@dotenvx/dotenvx 2.4.0 → 2.5.0

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.4.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.5.0...main)
+
+## [2.5.0](https://github.com/dotenvx/dotenvx/compare/v2.4.2...v2.5.0) (2026-07-11)
+
+### Added
+
+* Support `native up|down|pull|push` for windows ([#833](https://github.com/dotenvx/dotenvx/pull/883))
+
+## [2.4.1](https://github.com/dotenvx/dotenvx/compare/v2.4.0...v2.4.1) (2026-07-10)
+
+### Added
+
+* Support `config(path:)` as a directory like `app/web`. Useful for monorepos ([#882](https://github.com/dotenvx/dotenvx/pull/882))
 
 ## [2.4.0](https://github.com/dotenvx/dotenvx/compare/v2.3.4...v2.4.0) (2026-07-10)
 

package/README.md

@@ -2482,9 +2482,9 @@ $ dotenvx lock down
 </details>
 <details><summary>`native`</summary><br>
 
-Move private keys into your OS secret store (macOS Keychain supported).
+Move private keys into your OS secret store.
 
-Currently supported on macOS.
+Native commands support macOS Keychain and Windows Credential Manager.
 
 </details>
 <details><summary>`native up`</summary><br>
@@ -2646,7 +2646,7 @@ Commands:
  
 Professional Security: 
   lock                     ⊡ lock private keys with a local passphrase
-  native                   ⌥ move private keys into your OS secret store (macOS Keychain supported)
+  native                   ⌥ move private keys into your OS secret store (macOS and Windows supported)
   armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]
 ```
 
@@ -2928,6 +2928,28 @@ You can also set `DOTENV_CONFIG_CONVENTION=nextjs`.
 $ DOTENV_CONFIG_CONVENTION=nextjs node index.js
 ```
 
+</details>
+<details><summary>`config(path: directory, convention: 'nextjs')` - directory</summary><br>
+
+Use a directory as `path` to make it the base for convention files. This is useful when loading a workspace's env files from a monorepo root.
+
+```js
+// index.js
+require('@dotenvx/dotenvx').config({
+  path: 'apps/web',
+  convention: 'nextjs'
+})
+```
+
+This loads the convention from `apps/web`:
+
+```text
+apps/web/.env.development.local
+apps/web/.env.local
+apps/web/.env.development
+apps/web/.env
+```
+
 </details>
 <details><summary>`config(noArmor:)` - noArmor</summary><br>
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.4.0",
+  "version": "2.5.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/commands/native.js

@@ -1,6 +1,6 @@
 function configureNativeCommand (native) {
   native
-    .description('move private keys into your OS secret store (macOS Keychain supported)')
+    .description('move private keys into your OS secret store (macOS and Windows supported)')
     .action(function () {
       this.help()
     })

package/src/cli/dotenvx.js

@@ -260,7 +260,7 @@ program.command('help [command]')
 program.addHelpText('after', ' ')
 program.addHelpText('after', 'Professional Security: ')
 program.addHelpText('after', '  lock                     ⊡ lock private keys with a local passphrase')
-program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store (macOS Keychain supported)')
+program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store (macOS and Windows supported)')
 program.addHelpText('after', '  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
 
 // dotenvx native

package/src/lib/helpers/buildConfigEnvs.js

@@ -0,0 +1,13 @@
+const buildCommandEnvs = require('./buildCommandEnvs')
+const buildEnvs = require('./buildEnvs')
+
+function buildConfigEnvs (options = {}) {
+  if (options.envs) {
+    return options.envs
+  }
+
+  const pathOptions = { ...options, convention: undefined }
+  return buildCommandEnvs(buildEnvs(pathOptions), options.convention)
+}
+
+module.exports = buildConfigEnvs

package/src/lib/helpers/windowsCredentialManager.js

@@ -0,0 +1,161 @@
+const { execFileSync } = require('child_process')
+
+const POWERSHELL_BIN = 'powershell.exe'
+const SERVICE = 'dotenvx'
+
+const script = `
+$ErrorActionPreference = 'Stop'
+
+Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public static class DotenvxCredentialManager
+{
+    private const uint CRED_TYPE_GENERIC = 1;
+    private const uint CRED_PERSIST_LOCAL_MACHINE = 2;
+    private const int ERROR_NOT_FOUND = 1168;
+
+    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+    private struct Credential
+    {
+        public uint Flags;
+        public uint Type;
+        public string TargetName;
+        public string Comment;
+        public long LastWritten;
+        public uint CredentialBlobSize;
+        public IntPtr CredentialBlob;
+        public uint Persist;
+        public uint AttributeCount;
+        public IntPtr Attributes;
+        public string TargetAlias;
+        public string UserName;
+    }
+
+    [DllImport("Advapi32.dll", EntryPoint = "CredWriteW", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern bool CredWrite(ref Credential credential, uint flags);
+
+    [DllImport("Advapi32.dll", EntryPoint = "CredReadW", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern bool CredRead(string target, uint type, uint flags, out IntPtr credentialPtr);
+
+    [DllImport("Advapi32.dll", EntryPoint = "CredDeleteW", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern bool CredDelete(string target, uint type, uint flags);
+
+    [DllImport("Advapi32.dll", SetLastError = true)]
+    private static extern void CredFree(IntPtr credentialPtr);
+
+    public static string Read(string target)
+    {
+        IntPtr credentialPtr;
+        if (!CredRead(target, CRED_TYPE_GENERIC, 0, out credentialPtr))
+        {
+            int error = Marshal.GetLastWin32Error();
+            if (error == ERROR_NOT_FOUND) return null;
+            throw new Win32Exception(error);
+        }
+
+        try
+        {
+            Credential credential = (Credential)Marshal.PtrToStructure(credentialPtr, typeof(Credential));
+            if (credential.CredentialBlob == IntPtr.Zero || credential.CredentialBlobSize == 0) return null;
+            return Marshal.PtrToStringUni(credential.CredentialBlob, (int)credential.CredentialBlobSize / 2);
+        }
+        finally
+        {
+            CredFree(credentialPtr);
+        }
+    }
+
+    public static void Write(string target, string username, string secret)
+    {
+        IntPtr secretPtr = Marshal.StringToCoTaskMemUni(secret);
+        try
+        {
+            Credential credential = new Credential();
+            credential.Type = CRED_TYPE_GENERIC;
+            credential.TargetName = target;
+            credential.CredentialBlobSize = (uint)Encoding.Unicode.GetByteCount(secret);
+            credential.CredentialBlob = secretPtr;
+            credential.Persist = CRED_PERSIST_LOCAL_MACHINE;
+            credential.UserName = username;
+
+            if (!CredWrite(ref credential, 0))
+            {
+                throw new Win32Exception(Marshal.GetLastWin32Error());
+            }
+        }
+        finally
+        {
+            Marshal.ZeroFreeCoTaskMemUnicode(secretPtr);
+        }
+    }
+
+    public static void Delete(string target)
+    {
+        if (!CredDelete(target, CRED_TYPE_GENERIC, 0))
+        {
+            throw new Win32Exception(Marshal.GetLastWin32Error());
+        }
+    }
+}
+'@
+
+$payload = [Console]::In.ReadToEnd() | ConvertFrom-Json
+
+if ($payload.action -eq 'read') {
+    $secret = [DotenvxCredentialManager]::Read([string]$payload.target)
+    if ($null -ne $secret) {
+        [Console]::Out.Write($secret)
+    }
+} elseif ($payload.action -eq 'write') {
+    [DotenvxCredentialManager]::Write([string]$payload.target, [string]$payload.username, [string]$payload.secret)
+} elseif ($payload.action -eq 'delete') {
+    [DotenvxCredentialManager]::Delete([string]$payload.target)
+} else {
+    throw "unsupported credential action"
+}
+`
+
+const encodedScript = Buffer.from(script, 'utf16le').toString('base64')
+
+function target (publicKey) {
+  return `${SERVICE}:${publicKey}`
+}
+
+function run (payload) {
+  return execFileSync(POWERSHELL_BIN, ['-NoProfile', '-NonInteractive', '-EncodedCommand', encodedScript], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    stdio: ['pipe', 'pipe', 'pipe'],
+    windowsHide: true
+  })
+}
+
+function findGenericPassword (publicKey) {
+  try {
+    return run({ action: 'read', target: target(publicKey) }).trim() || null
+  } catch {
+    throw new Error('failed to read private key from Windows Credential Manager')
+  }
+}
+
+function addGenericPassword (publicKey, privateKey) {
+  try {
+    run({ action: 'write', target: target(publicKey), username: publicKey, secret: privateKey })
+  } catch {
+    throw new Error('failed to save private key to Windows Credential Manager')
+  }
+}
+
+function deleteGenericPassword (publicKey) {
+  try {
+    run({ action: 'delete', target: target(publicKey) })
+  } catch {
+    throw new Error('failed to delete private key from Windows Credential Manager')
+  }
+}
+
+module.exports = { findGenericPassword, addGenericPassword, deleteGenericPassword }

package/src/lib/main.js

@@ -18,6 +18,7 @@ const setTransform = require('./transforms/set')
 
 // helpers
 const buildEnvs = require('./helpers/buildEnvs')
+const buildConfigEnvs = require('./helpers/buildConfigEnvs')
 const { determine } = require('./helpers/envResolution')
 const fsx = require('./helpers/fsx')
 const decryptKeyValue = require('./helpers/cryptography/decryptKeyValue')
@@ -69,7 +70,7 @@ const config = function (options = {}) {
   const noKeychain = resolveNoKeychain(options)
 
   try {
-    let envs = buildEnvs(options)
+    let envs = buildConfigEnvs(options)
     if (!options.envs) {
       envs = determine(envs, processEnv)
     }

package/src/lib/providers/index.js

@@ -1,7 +1,7 @@
 const Session = require('./../../db/session')
 
 const armorProvider = require('./armor/index')
-const keychainProvider = require('./keychain/index')
+const nativeProvider = require('./native/index')
 
 function syncArmorProvider (publicKeyHex) {
   const { createSyncFn } = require('@dotenvx/tooling')
@@ -43,8 +43,8 @@ function armorProviderForOptions (options) {
   })
 }
 
-function useKeychain (options) {
-  if (process.platform !== 'darwin') return false
+function useNative (options) {
+  if (process.platform !== 'darwin' && process.platform !== 'win32') return false
   if (process.env.CI) return false
   return options.noNative !== true && options.native !== false && options.noKeychain !== true
 }
@@ -67,8 +67,8 @@ async function providers (options = {}) {
 
   const providerFns = []
 
-  if (useKeychain(options)) {
-    providerFns.push(keychainProvider)
+  if (useNative(options)) {
+    providerFns.push(nativeProvider)
   }
 
   if (options.noArmor !== true && options.armor !== false) {
@@ -89,8 +89,8 @@ providers.sync = function providersSync (options = {}) {
 
   const providerFns = []
 
-  if (useKeychain(options)) {
-    providerFns.push(keychainProvider)
+  if (useNative(options)) {
+    providerFns.push(nativeProvider)
   }
 
   if (options.noArmor !== true && options.armor !== false) {

package/src/lib/providers/native/index.js

@@ -0,0 +1,28 @@
+const { execFileSync } = require('child_process')
+
+const windowsCredentialManager = require('../../helpers/windowsCredentialManager')
+
+const SECURITY_BIN = '/usr/bin/security'
+const SERVICE = 'dotenvx'
+
+function findMacosPrivateKey (publicKeyHex) {
+  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKeyHex, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+}
+
+function index (publicKeyHex) {
+  if (process.platform !== 'darwin' && process.platform !== 'win32') return {}
+
+  try {
+    const privateKeyHex = process.platform === 'win32'
+      ? windowsCredentialManager.findGenericPassword(publicKeyHex)
+      : findMacosPrivateKey(publicKeyHex)
+
+    if (!privateKeyHex) return {}
+
+    return { [publicKeyHex]: privateKeyHex }
+  } catch {
+    return {}
+  }
+}
+
+module.exports = index

package/src/lib/services/keychainDown.js

@@ -3,10 +3,29 @@ const { execFileSync } = require('child_process')
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const upsertEnvKey = require('../helpers/upsertEnvKey')
+const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
+const windowsCredentialManager = require('../helpers/windowsCredentialManager')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
 
+function findGenericPassword (publicKey) {
+  if (process.platform === 'win32') {
+    return windowsCredentialManager.findGenericPassword(publicKey)
+  }
+
+  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+}
+
+function deleteGenericPassword (publicKey) {
+  if (process.platform === 'win32') {
+    windowsCredentialManager.deleteGenericPassword(publicKey)
+    return
+  }
+
+  execFileSync(SECURITY_BIN, ['delete-generic-password', '-s', SERVICE, '-a', publicKey], { stdio: 'ignore' })
+}
+
 class KeychainDown {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
     this.envFile = envFile
@@ -26,7 +45,11 @@ class KeychainDown {
     let privateKey
 
     try {
-      privateKey = execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+      privateKey = findGenericPassword(publicKey)
+      if (!privateKey) {
+        const secretStore = process.platform === 'win32' ? 'Windows Credential Manager' : 'macOS Keychain'
+        throw new Error(`[NOT_FOUND] private key not found in ${secretStore} (${armoredKeyDisplay(publicKey)}). fix: [dotenvx native up]`)
+      }
     } catch (error) {
       privateKey = readEnvKey(privateKeyName, envKeysFile, { strict: false })
 
@@ -43,7 +66,7 @@ class KeychainDown {
     }
 
     upsertEnvKey(privateKeyName, privateKey, envKeysFile)
-    execFileSync(SECURITY_BIN, ['delete-generic-password', '-s', SERVICE, '-a', publicKey], { stdio: 'ignore' })
+    deleteGenericPassword(publicKey)
 
     return {
       changed: true,

package/src/lib/services/keychainPull.js

@@ -4,10 +4,19 @@ const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const upsertEnvKey = require('../helpers/upsertEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
+const windowsCredentialManager = require('../helpers/windowsCredentialManager')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
 
+function findGenericPassword (publicKey) {
+  if (process.platform === 'win32') {
+    return windowsCredentialManager.findGenericPassword(publicKey)
+  }
+
+  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+}
+
 class KeychainPull {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
     this.envFile = envFile
@@ -27,9 +36,11 @@ class KeychainPull {
     let privateKey
 
     try {
-      privateKey = execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+      privateKey = findGenericPassword(publicKey)
+      if (!privateKey) throw new Error('not found')
     } catch {
-      throw new Error(`[NOT_FOUND] private key not found in macOS Keychain (${armoredKeyDisplay(publicKey)}). fix: [dotenvx native up]`)
+      const secretStore = process.platform === 'win32' ? 'Windows Credential Manager' : 'macOS Keychain'
+      throw new Error(`[NOT_FOUND] private key not found in ${secretStore} (${armoredKeyDisplay(publicKey)}). fix: [dotenvx native up]`)
     }
 
     const result = upsertEnvKey(privateKeyName, privateKey, envKeysFile)

package/src/lib/services/keychainPush.js

@@ -3,11 +3,17 @@ const { execFileSync } = require('child_process')
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
+const windowsCredentialManager = require('../helpers/windowsCredentialManager')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
 
 function addGenericPassword (publicKey, label, privateKey) {
+  if (process.platform === 'win32') {
+    windowsCredentialManager.addGenericPassword(publicKey, privateKey)
+    return
+  }
+
   try {
     execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', publicKey, '-l', label, '-w', privateKey], { stdio: 'ignore' })
   } catch {
@@ -15,6 +21,14 @@ function addGenericPassword (publicKey, label, privateKey) {
   }
 }
 
+function findGenericPassword (publicKey) {
+  if (process.platform === 'win32') {
+    return windowsCredentialManager.findGenericPassword(publicKey)
+  }
+
+  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+}
+
 class KeychainPush {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
     this.envFile = envFile
@@ -35,7 +49,7 @@ class KeychainPush {
     const label = `dotenvx (${armoredKeyDisplay(publicKey)})`
 
     try {
-      const existingPrivateKey = execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+      const existingPrivateKey = findGenericPassword(publicKey)
 
       if (existingPrivateKey === privateKey) {
         return {

package/src/lib/services/keychainUp.js

@@ -4,11 +4,17 @@ const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const removeEnvKey = require('../helpers/removeEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
+const windowsCredentialManager = require('../helpers/windowsCredentialManager')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
 
 function addGenericPassword (publicKey, label, privateKey) {
+  if (process.platform === 'win32') {
+    windowsCredentialManager.addGenericPassword(publicKey, privateKey)
+    return
+  }
+
   try {
     execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', publicKey, '-l', label, '-w', privateKey], { stdio: 'ignore' })
   } catch {
@@ -16,6 +22,14 @@ function addGenericPassword (publicKey, label, privateKey) {
   }
 }
 
+function findGenericPassword (publicKey) {
+  if (process.platform === 'win32') {
+    return windowsCredentialManager.findGenericPassword(publicKey)
+  }
+
+  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+}
+
 class KeychainUp {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
     this.envFile = envFile
@@ -36,7 +50,7 @@ class KeychainUp {
     let existingPrivateKey
 
     try {
-      existingPrivateKey = execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+      existingPrivateKey = findGenericPassword(publicKey)
     } catch {}
 
     const privateKey = readEnvKey(privateKeyName, envKeysFile, { strict: !existingPrivateKey })

package/src/lib/providers/keychain/index.js

@@ -1,20 +0,0 @@
-const { execFileSync } = require('child_process')
-
-const SECURITY_BIN = '/usr/bin/security'
-const SERVICE = 'dotenvx'
-
-function index (publicKeyHex) {
-  if (process.platform !== 'darwin') return {}
-
-  try {
-    const stdout = execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKeyHex, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
-    const privateKeyHex = stdout.trim()
-    if (!privateKeyHex) return {}
-
-    return { [publicKeyHex]: privateKeyHex }
-  } catch {
-    return {}
-  }
-}
-
-module.exports = index