@dotenvx/dotenvx 2.26.0 → 2.26.1

package/CHANGELOG.md

@@ -2,9 +2,15 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.26.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.26.1...main)
 
-## [2.25.0](https://github.com/dotenvx/dotenvx/compare/v2.25.0...v2.26.0) (2026-09-15)
+## [2.26.1](https://github.com/dotenvx/dotenvx/compare/v2.26.0...v2.26.1) (2026-09-15)
+
+### Changed
+
+* Add `dotenvx 1password up|down|push|pull` and `dotenvx bitwarden up|down|push|pull` ([#969](https://github.com/dotenvx/dotenvx/pull/969))
+
+## [2.26.0](https://github.com/dotenvx/dotenvx/compare/v2.25.0...v2.26.0) (2026-09-15)
 
 ### Added
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.26.0",
+  "version": "2.26.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/commands/armor.js

@@ -2,7 +2,7 @@ const executeDynamic = require('./../../lib/helpers/executeDynamic')
 
 function configureArmorCommand (armor) {
   armor
-    .description('move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
+    .description('move private keys in/out of Dotenvx Armor [www.dotenvx.com/armor]')
     .allowUnknownOption()
     .argument('[command]', 'dotenvx-armor command')
     .argument('[args...]', 'dotenvx-armor command arguments')

package/src/cli/commands/custody.js

@@ -0,0 +1,43 @@
+function configureCustodyCommand (command, name, providerPath) {
+  command.hook('preAction', async () => {
+    const Session = require('../../db/session')
+    await new Session().notifyUpdate()
+  })
+  command.description(`move private keys in/out of ${name}`).action(function () { this.help() })
+  const descriptions = {
+    up: `move key from .env.keys into ${name}`,
+    down: `move key from ${name} to .env.keys`,
+    push: `copy key from .env.keys into ${name}`,
+    pull: `copy key from ${name} into .env.keys`
+  }
+  for (const [operation, description] of Object.entries(descriptions)) {
+    command.command(operation)
+      .description(description)
+      .option('-f, --env-file <path>', 'path to your env file')
+      .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
+      .action(async function () {
+        const { logger } = require('../../shared/logger')
+        const createSpinner = require('../../lib/helpers/createSpinner')
+        const armoredKeyDisplay = require('../../lib/helpers/armoredKeyDisplay')
+        const transfer = require('../../lib/services/custodyTransfer')
+        const options = this.opts()
+        const spinner = await createSpinner({ ...this.optsWithGlobals(), text: `${operation === 'up' || operation === 'push' ? 'storing in' : 'reading from'} ${name}` })
+        try {
+          const result = await transfer(require(providerPath), name, operation, options.envFile, options.envKeysFile)
+          if (spinner) spinner.stop()
+          const display = armoredKeyDisplay(result.publicKeyValue) || result.privateKeyName
+          const messages = { up: `stored in ${name}`, down: `moved to ${options.envKeysFile}`, push: `pushed to ${name}`, pull: `pulled to ${options.envKeysFile}` }
+          if (result.changed) logger.success(`□ ${messages[operation]} (${display})`)
+          else logger.info(`○ no change (${display})`)
+        } catch (error) {
+          if (spinner) spinner.stop()
+          if (error.code === 'PROMPT_CANCELLED') return process.exit(130)
+          logger.error(error.message)
+          process.exit(1)
+        }
+      })
+  }
+  return command
+}
+
+module.exports = configureCustodyCommand

package/src/cli/commands/native.js

@@ -6,7 +6,7 @@ function configureNativeCommand (native) {
   })
 
   native
-    .description('move private keys into your OS secret store')
+    .description('move private keys in/out of your OS secret store')
     .action(function () {
       this.help()
     })

package/src/cli/dotenvx.js

@@ -346,14 +346,19 @@ program.command('help [command]')
 
 // security sections (hidden commands advertised here)
 program.addHelpText('after', ' ')
-program.addHelpText('after', 'Better Security:')
+program.addHelpText('after', 'Local Custody:')
 program.addHelpText('after', '  lock                     ⊡ lock private keys with a local passphrase')
-program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store')
+program.addHelpText('after', '  native                   ⌥ move private keys in/out of your OS secret store')
+program.addHelpText('after', '  1password                □ move private keys in/out of 1Password')
+program.addHelpText('after', '  bitwarden                □ move private keys in/out of Bitwarden')
 program.addHelpText('after', ' ')
-program.addHelpText('after', 'For Security Teams:')
-program.addHelpText('after', '  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
+program.addHelpText('after', 'Managed Custody:')
+program.addHelpText('after', '  armor                    ⛨ move private keys in/out of Dotenvx Armor [www.dotenvx.com/armor]')
 program.addHelpText('after', '  curl                     ⛨ call authenticated api Dotenvx Armor [www.dotenvx.com/armor]')
 
+require('./commands/custody')(program.command('1password', { hidden: true }), '1Password', '../../lib/helpers/onePasswordCustody')
+require('./commands/custody')(program.command('bitwarden', { hidden: true }), 'Bitwarden', '../../lib/helpers/bitwardenCustody')
+
 // dotenvx native
 require('./commands/native')(program.command('native', { hidden: true }))
 

package/src/lib/helpers/bitwardenCustody.js

@@ -159,4 +159,12 @@ async function set (publicKey, privateKey) {
   new Session().createStore().set(`${PREFIX}${publicKey}`, Buffer.from(JSON.stringify(loc)).toString('base64'))
 }
 
-module.exports = { available, configured, get, getSync, set }
+async function remove (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return
+  await authenticate(loc)
+  await run(['delete', 'item', loc.item])
+  new Session().openStore().delete(`${PREFIX}${publicKey}`)
+}
+
+module.exports = { available, configured, get, getSync, set, delete: remove }

package/src/lib/helpers/onePasswordCustody.js

@@ -15,7 +15,7 @@ function failure (message) {
 
 function commandError (args, stderr) {
   const step = args[0] === 'item'
-    ? 'create the key item'
+    ? (args[1] === 'delete' ? 'delete the key item' : 'create the key item')
     : {
         whoami: 'check the signed-in account',
         signin: 'sign in',
@@ -156,4 +156,12 @@ async function set (publicKey, privateKey) {
   new Session().createStore().set(`${PREFIX}${publicKey}`, `${account}|${reference}`)
 }
 
-module.exports = { available, configured, get, getSync, set }
+async function remove (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return
+  const [vault, item] = loc.reference.slice('op://'.length).split('/')
+  await run(['item', 'delete', item, `--vault=${vault}`, `--account=${loc.account}`])
+  new Session().openStore().delete(`${PREFIX}${publicKey}`)
+}
+
+module.exports = { available, configured, get, getSync, set, delete: remove }

package/src/lib/helpers/selectKeyStorage.js

@@ -14,7 +14,7 @@ async function selectKeyStorage (options = {}) {
   if (process.env.CI || options.noCreate || !process.stdin.isTTY || !process.stderr.isTTY) return defaultStorage
 
   const choices = [
-    ...(useNative ? [{ name: `□ Local Custody (${secretStoreNames[process.platform]})`, value: 'native' }] : [])
+    ...(useNative ? [{ name: `□ Local Custody (Native ${secretStoreNames[process.platform]})`, value: 'native' }] : [])
   ]
   if (!options.no1Password && process.env.DOTENVX_NO_1PASSWORD !== 'true' && await onePasswordCustody.available()) {
     choices.push({ name: '□ Local Custody (1Password)', value: 'onepassword' })

package/src/lib/services/custodyTransfer.js

@@ -0,0 +1,50 @@
+const { derive } = require('@dotenvx/primitives')
+const keynames = require('../conventions/keynames')
+const readEnvKey = require('../helpers/readEnvKey')
+const removeEnvKey = require('../helpers/removeEnvKey')
+const upsertEnvKey = require('../helpers/upsertEnvKey')
+
+function verify (publicKey, privateKey) {
+  try {
+    if (derive(privateKey) === publicKey) return
+  } catch {}
+  throw new Error('private key does not match the .env public key')
+}
+
+async function custodyTransfer (provider, name, operation, envFile = '.env', envKeysFile = '.env.keys') {
+  if (!['up', 'down', 'push', 'pull'].includes(operation)) throw new Error('unknown custody operation')
+  const { publicKeyName, privateKeyName } = keynames(envFile)
+  const publicKey = readEnvKey(publicKeyName, envFile, { strict: true })
+  const result = changed => ({ changed, privateKeyName, publicKeyValue: publicKey })
+  const local = readEnvKey(privateKeyName, envKeysFile)
+  if (operation === 'up' || operation === 'push') {
+    if (local) verify(publicKey, local)
+    if (operation === 'push' && !local) throw new Error(`missing ${privateKeyName} in ${envKeysFile}`)
+    const existing = (await provider.get(publicKey))[publicKey]
+    if (existing) verify(publicKey, existing)
+    if (!local && !existing) throw new Error(`missing ${privateKeyName} in ${envKeysFile}`)
+    if (!existing) await provider.set(publicKey, local)
+    const saved = (await provider.get(publicKey))[publicKey]
+    if (!saved || saved !== (local || existing)) throw new Error(`could not verify private key in ${name}; ${envKeysFile} unchanged`)
+    if (operation === 'up') return result(removeEnvKey(privateKeyName, envKeysFile).changed || !existing)
+    return result(!existing)
+  }
+
+  const privateKey = (await provider.get(publicKey))[publicKey]
+  if (!privateKey) {
+    if (operation === 'down' && local) {
+      verify(publicKey, local)
+      return result(false)
+    }
+    throw new Error(`[NOT_FOUND] private key not found in ${name}`)
+  }
+  verify(publicKey, privateKey)
+  const written = upsertEnvKey(privateKeyName, privateKey, envKeysFile)
+  if (readEnvKey(privateKeyName, envKeysFile, { strict: true }) !== privateKey) {
+    throw new Error(`could not verify private key in ${envKeysFile}; ${name} unchanged`)
+  }
+  if (operation === 'down') await provider.delete(publicKey)
+  return result(written.changed || operation === 'down')
+}
+
+module.exports = custodyTransfer