@dotenvx/dotenvx 2.13.0 → 2.15.0

package/CHANGELOG.md

@@ -2,7 +2,20 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.13.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.15.0...main)
+
+## [2.15.0](https://github.com/dotenvx/dotenvx/compare/v2.14.0...v2.15.0) (2026-07-20)
+
+### Added
+
+* Add support for 1Password `op://` secrets in your .env files. ([#908](https://github.com/dotenvx/dotenvx/pull/908))
+
+## [2.14.0](https://github.com/dotenvx/dotenvx/compare/v2.13.0...v2.14.0) (2026-07-16)
+
+### Added
+
+* Add `dotenvx run --validate` for simple env validation against your `.env.example` ([#906](https://github.com/dotenvx/dotenvx/pull/906))
+* Add `dotenvx validate` for a pre-check of validation against your `.env.example` file ([#906](https://github.com/dotenvx/dotenvx/pull/906))
 
 ## [2.13.0](https://github.com/dotenvx/dotenvx/compare/v2.12.0...v2.13.0) (2026-07-16)
 

package/README.md

@@ -153,6 +153,19 @@ Hello [REDACTED]
 
 see [Codex redaction guide](https://dotenvx.com/docs/cli/run-redact-codex-exec)
 
+</details>
+<details><summary>1Password 🔐</summary><br>
+
+Run with secrets resolved directly from 1Password.
+
+```sh
+$ echo "HELLO=op://Personal/hello/password" > .env
+$ dotenvx run -- sh -c 'echo Hello $HELLO'
+Hello World
+```
+
+see [1Password guide](https://dotenvx.com/docs/secrets-in-1password)
+
 </details>
 <details><summary>TypeScript 📘</summary><br>
 
@@ -1156,6 +1169,30 @@ $ dotenvx get GOODBYE
 [MISSING_KEY] missing key (GOODBYE)
 ```
 
+</details>
+<details><summary>`run` - 1Password</summary><br>
+
+Resolve [1Password op://](https://developer.1password.com/docs/cli/secrets-reference-syntax/) directly from your `.env` file.
+
+```ini
+# .env
+API_KEY=op://Personal/my_api_key/password
+```
+
+Install the [1Password CLI](https://developer.1password.com/docs/cli/get-started/) and authenticate with `op`. Dotenvx automatically reads `op://` values through `op read` before injecting them.
+
+```sh
+$ dotenvx run -- node index.js
+```
+
+Use `--no-1password` to leave `op://` values unresolved.
+
+```sh
+$ dotenvx run --no-1password -- node index.js
+```
+
+The same flag is available for `dotenvx get` and `dotenvx validate`.
+
 </details>
 <details><summary>`run -f <directory>`</summary><br>
 
@@ -1453,6 +1490,31 @@ Hello production
 
 Available log levels are `error, warn, info, verbose, debug, silly` ([source](https://docs.npmjs.com/cli/v8/using-npm/logging#setting-log-levels))
 
+</details>
+<details><summary>`run --validate`</summary><br>
+
+Validate your environment against `.env.example`.
+
+```ini
+# .env.example
+DATABASE_URL=
+API_KEY=
+SENTRY_DSN= # optional
+```
+
+```sh
+$ dotenvx run --validate -- node index.js
+[VALIDATION_FAILED] missing required (DATABASE_URL, API_KEY). fix: [https://github.com/dotenvx/dotenvx/issues/907]
+```
+
+Validation errors are reported without stopping your command. Combine `--validate` with `--strict` to exit with code `1` before the command runs.
+
+```sh
+$ dotenvx run --validate --strict -- node index.js
+```
+
+Any inline comment containing the word `optional` marks that key as optional. If `.env.example` is missing, dotenvx reports `MISSING_ENV_EXAMPLE`. An empty `.env.example` is valid and declares no required variables.
+
 </details>
 <details><summary>`run --strict`</summary><br>
 
@@ -2442,6 +2504,29 @@ $ dotenvx ls --json
 $ dotenvx ls --json > dotenv-files.json
 ```
 
+</details>
+<details><summary>`validate`</summary><br>
+
+Validate `.env` file(s) against `.env.example` without running a command.
+
+```ini
+# .env.example
+DATABASE_URL=
+API_KEY=
+SENTRY_DSN= # optional
+```
+
+```sh
+$ dotenvx validate
+[VALIDATION_FAILED] missing required (DATABASE_URL, API_KEY). fix: [https://github.com/dotenvx/dotenvx/issues/907]
+```
+
+Use `-f` and `-fk` to validate a specific env file and keys file. The command exits with code `1` when validation fails and prints errors to stderr. On success, it exits with code `0`.
+
+```sh
+$ dotenvx validate -f .env.production -fk .env.keys
+```
+
 </details>
 <details><summary>`genexample`</summary><br>
 
@@ -2825,9 +2910,10 @@ Commands:
   decrypt            decrypt .env file(s)
   keypair [KEY]      print public/private keys for .env file(s)
   ls [directory]     print all .env files in a tree structure
+  gitignore          append to .gitignore
   genexample [directory]
                      generate .env.example
-  gitignore          append to .gitignore
+  validate           validate .env file(s) against .env.example
   precommit [directory]
                      prevent committing .env files to code
   prebuild [directory]
@@ -3176,6 +3262,30 @@ Turn off [Dotenvx Armor ⛨](https://dotenvx.com/armor) features.
 require('@dotenvx/dotenvx').config({noArmor: true})
 ```
 
+</details>
+<details><summary>`config(no1Password:)` - no1Password</summary><br>
+
+By default, `config()` automatically resolves `op://` values through the installed [1Password CLI](https://developer.1password.com/docs/cli/get-started/).
+
+```ini
+# .env
+API_KEY=op://Personal/my_api_key/password
+```
+
+```js
+// index.js
+require('@dotenvx/dotenvx').config()
+
+console.log(process.env.API_KEY)
+```
+
+Set `no1Password` to leave `op://` values unresolved and avoid calling `op`.
+
+```js
+// index.js
+require('@dotenvx/dotenvx').config({no1Password: true})
+```
+
 </details>
 <details><summary>`parse(src)`</summary><br>
 
@@ -3336,7 +3446,6 @@ Set `mask: 0` to fully mask values.
   * [GitHub Actions](https://dotenvx.com/docs/cis/github-actions)
 * [Password Managers](https://dotenvx.com/docs#password-managers)
   * [1Password](https://dotenvx.com/docs/guides/1password)
-  * [Bitwarden](https://dotenvx.com/docs/guides/bitwarden)
 * [Background Jobs](https://dotenvx.com/docs#background-jobs)
   * [Trigger.dev](https://dotenvx.com/docs/background-jobs/triggerdotdev)
 * [Package Managers](https://dotenvx.com/docs#package-managers)

package/package.json

@@ -1,11 +1,20 @@
 {
-  "version": "2.13.0",
+  "version": "2.15.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
   "keywords": [
     "dotenv",
-    "env"
+    "env",
+    ".env",
+    "environment",
+    "variables",
+    "config",
+    "settings",
+    "env vars",
+    "environment variables",
+    "secret-management",
+    "secrets"
   ],
   "homepage": "https://github.com/dotenvx/dotenvx",
   "repository": {
@@ -43,7 +52,7 @@
   },
   "funding": "https://dotenvx.com",
   "dependencies": {
-    "@dotenvx/primitives": "^2.0.0",
+    "@dotenvx/primitives": "^2.1.0",
     "@dotenvx/tooling": "^1.0.2",
     "yocto-spinner": "^1.2.1"
   },

package/src/cli/actions/get.js

@@ -38,6 +38,8 @@ async function get (key) {
       envKeysFile: resolveEnvKeysFile(options.envKeysFile),
       noArmor,
       noKeychain,
+      no1Password: options['1password'] === false || options.no1Password === true,
+      noBitwarden: options.bitwarden === false || options.noBitwarden === true,
       onStatus: (text) => {
         if (spinner && text) {
           spinner.text = text

package/src/cli/actions/run.js

@@ -15,6 +15,7 @@ const maskEnvSrc = require('../../lib/helpers/maskEnvSrc')
 const maskProcessedEnvs = require('../../lib/helpers/maskProcessedEnvs')
 const redactedValues = require('../../lib/helpers/redactedValues')
 const { redactOutput } = require('../../lib/helpers/redactOutput')
+const validateEnvExample = require('../../lib/helpers/validateEnvExample')
 
 const { determine } = require('./../../lib/helpers/envResolution')
 
@@ -117,6 +118,8 @@ async function run () {
       envKeysFile: resolveEnvKeysFile(options.envKeysFile),
       noArmor,
       noKeychain,
+      no1Password: options['1password'] === false || options.no1Password === true,
+      noBitwarden: options.bitwarden === false || options.noBitwarden === true,
       token: options.token,
       command: commandArgs,
       onStatus: (text) => {
@@ -135,6 +138,20 @@ async function run () {
       maskProcessedEnvs(processedEnvs, commandEnv, showChar)
     }
 
+    if (options.validate) {
+      const error = validateEnvExample(process.env)
+
+      if (error) {
+        if (ignore.includes(error.code)) {
+          logger.verbose(`ignored: ${error.message}`)
+        } else if (options.strict) {
+          throw error
+        } else {
+          logger.error(error.messageWithHelp || error.message)
+        }
+      }
+    }
+
     for (const processedEnv of processedEnvs) {
       if (processedEnv.type === 'envFile') {
         logger.verbose(`loading env from ${processedEnv.filepath} (${path.resolve(processedEnv.filepath)})`)

package/src/cli/actions/validate.js

@@ -0,0 +1,86 @@
+const { logger } = require('./../../shared/logger')
+
+const envsResolver = require('./../../lib/resolvers/envs')
+const catchAndLog = require('./../../lib/helpers/catchAndLog')
+const createSpinner = require('../../lib/helpers/createSpinner')
+const Session = require('../../db/session')
+const normalizeDotenvConfigQuiet = require('../../lib/helpers/normalizeDotenvConfigQuiet')
+const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDotenvConfigConvention')
+const buildCommandEnvs = require('../../lib/helpers/buildCommandEnvs')
+const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
+const validateEnvExample = require('../../lib/helpers/validateEnvExample')
+
+const { determine } = require('./../../lib/helpers/envResolution')
+
+async function validate () {
+  const options = normalizeDotenvConfigConvention(normalizeDotenvConfigQuiet(this.opts()))
+  const spinnerOptions = typeof this.optsWithGlobals === 'function' ? this.optsWithGlobals() : options
+  const spinner = await createSpinner({ ...spinnerOptions, ...options, text: 'validating' })
+  const ignore = options.ignore || []
+  const validateEnv = { ...process.env }
+  let errorCount = 0
+
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  try {
+    let envs = buildCommandEnvs(this.envs, options.convention)
+    envs = determine(envs, process.env)
+
+    const sesh = new Session()
+    const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
+    const noKeychain = options.native === false || options.noNative === true
+
+    const { processedEnvs } = await envsResolver({
+      envs,
+      overload: options.overload,
+      processEnv: validateEnv,
+      envKeysFile: resolveEnvKeysFile(options.envKeysFile),
+      noArmor,
+      noKeychain,
+      no1Password: options['1password'] === false || options.no1Password === true,
+      noBitwarden: options.bitwarden === false || options.noBitwarden === true,
+      token: options.token,
+      onStatus: (text) => {
+        if (spinner && text) {
+          spinner.text = text
+        }
+      }
+    })
+
+    for (const processedEnv of processedEnvs) {
+      for (const error of processedEnv.errors || []) {
+        if (ignore.includes(error.code)) {
+          logger.verbose(`ignored: ${error.message}`)
+          continue
+        }
+
+        errorCount += 1
+        logger.error(error.messageWithHelp || error.message)
+      }
+    }
+
+    const validationError = validateEnvExample(validateEnv)
+    if (validationError) {
+      if (ignore.includes(validationError.code)) {
+        logger.verbose(`ignored: ${validationError.message}`)
+      } else {
+        errorCount += 1
+        logger.error(validationError.messageWithHelp || validationError.message)
+      }
+    }
+
+    if (spinner) spinner.stop()
+
+    if (errorCount > 0) {
+      process.exit(1)
+    } else {
+      logger.success('▣ validated')
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    catchAndLog(error)
+    process.exit(1)
+  }
+}
+
+module.exports = validate

package/src/cli/dotenvx.js

@@ -66,6 +66,7 @@ program.command('run')
   .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
   .option('--redact', 'redact injected values except keys ending in _PLAIN', false)
   .option('-o, --overload', 'override existing env variables (by default, existing env vars take precedence over .env files)')
+  .option('--validate', 'validate against .env.example', false)
   .option('--strict', 'process.exit(1) on any errors', false)
   .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
@@ -73,6 +74,8 @@ program.command('run')
   .option('--mask [characters]', 'inject masked values, optionally setting visible characters')
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')
+  .option('--no-1password', 'disable 1Password secret reference resolution')
+  .option('--no-bitwarden', 'disable Bitwarden secret reference resolution')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/run').apply(this, args)
@@ -97,6 +100,8 @@ program.command('get')
   .option('--format <type>', 'format of the output (json, shell, colon, eval, eval-export)', 'json')
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')
+  .option('--no-1password', 'disable 1Password secret reference resolution')
+  .option('--no-bitwarden', 'disable Bitwarden secret reference resolution')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/get').apply(this, args)
@@ -182,13 +187,23 @@ program.command('ls')
     return require('./actions/ls').apply(this, args)
   })
 
-// dotenvx genexample
-program.command('genexample')
-  .description('generate .env.example')
-  .argument('[directory]', 'directory to generate from', '.')
-  .option('-f, --env-file <paths...>', 'path(s) to your env file(s)', '.env')
+// dotenvx validate
+program.command('validate')
+  .description('validate .env file(s) against .env.example')
+  .option('-e, --env <strings...>', 'environment variable(s) set as string (example: "HELLO=World")', collectEnvs('env'), [])
+  .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
+  .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
+  .option('-o, --overload', 'override existing env variables (by default, existing env vars take precedence over .env files)')
+  .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
+  .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
+  .option('--token <token>', 'set Armor ⛨ token')
+  .option('--no-armor', 'disable Dotenvx Armor features')
+  .option('--no-native', 'disable OS secret store features')
+  .option('--no-1password', 'disable 1Password secret reference resolution')
+  .option('--no-bitwarden', 'disable Bitwarden secret reference resolution')
   .action(function (...args) {
-    return require('./actions/ext/genexample').apply(this, args)
+    this.envs = envs
+    return require('./actions/validate').apply(this, args)
   })
 
 // dotenvx gitignore
@@ -200,6 +215,15 @@ program.command('gitignore')
     return require('./actions/ext/gitignore').apply(this, args)
   })
 
+// dotenvx genexample
+program.command('genexample')
+  .description('generate .env.example')
+  .argument('[directory]', 'directory to generate from', '.')
+  .option('-f, --env-file <paths...>', 'path(s) to your env file(s)', '.env')
+  .action(function (...args) {
+    return require('./actions/ext/genexample').apply(this, args)
+  })
+
 // dotenvx precommit
 program.command('precommit')
   .description('prevent committing .env files to code')

package/src/lib/helpers/createSpinner.js

@@ -1,5 +1,6 @@
 const FRAMES = ['◇', '⬖', '◆', '⬗']
 const FRAME_INTERVAL_MS = 80
+let activeSpinner
 
 async function createSpinner (options = {}) {
   const stream = process.stderr
@@ -11,7 +12,7 @@ async function createSpinner (options = {}) {
   const frames = options.frames || FRAMES
 
   const { default: yoctoSpinner } = await import('yocto-spinner')
-  return yoctoSpinner({
+  activeSpinner = yoctoSpinner({
     text,
     spinner: {
       frames,
@@ -19,6 +20,21 @@ async function createSpinner (options = {}) {
     },
     stream
   }).start()
+
+  return activeSpinner
+}
+
+createSpinner.stop = function () {
+  if (activeSpinner) activeSpinner.stop()
+  activeSpinner = null
+}
+
+createSpinner.pause = function () {
+  if (activeSpinner) activeSpinner.stop()
+}
+
+createSpinner.resume = function () {
+  if (activeSpinner) activeSpinner.start()
 }
 
 module.exports = createSpinner

package/src/lib/helpers/errors.js

@@ -9,9 +9,12 @@ const ISSUE_BY_CODE = {
   INVALID_PASSPHRASE: 'try again with the correct passphrase',
   INVALID_PRIVATE_KEY: 'https://github.com/dotenvx/dotenvx/issues/465',
   INVALID_PUBLIC_KEY: 'https://github.com/dotenvx/dotenvx/issues/756',
+  '1PASSWORD_FAILED': 'https://www.1password.dev/cli/get-started',
+  BITWARDEN_FAILED: 'https://bitwarden.com/help/cli/',
   MALFORMED_ENCRYPTED_DATA: 'https://github.com/dotenvx/dotenvx/issues/467',
   MISPAIRED_PRIVATE_KEY: 'https://github.com/dotenvx/dotenvx/issues/752',
   MISSING_DIRECTORY: 'https://github.com/dotenvx/dotenvx/issues/758',
+  MISSING_ENV_EXAMPLE: 'https://github.com/dotenvx/dotenvx/issues/905',
   MISSING_ENV_FILE: 'https://github.com/dotenvx/dotenvx/issues/484',
   MISSING_ENV_KEYS_FILE: 'https://github.com/dotenvx/dotenvx/issues/775',
   MISSING_ENV_FILES: 'https://github.com/dotenvx/dotenvx/issues/760',
@@ -22,6 +25,7 @@ const ISSUE_BY_CODE = {
   MISSING_VALUE: 'https://github.com/dotenvx/dotenvx/issues/864',
   FILE_NOT_WRITABLE: 'https://github.com/dotenvx/dotenvx/issues/890',
   PRECOMMIT_HOOK_MODIFY_FAILED: 'try again or report error',
+  VALIDATION_FAILED: 'https://github.com/dotenvx/dotenvx/issues/907',
   WRONG_PRIVATE_KEY: 'https://github.com/dotenvx/dotenvx/issues/466'
 }
 
@@ -98,6 +102,30 @@ class Errors {
     return e
   }
 
+  onePasswordFailed () {
+    const code = '1PASSWORD_FAILED'
+    const message = `[${code}] ${this.message}`
+    const help = `fix: [${ISSUE_BY_CODE[code]}]`
+
+    const e = new Error(message)
+    e.code = code
+    e.help = help
+    e.messageWithHelp = `${message}. ${help}`
+    return e
+  }
+
+  bitwardenFailed () {
+    const code = 'BITWARDEN_FAILED'
+    const message = `[${code}] ${this.message}`
+    const help = this.help || `fix: [${ISSUE_BY_CODE[code]}]`
+
+    const e = new Error(message)
+    e.code = code
+    e.help = help
+    e.messageWithHelp = `${message}. ${help}`
+    return e
+  }
+
   invalidColor () {
     const code = 'INVALID_COLOR'
     const message = `[${code}] Invalid color ${this.color}`
@@ -207,6 +235,18 @@ class Errors {
     return e
   }
 
+  missingEnvExample () {
+    const code = 'MISSING_ENV_EXAMPLE'
+    const message = `[${code}] missing .env.example file`
+    const help = `fix: [${ISSUE_BY_CODE[code]}]`
+
+    const e = new Error(message)
+    e.code = code
+    e.help = help
+    e.messageWithHelp = `${message}. ${help}`
+    return e
+  }
+
   missingEnvKeysFile () {
     const code = 'MISSING_ENV_KEYS_FILE'
     const envKeysFilepath = this.envKeysFilepath || '.env.keys'
@@ -305,6 +345,18 @@ class Errors {
     return e
   }
 
+  validationFailed () {
+    const code = 'VALIDATION_FAILED'
+    const message = `[${code}] ${this.message}`
+    const help = `fix: [${ISSUE_BY_CODE[code]}]`
+
+    const e = new Error(message)
+    e.code = code
+    e.help = help
+    e.messageWithHelp = `${message}. ${help}`
+    return e
+  }
+
   precommitHookModifyFailed () {
     const code = 'PRECOMMIT_HOOK_MODIFY_FAILED'
     const message = `[${code}] failed to modify pre-commit hook: ${this.error.message}`

package/src/lib/helpers/resolveBitwardenPassword.js

@@ -0,0 +1,149 @@
+const { execFile, execFileSync } = require('child_process')
+const Errors = require('./errors')
+const prompts = require('./prompts')
+const createSpinner = require('./createSpinner')
+
+const FIELDS = new Set(['username', 'password', 'uri'])
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+function execFileAsync (command, args, options) {
+  return new Promise((resolve, reject) => {
+    execFile(command, args, options, (error, stdout) => {
+      if (error) return reject(error)
+      resolve(stdout)
+    })
+  })
+}
+
+function isSecretReference (value) {
+  return typeof value === 'string' && value.startsWith('bw://')
+}
+
+function parseSecretReference (value) {
+  const [itemId, field, ...extra] = value.slice('bw://'.length).split('/')
+
+  if (!UUID.test(itemId) || !field || extra.length > 0) {
+    throw new Error('invalid Bitwarden Password Manager reference')
+  }
+
+  if (!FIELDS.has(field)) {
+    throw new Error(`unsupported Bitwarden Password Manager field ${field}`)
+  }
+
+  return { itemId, field }
+}
+
+async function session (options) {
+  if (options.session) return options.session
+
+  if (process.stdin.isTTY && process.stderr.isTTY) {
+    createSpinner.pause()
+    const password = await prompts.password({
+      message: 'Bitwarden master password',
+      prefix: '◇',
+      separator: '='
+    }, {
+      input: process.stdin,
+      output: process.stderr
+    })
+    createSpinner.resume()
+    const passwordEnv = 'DOTENVX_BITWARDEN_PASSWORD'
+    options.session = secretValue(await execFileAsync('bw', ['unlock', '--passwordenv', passwordEnv, '--raw'], {
+      encoding: 'utf8',
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, [passwordEnv]: password }
+    }))
+    return options.session
+  }
+
+  if (!options.session) {
+    const error = new Error('Bitwarden Password Manager requires an unlocked BW_SESSION')
+    error.code = 'BW_SESSION_MISSING'
+    throw error
+  }
+}
+
+function resolutionError (key, error) {
+  let message
+  if (error && error.code === 'ENOENT') {
+    message = `Bitwarden Password Manager CLI is not installed and could not resolve ${key}`
+  } else if (error && error.code === 'BW_SESSION_MISSING') {
+    message = `Bitwarden Password Manager is locked and could not resolve ${key}; run 'export BW_SESSION="$(bw unlock --raw)"'`
+  } else if (error && error.message && error.message.startsWith('unsupported Bitwarden Password Manager field')) {
+    message = `${error.message} for ${key}`
+  } else if (error && error.message === 'invalid Bitwarden Password Manager reference') {
+    message = `invalid Bitwarden Password Manager reference for ${key}`
+  } else {
+    message = `Bitwarden Password Manager CLI failed to resolve ${key}`
+  }
+
+  return new Errors({
+    message,
+    help: 'fix: [https://bitwarden.com/help/cli/]'
+  }).bitwardenFailed()
+}
+
+function secretValue (stdout) {
+  return stdout.replace(/\r?\n$/, '')
+}
+
+async function resolveBitwardenPassword (parsed, options = {}) {
+  const errors = []
+  const unresolved = []
+  options.session = options.session || process.env.BW_SESSION
+
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!isSecretReference(value)) continue
+
+    try {
+      const { itemId, field } = parseSecretReference(value)
+      const bwSession = await session(options)
+      const stdout = await execFileAsync('bw', ['get', field, itemId], {
+        encoding: 'utf8',
+        windowsHide: true,
+        env: { ...process.env, BW_SESSION: bwSession }
+      })
+      parsed[key] = secretValue(stdout)
+    } catch (error) {
+      errors.push(resolutionError(key, error))
+      unresolved.push(key)
+      delete parsed[key]
+    }
+  }
+
+  return { errors, unresolved }
+}
+
+function resolveBitwardenPasswordSync (parsed) {
+  const errors = []
+  const unresolved = []
+
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!isSecretReference(value)) continue
+
+    try {
+      const { itemId, field } = parseSecretReference(value)
+      if (!process.env.BW_SESSION) {
+        const error = new Error('Bitwarden Password Manager requires an unlocked BW_SESSION')
+        error.code = 'BW_SESSION_MISSING'
+        throw error
+      }
+      const stdout = execFileSync('bw', ['get', field, itemId], {
+        encoding: 'utf8',
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'pipe']
+      })
+      parsed[key] = secretValue(stdout)
+    } catch (error) {
+      errors.push(resolutionError(key, error))
+      unresolved.push(key)
+      delete parsed[key]
+    }
+  }
+
+  return { errors, unresolved }
+}
+
+module.exports = resolveBitwardenPassword
+module.exports.sync = resolveBitwardenPasswordSync

package/src/lib/helpers/resolveOnePassword.js

@@ -0,0 +1,72 @@
+const { execFile, execFileSync } = require('child_process')
+const Errors = require('./errors')
+
+function execFileAsync (command, args, options) {
+  return new Promise((resolve, reject) => {
+    execFile(command, args, options, (error, stdout) => {
+      if (error) return reject(error)
+      resolve(stdout)
+    })
+  })
+}
+
+function isSecretReference (value) {
+  return typeof value === 'string' && value.startsWith('op://')
+}
+
+function resolutionError (key, error) {
+  const message = error && error.code === 'ENOENT'
+    ? `1Password CLI is not installed and could not resolve ${key}`
+    : `1Password CLI failed to resolve ${key}`
+
+  return new Errors({ message }).onePasswordFailed()
+}
+
+async function resolveOnePassword (parsed) {
+  const errors = []
+  const unresolved = []
+
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!isSecretReference(value)) continue
+
+    try {
+      const stdout = await execFileAsync('op', ['read', value, '--no-newline'], {
+        encoding: 'utf8',
+        windowsHide: true
+      })
+      parsed[key] = stdout
+    } catch (error) {
+      errors.push(resolutionError(key, error))
+      unresolved.push(key)
+      delete parsed[key]
+    }
+  }
+
+  return { errors, unresolved }
+}
+
+function resolveOnePasswordSync (parsed) {
+  const errors = []
+  const unresolved = []
+
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!isSecretReference(value)) continue
+
+    try {
+      parsed[key] = execFileSync('op', ['read', value, '--no-newline'], {
+        encoding: 'utf8',
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'pipe']
+      })
+    } catch (error) {
+      errors.push(resolutionError(key, error))
+      unresolved.push(key)
+      delete parsed[key]
+    }
+  }
+
+  return { errors, unresolved }
+}
+
+module.exports = resolveOnePassword
+module.exports.sync = resolveOnePasswordSync

package/src/lib/helpers/validate.js

@@ -0,0 +1,40 @@
+function optionalKeys (comments) {
+  const keys = new Set()
+
+  for (const [key, values] of Object.entries(comments)) {
+    if (values.some(comment => comment && /\boptional\b/i.test(comment))) {
+      keys.add(key)
+    }
+  }
+
+  return keys
+}
+
+function validate (example = {}, env = {}, options = {}) {
+  const errors = []
+  const missingRequired = []
+  const optional = optionalKeys(options.comments || {})
+
+  for (const key of Object.keys(example)) {
+    const value = env[key]
+    const missing = !Object.prototype.hasOwnProperty.call(env, key) || value.trim() === ''
+    if (!optional.has(key) && missing) {
+      missingRequired.push(key)
+    }
+  }
+
+  if (missingRequired.length > 0) {
+    errors.push({
+      code: 'MISSING_REQUIRED',
+      keys: missingRequired,
+      message: `missing required (${missingRequired.join(', ')})`
+    })
+  }
+
+  return {
+    valid: errors.length === 0,
+    errors
+  }
+}
+
+module.exports = validate

package/src/lib/helpers/validateEnvExample.js

@@ -0,0 +1,24 @@
+const fs = require('fs')
+const { scan } = require('@dotenvx/primitives')
+
+const Errors = require('./errors')
+const validate = require('./validate')
+
+function validateEnvExample (env = process.env, options = {}) {
+  const filepath = options.filepath || '.env.example'
+
+  if (!fs.existsSync(filepath)) {
+    return new Errors().missingEnvExample()
+  }
+
+  const exampleSrc = fs.readFileSync(filepath, 'utf8')
+  const { parsed: example, comments } = scan(exampleSrc)
+  const validation = validate(example, env, { comments })
+
+  if (!validation.valid) {
+    const message = validation.errors.map(error => error.message).join('; ')
+    return new Errors({ message }).validationFailed()
+  }
+}
+
+module.exports = validateEnvExample

package/src/lib/main.d.ts

@@ -194,6 +194,22 @@ export interface DotenvConfigOptions {
    */
   noNative?: boolean;
 
+  /**
+   * Turn off 1Password secret reference resolution.
+   *
+   * @default false
+   * @example require('@dotenvx/dotenvx').config({ no1Password: true })
+   */
+  no1Password?: boolean;
+
+  /**
+   * Turn off Bitwarden secret reference resolution.
+   *
+   * @default false
+   * @example require('@dotenvx/dotenvx').config({ noBitwarden: true })
+   */
+  noBitwarden?: boolean;
+
 }
 
 export type DotenvConfigEnv =
@@ -370,6 +386,22 @@ export interface GetOptions {
    */
   noNative?: boolean;
 
+  /**
+   * Turn off 1Password secret reference resolution.
+   *
+   * @default false
+   * @example require('@dotenvx/dotenvx').get('KEY', { no1Password: true })
+   */
+  no1Password?: boolean;
+
+  /**
+   * Turn off Bitwarden secret reference resolution.
+   *
+   * @default false
+   * @example require('@dotenvx/dotenvx').get('KEY', { noBitwarden: true })
+   */
+  noBitwarden?: boolean;
+
 }
 
 /**

package/src/lib/main.js

@@ -87,6 +87,8 @@ const config = function (options = {}) {
       envKeysFile,
       noArmor,
       noKeychain,
+      no1Password: options.no1Password,
+      noBitwarden: options.noBitwarden,
       noSpinner: options.noSpinner,
       token: options.token
     })
@@ -331,7 +333,9 @@ const get = async function (key, options = {}) {
     all: options.all,
     envKeysFile: options.envKeysFile,
     noArmor,
-    noKeychain
+    noKeychain,
+    no1Password: options.no1Password,
+    noBitwarden: options.noBitwarden
   })
 
   if (options.mask !== undefined) {

package/src/lib/resolvers/envs.js

@@ -12,6 +12,8 @@ const keynames = require('./../conventions/keynames')
 const providers = require('./../providers')
 const decryptors = require('./../decryptors')
 const parseWithDecryptor = require('./../helpers/parseWithDecryptor')
+const resolveOnePassword = require('./../helpers/resolveOnePassword')
+const resolveBitwardenPassword = require('./../helpers/resolveBitwardenPassword')
 
 function unresolvedEncryptedErrors (parsed) {
   const keys = []
@@ -70,7 +72,7 @@ function buildParseOptions ({ processEnv, overload, envKeysFilepath, provider, d
   return options
 }
 
-async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider, decryptor }) {
+async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, no1Password, noBitwarden }) {
   const row = {}
   row.type = TYPE_ENV
   row.string = env.value
@@ -101,6 +103,21 @@ async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider
     row.injected = injected || {}
     row.existed = existed || {}
 
+    if (!no1Password) {
+      const result = await resolveOnePassword(row.injected)
+      row.errors.push(...result.errors)
+      for (const key of result.unresolved) delete row.parsed[key]
+      Object.assign(row.parsed, row.injected)
+    }
+
+    if (!noBitwarden) {
+      const passwordResult = await resolveBitwardenPassword(row.injected)
+      row.errors.push(...passwordResult.errors)
+      for (const key of passwordResult.unresolved) delete row.parsed[key]
+
+      Object.assign(row.parsed, row.injected)
+    }
+
     inject(processEnv, row.parsed)
   } catch (e) {
     row.errors = [e]
@@ -109,7 +126,7 @@ async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider
   return row
 }
 
-function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider, decryptor }) {
+function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, no1Password, noBitwarden }) {
   const row = {}
   row.type = TYPE_ENV
   row.string = env.value
@@ -140,6 +157,21 @@ function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider,
     row.injected = injected || {}
     row.existed = existed || {}
 
+    if (!no1Password) {
+      const result = resolveOnePassword.sync(row.injected)
+      row.errors.push(...result.errors)
+      for (const key of result.unresolved) delete row.parsed[key]
+      Object.assign(row.parsed, row.injected)
+    }
+
+    if (!noBitwarden) {
+      const passwordResult = resolveBitwardenPassword.sync(row.injected)
+      row.errors.push(...passwordResult.errors)
+      for (const key of passwordResult.unresolved) delete row.parsed[key]
+
+      Object.assign(row.parsed, row.injected)
+    }
+
     inject(processEnv, row.parsed)
   } catch (e) {
     row.errors = [e]
@@ -148,7 +180,7 @@ function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider,
   return row
 }
 
-async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths }) {
+async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths, no1Password, noBitwarden }) {
   const row = {}
   row.type = TYPE_ENV_FILE
   row.filepath = env.value
@@ -182,6 +214,21 @@ async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, prov
     row.errors = decryptErrors(parsed, errors)
     row.existed = existed || {}
 
+    if (!no1Password) {
+      const result = await resolveOnePassword(row.injected)
+      row.errors.push(...result.errors)
+      for (const key of result.unresolved) delete row.parsed[key]
+      Object.assign(row.parsed, row.injected)
+    }
+
+    if (!noBitwarden) {
+      const passwordResult = await resolveBitwardenPassword(row.injected)
+      row.errors.push(...passwordResult.errors)
+      for (const key of passwordResult.unresolved) delete row.parsed[key]
+
+      Object.assign(row.parsed, row.injected)
+    }
+
     inject(processEnv, parsed)
   } catch (e) {
     if (e.code === 'ENOENT' || e.code === 'EISDIR') {
@@ -194,7 +241,7 @@ async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, prov
   return row
 }
 
-function injectEnvFileSync ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths }) {
+function injectEnvFileSync ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths, no1Password, noBitwarden }) {
   const row = {}
   row.type = TYPE_ENV_FILE
   row.filepath = env.value
@@ -228,6 +275,21 @@ function injectEnvFileSync ({ env, overload, processEnv, envKeysFilepath, provid
     row.errors = decryptErrors(parsed, errors)
     row.existed = existed || {}
 
+    if (!no1Password) {
+      const result = resolveOnePassword.sync(row.injected)
+      row.errors.push(...result.errors)
+      for (const key of result.unresolved) delete row.parsed[key]
+      Object.assign(row.parsed, row.injected)
+    }
+
+    if (!noBitwarden) {
+      const passwordResult = resolveBitwardenPassword.sync(row.injected)
+      row.errors.push(...passwordResult.errors)
+      for (const key of passwordResult.unresolved) delete row.parsed[key]
+
+      Object.assign(row.parsed, row.injected)
+    }
+
     inject(processEnv, parsed)
   } catch (e) {
     if (e.code === 'ENOENT' || e.code === 'EISDIR') {
@@ -247,7 +309,6 @@ async function envs (options = {}) {
   const envKeysFilepath = options.envKeysFilepath || options.envKeysFile || null
   const provider = await providers(options)
   const decryptor = await decryptors(options)
-
   for (const env of options.envs || []) {
     if (env.type === TYPE_ENV_FILE) {
       processedEnvs.push(await injectEnvFile({
@@ -257,7 +318,9 @@ async function envs (options = {}) {
         envKeysFilepath,
         provider,
         decryptor,
-        readableFilepaths
+        readableFilepaths,
+        no1Password: options.no1Password,
+        noBitwarden: options.noBitwarden
       }))
     } else if (env.type === TYPE_ENV) {
       processedEnvs.push(await injectEnv({
@@ -266,7 +329,9 @@ async function envs (options = {}) {
         processEnv,
         envKeysFilepath,
         provider,
-        decryptor
+        decryptor,
+        no1Password: options.no1Password,
+        noBitwarden: options.noBitwarden
       }))
     }
   }
@@ -294,7 +359,9 @@ function envsSync (options = {}) {
         envKeysFilepath,
         provider,
         decryptor,
-        readableFilepaths
+        readableFilepaths,
+        no1Password: options.no1Password,
+        noBitwarden: options.noBitwarden
       }))
     } else if (env.type === TYPE_ENV) {
       processedEnvs.push(injectEnvSync({
@@ -303,7 +370,9 @@ function envsSync (options = {}) {
         processEnv,
         envKeysFilepath,
         provider,
-        decryptor
+        decryptor,
+        no1Password: options.no1Password,
+        noBitwarden: options.noBitwarden
       }))
     }
   }

package/src/lib/resolvers/get.js

@@ -51,6 +51,8 @@ function buildOptions (options, processEnv) {
     envKeysFilepath: options.envKeysFilepath || options.envKeysFile || null,
     noArmor: options.noArmor,
     noKeychain: options.noKeychain,
+    no1Password: options.no1Password,
+    noBitwarden: options.noBitwarden,
     onStatus: options.onStatus
   }
 }