@dotenvx/dotenvx 2.26.0 → 2.27.0

package/src/lib/helpers/errors.js

@@ -14,7 +14,6 @@ const ISSUE_BY_CODE = {
   MALFORMED_ENCRYPTED_DATA: 'https://github.com/dotenvx/dotenvx/issues/467',
   MISPAIRED_PRIVATE_KEY: 'https://github.com/dotenvx/dotenvx/issues/752',
   MISSING_DIRECTORY: 'https://github.com/dotenvx/dotenvx/issues/758',
-  MISSING_ENV_EXAMPLE: 'https://github.com/dotenvx/dotenvx/issues/905',
   MISSING_ENV_FILE: 'https://github.com/dotenvx/dotenvx/issues/484',
   MISSING_ENV_KEYS_FILE: 'https://github.com/dotenvx/dotenvx/issues/775',
   MISSING_ENV_FILES: 'https://github.com/dotenvx/dotenvx/issues/760',
@@ -25,7 +24,6 @@ const ISSUE_BY_CODE = {
   MISSING_VALUE: 'https://github.com/dotenvx/dotenvx/issues/864',
   FILE_NOT_WRITABLE: 'https://github.com/dotenvx/dotenvx/issues/890',
   PRECOMMIT_HOOK_MODIFY_FAILED: 'try again or report error',
-  VALIDATION_FAILED: 'https://github.com/dotenvx/dotenvx/issues/907',
   WRONG_PRIVATE_KEY: 'https://github.com/dotenvx/dotenvx/issues/466'
 }
 
@@ -235,15 +233,10 @@ class Errors {
     return e
   }
 
-  missingEnvExample () {
-    const code = 'MISSING_ENV_EXAMPLE'
-    const message = `[${code}] missing .env.example file`
-    const help = `fix: [${ISSUE_BY_CODE[code]}]`
-
-    const e = new Error(message)
-    e.code = code
-    e.help = help
-    e.messageWithHelp = `${message}. ${help}`
+  envfileRequired () {
+    const e = new Error('[ENVFILE_REQUIRED] validate requires an Envfile')
+    e.code = 'ENVFILE_REQUIRED'
+    e.messageWithHelp = e.message
     return e
   }
 
@@ -345,15 +338,22 @@ class Errors {
     return e
   }
 
-  validationFailed () {
-    const code = 'VALIDATION_FAILED'
+  malformedEnvfile () {
+    const code = 'MALFORMED_ENVFILE'
+    const message = `[${code}] ${this.message}`
+    const e = new Error(message)
+    e.code = code
+    e.messageWithHelp = message
+    return e
+  }
+
+  invalidEnv () {
+    const code = 'INVALID_ENV'
     const message = `[${code}] ${this.message}`
-    const help = `fix: [${ISSUE_BY_CODE[code]}]`
 
     const e = new Error(message)
     e.code = code
-    e.help = help
-    e.messageWithHelp = `${message}. ${help}`
+    e.messageWithHelp = message
     return e
   }
 

package/src/lib/helpers/executeCommand.js

@@ -6,7 +6,7 @@ const Errors = require('./errors')
 const { createRedactedStreamWriter, redactOutput } = require('./redactOutput')
 const ptyCommand = require('./ptyCommand')
 
-async function executeCommand (commandArgs, env, sensitiveValues = []) {
+async function executeCommand (commandArgs, env, sensitiveValues = [], onComplete) {
   const FORWARD_SIGNAL_GRACE_MS = 1000
   const FORCE_KILL_GRACE_MS = 1000
   const signals = [
@@ -17,6 +17,7 @@ async function executeCommand (commandArgs, env, sensitiveValues = []) {
   logger.debug(`executing process command [${commandArgs.join(' ')}]`)
 
   let child
+  let commandExitCode
   let signalSent
   let sigintCount = 0
   const signalForwardTimers = new Set()
@@ -175,7 +176,7 @@ async function executeCommand (commandArgs, env, sensitiveValues = []) {
     }
 
     // Exit with the error code from the command process, or 1 if unavailable
-    process.exit(error.exitCode || 1)
+    commandExitCode = error.exitCode || 1
   } finally {
     signalForwardTimers.forEach(timer => clearTimeout(timer))
     signalForwardTimers.clear()
@@ -188,7 +189,10 @@ async function executeCommand (commandArgs, env, sensitiveValues = []) {
     otherSignalHandlers.forEach((handler, signal) => {
       process.removeListener(signal, handler)
     })
+    if (onComplete) await onComplete()
   }
+
+  if (commandExitCode) process.exit(commandExitCode)
 }
 
 module.exports = executeCommand

package/src/lib/helpers/formatEnvfileSyntaxError.js

@@ -0,0 +1,24 @@
+const path = require('node:path')
+
+module.exports = function formatEnvfileSyntaxError (error, src, filepath) {
+  const location = error.location?.start
+  if (!location) return error.message
+
+  const filename = path.relative(process.cwd(), filepath) || path.basename(filepath)
+  const line = src.split(/\r\n|\n|\r/)[location.line - 1] || ''
+  let message = error.message
+  if (error.expected) {
+    const remaining = src.slice(location.offset)
+    const token = remaining.match(/^(?:"[^"\r\n]*"|'[^'\r\n]*'|[A-Za-z0-9_]+|[^\r\n])/u)?.[0]
+    const displayToken = token && /^["']/.test(token) ? token : JSON.stringify(token)
+    message = token ? `Unexpected ${displayToken}` : 'Unexpected end of input'
+    const expected = [...new Set(error.expected.flatMap(item => {
+      if (item.type === 'other') return [item.description]
+      if (item.type === 'literal' && item.text.trim() && item.text !== '#') return [JSON.stringify(item.text)]
+      return []
+    }))]
+    if (expected.length > 0 && expected.length <= 3) message += `; expected ${expected.join(' or ')}`
+  }
+  const prefix = `${location.line} | `
+  return `${filename}:${location.line}:${location.column}: ${message}\n${prefix}${line}\n${' '.repeat(prefix.length)}${line.slice(0, location.column - 1).replace(/[^\t]/g, ' ')}^`
+}

package/src/lib/helpers/isValidEmail.js

@@ -0,0 +1,11 @@
+module.exports = function isValidEmail (value) {
+  if (value.length > 254 || /\s/.test(value)) return false
+  const parts = value.split('@')
+  if (parts.length !== 2) return false
+  const [local, domain] = parts
+  if (local.length > 64 || !/^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*$/i.test(local)) return false
+  const labels = domain.split('.')
+  return labels.length > 1 &&
+    labels.every(label => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(label)) &&
+    /^(?:[a-z]{2,63}|xn--[a-z0-9-]+)$/i.test(labels[labels.length - 1])
+}

package/src/lib/helpers/isValidUrl.js

@@ -0,0 +1,9 @@
+const { URL } = require('node:url')
+
+module.exports = function isValidUrl (value) {
+  try {
+    return new URL(value).protocol !== ''
+  } catch {
+    return false
+  }
+}

package/src/lib/helpers/onePasswordCustody.js

@@ -15,7 +15,7 @@ function failure (message) {
 
 function commandError (args, stderr) {
   const step = args[0] === 'item'
-    ? 'create the key item'
+    ? (args[1] === 'delete' ? 'delete the key item' : 'create the key item')
     : {
         whoami: 'check the signed-in account',
         signin: 'sign in',
@@ -156,4 +156,12 @@ async function set (publicKey, privateKey) {
   new Session().createStore().set(`${PREFIX}${publicKey}`, `${account}|${reference}`)
 }
 
-module.exports = { available, configured, get, getSync, set }
+async function remove (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return
+  const [vault, item] = loc.reference.slice('op://'.length).split('/')
+  await run(['item', 'delete', item, `--vault=${vault}`, `--account=${loc.account}`])
+  new Session().openStore().delete(`${PREFIX}${publicKey}`)
+}
+
+module.exports = { available, configured, get, getSync, set, delete: remove }

package/src/lib/helpers/parseWithDecryptor.js

@@ -1,4 +1,5 @@
-const { parse, parseSync, parsearrays } = require('@dotenvx/primitives')
+const { parse, parseSync, parsearrays, scan, encrypted } = require('@dotenvx/primitives')
+const prepareProxy = require('../proxy/prepareProxy')
 const SERVER_SIDE_DECRYPTION_REQUIRED = 'SERVER_SIDE_DECRYPTION_REQUIRED'
 
 function decryptOptions (error) {
@@ -27,6 +28,13 @@ function failedKeyAccessFallback (result, error) {
 }
 
 async function parseWithDecryptor (src, options = {}) {
+  if (options.proxyCredentials) {
+    const original = src
+    src = prepareProxy(src, options.proxyCredentials, options.processEnv, options.proxyRules)
+    if (src !== original && !Object.values(scan(src).parsed).flat().some(encrypted)) {
+      options = parseOptionsWithoutProvider(options)
+    }
+  }
   return parseWith(src, options, parse)
 }
 

package/src/lib/helpers/readEnvfile.js

@@ -0,0 +1,128 @@
+const fs = require('node:fs')
+const path = require('node:path')
+const { isIP } = require('node:net')
+const parser = require('./envfileParser')
+const Errors = require('./errors')
+const isValidUrl = require('./isValidUrl')
+const isValidEmail = require('./isValidEmail')
+const formatEnvfileSyntaxError = require('./formatEnvfileSyntaxError')
+
+function compileDeclarations (declarations) {
+  const proxyRules = new Map()
+  const requiredKeys = []
+  const types = new Map()
+  const enums = new Map()
+  const ranges = new Map()
+  const encryptedKeys = []
+  const names = new Set()
+  for (const input of declarations) {
+    const declaration = { ...input }
+    if (names.has(declaration.name)) throw new Errors({ message: `Duplicate Envfile declaration: ${declaration.name}` }).malformedEnvfile()
+    names.add(declaration.name)
+    if (declaration.encrypted) encryptedKeys.push(declaration.name)
+    if (declaration.type === 'port') {
+      declaration.type = 'integer'
+      if (declaration.min === undefined || BigInt(declaration.min) < 0n) declaration.min = '0'
+      if (declaration.max === undefined || BigInt(declaration.max) > 65535n) declaration.max = '65535'
+    }
+    if (declaration.required) requiredKeys.push(declaration.name)
+    if (declaration.type) types.set(declaration.name, declaration.type)
+    if (declaration.min !== undefined || declaration.max !== undefined) {
+      if (declaration.type !== 'integer') {
+        throw new Errors({ message: `Invalid Envfile range for ${declaration.name}: min and max require type: "integer" or "port".` }).malformedEnvfile()
+      }
+      if (declaration.min !== undefined && declaration.max !== undefined && BigInt(declaration.min) > BigInt(declaration.max)) {
+        throw new Errors({ message: `Invalid Envfile range for ${declaration.name}: min must be less than or equal to max.` }).malformedEnvfile()
+      }
+      ranges.set(declaration.name, { min: declaration.min, max: declaration.max })
+    }
+    if (declaration.enum) {
+      if (declaration.type === 'integer' && declaration.enum.some(value => !/^[+-]?\d+$/.test(value.trim()))) {
+        throw new Errors({ message: `Invalid Envfile enum for ${declaration.name}: expected integer choices.` }).malformedEnvfile()
+      }
+      if (declaration.type === 'boolean' && declaration.enum.some(value => !['true', 'false', '1', '0'].includes(value))) {
+        throw new Errors({ message: `Invalid Envfile enum for ${declaration.name}: expected true, false, 1, or 0 choices.` }).malformedEnvfile()
+      }
+      if (declaration.type === 'url' && declaration.enum.some(value => !isValidUrl(value))) {
+        throw new Errors({ message: `Invalid Envfile enum for ${declaration.name}: expected URL choices.` }).malformedEnvfile()
+      }
+      if (declaration.type === 'email' && declaration.enum.some(value => !isValidEmail(value))) {
+        throw new Errors({ message: `Invalid Envfile enum for ${declaration.name}: expected email choices.` }).malformedEnvfile()
+      }
+      if (declaration.type === 'ip' && declaration.enum.some(value => isIP(value) === 0)) {
+        throw new Errors({ message: `Invalid Envfile enum for ${declaration.name}: expected IPv4 or IPv6 choices.` }).malformedEnvfile()
+      }
+      enums.set(declaration.name, declaration.enum)
+    }
+    if (declaration.proxy) {
+      const host = declaration.proxy.domain.toLowerCase()
+      if (host.length > 253 || isIP(host) || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(host)) {
+        throw new Errors({ message: `Invalid Envfile proxy host for ${declaration.name}: expected a DNS hostname without a scheme, port, path or wildcard.` }).malformedEnvfile()
+      }
+      proxyRules.set(declaration.name, host)
+    }
+  }
+  return { exists: true, proxyRules, requiredKeys, types, enums, ranges, encryptedKeys }
+}
+
+module.exports = function readEnvfile (filepath = path.resolve('Envfile'), envFiles = ['.env']) {
+  let src
+  try {
+    src = fs.readFileSync(filepath, 'utf8')
+  } catch (error) {
+    if (error.code === 'ENOENT') return { ...compileDeclarations([]), exists: false }
+    throw error
+  }
+
+  let document
+  try {
+    document = parser.parse(src)
+  } catch (error) {
+    throw new Errors({ message: formatEnvfileSyntaxError(error, src, filepath) }).malformedEnvfile()
+  }
+
+  const defaults = { proxy: false, required: true, encrypted: document.encrypted }
+  const base = document.declarations.map(item => ({ ...defaults, ...item }))
+  const baseSchema = compileDeclarations(base)
+  const selected = new Set(envFiles.map(file => path.resolve(file)))
+  const seen = new Set()
+  const active = []
+  for (const block of document.files) {
+    if (/[*?[\]]/.test(block.file)) {
+      throw new Errors({ message: `File blocks require an exact filename: ${block.file}` }).malformedEnvfile()
+    }
+    const file = path.resolve(path.dirname(filepath), block.file)
+    if (seen.has(file)) throw new Errors({ message: `Duplicate Envfile file block: ${block.file}` }).malformedEnvfile()
+    seen.add(file)
+    const merged = new Map(base.map(item => [item.name, { ...item }]))
+    if (block.encrypted !== null && block.encrypted !== undefined) {
+      for (const item of merged.values()) item.encrypted = block.encrypted
+    }
+    const names = new Set()
+    for (const item of block.declarations) {
+      if (names.has(item.name)) throw new Errors({ message: `Duplicate Envfile declaration in ${block.file}: ${item.name}` }).malformedEnvfile()
+      names.add(item.name)
+      merged.set(item.name, {
+        ...defaults,
+        ...(block.encrypted === null || block.encrypted === undefined ? {} : { encrypted: block.encrypted }),
+        ...merged.get(item.name),
+        ...item
+      })
+    }
+    const schema = compileDeclarations([...merged.values()])
+    if (selected.has(file)) active.push(schema)
+  }
+  if (active.length === 0) return baseSchema
+
+  // Each selected file policy must hold, regardless of file loading order.
+  const proxyRules = new Map()
+  for (const schema of active) {
+    for (const [key, host] of schema.proxyRules) {
+      if (proxyRules.has(key) && proxyRules.get(key) !== host) {
+        throw new Errors({ message: `Conflicting Envfile proxy domains for ${key} in selected file blocks` }).malformedEnvfile()
+      }
+      proxyRules.set(key, host)
+    }
+  }
+  return { ...active[0], proxyRules, schemas: active }
+}

package/src/lib/helpers/selectKeyStorage.js

@@ -9,12 +9,12 @@ const secretStoreNames = {
 }
 
 async function selectKeyStorage (options = {}) {
-  const useNative = !options.noKeychain && !process.env.CI && ['darwin', 'linux', 'win32'].includes(process.platform)
+  const useNative = !options.noNative && process.env.DOTENVX_NO_NATIVE !== 'true' && !process.env.CI && ['darwin', 'linux', 'win32'].includes(process.platform)
   const defaultStorage = useNative ? 'native' : 'file'
   if (process.env.CI || options.noCreate || !process.stdin.isTTY || !process.stderr.isTTY) return defaultStorage
 
   const choices = [
-    ...(useNative ? [{ name: `□ Local Custody (${secretStoreNames[process.platform]})`, value: 'native' }] : [])
+    ...(useNative ? [{ name: `□ Local Custody (Native ${secretStoreNames[process.platform]})`, value: 'native' }] : [])
   ]
   if (!options.no1Password && process.env.DOTENVX_NO_1PASSWORD !== 'true' && await onePasswordCustody.available()) {
     choices.push({ name: '□ Local Custody (1Password)', value: 'onepassword' })

package/src/lib/helpers/validate.js

@@ -1,24 +1,15 @@
-function optionalKeys (comments) {
-  const keys = new Set()
-
-  for (const [key, values] of Object.entries(comments)) {
-    if (values.some(comment => comment && /\boptional\b/i.test(comment))) {
-      keys.add(key)
-    }
-  }
-
-  return keys
-}
+const isValidUrl = require('./isValidUrl')
+const isValidEmail = require('./isValidEmail')
+const { isIP } = require('node:net')
 
 function validate (example = {}, env = {}, options = {}) {
   const errors = []
   const missingRequired = []
-  const optional = optionalKeys(options.comments || {})
 
   for (const key of Object.keys(example)) {
     const value = env[key]
     const missing = !Object.prototype.hasOwnProperty.call(env, key) || value.trim() === ''
-    if (!optional.has(key) && missing) {
+    if (missing) {
       missingRequired.push(key)
     }
   }
@@ -27,10 +18,88 @@ function validate (example = {}, env = {}, options = {}) {
     errors.push({
       code: 'MISSING_REQUIRED',
       keys: missingRequired,
-      message: `missing required (${missingRequired.join(', ')})`
+      message: missingRequired.map(key => `${key} is required`).join('; ')
     })
   }
 
+  const invalidIntegers = []
+  const invalidBooleans = []
+  const invalidUrls = []
+  const invalidEmails = []
+  const invalidIps = []
+  for (const [key, type] of options.types || []) {
+    if (!Object.prototype.hasOwnProperty.call(env, key)) continue
+    const value = env[key].trim()
+    if (value === '') continue // required checks handle blank values
+    if (type === 'integer' && !/^[+-]?\d+$/.test(value)) invalidIntegers.push(key)
+    if (type === 'boolean' && !['true', 'false', '1', '0'].includes(env[key])) invalidBooleans.push(key)
+    if (type === 'url' && !isValidUrl(env[key])) invalidUrls.push(key)
+    if (type === 'email' && !isValidEmail(env[key])) invalidEmails.push(key)
+    if (type === 'ip' && isIP(env[key]) === 0) invalidIps.push(key)
+  }
+  if (invalidIntegers.length > 0) {
+    errors.push({
+      code: 'INVALID_INTEGER',
+      keys: invalidIntegers,
+      message: invalidIntegers.map(key => `${key} must be an integer`).join('; ')
+    })
+  }
+
+  if (invalidBooleans.length > 0) {
+    errors.push({
+      code: 'INVALID_BOOLEAN',
+      keys: invalidBooleans,
+      message: invalidBooleans.map(key => `${key} must be true, false, 1, or 0`).join('; ')
+    })
+  }
+  if (invalidUrls.length > 0) {
+    errors.push({ code: 'INVALID_URL', keys: invalidUrls, message: invalidUrls.map(key => `${key} must be a valid URL`).join('; ') })
+  }
+  if (invalidEmails.length > 0) {
+    errors.push({ code: 'INVALID_EMAIL', keys: invalidEmails, message: invalidEmails.map(key => `${key} must be a valid email address`).join('; ') })
+  }
+  if (invalidIps.length > 0) {
+    errors.push({ code: 'INVALID_IP', keys: invalidIps, message: invalidIps.map(key => `${key} must be a valid IPv4 or IPv6 address`).join('; ') })
+  }
+  const invalidEnums = []
+  for (const [key, choices] of options.enums || []) {
+    if (!Object.prototype.hasOwnProperty.call(env, key) || env[key].trim() === '') continue
+    if (invalidIntegers.includes(key) || invalidBooleans.includes(key) || invalidUrls.includes(key) || invalidEmails.includes(key) || invalidIps.includes(key)) continue
+    const value = env[key]
+    const matches = options.types?.get(key) === 'integer'
+      ? choices.some(choice => BigInt(choice.trim()) === BigInt(value.trim()))
+      : choices.includes(value)
+    if (!matches) invalidEnums.push(key)
+  }
+  if (invalidEnums.length > 0) {
+    errors.push({
+      code: 'INVALID_ENUM',
+      keys: invalidEnums,
+      message: invalidEnums.map(key => `${key} is not an allowed value`).join('; ')
+    })
+  }
+
+  for (const [key, { min, max }] of options.ranges || []) {
+    if (!Object.prototype.hasOwnProperty.call(env, key) || env[key].trim() === '') continue
+    if (invalidIntegers.includes(key)) continue
+    const value = BigInt(env[key].trim())
+    if (min !== undefined && value < BigInt(min)) {
+      errors.push({ code: 'BELOW_MIN', keys: [key], message: `${key} must be at least ${min}` })
+    }
+    if (max !== undefined && value > BigInt(max)) {
+      errors.push({ code: 'ABOVE_MAX', keys: [key], message: `${key} must be at most ${max}` })
+    }
+  }
+
+  const unencrypted = []
+  for (const key of options.encryptedKeys || []) {
+    if (!Object.prototype.hasOwnProperty.call(env, key) || env[key].trim() === '') continue
+    if (!options.encryptedSources?.has(key)) unencrypted.push(key)
+  }
+  if (unencrypted.length > 0) {
+    errors.push({ code: 'EXPECTED_ENCRYPTED', keys: unencrypted, message: unencrypted.map(key => `${key} is not encrypted`).join('; ') })
+  }
+
   return {
     valid: errors.length === 0,
     errors

package/src/lib/helpers/validateEnvfile.js

@@ -0,0 +1,24 @@
+const validate = require('./validate')
+const encryptedSources = require('./encryptedSources')
+const Errors = require('./errors')
+
+module.exports = function validateEnvfile (schema, env, processedEnvs) {
+  const messages = new Set()
+  const schemas = schema.schemas || [schema]
+  const sources = schemas.some(rules => rules.encryptedKeys.length > 0) ? encryptedSources(processedEnvs) : undefined
+  for (const rules of schemas) {
+    const { requiredKeys, types, enums, ranges, encryptedKeys } = rules
+    const required = Object.fromEntries(requiredKeys.map(key => [key, '']))
+    const validation = validate(required, env, {
+      types,
+      enums,
+      ranges,
+      encryptedKeys,
+      encryptedSources: sources
+    })
+    for (const error of validation.errors) messages.add(error.message)
+  }
+  if (messages.size > 0) {
+    return new Errors({ message: [...messages].join('; ') }).invalidEnv()
+  }
+}

package/src/lib/main.js

@@ -73,7 +73,7 @@ const config = function (options = {}) {
 
   // dotenvx-armor related
   const noArmor = resolveNoArmor(options)
-  const noKeychain = resolveNoKeychain(options)
+  const noNative = resolveNoNative(options)
 
   try {
     let envs = normalizeDotenvConfigPath(buildConfigEnvs(options))
@@ -89,7 +89,7 @@ const config = function (options = {}) {
       processEnv,
       envKeysFile,
       noArmor,
-      noKeychain,
+      noNative,
       no1Password: options.no1Password,
       noBitwarden: options.noBitwarden,
       noSpinner: options.noSpinner,
@@ -243,7 +243,7 @@ const set = async function (key, value, options = {}) {
   const envKeysFilepath = options.envKeysFile
   const noCreate = options.create === false
   const noArmor = resolveNoArmor(options)
-  const noKeychain = resolveNoKeychain(options)
+  const noNative = resolveNoNative(options)
 
   const {
     keysSrc,
@@ -256,7 +256,7 @@ const set = async function (key, value, options = {}) {
     value,
     fk: envKeysFilepath,
     noArmor,
-    noKeychain,
+    noNative,
     no1Password: options.no1Password,
     noBitwarden: options.noBitwarden,
     noCreate,
@@ -327,7 +327,7 @@ const get = async function (key, options = {}) {
 
   const envs = buildEnvs(options)
   const noArmor = resolveNoArmor(options)
-  const noKeychain = resolveNoKeychain(options)
+  const noNative = resolveNoNative(options)
 
   // ignore
   const ignore = options.ignore || []
@@ -339,7 +339,7 @@ const get = async function (key, options = {}) {
     all: options.all,
     envKeysFile: options.envKeysFile,
     noArmor,
-    noKeychain,
+    noNative,
     no1Password: options.no1Password,
     noBitwarden: options.noBitwarden
   })
@@ -410,7 +410,7 @@ function resolveNoArmor (options = {}) {
   return options.noArmor === true || (!options.token && sesh.noArmorSync())
 }
 
-function resolveNoKeychain (options = {}) {
+function resolveNoNative (options = {}) {
   return options.noNative === true || options.native === false
 }
 

package/src/lib/providers/index.js

@@ -48,7 +48,7 @@ function armorProviderForOptions (options) {
 function useNative (options) {
   if (!['darwin', 'linux', 'win32'].includes(process.platform)) return false
   if (process.env.CI) return false
-  return options.noNative !== true && options.native !== false && options.noKeychain !== true
+  return options.noNative !== true && options.native !== false && process.env.DOTENVX_NO_NATIVE !== 'true'
 }
 
 function useOnePassword (options) {

package/src/lib/proxy/configureProxy.js

@@ -0,0 +1,55 @@
+const path = require('node:path')
+const fs = require('node:fs')
+const startProxy = require('./proxyServer')
+
+module.exports = async function configureProxy (commandArgs, env, credentials = [], session, explicitToken) {
+  const active = credentials.filter(credential => env[credential.name] === credential.placeholder)
+  if (active.length === 0) return { commandArgs, env }
+  const token = explicitToken || session.token()
+  if (!token || token.startsWith('encrypted:')) throw new Error('Credential proxy requires Armor login. Run [dotenvx armor login].')
+  const hostname = session.hostname()
+  const url = new URL(hostname)
+  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash) {
+    throw new Error('Credential proxy requires an HTTPS Armor hostname.')
+  }
+  const server = await startProxy({ credentials: active, token, hostname: url.href.replace(/\/$/, ''), devicePublicKey: session.devicePublicKey(), env })
+  const preload = path.join(path.dirname(server.caPath), 'proxy-preload.cjs')
+  try {
+    fs.writeFileSync(preload, require('./proxyPreloadSource'), { mode: 0o600 })
+  } catch (error) {
+    await server.close()
+    throw error
+  }
+  const nodeOptions = `${env.NODE_OPTIONS || ''} --require ${JSON.stringify(preload)}`.trim()
+  const args = /\.(mjs|cjs|js)$/.test(commandArgs[0])
+    ? [process.pkg ? 'node' : process.execPath, path.resolve(commandArgs[0]), ...commandArgs.slice(1)]
+    : commandArgs
+  return {
+    commandArgs: args,
+    close: server.close,
+    env: {
+      ...env,
+      NODE_OPTIONS: nodeOptions,
+      HTTP_PROXY: server.proxyUrl,
+      HTTPS_PROXY: server.proxyUrl,
+      ALL_PROXY: server.proxyUrl,
+      http_proxy: server.proxyUrl,
+      https_proxy: server.proxyUrl,
+      all_proxy: server.proxyUrl,
+      NO_PROXY: 'localhost,127.0.0.1,::1',
+      no_proxy: 'localhost,127.0.0.1,::1',
+      NODE_EXTRA_CA_CERTS: server.caPath,
+      SSL_CERT_FILE: server.caPath,
+      REQUESTS_CA_BUNDLE: server.caPath,
+      CURL_CA_BUNDLE: server.caPath,
+      GIT_SSL_CAINFO: server.caPath,
+      CARGO_HTTP_CAINFO: server.caPath,
+      DENO_CERT: server.caPath,
+      DOTENVX_PROXY_URL: server.proxyUrl,
+      DOTENVX_PROXY_SOCKET: undefined,
+      DOTENVX_PROXY_CONFIG: undefined,
+      DOTENVX_TOKEN: undefined,
+      DOTENVX_ARMOR_TOKEN: undefined
+    }
+  }
+}

package/src/lib/proxy/eligibleHeaders.js

@@ -0,0 +1,16 @@
+// Keep this policy in sync with Radar's GatewayService::EligibleHeaders.
+// Authentication headers (Authorization, X-Api-Key, etc.) are eligible. Routing,
+// transport, browser context, cookies and proxy control metadata are not.
+const EXCLUDED = new Set([
+  'host', 'connection', 'keep-alive', 'transfer-encoding', 'content-length',
+  'te', 'trailer', 'upgrade', 'expect', 'accept-encoding',
+  'cookie', 'set-cookie', 'forwarded', 'via', 'referer', 'origin', 'user-agent',
+  'x-real-ip', 'x-original-url', 'x-rewrite-url', 'x-http-method-override'
+])
+const PREFIXES = ['proxy-', 'dotenvx-', 'x-forwarded-', 'sec-']
+
+module.exports = function eligibleHeaders (name) {
+  const lower = name.toLowerCase()
+  return /^[!#$%&'*+.^_`|~0-9a-z-]+$/.test(lower) &&
+    !EXCLUDED.has(lower) && !PREFIXES.some(prefix => lower.startsWith(prefix))
+}

package/src/lib/proxy/prepareProxy.js

@@ -0,0 +1,24 @@
+const { randomBytes } = require('node:crypto')
+const { scan, upsert, encrypted } = require('@dotenvx/primitives')
+
+// Remove proxy credentials before any local or Armor decryption is attempted.
+module.exports = function prepareProxy (src, credentials, processEnv = {}, proxyRules = new Map()) {
+  const { parsed } = scan(src)
+  const publicKeys = Object.entries(parsed).filter(([name]) => name.startsWith('DOTENV_PUBLIC_KEY'))
+  for (const [name, values] of Object.entries(parsed)) {
+    if (!proxyRules.has(name)) continue
+    const replaced = values.map(value => {
+      if (!encrypted(value)) return value
+      if (publicKeys.length > 1) throw new Error('Credential proxy requires an unambiguous DOTENV_PUBLIC_KEY in its env file.')
+      const publicKey = publicKeys.length === 1 ? publicKeys[0][1].at(-1) : processEnv.DOTENV_PUBLIC_KEY
+      if (!publicKey || !/^(02|03)[0-9a-f]{64}$/i.test(publicKey)) {
+        throw new Error('Credential proxy requires DOTENV_PUBLIC_KEY alongside the encrypted credential.')
+      }
+      const placeholder = `dotenvx_proxy_${randomBytes(24).toString('hex')}`
+      credentials.push({ name, host: proxyRules.get(name), placeholder, ciphertext: value, publicKey })
+      return placeholder
+    })
+    src = upsert(src, name, replaced)
+  }
+  return src
+}