@dotenvx/next-env 2.5.6 → 3.0.1

package/README.md

@@ -1,131 +1,105 @@
-# @dotenvx/next-env
+[![dotenvx](https://dotenvx.com/banner.png?v2)](https://dotenvx.com)
 
-`@dotenvx/next-env` is a drop-in replacement for Next.js' `@next/env` package.
+*A secure dotenv*–from the creator of [`dotenv`](https://github.com/motdotla/dotenv).
 
-Use it when you want Next.js to load encrypted dotenvx files during Next's own environment-loading step. This lets decrypted values exist before Next.js evaluates server modules.
+* Encrypt
+* Commit
+* Ship
+
+[Install](https://dotenvx.com/docs/install) · [Quickstart](https://dotenvx.com/docs/nextjs/)
+
+## Quickstart
+
+`@dotenvx/next-env` replaces Next.js’ `@next/env` loader. In your existing Next.js app, install it.
+
+```sh
+npm install @dotenvx/next-env@^3.0.0
+```
+
+Add the override to your app’s `package.json`.
 
 ```json
 {
-  "dependencies": {
-    "@dotenvx/next-env": "^2.5.3",
-    "next": "^16.0.0"
-  },
   "overrides": {
-    "@next/env": "npm:@dotenvx/next-env"
+    "@next/env": "npm:@dotenvx/next-env@^3.0.0"
   }
 }
 ```
 
-After installing, run Next.js normally:
+Run `npm install` again to apply the override.
 
-```sh
-npm run dev
-npm run build
-```
+`.env`
 
-## Third Party Notices
-
-This package bundles portions of `@dotenvx/primitives`, which bundles portions of the following MIT-licensed packages:
+```dotenv
+HELLO=World
+```
 
-- `eciesjs`
-- `@ecies/ciphers`
-- `@noble/curves`
-- `@noble/hashes`
-- `@noble/ciphers`
+`app/api/hello/route.js`
 
-### eciesjs
+```js
+export function GET() {
+  return new Response(`Hello ${process.env.HELLO}`)
+}
+```
 
-MIT License
+Run `npm run dev` and open `http://localhost:3000/api/hello` to see `Hello World`.
 
-Copyright (c) 2019-2026 Weiliang Li
+- Prebuilt Node addons are included for macOS arm64/x64, Linux glibc arm64/x64,
+  and Windows x64.
+- Stored key lookup requires a compatible `dotenvx` CLI on `PATH`. Keys in
+  `process.env` and `.env.keys` work without the CLI.
+- Armor Enclave server-side decryption is unavailable in v3.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+ 
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+## Usage
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+*Install* dotenvx.
 
-### @ecies/ciphers
+```sh
+$ curl -sfS https://dotenvx.sh | sh
+◈ installed (2.38.2:/usr/local/bin/dotenvx)
+```
 
-MIT License
+*Encrypt* your secrets in `.env` files. The values become ciphertext and only your private key can unlock them.
 
-Copyright (c) 2019-2026 Weiliang Li
+```sh
+$ dotenvx encrypt
+◈ encrypted .env (039 BCA) via .env.keys ⛉
+```
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+*Commit* your encrypted `.env` files with your code. Keep `.env.keys` out of git. The `-f` flag adds the encrypted file when your Next.js project ignores it.
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+```sh
+$ git add -f .env
+$ git commit -m "encrypt .env"
+```
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+*Ship* your code and secrets together. Dotenvx uses your private key to decrypt and inject your secrets just-in-time to your code.
 
-### @noble/curves and @noble/hashes
+```sh
+$ npm run dev
+⟐ injected env (2) from .env (039 BCA) via .env.keys ⛉
+```
 
-The MIT License (MIT)
+Set the matching private key, such as `DOTENV_PRIVATE_KEY`, in your deployment environment.
 
-Copyright (c) 2022 Paul Miller (https://paulmillr.com)
+ 
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the “Software”), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+## Design
 
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
+Three widely used and proven primitives make up Dotenvx's design. Git, .env, and secp256k1.
 
-THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
+We chose git because it is the best way to deliver digital goods. It is the container ship of the digital world. All code travels on its ships. Why not secrets? Why invent an inferior secrets delivery mechanism when the world class one is right there at your fingertips.
 
-### @noble/ciphers
+We chose .env because it is the open standard for loading secrets into code. It represents environment variables, the core primitive that all secrets end up injected into at runtime of code.
 
-The MIT License (MIT)
+Lastly, we needed to choose an encryption algorithm. Encryption of the values inside the .env file would allow us to place those values with code, leveraging git's distribution advantages while still following the twelve-factor config – by separating the decryption key from the code (environment).
 
-Copyright (c) 2022 Paul Miller (https://paulmillr.com)
-Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
+It was important that we choose a proven, simple, asymmetric standard with small keys. We chose secp256k1, battle-tested by Bitcoin for more than seventeen years. We made cryptography an opinionated choice so developers wouldn't have to. Encryption just worked.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the “Software”), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+The result is a system built entirely from primitives, developers already understand, and infrastructure they already use. Secrets can travel with code without becoming part of the code. Git distributes them, .env defines how apps consume them, and secp256k1 keeps their values unreadable. The kicker, all this works by setting a single private key on your infrastructure - no more risky async coordination of secrets, no more centralized downtime risk. Your secrets are always just there with your code, ready to be unlocked at runtime.
 
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
+[Read the whitepaper →](https://dotenvx.com/dotenvx.pdf?v=README)
 
-THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
+&nbsp;