@dotenvx/dotenvx 2.27.0 → 2.28.0

package/CHANGELOG.md

@@ -2,7 +2,24 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.27.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.28.0...main)
+
+## [2.28.0](https://github.com/dotenvx/dotenvx/compare/v2.27.0...v2.28.0) (2026-09-16)
+
+### Added
+
+* Choose where you custody your keys ([#972](https://github.com/dotenvx/dotenvx/pull/972))
+
+```text
+Your private key
+├── ⛉ Local Custody
+│   ├── OS (macOS Keychain / Windows Credential Manager / Linux Secret Service)
+│   ├── 1Password
+│   ├── Bitwarden
+│   └── File (.env.keys)
+└── ⛊ Managed Custody
+    └── ⛨ Armor
+```
 
 ## [2.27.0](https://github.com/dotenvx/dotenvx/compare/v2.26.1...v2.27.0) (2026-09-16)
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.27.0",
+  "version": "2.28.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/lib/helpers/prompts.js

@@ -8,7 +8,8 @@ function choicesForSelect (choices) {
 
     return {
       name: choice.value,
-      message: choice.name || choice.value
+      message: choice.name || choice.value,
+      ...(choice.disabled !== undefined ? { disabled: choice.disabled === true ? '(unavailable)' : choice.disabled } : {})
     }
   })
 }

package/src/lib/helpers/selectKeyStorage.js

@@ -13,22 +13,28 @@ async function selectKeyStorage (options = {}) {
   const defaultStorage = useNative ? 'native' : 'file'
   if (process.env.CI || options.noCreate || !process.stdin.isTTY || !process.stderr.isTTY) return defaultStorage
 
-  const choices = [
-    ...(useNative ? [{ name: `□ Local Custody (Native ${secretStoreNames[process.platform]})`, value: 'native' }] : [])
+  const use1Password = !options.no1Password && process.env.DOTENVX_NO_1PASSWORD !== 'true' && await onePasswordCustody.available()
+  const useBitwarden = !options.noBitwarden && process.env.DOTENVX_NO_BITWARDEN !== 'true' && await bitwardenCustody.available()
+  const localChoices = [
+    { name: `OS${secretStoreNames[process.platform] ? ` (${secretStoreNames[process.platform]})` : ''}`, value: 'native', disabled: !useNative },
+    { name: '1Password', value: 'onepassword', disabled: !use1Password },
+    { name: 'Bitwarden', value: 'bitwarden', disabled: !useBitwarden },
+    { name: 'File (.env.keys)', value: 'file', disabled: false }
   ]
-  if (!options.no1Password && process.env.DOTENVX_NO_1PASSWORD !== 'true' && await onePasswordCustody.available()) {
-    choices.push({ name: '□ Local Custody (1Password)', value: 'onepassword' })
-  }
-  if (!options.noBitwarden && process.env.DOTENVX_NO_BITWARDEN !== 'true' && await bitwardenCustody.available()) {
-    choices.push({ name: '□ Local Custody (Bitwarden)', value: 'bitwarden' })
-  }
-  if (!options.noArmor) choices.push({ name: '⛨ Managed Custody (Armor)', value: 'armored' })
-  if (choices.length < 2) return choices.length ? choices[0].value : defaultStorage
 
-  return prompts.select({
+  const choices = [{ name: '⛉ Local Custody', value: 'local', disabled: false }]
+  if (!options.noArmor) choices.push({ name: '⛊ Managed Custody', value: 'managed' })
+
+  const context = { input: process.stdin, output: process.stderr }
+  const custody = await prompts.select({
     message: 'Choose private key storage',
     choices
-  }, { input: process.stdin, output: process.stderr })
+  }, context)
+
+  return prompts.select({
+    message: custody === 'local' ? 'Choose local custody' : 'Choose managed custody',
+    choices: custody === 'local' ? localChoices : [{ name: '⛨ Armor', value: 'armored' }]
+  }, context)
 }
 
 module.exports = selectKeyStorage