@dotenvx/dotenvx 2.28.0 → 2.28.2

package/src/lib/helpers/selectKeyStorage.js

@@ -1,29 +1,15 @@
 const prompts = require('./prompts')
-const onePasswordCustody = require('./onePasswordCustody')
-const bitwardenCustody = require('./bitwardenCustody')
-
-const secretStoreNames = {
-  darwin: 'macOS Keychain',
-  win32: 'Windows Credential Manager',
-  linux: 'Linux Secret Service'
-}
+const custodians = require('../custodians')
 
 async function selectKeyStorage (options = {}) {
-  const useNative = !options.noNative && process.env.DOTENVX_NO_NATIVE !== 'true' && !process.env.CI && ['darwin', 'linux', 'win32'].includes(process.platform)
-  const defaultStorage = useNative ? 'native' : 'file'
+  const defaultStorage = custodians.get('native').enabled(options) ? 'native' : 'file'
   if (process.env.CI || options.noCreate || !process.stdin.isTTY || !process.stderr.isTTY) return defaultStorage
 
-  const use1Password = !options.no1Password && process.env.DOTENVX_NO_1PASSWORD !== 'true' && await onePasswordCustody.available()
-  const useBitwarden = !options.noBitwarden && process.env.DOTENVX_NO_BITWARDEN !== 'true' && await bitwardenCustody.available()
-  const localChoices = [
-    { name: `OS${secretStoreNames[process.platform] ? ` (${secretStoreNames[process.platform]})` : ''}`, value: 'native', disabled: !useNative },
-    { name: '1Password', value: 'onepassword', disabled: !use1Password },
-    { name: 'Bitwarden', value: 'bitwarden', disabled: !useBitwarden },
-    { name: 'File (.env.keys)', value: 'file', disabled: false }
-  ]
+  const localChoices = await custodians.choices(options)
 
   const choices = [{ name: '⛉ Local Custody', value: 'local', disabled: false }]
-  if (!options.noArmor) choices.push({ name: '⛊ Managed Custody', value: 'managed' })
+  const managedChoices = (await custodians.choices(options, 'managed')).filter(choice => !choice.disabled).map(({ name, value }) => ({ name, value }))
+  if (managedChoices.length) choices.push({ name: '⛊ Managed Custody', value: 'managed' })
 
   const context = { input: process.stdin, output: process.stderr }
   const custody = await prompts.select({
@@ -31,10 +17,12 @@ async function selectKeyStorage (options = {}) {
     choices
   }, context)
 
-  return prompts.select({
+  const storage = await prompts.select({
     message: custody === 'local' ? 'Choose local custody' : 'Choose managed custody',
-    choices: custody === 'local' ? localChoices : [{ name: '⛨ Armor', value: 'armored' }]
+    choices: custody === 'local' ? localChoices : managedChoices
   }, context)
+
+  return storage
 }
 
 module.exports = selectKeyStorage

package/src/lib/helpers/unlockedValue.js

@@ -0,0 +1,26 @@
+const crypto = require('crypto')
+
+function unlockedValue (lockedPrivateKey, passphrase) {
+  const parts = lockedPrivateKey.split(':')
+  const payload = Buffer.from(parts.slice(2).join(':'), 'base64url')
+  const version = payload.subarray(0, 1)[0]
+  const salt = payload.subarray(1, 17)
+  const iv = payload.subarray(17, 29)
+  const tag = payload.subarray(29, 45)
+  const ciphertext = payload.subarray(45)
+  const key = crypto.scryptSync(passphrase, salt, 32)
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv)
+
+  if (version !== 1) {
+    throw new Error('unsupported locked private key version')
+  }
+
+  decipher.setAuthTag(tag)
+
+  return Buffer.concat([
+    decipher.update(ciphertext),
+    decipher.final()
+  ]).toString('utf8')
+}
+
+module.exports = unlockedValue

package/src/lib/helpers/upsertEnvKey.js

@@ -1,5 +1,6 @@
 const fs = require('fs')
 const path = require('path')
+const fsx = require('./fsx')
 
 function escapeForRegex (value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
@@ -46,7 +47,7 @@ function upsertEnvKey (key, value, keysFilepath = '.env.keys') {
   const changed = created || nextSrc !== src
 
   if (changed) {
-    fs.writeFileSync(resolvedKeysFilepath, nextSrc, 'utf8')
+    fsx.writeKeyFileSync(resolvedKeysFilepath, nextSrc)
   }
 
   return {

package/src/lib/helpers/withLockedKeys.js

@@ -0,0 +1,41 @@
+const fs = require('fs')
+const { scan } = require('@dotenvx/primitives')
+const protection = require('../custodians/lock')
+
+// Primitives already resolve raw file/environment keys first. This provider
+// supplies locked keys only when the requested private key is still missing.
+function withLockedKeys (options, sync = false) {
+  const candidates = []
+  const paths = Array.isArray(options.fk) ? options.fk : [options.fk || '.env.keys']
+  for (const filepath of paths) {
+    let src
+    try { src = fs.readFileSync(filepath, 'utf8') } catch { continue }
+    for (const [name, values] of Object.entries(scan(src).parsed)) {
+      if (name.startsWith('DOTENV_PRIVATE_KEY')) candidates.push(...values.flatMap(value => value.split(',')))
+    }
+  }
+  // Environment assignments take precedence over key files.
+  for (const [name, value] of Object.entries(options.processEnv || process.env)) {
+    if (name.startsWith('DOTENV_PRIVATE_KEY') && typeof value === 'string') candidates.push(...value.split(','))
+  }
+  if (!candidates.some(value => value.startsWith('locked:'))) return options
+  candidates.reverse()
+  function find (publicKey) {
+    return candidates.find(value => value.startsWith(`locked:${publicKey}:`))
+  }
+  const provider = options.provider
+  return {
+    ...options,
+    provider: sync
+      ? publicKey => {
+        const value = find(publicKey)
+        return value ? protection.unlockSync(publicKey, { [publicKey]: value }, options) : (provider ? provider(publicKey) : {})
+      }
+      : async publicKey => {
+        const value = find(publicKey)
+        return value ? protection.unlock(publicKey, { [publicKey]: value }, options) : (provider ? provider(publicKey) : {})
+      }
+  }
+}
+
+module.exports = withLockedKeys

package/src/lib/main.d.ts

@@ -50,6 +50,9 @@ export function parse<T extends DotenvParseOutput = DotenvParseOutput>(
 ): T;
 
 export interface DotenvConfigOptions {
+  /** Password to unlock private keys in memory. Defaults to DOTENVX_LOCK_PASSWORD. */
+  lockPassword?: string;
+
   /**
    * Specify explicit env sources. When set, `path` and `convention` are ignored.
    *
@@ -339,6 +342,9 @@ export function set(
 ): Promise<SetOutput>;
 
 export interface GetOptions {
+  /** Password to unlock private keys in memory. Defaults to DOTENVX_LOCK_PASSWORD. */
+  lockPassword?: string;
+
   /**
    * Specify a custom path if your file containing environment variables is located elsewhere.
    * Can also be an array of strings, specifying multiple paths.

package/src/lib/main.js

@@ -92,6 +92,7 @@ const config = function (options = {}) {
       noNative,
       no1Password: options.no1Password,
       noBitwarden: options.noBitwarden,
+      lockPassword: options.lockPassword,
       noSpinner: options.noSpinner,
       token: options.token
     })
@@ -259,12 +260,13 @@ const set = async function (key, value, options = {}) {
     noNative,
     no1Password: options.no1Password,
     noBitwarden: options.noBitwarden,
+    lockPassword: options.lockPassword,
     noCreate,
     encrypt
   })
 
   if (keysSrc) {
-    fsx.writeFileXSync(envKeysFilepath || '.env.keys', keysSrc)
+    fsx.writeKeyFileSync(envKeysFilepath || '.env.keys', keysSrc)
   }
 
   let withEncryption = ''
@@ -341,7 +343,8 @@ const get = async function (key, options = {}) {
     noArmor,
     noNative,
     no1Password: options.no1Password,
-    noBitwarden: options.noBitwarden
+    noBitwarden: options.noBitwarden,
+    lockPassword: options.lockPassword
   })
 
   if (options.mask !== undefined) {

package/src/lib/providers/index.js

@@ -1,15 +1,4 @@
-const Session = require('./../../db/session')
-
-const armorProvider = require('./armor/index')
-const nativeProvider = require('./native/index')
-const onePasswordCustody = require('../helpers/onePasswordCustody')
-const bitwardenCustody = require('../helpers/bitwardenCustody')
-
-function syncArmorProvider (publicKeyHex) {
-  const { createSyncFn } = require('@dotenvx/tooling')
-  const runProviderSync = createSyncFn(require.resolve('./provider-worker.js'))
-  return runProviderSync(publicKeyHex)
-}
+const custodians = require('../custodians')
 
 function hasKey (keyring, publicKeyHex) {
   return keyring && keyring[publicKeyHex]
@@ -37,32 +26,6 @@ function composeProvidersSync (providerFns) {
   }
 }
 
-function armorProviderForOptions (options) {
-  return (publicKeyHex) => armorProvider(publicKeyHex, {
-    onStatus: options.onStatus,
-    token: options.token,
-    command: options.command
-  })
-}
-
-function useNative (options) {
-  if (!['darwin', 'linux', 'win32'].includes(process.platform)) return false
-  if (process.env.CI) return false
-  return options.noNative !== true && options.native !== false && process.env.DOTENVX_NO_NATIVE !== 'true'
-}
-
-function useOnePassword (options) {
-  return options.no1Password !== true && process.env.DOTENVX_NO_1PASSWORD !== 'true' && onePasswordCustody.configured()
-}
-
-function useBitwarden (options) {
-  return options.noBitwarden !== true && process.env.DOTENVX_NO_BITWARDEN !== 'true' && bitwardenCustody.configured()
-}
-
-function useArmor (options, noArmor) {
-  return options.noArmor !== true && options.armor !== false && !noArmor
-}
-
 function providerFrom (providerFns, compose) {
   if (providerFns.length === 0) return null
   if (providerFns.length === 1) return providerFns[0]
@@ -75,21 +38,11 @@ async function providers (options = {}) {
     return options.provider
   }
 
-  const providerFns = []
-
-  if (useNative(options)) {
-    providerFns.push(nativeProvider)
-  }
-
-  if (useOnePassword(options)) providerFns.push(onePasswordCustody.get)
-  if (useBitwarden(options)) providerFns.push(bitwardenCustody.get)
+  const providerFns = custodians.providers(options)
 
-  if (options.noArmor !== true && options.armor !== false) {
-    const sesh = new Session()
-    const noArmor = !options.token && await sesh.noArmor()
-    if (useArmor(options, noArmor)) {
-      providerFns.push(armorProviderForOptions(options))
-    }
+  const armor = custodians.get('armored')
+  if (armor.enabled(options) && await armor.configured(options)) {
+    providerFns.push(publicKey => armor.get(publicKey, options))
   }
 
   return providerFrom(providerFns, composeProviders)
@@ -100,21 +53,11 @@ providers.sync = function providersSync (options = {}) {
     return options.provider
   }
 
-  const providerFns = []
-
-  if (useNative(options)) {
-    providerFns.push(nativeProvider)
-  }
+  const providerFns = custodians.providers(options, true)
 
-  if (useOnePassword(options)) providerFns.push(onePasswordCustody.getSync)
-  if (useBitwarden(options)) providerFns.push(bitwardenCustody.getSync)
-
-  if (options.noArmor !== true && options.armor !== false) {
-    const sesh = new Session()
-    const noArmor = !options.token && sesh.noArmorSync()
-    if (useArmor(options, noArmor)) {
-      providerFns.push(syncArmorProvider)
-    }
+  const armor = custodians.get('armored')
+  if (armor.enabled(options) && armor.configuredSync(options)) {
+    providerFns.push(armor.getSync)
   }
 
   return providerFrom(providerFns, composeProvidersSync)

package/src/lib/providers/native/index.js

@@ -1,62 +1,2 @@
-const macosKeychain = require('../../helpers/macosKeychain')
-const windowsCredentialManager = require('../../helpers/windowsCredentialManager')
-const linuxSecretService = require('../../helpers/linuxSecretService')
-
-function get (key) {
-  if (process.platform === 'win32') {
-    return windowsCredentialManager.get(key)
-  }
-
-  if (process.platform === 'linux') {
-    return linuxSecretService.get(key)
-  }
-
-  return macosKeychain.get(key)
-}
-
-function set (key, value, label = key) {
-  if (process.platform === 'win32') {
-    windowsCredentialManager.set(key, value, label)
-    return
-  }
-
-  if (process.platform === 'linux') {
-    linuxSecretService.set(key, value, label)
-    return
-  }
-
-  macosKeychain.set(key, value, label)
-}
-
-index.delete = function (key) {
-  if (process.platform === 'win32') {
-    windowsCredentialManager.delete(key)
-    return
-  }
-
-  if (process.platform === 'linux') {
-    linuxSecretService.delete(key)
-    return
-  }
-
-  macosKeychain.delete(key)
-}
-
-function index (publicKeyHex) {
-  if (!['darwin', 'linux', 'win32'].includes(process.platform)) return {}
-
-  try {
-    const privateKeyHex = get(publicKeyHex)
-
-    if (!privateKeyHex) return {}
-
-    return { [publicKeyHex]: privateKeyHex }
-  } catch {
-    return {}
-  }
-}
-
-index.set = set
-index.get = get
-
-module.exports = index
+// Compatibility adapter for session credentials and native transfer commands.
+module.exports = require('../../custodians/local/native/backend')

package/src/lib/providers/provider-worker.js

@@ -1,5 +1,5 @@
 const { runAsWorker } = require('@dotenvx/tooling')
-const provider = require('./armor/index')
+const provider = require('../custodians/managed/armor').get
 
 runAsWorker(async (publicKeyHex) => {
   return provider(publicKeyHex)

package/src/lib/resolvers/envs.js

@@ -54,8 +54,9 @@ function inject (processEnv, parsed) {
   }
 }
 
-function buildParseOptions ({ processEnv, overload, envKeysFilepath, provider, decryptor, proxyCredentials, proxyRules }) {
+function buildParseOptions ({ lockPassword, processEnv, overload, envKeysFilepath, provider, decryptor, proxyCredentials, proxyRules }) {
   const options = {
+    lockPassword,
     processEnv,
     overload,
     proxyCredentials,
@@ -76,7 +77,7 @@ function buildParseOptions ({ processEnv, overload, envKeysFilepath, provider, d
   return options
 }
 
-async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, no1Password, noBitwarden, onStatus, proxyCredentials, proxyRules }) {
+async function injectEnv ({ env, lockPassword, overload, processEnv, envKeysFilepath, provider, decryptor, no1Password, noBitwarden, onStatus, proxyCredentials, proxyRules }) {
   const row = {}
   row.type = TYPE_ENV
   row.string = env.value
@@ -90,6 +91,7 @@ async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider
     const parseOptions = buildParseOptions({
       processEnv: parseProcessEnv,
       overload,
+      lockPassword,
       envKeysFilepath,
       provider,
       decryptor,
@@ -131,7 +133,7 @@ async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider
   return row
 }
 
-function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, no1Password, noBitwarden }) {
+function injectEnvSync ({ env, lockPassword, overload, processEnv, envKeysFilepath, provider, decryptor, no1Password, noBitwarden }) {
   const row = {}
   row.type = TYPE_ENV
   row.string = env.value
@@ -145,6 +147,7 @@ function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider,
     const parseOptions = buildParseOptions({
       processEnv: parseProcessEnv,
       overload,
+      lockPassword,
       envKeysFilepath,
       provider,
       decryptor
@@ -183,7 +186,7 @@ function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider,
   return row
 }
 
-async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths, no1Password, noBitwarden, onStatus, proxyCredentials, proxyRules }) {
+async function injectEnvFile ({ env, lockPassword, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths, no1Password, noBitwarden, onStatus, proxyCredentials, proxyRules }) {
   const row = {}
   row.type = TYPE_ENV_FILE
   row.filepath = env.value
@@ -199,6 +202,7 @@ async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, prov
     const parseOptions = buildParseOptions({
       processEnv,
       overload,
+      lockPassword,
       envKeysFilepath: fk,
       provider,
       decryptor,
@@ -245,7 +249,7 @@ async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, prov
   return row
 }
 
-function injectEnvFileSync ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths, no1Password, noBitwarden }) {
+function injectEnvFileSync ({ env, lockPassword, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths, no1Password, noBitwarden }) {
   const row = {}
   row.type = TYPE_ENV_FILE
   row.filepath = env.value
@@ -261,6 +265,7 @@ function injectEnvFileSync ({ env, overload, processEnv, envKeysFilepath, provid
     const parseOptions = buildParseOptions({
       processEnv,
       overload,
+      lockPassword,
       envKeysFilepath: fk,
       provider,
       decryptor
@@ -318,6 +323,7 @@ async function envs (options = {}) {
       processedEnvs.push(await injectEnvFile({
         env,
         overload: options.overload,
+        lockPassword: options.lockPassword,
         processEnv,
         envKeysFilepath,
         provider,
@@ -333,6 +339,7 @@ async function envs (options = {}) {
       processedEnvs.push(await injectEnv({
         env,
         overload: options.overload,
+        lockPassword: options.lockPassword,
         processEnv,
         envKeysFilepath,
         provider,
@@ -367,6 +374,7 @@ function envsSync (options = {}) {
       processedEnvs.push(injectEnvFileSync({
         env,
         overload: options.overload,
+        lockPassword: options.lockPassword,
         processEnv,
         envKeysFilepath,
         provider,
@@ -379,6 +387,7 @@ function envsSync (options = {}) {
       processedEnvs.push(injectEnvSync({
         env,
         overload: options.overload,
+        lockPassword: options.lockPassword,
         processEnv,
         envKeysFilepath,
         provider,

package/src/lib/resolvers/get.js

@@ -53,6 +53,7 @@ function buildOptions (options, processEnv) {
     noNative: options.noNative,
     no1Password: options.no1Password,
     noBitwarden: options.noBitwarden,
+    lockPassword: options.lockPassword,
     onStatus: options.onStatus
   }
 }

package/src/lib/services/custodyTransfer.js

@@ -1,4 +1,4 @@
-const { derive } = require('@dotenvx/primitives')
+const matchesStoredKey = require('../helpers/matchesStoredKey')
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const removeEnvKey = require('../helpers/removeEnvKey')
@@ -6,7 +6,7 @@ const upsertEnvKey = require('../helpers/upsertEnvKey')
 
 function verify (publicKey, privateKey) {
   try {
-    if (derive(privateKey) === publicKey) return
+    if (matchesStoredKey(publicKey, privateKey)) return
   } catch {}
   throw new Error('private key does not match the .env public key')
 }

package/src/lib/services/init.js

@@ -0,0 +1,49 @@
+const fs = require('node:fs')
+const path = require('node:path')
+const { scan, encrypted } = require('@dotenvx/primitives')
+
+module.exports = function init ({ directory = process.cwd(), envFile } = {}) {
+  const target = path.resolve(directory, 'Envfile')
+  // lstat also preserves dangling symlinks. Never overwrite an existing Envfile.
+  try {
+    fs.lstatSync(target)
+    return { created: false }
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error
+  }
+
+  const sources = []
+  const names = new Set()
+  let requireEncryption = false
+  for (const candidate of envFile ? [envFile] : ['.env.example', '.env']) {
+    let src
+    try {
+      src = fs.readFileSync(path.resolve(directory, candidate), 'utf8')
+    } catch (error) {
+      if (envFile || error.code !== 'ENOENT') throw error
+      continue
+    }
+    sources.push(candidate)
+    // scan preserves every assignment as an array, without decrypting or expanding.
+    for (const [key, values] of Object.entries(scan(src).parsed)) {
+      if (/^DOTENV_(?:PUBLIC|PRIVATE)_KEY(?:_|$)/.test(key)) continue
+      names.add(key)
+      if (values.some(value => encrypted(value))) requireEncryption = true
+    }
+  }
+
+  const keys = [...names]
+  const invalid = keys.filter(key => !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+  if (invalid.length) throw new Error(`Unsupported Envfile variable names: ${invalid.join(', ')}`)
+
+  const declarations = keys.map(key => `env "${key}"`).join('\n')
+  const content = `encrypted ${requireEncryption}\n` +
+    (declarations ? `\n${declarations}\n` : '')
+  try {
+    fs.writeFileSync(target, content, { flag: 'wx' })
+  } catch (error) {
+    if (error.code === 'EEXIST') return { created: false }
+    throw error
+  }
+  return { created: true, source: sources.join(', '), count: keys.length }
+}

package/src/lib/services/precommit.js

@@ -17,10 +17,14 @@ class Precommit {
     this.directory = directory
     // options
     this.install = options.install
+    this.global = options.global
     this.excludeEnvFile = ['test/**', 'tests/**', 'spec/**', 'specs/**', 'pytest/**', 'test_suite/**']
   }
 
   run () {
+    if (this.global && !this.install) {
+      throw new Error('--global requires --install')
+    }
     if (this.install) {
       const {
         successMessage
@@ -136,7 +140,14 @@ class Precommit {
   }
 
   _installPrecommitHook () {
-    return new InstallPrecommitHook().run()
+    if (this.global) {
+      const attributesPath = require('../helpers/installPrecommitFilter')(true)
+      return { successMessage: `▣ dotenvx required clean filter installed globally [${attributesPath}]` }
+    }
+    const hookPath = require('../helpers/installPrecommitFilter')()
+    const result = new InstallPrecommitHook(hookPath).run()
+    result.successMessage += '\n▣ dotenvx required clean filter installed (blocks staging plaintext .env files)'
+    return result
   }
 }
 

package/src/lib/services/validate.js

@@ -31,6 +31,7 @@ module.exports = async function validate ({ envs = [], options = {}, processEnv
     noNative: options.native === false || options.noNative === true,
     no1Password: options['1password'] === false || options.no1Password === true,
     noBitwarden: options.bitwarden === false || options.noBitwarden === true,
+    lockPassword: options.lockPassword,
     token: options.token,
     command,
     onStatus

package/src/lib/transforms/encrypt.js

@@ -8,18 +8,11 @@ const SAMPLE_ENV_KIT = require('../helpers/kits/sample')
 const Errors = require('../helpers/errors')
 const { determine } = require('./../helpers/envResolution')
 const detectEncoding = require('./../helpers/detectEncoding')
-const { isDotenvPublicKey, isPlainKey, mutateSrc, mutateKeysSrc } = require('../helpers/cryptography')
+const { isDotenvPublicKey, isPlainKey, mutateSrc } = require('../helpers/cryptography')
 const keynames = require('../conventions/keynames')
-const PostArmorUp = require('../api/postArmorUp')
-const prompts = require('../helpers/prompts')
-const teamChoicesFromMeta = require('../helpers/teamChoicesFromMeta')
-const isTeamRequiredError = require('../helpers/isTeamRequiredError')
-const Session = require('../../db/session')
 
 const selectKeyStorage = require('../helpers/selectKeyStorage')
-const storeNativePrivateKey = require('../helpers/storeNativePrivateKey')
-const onePasswordCustody = require('../helpers/onePasswordCustody')
-const bitwardenCustody = require('../helpers/bitwardenCustody')
+const custodians = require('../custodians')
 
 async function encryptTransform (options = {}) {
   const envs = options.envs || []
@@ -27,6 +20,7 @@ async function encryptTransform (options = {}) {
   const ek = options.ek
   const fk = options.fk || '.env.keys'
   let storage
+  const custodyContext = {}
   const noCreate = options.noCreate
 
   const processedEnvs = []
@@ -87,46 +81,9 @@ async function encryptTransform (options = {}) {
 
         const comment = path.basename(envFilepath)
 
-        if (storage === 'bitwarden') {
-          await bitwardenCustody.set(publicKey, privateKey)
-        } else if (storage === 'onepassword') {
-          await onePasswordCustody.set(publicKey, privateKey)
-        } else if (storage === 'native' && storeNativePrivateKey(publicKey, privateKey, fk)) {
-          row.nativePrivateKeyAdded = true
-        } else if (storage !== 'armored') {
-          const mutated = mutateKeysSrc({ keysSrc, privateKeyName, privateKeyValue: privateKey, comment })
-          keysSrc = mutated.keysSrc
-        } else {
-          const sesh = new Session()
-          const hostname = sesh.hostname()
-          const token = sesh.token()
-          const devicePublicKey = sesh.devicePublicKey()
-
-          try {
-            await new PostArmorUp(hostname, token, devicePublicKey, publicKey, privateKey, undefined).run()
-          } catch (error) {
-            if (!isTeamRequiredError(error)) {
-              throw error
-            }
-
-            const choices = teamChoicesFromMeta(error.meta)
-
-            let team = choices[0].value
-            if (choices.length > 1) {
-              team = await prompts.select({
-                message: 'Select team',
-                choices
-              }, {
-                input: process.stdin,
-                output: process.stderr
-              })
-            }
-
-            await new PostArmorUp(hostname, token, devicePublicKey, publicKey, privateKey, team).run()
-          }
-
-          // don't set keysSrc (in armor)
-        }
+        const stored = await custodians.store(storage, publicKey, privateKey, Object.assign(custodyContext, { keysSrc, privateKeyName, comment, keysFilepath: fk }))
+        if (Object.prototype.hasOwnProperty.call(stored, 'keysSrc')) keysSrc = stored.keysSrc
+        if (stored.nativePrivateKeyAdded) row.nativePrivateKeyAdded = true
       }
 
       const { parsed } = scan(row.envSrc, { ik, ek })