@dotenvx/dotenvx 2.3.4 → 2.4.0

package/CHANGELOG.md

@@ -2,7 +2,14 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.3.4...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.4.0...main)
+
+## [2.4.0](https://github.com/dotenvx/dotenvx/compare/v2.3.4...v2.4.0) (2026-07-10)
+
+### Added
+
+* Support multiple `-fk` flags for select commands ([#880](https://github.com/dotenvx/dotenvx/pull/880))
+* Support `-f ../..` directories ([#881](https://github.com/dotenvx/dotenvx/pull/881))
 
 ## [2.3.4](https://github.com/dotenvx/dotenvx/compare/v2.3.3...v2.3.4) (2026-07-09)
 

package/README.md

@@ -843,25 +843,45 @@ Hello Dotenvx
 Note the `DOTENV_PRIVATE_KEY` instructs `dotenvx run` to load the `.env` file and the `DOTENV_PRIVATE_KEY_PRODUCTION` instructs it to load the `.env.production` file. See the pattern?
 
 </details>
-<details><summary>combine multiple encrypted .env files for monorepo</summary><br>
+<details><summary>use directories with monorepos</summary><br>
+
+Point `-f` at a directory to load the `.env` inside it. From a workspace, this makes a shared root `.env` available without repeating its filename.
+
+```text
+my-monorepo/
+  .env
+  .env.keys
+  apps/
+    web/
+      index.js
+```
 
 ```sh
-$ mkdir app1
-$ mkdir app2
-$ dotenvx set HELLO app1 -f app1/.env.ci
-$ dotenvx set HELLO app2 -f app2/.env.ci
-$ echo "console.log('Hello ' + process.env.HELLO)" > index.js
+$ cd apps/web
 
-$ DOTENV_PRIVATE_KEY_CI="<app1/privat ci key>,<app2/private ci key>" dotenvx run -f app1/.env.ci -f app2/.env.ci -- node index.js
-[dotenvx@1.X.X] injecting env (2) from app1/.env.ci,app2/.env.ci
-Hello app1
+$ dotenvx get HELLO -f ../..
+World
 
-$ DOTENV_PRIVATE_KEY_CI="<app1/privat ci key>,<app2/private ci key>" dotenvx run -f app1/.env.ci -f app2/.env.ci --overload -- node index.js
-[dotenvx@1.X.X] injecting env (2) from app1/.env.ci,app2/.env.ci
-Hello app2
+$ dotenvx run -f ../.. -- node index.js
+[dotenvx@1.X.X] injecting env (1) from ../../.env
+Hello World
+```
+
+Encrypted values work without extra configuration when `.env.keys` sits beside the resolved `.env`.
+
+The directory also becomes the base when using a convention:
+
+```sh
+$ dotenvx run -f ../.. --convention=nextjs -- node index.js
+[dotenvx@1.X.X] injecting env (1) from ../../.env.development.local, ../../.env.local, ../../.env.development, ../../.env
+Hello development local
 ```
 
-Note the `DOTENV_PRIVATE_KEY_CI` (and any `DOTENV_PRIVATE_KEY*`) can take multiple private keys by simply comma separating them.
+If a workspace has its own `.env` but shares the root `.env.keys`, point `-fk` at the root directory:
+
+```sh
+$ dotenvx run -f . -fk ../.. -- node index.js
+```
 
 </details>
 <details><summary>`--stdout`</summary><br>
@@ -1108,6 +1128,17 @@ $ dotenvx get GOODBYE
 [MISSING_KEY] missing key (GOODBYE)
 ```
 
+</details>
+<details><summary>`run -f <directory>`</summary><br>
+
+Run a command using the `.env` file in a directory. This is useful with monorepos.
+
+```sh
+$ dotenvx run -f ../.. -- node index.js
+[dotenvx@1.X.X] injecting env (1) from ../../.env
+Hello World
+```
+
 </details>
 <details><summary>`run` - multiple `-f` flags</summary><br>
 
@@ -1383,6 +1414,17 @@ Hello development local
 
 (more conventions available upon request)
 
+</details>
+<details><summary>`run -f <directory> --convention=nextjs`</summary><br>
+
+Run a command using Next.js' convention from a directory. This is useful with monorepos.
+
+```sh
+$ dotenvx run -f ../.. --convention=nextjs -- node index.js
+[dotenvx@1.X.X] injecting env (1) from ../../.env.development.local, ../../.env.local, ../../.env.development, ../../.env
+Hello development local
+```
+
 </details>
 <details><summary>`run --convention=flow`</summary><br>
 
@@ -1490,6 +1532,16 @@ $ dotenvx get HELLO -f .env.production
 production
 ```
 
+</details>
+<details><summary>`get KEY -f <directory>`</summary><br>
+
+Return a single environment variable's value from the `.env` file in a directory. This is useful with monorepos.
+
+```sh
+$ dotenvx get HELLO -f ../..
+World
+```
+
 </details>
 <details><summary>`get KEY -fk`</summary><br>
 
@@ -1561,6 +1613,16 @@ $ DOTENV_CONFIG_CONVENTION=nextjs dotenvx get HELLO
 development local
 ```
 
+</details>
+<details><summary>`get KEY -f <directory> --convention=nextjs`</summary><br>
+
+Return a single environment variable's value using Next.js' convention from a directory. This is useful with monorepos.
+
+```sh
+$ dotenvx get HELLO -f ../.. --convention=nextjs
+development local
+```
+
 </details>
 <details><summary>`get KEY --convention=flow`</summary><br>
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.3.4",
+  "version": "2.4.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/get.js

@@ -1,12 +1,13 @@
 const { logger } = require('./../../shared/logger')
 
-const conventions = require('./../../lib/helpers/conventions')
 const escape = require('./../../lib/helpers/escape')
 const catchAndLog = require('./../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
 const getResolver = require('./../../lib/resolvers/get')
 const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDotenvConfigConvention')
+const buildCommandEnvs = require('../../lib/helpers/buildCommandEnvs')
+const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
 
 async function get (key) {
   const options = normalizeDotenvConfigConvention(this.opts())
@@ -21,13 +22,7 @@ async function get (key) {
   const ignore = options.ignore || []
   let errorCount = 0
 
-  let envs = []
-  // handle shorthand conventions - like --convention=nextjs
-  if (options.convention) {
-    envs = conventions(options.convention).concat(this.envs)
-  } else {
-    envs = this.envs
-  }
+  const envs = buildCommandEnvs(this.envs, options.convention)
 
   try {
     const sesh = new Session()
@@ -38,7 +33,7 @@ async function get (key) {
       envs,
       overload: options.overload,
       all: options.all,
-      envKeysFile: options.envKeysFile,
+      envKeysFile: resolveEnvKeysFile(options.envKeysFile),
       noArmor,
       noKeychain,
       onStatus: (text) => {

package/src/cli/actions/run.js

@@ -8,8 +8,9 @@ const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
 const normalizeDotenvConfigQuiet = require('../../lib/helpers/normalizeDotenvConfigQuiet')
 const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDotenvConfigConvention')
+const buildCommandEnvs = require('../../lib/helpers/buildCommandEnvs')
+const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
 
-const conventions = require('./../../lib/helpers/conventions')
 const { determine } = require('./../../lib/helpers/envResolution')
 
 function inferCommandArgsFromProcessArgv (argv) {
@@ -80,13 +81,7 @@ async function run () {
   }
 
   try {
-    let envs = []
-    // handle shorthand conventions - like --convention=nextjs
-    if (options.convention) {
-      envs = conventions(options.convention).concat(this.envs)
-    } else {
-      envs = this.envs
-    }
+    let envs = buildCommandEnvs(this.envs, options.convention)
     envs = determine(envs, process.env)
 
     const {
@@ -96,7 +91,7 @@ async function run () {
       envs,
       overload: options.overload,
       processEnv: process.env,
-      envKeysFile: options.envKeysFile,
+      envKeysFile: resolveEnvKeysFile(options.envKeysFile),
       noArmor,
       noKeychain,
       token: options.token,

package/src/cli/dotenvx.js

@@ -17,10 +17,17 @@ const envs = []
 function collectEnvs (type) {
   return function (value, previous) {
     envs.push({ type, value })
-    return previous.concat([value])
+    return (previous || []).concat([value])
   }
 }
 
+function collectEnvKeys (value, previous) {
+  if (previous === undefined) return value
+  if (Array.isArray(previous)) return previous.concat([value])
+
+  return [previous, value]
+}
+
 // global log levels
 program
   .usage('run -- yourcommand')
@@ -56,7 +63,7 @@ program.command('run')
   .addHelpText('after', examples.run)
   .option('-e, --env <strings...>', 'environment variable(s) set as string (example: "HELLO=World")', collectEnvs('env'), [])
   .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
-  .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
+  .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
   .option('-o, --overload', 'override existing env variables (by default, existing env vars take precedence over .env files)')
   .option('--strict', 'process.exit(1) on any errors', false)
   .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
@@ -76,7 +83,7 @@ program.command('get')
   .argument('[KEY]', 'environment variable name')
   .option('-e, --env <strings...>', 'environment variable(s) set as string (example: "HELLO=World")', collectEnvs('env'), [])
   .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
-  .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
+  .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
   .option('-o, --overload', 'override existing env variables (by default, existing env vars take precedence over .env files)')
   .option('--strict', 'process.exit(1) on any errors', false)
   .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
@@ -133,7 +140,7 @@ program.command('encrypt')
 program.command('decrypt')
   .description('decrypt .env file(s)')
   .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
-  .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
+  .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
   .option('-k, --key <keys...>', 'keys(s) to decrypt (default: all keys in file)')
   .option('-ek, --exclude-key <excludeKeys...>', 'keys(s) to exclude from decryption (default: none)')
   .option('--no-armor', 'disable Dotenvx Armor features')
@@ -149,8 +156,8 @@ program.command('keypair')
   .usage('[KEY] [options]')
   .description('print public/private keys for .env file(s)')
   .argument('[KEY]', 'environment variable key name')
-  .option('-f, --env-file <path>', 'path(s) to your env file(s)')
-  .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
+  .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'))
+  .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')
   .option('-pp, --pretty-print', 'pretty print output')

package/src/lib/helpers/buildCommandEnvs.js

@@ -0,0 +1,40 @@
+const conventions = require('./conventions')
+const resolveDirectoryFilepath = require('./resolveDirectoryFilepath')
+
+function buildCommandEnvs (envs, convention) {
+  const resolvedEnvs = []
+  let hasDirectory = false
+
+  for (const env of envs) {
+    if (env.type !== 'envFile') {
+      resolvedEnvs.push(env)
+      continue
+    }
+
+    const envFilepath = resolveDirectoryFilepath(env.value, '.env')
+    if (envFilepath === env.value) {
+      resolvedEnvs.push(env)
+      continue
+    }
+
+    hasDirectory = true
+    if (convention) {
+      for (const conventionEnv of conventions(convention)) {
+        resolvedEnvs.push({
+          ...conventionEnv,
+          value: resolveDirectoryFilepath(env.value, conventionEnv.value)
+        })
+      }
+    } else {
+      resolvedEnvs.push({ ...env, value: envFilepath })
+    }
+  }
+
+  if (convention && !hasDirectory) {
+    return conventions(convention).concat(resolvedEnvs)
+  }
+
+  return resolvedEnvs
+}
+
+module.exports = buildCommandEnvs

package/src/lib/helpers/resolveDirectoryFilepath.js

@@ -0,0 +1,16 @@
+const fs = require('fs')
+const path = require('path')
+
+function resolveDirectoryFilepath (filepath, filename) {
+  try {
+    if (fs.statSync(filepath).isDirectory()) {
+      return path.join(filepath, filename)
+    }
+  } catch (_error) {
+    // Preserve missing paths so the existing error handling can report them.
+  }
+
+  return filepath
+}
+
+module.exports = resolveDirectoryFilepath

package/src/lib/helpers/resolveEnvKeysFile.js

@@ -0,0 +1,11 @@
+const resolveDirectoryFilepath = require('./resolveDirectoryFilepath')
+
+function resolveEnvKeysFile (envKeysFile) {
+  if (Array.isArray(envKeysFile)) {
+    return envKeysFile.map(filepath => resolveDirectoryFilepath(filepath, '.env.keys'))
+  }
+
+  return envKeysFile && resolveDirectoryFilepath(envKeysFile, '.env.keys')
+}
+
+module.exports = resolveEnvKeysFile