +1,14 @@
+const TYPE_ENV_FILE = 'envFile'
+
+function normalizeDotenvConfigPath (envs = [], processEnv = process.env) {
+  if (envs.some(env => env.type === TYPE_ENV_FILE)) return envs
+
+  const configuredEnvFiles = processEnv.DOTENV_PATH || processEnv.DOTENV_F
+  if (!configuredEnvFiles) return envs
+
+  const envFiles = configuredEnvFiles.split(',').map(value => value.trim()).filter(Boolean)
+
+  return envFiles.map(value => ({ type: TYPE_ENV_FILE, value })).concat(envs)
+}
+
+module.exports = normalizeDotenvConfigPath

package/src/lib/helpers/normalizeDotenvConfigQuiet.js

@@ -1,7 +1,9 @@
 function normalizeDotenvConfigQuiet (
   /** @type {import('../main').DotenvConfigOptions} */ options
 ) {
-  if (process.env.DOTENV_CONFIG_QUIET === 'true') {
+  const quiet = process.env.DOTENV_QUIET ?? process.env.DOTENV_CONFIG_QUIET
+
+  if (quiet === 'true') {
     options.quiet = true
   }
 

package/src/lib/helpers/parseWithDecryptor.js

@@ -1,6 +1,4 @@
 const { parse, parseSync } = require('@dotenvx/primitives')
-const isNetworkError = require('./isNetworkError')
-
 const SERVER_SIDE_DECRYPTION_REQUIRED = 'SERVER_SIDE_DECRYPTION_REQUIRED'
 
 function decryptOptions (error) {
@@ -21,23 +19,30 @@ function parseOptionsWithoutProvider (options) {
   }
 }
 
+function failedKeyAccessFallback (result, error) {
+  return {
+    ...result,
+    errors: [error, ...(result.errors || [])]
+  }
+}
+
 async function parseWithDecryptor (src, options = {}) {
   try {
     return await parse(src, options)
   } catch (error) {
     if (error.code !== SERVER_SIDE_DECRYPTION_REQUIRED || typeof options.decryptor !== 'function') {
-      throw error
+      if (typeof options.provider !== 'function') throw error
+
+      const result = await parse(src, parseOptionsWithoutProvider(options))
+      return failedKeyAccessFallback(result, error)
     }
 
     try {
       const result = await options.decryptor(src, decryptOptions(error))
       return await parse(result.src, parseOptionsWithoutProvider(options))
     } catch (decryptorError) {
-      if (isNetworkError(decryptorError)) {
-        return await parse(src, parseOptionsWithoutProvider(options))
-      }
-
-      throw decryptorError
+      const result = await parse(src, parseOptionsWithoutProvider(options))
+      return failedKeyAccessFallback(result, decryptorError)
     }
   }
 }
@@ -47,18 +52,18 @@ parseWithDecryptor.sync = function parseWithDecryptorSync (src, options = {}) {
     return parseSync(src, options)
   } catch (error) {
     if (error.code !== SERVER_SIDE_DECRYPTION_REQUIRED || typeof options.decryptor !== 'function') {
-      throw error
+      if (typeof options.provider !== 'function') throw error
+
+      const result = parseSync(src, parseOptionsWithoutProvider(options))
+      return failedKeyAccessFallback(result, error)
     }
 
     try {
       const result = options.decryptor(src, decryptOptions(error))
       return parseSync(result.src, parseOptionsWithoutProvider(options))
     } catch (decryptorError) {
-      if (isNetworkError(decryptorError)) {
-        return parseSync(src, parseOptionsWithoutProvider(options))
-      }
-
-      throw decryptorError
+      const result = parseSync(src, parseOptionsWithoutProvider(options))
+      return failedKeyAccessFallback(result, decryptorError)
     }
   }
 }

package/src/lib/helpers/removeOptionsHelpParts.js

@@ -1,10 +1,27 @@
-// Remove [options] from help text. example:
+// Remove [options] from usage/command lines and hide the Options: section.
+
+function removeOptionsSection (lines) {
+  const start = lines.indexOf('Options:')
+  if (start === -1) return
+
+  let end = start + 1
+  while (end < lines.length && lines[end] !== '' && !lines[end].endsWith(':')) {
+    end++
+  }
+
+  // drop trailing blank line after the Options block when present
+  if (lines[end] === '') end++
+
+  lines.splice(start, end - start)
+}
 
 function removeOptionsHelpParts (lines) {
   for (let i = 0; i < lines.length; i++) {
     lines[i] = lines[i].replace(' [options]', '')
   }
 
+  removeOptionsSection(lines)
+
   let commandsStart = -1
   for (let i = 0; i < lines.length; i++) {
     if (lines[i] === 'Commands:') {

package/src/lib/main.js

@@ -27,6 +27,7 @@ const Errors = require('./helpers/errors')
 const normalizeDotenvConfigQuiet = require('./helpers/normalizeDotenvConfigQuiet')
 const normalizeDotenvConfigConvention = require('./helpers/normalizeDotenvConfigConvention')
 const normalizeDotenvConfigIgnore = require('./helpers/normalizeDotenvConfigIgnore')
+const normalizeDotenvConfigPath = require('./helpers/normalizeDotenvConfigPath')
 const mask = require('./helpers/mask')
 const maskProcessedEnvs = require('./helpers/maskProcessedEnvs')
 
@@ -75,7 +76,7 @@ const config = function (options = {}) {
   const noKeychain = resolveNoKeychain(options)
 
   try {
-    let envs = buildConfigEnvs(options)
+    let envs = normalizeDotenvConfigPath(buildConfigEnvs(options))
     if (!options.envs) {
       envs = determine(envs, processEnv)
     }

package/src/lib/resolvers/envs.js

@@ -32,6 +32,8 @@ function unresolvedEncryptedErrors (parsed) {
 
 function decryptErrors (parsed, errors) {
   const mappedErrors = (errors || []).map(error => {
+    if (error instanceof Error) return error
+
     return new Errors({
       code: error.code,
       message: error.message,

package/src/lib/services/armorDown.js

@@ -4,6 +4,7 @@ const keynames = require('../conventions/keynames')
 const upsertEnvKey = require('../helpers/upsertEnvKey')
 const readEnvKey = require('../helpers/readEnvKey')
 const teamChoicesFromMeta = require('../helpers/teamChoicesFromMeta')
+const isTeamRequiredError = require('../helpers/isTeamRequiredError')
 
 class ArmorDown {
   constructor (hostname, token, devicePublicKey, envFile = '.env', team = undefined) {
@@ -35,7 +36,7 @@ class ArmorDown {
       try {
         json = await new PostArmorDown(hostname, token, devicePublicKey, publicKey, undefined).run()
       } catch (error) {
-        if (error.code !== 'DOTENVX_TEAM_REQUIRED') {
+        if (!isTeamRequiredError(error)) {
           throw error
         }
 

package/src/lib/services/armorPull.js

@@ -4,6 +4,7 @@ const upsertEnvKey = require('../helpers/upsertEnvKey')
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const teamChoicesFromMeta = require('../helpers/teamChoicesFromMeta')
+const isTeamRequiredError = require('../helpers/isTeamRequiredError')
 
 class ArmorPull {
   constructor (hostname, token, devicePublicKey, envFile = '.env', team = undefined) {
@@ -35,7 +36,7 @@ class ArmorPull {
       try {
         json = await new PostArmorPull(hostname, token, devicePublicKey, publicKey, undefined).run()
       } catch (error) {
-        if (error.code !== 'DOTENVX_TEAM_REQUIRED') {
+        if (!isTeamRequiredError(error)) {
           throw error
         }
 

package/src/lib/services/armorPush.js

@@ -4,6 +4,7 @@ const PostArmorPush = require('../api/postArmorPush')
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const teamChoicesFromMeta = require('../helpers/teamChoicesFromMeta')
+const isTeamRequiredError = require('../helpers/isTeamRequiredError')
 
 function publicKeyFromPrivateKey (privateKey) {
   try {
@@ -42,7 +43,7 @@ class ArmorPush {
       try {
         json = await new PostArmorPush(hostname, token, devicePublicKey, privateKey, undefined).run()
       } catch (error) {
-        if (error.code !== 'DOTENVX_TEAM_REQUIRED') {
+        if (!isTeamRequiredError(error)) {
           throw error
         }
 

package/src/lib/services/armorUp.js

@@ -4,6 +4,7 @@ const keynames = require('../conventions/keynames')
 const removeEnvKey = require('../helpers/removeEnvKey')
 const readEnvKey = require('../helpers/readEnvKey')
 const teamChoicesFromMeta = require('../helpers/teamChoicesFromMeta')
+const isTeamRequiredError = require('../helpers/isTeamRequiredError')
 
 class ArmorUp {
   constructor (hostname, token, devicePublicKey, envFile = '.env', team = undefined) {
@@ -37,7 +38,7 @@ class ArmorUp {
       try {
         json = await new PostArmorUp(hostname, token, devicePublicKey, publicKey, privateKey, undefined).run()
       } catch (error) {
-        if (error.code !== 'DOTENVX_TEAM_REQUIRED') {
+        if (!isTeamRequiredError(error)) {
           throw error
         }
 

package/src/lib/transforms/encrypt.js

@@ -13,6 +13,7 @@ const keynames = require('../conventions/keynames')
 const PostArmorUp = require('../api/postArmorUp')
 const prompts = require('../helpers/prompts')
 const teamChoicesFromMeta = require('../helpers/teamChoicesFromMeta')
+const isTeamRequiredError = require('../helpers/isTeamRequiredError')
 const Session = require('../../db/session')
 
 async function selectKeyStorage () {
@@ -110,7 +111,7 @@ async function encryptTransform (options = {}) {
           try {
             await new PostArmorUp(hostname, token, devicePublicKey, publicKey, privateKey, undefined).run()
           } catch (error) {
-            if (error.code !== 'DOTENVX_TEAM_REQUIRED') {
+            if (!isTeamRequiredError(error)) {
               throw error
             }
 

package/src/lib/transforms/set.js

@@ -13,6 +13,7 @@ const Errors = require('../helpers/errors')
 const PostArmorUp = require('../api/postArmorUp')
 const prompts = require('../helpers/prompts')
 const teamChoicesFromMeta = require('../helpers/teamChoicesFromMeta')
+const isTeamRequiredError = require('../helpers/isTeamRequiredError')
 const Session = require('../../db/session')
 
 async function selectKeyStorage () {
@@ -113,7 +114,7 @@ async function setTransform (options = {}) {
           try {
             await new PostArmorUp(hostname, token, devicePublicKey, publicKey, privateKey, undefined).run()
           } catch (error) {
-            if (error.code !== 'DOTENVX_TEAM_REQUIRED') {
+            if (!isTeamRequiredError(error)) {
               throw error
             }