@dotenvx/dotenvx 2.14.0 → 2.15.0

package/CHANGELOG.md

@@ -2,7 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.14.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.15.0...main)
+
+## [2.15.0](https://github.com/dotenvx/dotenvx/compare/v2.14.0...v2.15.0) (2026-07-20)
+
+### Added
+
+* Add support for 1Password `op://` secrets in your .env files. ([#908](https://github.com/dotenvx/dotenvx/pull/908))
 
 ## [2.14.0](https://github.com/dotenvx/dotenvx/compare/v2.13.0...v2.14.0) (2026-07-16)
 

package/README.md

@@ -153,6 +153,19 @@ Hello [REDACTED]
 
 see [Codex redaction guide](https://dotenvx.com/docs/cli/run-redact-codex-exec)
 
+</details>
+<details><summary>1Password 🔐</summary><br>
+
+Run with secrets resolved directly from 1Password.
+
+```sh
+$ echo "HELLO=op://Personal/hello/password" > .env
+$ dotenvx run -- sh -c 'echo Hello $HELLO'
+Hello World
+```
+
+see [1Password guide](https://dotenvx.com/docs/secrets-in-1password)
+
 </details>
 <details><summary>TypeScript 📘</summary><br>
 
@@ -1156,6 +1169,30 @@ $ dotenvx get GOODBYE
 [MISSING_KEY] missing key (GOODBYE)
 ```
 
+</details>
+<details><summary>`run` - 1Password</summary><br>
+
+Resolve [1Password op://](https://developer.1password.com/docs/cli/secrets-reference-syntax/) directly from your `.env` file.
+
+```ini
+# .env
+API_KEY=op://Personal/my_api_key/password
+```
+
+Install the [1Password CLI](https://developer.1password.com/docs/cli/get-started/) and authenticate with `op`. Dotenvx automatically reads `op://` values through `op read` before injecting them.
+
+```sh
+$ dotenvx run -- node index.js
+```
+
+Use `--no-1password` to leave `op://` values unresolved.
+
+```sh
+$ dotenvx run --no-1password -- node index.js
+```
+
+The same flag is available for `dotenvx get` and `dotenvx validate`.
+
 </details>
 <details><summary>`run -f <directory>`</summary><br>
 
@@ -1478,29 +1515,6 @@ $ dotenvx run --validate --strict -- node index.js
 
 Any inline comment containing the word `optional` marks that key as optional. If `.env.example` is missing, dotenvx reports `MISSING_ENV_EXAMPLE`. An empty `.env.example` is valid and declares no required variables.
 
-</details>
-<details><summary>`validate`</summary><br>
-
-Validate `.env` file(s) against `.env.example` without running a command.
-
-```ini
-# .env.example
-DATABASE_URL=
-API_KEY=
-SENTRY_DSN= # optional
-```
-
-```sh
-$ dotenvx validate
-[VALIDATION_FAILED] missing required (DATABASE_URL, API_KEY). fix: [https://github.com/dotenvx/dotenvx/issues/907]
-```
-
-Use `-f` and `-fk` to validate a specific env file and keys file. The command exits with code `1` when validation fails and prints errors to stderr. On success, it exits with code `0`.
-
-```sh
-$ dotenvx validate -f .env.production -fk .env.keys
-```
-
 </details>
 <details><summary>`run --strict`</summary><br>
 
@@ -2490,6 +2504,29 @@ $ dotenvx ls --json
 $ dotenvx ls --json > dotenv-files.json
 ```
 
+</details>
+<details><summary>`validate`</summary><br>
+
+Validate `.env` file(s) against `.env.example` without running a command.
+
+```ini
+# .env.example
+DATABASE_URL=
+API_KEY=
+SENTRY_DSN= # optional
+```
+
+```sh
+$ dotenvx validate
+[VALIDATION_FAILED] missing required (DATABASE_URL, API_KEY). fix: [https://github.com/dotenvx/dotenvx/issues/907]
+```
+
+Use `-f` and `-fk` to validate a specific env file and keys file. The command exits with code `1` when validation fails and prints errors to stderr. On success, it exits with code `0`.
+
+```sh
+$ dotenvx validate -f .env.production -fk .env.keys
+```
+
 </details>
 <details><summary>`genexample`</summary><br>
 
@@ -3225,6 +3262,30 @@ Turn off [Dotenvx Armor ⛨](https://dotenvx.com/armor) features.
 require('@dotenvx/dotenvx').config({noArmor: true})
 ```
 
+</details>
+<details><summary>`config(no1Password:)` - no1Password</summary><br>
+
+By default, `config()` automatically resolves `op://` values through the installed [1Password CLI](https://developer.1password.com/docs/cli/get-started/).
+
+```ini
+# .env
+API_KEY=op://Personal/my_api_key/password
+```
+
+```js
+// index.js
+require('@dotenvx/dotenvx').config()
+
+console.log(process.env.API_KEY)
+```
+
+Set `no1Password` to leave `op://` values unresolved and avoid calling `op`.
+
+```js
+// index.js
+require('@dotenvx/dotenvx').config({no1Password: true})
+```
+
 </details>
 <details><summary>`parse(src)`</summary><br>
 
@@ -3385,7 +3446,6 @@ Set `mask: 0` to fully mask values.
   * [GitHub Actions](https://dotenvx.com/docs/cis/github-actions)
 * [Password Managers](https://dotenvx.com/docs#password-managers)
   * [1Password](https://dotenvx.com/docs/guides/1password)
-  * [Bitwarden](https://dotenvx.com/docs/guides/bitwarden)
 * [Background Jobs](https://dotenvx.com/docs#background-jobs)
   * [Trigger.dev](https://dotenvx.com/docs/background-jobs/triggerdotdev)
 * [Package Managers](https://dotenvx.com/docs#package-managers)

package/package.json

@@ -1,11 +1,20 @@
 {
-  "version": "2.14.0",
+  "version": "2.15.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
   "keywords": [
     "dotenv",
-    "env"
+    "env",
+    ".env",
+    "environment",
+    "variables",
+    "config",
+    "settings",
+    "env vars",
+    "environment variables",
+    "secret-management",
+    "secrets"
   ],
   "homepage": "https://github.com/dotenvx/dotenvx",
   "repository": {

package/src/cli/actions/get.js

@@ -38,6 +38,8 @@ async function get (key) {
       envKeysFile: resolveEnvKeysFile(options.envKeysFile),
       noArmor,
       noKeychain,
+      no1Password: options['1password'] === false || options.no1Password === true,
+      noBitwarden: options.bitwarden === false || options.noBitwarden === true,
       onStatus: (text) => {
         if (spinner && text) {
           spinner.text = text

package/src/cli/actions/run.js

@@ -118,6 +118,8 @@ async function run () {
       envKeysFile: resolveEnvKeysFile(options.envKeysFile),
       noArmor,
       noKeychain,
+      no1Password: options['1password'] === false || options.no1Password === true,
+      noBitwarden: options.bitwarden === false || options.noBitwarden === true,
       token: options.token,
       command: commandArgs,
       onStatus: (text) => {

package/src/cli/actions/validate.js

@@ -37,6 +37,8 @@ async function validate () {
       envKeysFile: resolveEnvKeysFile(options.envKeysFile),
       noArmor,
       noKeychain,
+      no1Password: options['1password'] === false || options.no1Password === true,
+      noBitwarden: options.bitwarden === false || options.noBitwarden === true,
       token: options.token,
       onStatus: (text) => {
         if (spinner && text) {

package/src/cli/dotenvx.js

@@ -74,6 +74,8 @@ program.command('run')
   .option('--mask [characters]', 'inject masked values, optionally setting visible characters')
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')
+  .option('--no-1password', 'disable 1Password secret reference resolution')
+  .option('--no-bitwarden', 'disable Bitwarden secret reference resolution')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/run').apply(this, args)
@@ -98,6 +100,8 @@ program.command('get')
   .option('--format <type>', 'format of the output (json, shell, colon, eval, eval-export)', 'json')
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')
+  .option('--no-1password', 'disable 1Password secret reference resolution')
+  .option('--no-bitwarden', 'disable Bitwarden secret reference resolution')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/get').apply(this, args)
@@ -183,6 +187,25 @@ program.command('ls')
     return require('./actions/ls').apply(this, args)
   })
 
+// dotenvx validate
+program.command('validate')
+  .description('validate .env file(s) against .env.example')
+  .option('-e, --env <strings...>', 'environment variable(s) set as string (example: "HELLO=World")', collectEnvs('env'), [])
+  .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
+  .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
+  .option('-o, --overload', 'override existing env variables (by default, existing env vars take precedence over .env files)')
+  .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
+  .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
+  .option('--token <token>', 'set Armor ⛨ token')
+  .option('--no-armor', 'disable Dotenvx Armor features')
+  .option('--no-native', 'disable OS secret store features')
+  .option('--no-1password', 'disable 1Password secret reference resolution')
+  .option('--no-bitwarden', 'disable Bitwarden secret reference resolution')
+  .action(function (...args) {
+    this.envs = envs
+    return require('./actions/validate').apply(this, args)
+  })
+
 // dotenvx gitignore
 program.command('gitignore')
   .description('append to .gitignore')
@@ -201,23 +224,6 @@ program.command('genexample')
     return require('./actions/ext/genexample').apply(this, args)
   })
 
-// dotenvx validate
-program.command('validate')
-  .description('validate .env file(s) against .env.example')
-  .option('-e, --env <strings...>', 'environment variable(s) set as string (example: "HELLO=World")', collectEnvs('env'), [])
-  .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
-  .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
-  .option('-o, --overload', 'override existing env variables (by default, existing env vars take precedence over .env files)')
-  .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
-  .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
-  .option('--token <token>', 'set Armor ⛨ token')
-  .option('--no-armor', 'disable Dotenvx Armor features')
-  .option('--no-native', 'disable OS secret store features')
-  .action(function (...args) {
-    this.envs = envs
-    return require('./actions/validate').apply(this, args)
-  })
-
 // dotenvx precommit
 program.command('precommit')
   .description('prevent committing .env files to code')

package/src/lib/helpers/createSpinner.js

@@ -1,5 +1,6 @@
 const FRAMES = ['◇', '⬖', '◆', '⬗']
 const FRAME_INTERVAL_MS = 80
+let activeSpinner
 
 async function createSpinner (options = {}) {
   const stream = process.stderr
@@ -11,7 +12,7 @@ async function createSpinner (options = {}) {
   const frames = options.frames || FRAMES
 
   const { default: yoctoSpinner } = await import('yocto-spinner')
-  return yoctoSpinner({
+  activeSpinner = yoctoSpinner({
     text,
     spinner: {
       frames,
@@ -19,6 +20,21 @@ async function createSpinner (options = {}) {
     },
     stream
   }).start()
+
+  return activeSpinner
+}
+
+createSpinner.stop = function () {
+  if (activeSpinner) activeSpinner.stop()
+  activeSpinner = null
+}
+
+createSpinner.pause = function () {
+  if (activeSpinner) activeSpinner.stop()
+}
+
+createSpinner.resume = function () {
+  if (activeSpinner) activeSpinner.start()
 }
 
 module.exports = createSpinner

package/src/lib/helpers/errors.js

@@ -9,6 +9,8 @@ const ISSUE_BY_CODE = {
   INVALID_PASSPHRASE: 'try again with the correct passphrase',
   INVALID_PRIVATE_KEY: 'https://github.com/dotenvx/dotenvx/issues/465',
   INVALID_PUBLIC_KEY: 'https://github.com/dotenvx/dotenvx/issues/756',
+  '1PASSWORD_FAILED': 'https://www.1password.dev/cli/get-started',
+  BITWARDEN_FAILED: 'https://bitwarden.com/help/cli/',
   MALFORMED_ENCRYPTED_DATA: 'https://github.com/dotenvx/dotenvx/issues/467',
   MISPAIRED_PRIVATE_KEY: 'https://github.com/dotenvx/dotenvx/issues/752',
   MISSING_DIRECTORY: 'https://github.com/dotenvx/dotenvx/issues/758',
@@ -100,6 +102,30 @@ class Errors {
     return e
   }
 
+  onePasswordFailed () {
+    const code = '1PASSWORD_FAILED'
+    const message = `[${code}] ${this.message}`
+    const help = `fix: [${ISSUE_BY_CODE[code]}]`
+
+    const e = new Error(message)
+    e.code = code
+    e.help = help
+    e.messageWithHelp = `${message}. ${help}`
+    return e
+  }
+
+  bitwardenFailed () {
+    const code = 'BITWARDEN_FAILED'
+    const message = `[${code}] ${this.message}`
+    const help = this.help || `fix: [${ISSUE_BY_CODE[code]}]`
+
+    const e = new Error(message)
+    e.code = code
+    e.help = help
+    e.messageWithHelp = `${message}. ${help}`
+    return e
+  }
+
   invalidColor () {
     const code = 'INVALID_COLOR'
     const message = `[${code}] Invalid color ${this.color}`

package/src/lib/helpers/resolveBitwardenPassword.js

@@ -0,0 +1,149 @@
+const { execFile, execFileSync } = require('child_process')
+const Errors = require('./errors')
+const prompts = require('./prompts')
+const createSpinner = require('./createSpinner')
+
+const FIELDS = new Set(['username', 'password', 'uri'])
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+function execFileAsync (command, args, options) {
+  return new Promise((resolve, reject) => {
+    execFile(command, args, options, (error, stdout) => {
+      if (error) return reject(error)
+      resolve(stdout)
+    })
+  })
+}
+
+function isSecretReference (value) {
+  return typeof value === 'string' && value.startsWith('bw://')
+}
+
+function parseSecretReference (value) {
+  const [itemId, field, ...extra] = value.slice('bw://'.length).split('/')
+
+  if (!UUID.test(itemId) || !field || extra.length > 0) {
+    throw new Error('invalid Bitwarden Password Manager reference')
+  }
+
+  if (!FIELDS.has(field)) {
+    throw new Error(`unsupported Bitwarden Password Manager field ${field}`)
+  }
+
+  return { itemId, field }
+}
+
+async function session (options) {
+  if (options.session) return options.session
+
+  if (process.stdin.isTTY && process.stderr.isTTY) {
+    createSpinner.pause()
+    const password = await prompts.password({
+      message: 'Bitwarden master password',
+      prefix: '◇',
+      separator: '='
+    }, {
+      input: process.stdin,
+      output: process.stderr
+    })
+    createSpinner.resume()
+    const passwordEnv = 'DOTENVX_BITWARDEN_PASSWORD'
+    options.session = secretValue(await execFileAsync('bw', ['unlock', '--passwordenv', passwordEnv, '--raw'], {
+      encoding: 'utf8',
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, [passwordEnv]: password }
+    }))
+    return options.session
+  }
+
+  if (!options.session) {
+    const error = new Error('Bitwarden Password Manager requires an unlocked BW_SESSION')
+    error.code = 'BW_SESSION_MISSING'
+    throw error
+  }
+}
+
+function resolutionError (key, error) {
+  let message
+  if (error && error.code === 'ENOENT') {
+    message = `Bitwarden Password Manager CLI is not installed and could not resolve ${key}`
+  } else if (error && error.code === 'BW_SESSION_MISSING') {
+    message = `Bitwarden Password Manager is locked and could not resolve ${key}; run 'export BW_SESSION="$(bw unlock --raw)"'`
+  } else if (error && error.message && error.message.startsWith('unsupported Bitwarden Password Manager field')) {
+    message = `${error.message} for ${key}`
+  } else if (error && error.message === 'invalid Bitwarden Password Manager reference') {
+    message = `invalid Bitwarden Password Manager reference for ${key}`
+  } else {
+    message = `Bitwarden Password Manager CLI failed to resolve ${key}`
+  }
+
+  return new Errors({
+    message,
+    help: 'fix: [https://bitwarden.com/help/cli/]'
+  }).bitwardenFailed()
+}
+
+function secretValue (stdout) {
+  return stdout.replace(/\r?\n$/, '')
+}
+
+async function resolveBitwardenPassword (parsed, options = {}) {
+  const errors = []
+  const unresolved = []
+  options.session = options.session || process.env.BW_SESSION
+
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!isSecretReference(value)) continue
+
+    try {
+      const { itemId, field } = parseSecretReference(value)
+      const bwSession = await session(options)
+      const stdout = await execFileAsync('bw', ['get', field, itemId], {
+        encoding: 'utf8',
+        windowsHide: true,
+        env: { ...process.env, BW_SESSION: bwSession }
+      })
+      parsed[key] = secretValue(stdout)
+    } catch (error) {
+      errors.push(resolutionError(key, error))
+      unresolved.push(key)
+      delete parsed[key]
+    }
+  }
+
+  return { errors, unresolved }
+}
+
+function resolveBitwardenPasswordSync (parsed) {
+  const errors = []
+  const unresolved = []
+
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!isSecretReference(value)) continue
+
+    try {
+      const { itemId, field } = parseSecretReference(value)
+      if (!process.env.BW_SESSION) {
+        const error = new Error('Bitwarden Password Manager requires an unlocked BW_SESSION')
+        error.code = 'BW_SESSION_MISSING'
+        throw error
+      }
+      const stdout = execFileSync('bw', ['get', field, itemId], {
+        encoding: 'utf8',
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'pipe']
+      })
+      parsed[key] = secretValue(stdout)
+    } catch (error) {
+      errors.push(resolutionError(key, error))
+      unresolved.push(key)
+      delete parsed[key]
+    }
+  }
+
+  return { errors, unresolved }
+}
+
+module.exports = resolveBitwardenPassword
+module.exports.sync = resolveBitwardenPasswordSync

package/src/lib/helpers/resolveOnePassword.js

@@ -0,0 +1,72 @@
+const { execFile, execFileSync } = require('child_process')
+const Errors = require('./errors')
+
+function execFileAsync (command, args, options) {
+  return new Promise((resolve, reject) => {
+    execFile(command, args, options, (error, stdout) => {
+      if (error) return reject(error)
+      resolve(stdout)
+    })
+  })
+}
+
+function isSecretReference (value) {
+  return typeof value === 'string' && value.startsWith('op://')
+}
+
+function resolutionError (key, error) {
+  const message = error && error.code === 'ENOENT'
+    ? `1Password CLI is not installed and could not resolve ${key}`
+    : `1Password CLI failed to resolve ${key}`
+
+  return new Errors({ message }).onePasswordFailed()
+}
+
+async function resolveOnePassword (parsed) {
+  const errors = []
+  const unresolved = []
+
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!isSecretReference(value)) continue
+
+    try {
+      const stdout = await execFileAsync('op', ['read', value, '--no-newline'], {
+        encoding: 'utf8',
+        windowsHide: true
+      })
+      parsed[key] = stdout
+    } catch (error) {
+      errors.push(resolutionError(key, error))
+      unresolved.push(key)
+      delete parsed[key]
+    }
+  }
+
+  return { errors, unresolved }
+}
+
+function resolveOnePasswordSync (parsed) {
+  const errors = []
+  const unresolved = []
+
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!isSecretReference(value)) continue
+
+    try {
+      parsed[key] = execFileSync('op', ['read', value, '--no-newline'], {
+        encoding: 'utf8',
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'pipe']
+      })
+    } catch (error) {
+      errors.push(resolutionError(key, error))
+      unresolved.push(key)
+      delete parsed[key]
+    }
+  }
+
+  return { errors, unresolved }
+}
+
+module.exports = resolveOnePassword
+module.exports.sync = resolveOnePasswordSync

package/src/lib/main.d.ts

@@ -194,6 +194,22 @@ export interface DotenvConfigOptions {
    */
   noNative?: boolean;
 
+  /**
+   * Turn off 1Password secret reference resolution.
+   *
+   * @default false
+   * @example require('@dotenvx/dotenvx').config({ no1Password: true })
+   */
+  no1Password?: boolean;
+
+  /**
+   * Turn off Bitwarden secret reference resolution.
+   *
+   * @default false
+   * @example require('@dotenvx/dotenvx').config({ noBitwarden: true })
+   */
+  noBitwarden?: boolean;
+
 }
 
 export type DotenvConfigEnv =
@@ -370,6 +386,22 @@ export interface GetOptions {
    */
   noNative?: boolean;
 
+  /**
+   * Turn off 1Password secret reference resolution.
+   *
+   * @default false
+   * @example require('@dotenvx/dotenvx').get('KEY', { no1Password: true })
+   */
+  no1Password?: boolean;
+
+  /**
+   * Turn off Bitwarden secret reference resolution.
+   *
+   * @default false
+   * @example require('@dotenvx/dotenvx').get('KEY', { noBitwarden: true })
+   */
+  noBitwarden?: boolean;
+
 }
 
 /**

package/src/lib/main.js

@@ -87,6 +87,8 @@ const config = function (options = {}) {
       envKeysFile,
       noArmor,
       noKeychain,
+      no1Password: options.no1Password,
+      noBitwarden: options.noBitwarden,
       noSpinner: options.noSpinner,
       token: options.token
     })
@@ -331,7 +333,9 @@ const get = async function (key, options = {}) {
     all: options.all,
     envKeysFile: options.envKeysFile,
     noArmor,
-    noKeychain
+    noKeychain,
+    no1Password: options.no1Password,
+    noBitwarden: options.noBitwarden
   })
 
   if (options.mask !== undefined) {

package/src/lib/resolvers/envs.js

@@ -12,6 +12,8 @@ const keynames = require('./../conventions/keynames')
 const providers = require('./../providers')
 const decryptors = require('./../decryptors')
 const parseWithDecryptor = require('./../helpers/parseWithDecryptor')
+const resolveOnePassword = require('./../helpers/resolveOnePassword')
+const resolveBitwardenPassword = require('./../helpers/resolveBitwardenPassword')
 
 function unresolvedEncryptedErrors (parsed) {
   const keys = []
@@ -70,7 +72,7 @@ function buildParseOptions ({ processEnv, overload, envKeysFilepath, provider, d
   return options
 }
 
-async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider, decryptor }) {
+async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, no1Password, noBitwarden }) {
   const row = {}
   row.type = TYPE_ENV
   row.string = env.value
@@ -101,6 +103,21 @@ async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider
     row.injected = injected || {}
     row.existed = existed || {}
 
+    if (!no1Password) {
+      const result = await resolveOnePassword(row.injected)
+      row.errors.push(...result.errors)
+      for (const key of result.unresolved) delete row.parsed[key]
+      Object.assign(row.parsed, row.injected)
+    }
+
+    if (!noBitwarden) {
+      const passwordResult = await resolveBitwardenPassword(row.injected)
+      row.errors.push(...passwordResult.errors)
+      for (const key of passwordResult.unresolved) delete row.parsed[key]
+
+      Object.assign(row.parsed, row.injected)
+    }
+
     inject(processEnv, row.parsed)
   } catch (e) {
     row.errors = [e]
@@ -109,7 +126,7 @@ async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider
   return row
 }
 
-function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider, decryptor }) {
+function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, no1Password, noBitwarden }) {
   const row = {}
   row.type = TYPE_ENV
   row.string = env.value
@@ -140,6 +157,21 @@ function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider,
     row.injected = injected || {}
     row.existed = existed || {}
 
+    if (!no1Password) {
+      const result = resolveOnePassword.sync(row.injected)
+      row.errors.push(...result.errors)
+      for (const key of result.unresolved) delete row.parsed[key]
+      Object.assign(row.parsed, row.injected)
+    }
+
+    if (!noBitwarden) {
+      const passwordResult = resolveBitwardenPassword.sync(row.injected)
+      row.errors.push(...passwordResult.errors)
+      for (const key of passwordResult.unresolved) delete row.parsed[key]
+
+      Object.assign(row.parsed, row.injected)
+    }
+
     inject(processEnv, row.parsed)
   } catch (e) {
     row.errors = [e]
@@ -148,7 +180,7 @@ function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider,
   return row
 }
 
-async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths }) {
+async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths, no1Password, noBitwarden }) {
   const row = {}
   row.type = TYPE_ENV_FILE
   row.filepath = env.value
@@ -182,6 +214,21 @@ async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, prov
     row.errors = decryptErrors(parsed, errors)
     row.existed = existed || {}
 
+    if (!no1Password) {
+      const result = await resolveOnePassword(row.injected)
+      row.errors.push(...result.errors)
+      for (const key of result.unresolved) delete row.parsed[key]
+      Object.assign(row.parsed, row.injected)
+    }
+
+    if (!noBitwarden) {
+      const passwordResult = await resolveBitwardenPassword(row.injected)
+      row.errors.push(...passwordResult.errors)
+      for (const key of passwordResult.unresolved) delete row.parsed[key]
+
+      Object.assign(row.parsed, row.injected)
+    }
+
     inject(processEnv, parsed)
   } catch (e) {
     if (e.code === 'ENOENT' || e.code === 'EISDIR') {
@@ -194,7 +241,7 @@ async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, prov
   return row
 }
 
-function injectEnvFileSync ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths }) {
+function injectEnvFileSync ({ env, overload, processEnv, envKeysFilepath, provider, decryptor, readableFilepaths, no1Password, noBitwarden }) {
   const row = {}
   row.type = TYPE_ENV_FILE
   row.filepath = env.value
@@ -228,6 +275,21 @@ function injectEnvFileSync ({ env, overload, processEnv, envKeysFilepath, provid
     row.errors = decryptErrors(parsed, errors)
     row.existed = existed || {}
 
+    if (!no1Password) {
+      const result = resolveOnePassword.sync(row.injected)
+      row.errors.push(...result.errors)
+      for (const key of result.unresolved) delete row.parsed[key]
+      Object.assign(row.parsed, row.injected)
+    }
+
+    if (!noBitwarden) {
+      const passwordResult = resolveBitwardenPassword.sync(row.injected)
+      row.errors.push(...passwordResult.errors)
+      for (const key of passwordResult.unresolved) delete row.parsed[key]
+
+      Object.assign(row.parsed, row.injected)
+    }
+
     inject(processEnv, parsed)
   } catch (e) {
     if (e.code === 'ENOENT' || e.code === 'EISDIR') {
@@ -247,7 +309,6 @@ async function envs (options = {}) {
   const envKeysFilepath = options.envKeysFilepath || options.envKeysFile || null
   const provider = await providers(options)
   const decryptor = await decryptors(options)
-
   for (const env of options.envs || []) {
     if (env.type === TYPE_ENV_FILE) {
       processedEnvs.push(await injectEnvFile({
@@ -257,7 +318,9 @@ async function envs (options = {}) {
         envKeysFilepath,
         provider,
         decryptor,
-        readableFilepaths
+        readableFilepaths,
+        no1Password: options.no1Password,
+        noBitwarden: options.noBitwarden
       }))
     } else if (env.type === TYPE_ENV) {
       processedEnvs.push(await injectEnv({
@@ -266,7 +329,9 @@ async function envs (options = {}) {
         processEnv,
         envKeysFilepath,
         provider,
-        decryptor
+        decryptor,
+        no1Password: options.no1Password,
+        noBitwarden: options.noBitwarden
       }))
     }
   }
@@ -294,7 +359,9 @@ function envsSync (options = {}) {
         envKeysFilepath,
         provider,
         decryptor,
-        readableFilepaths
+        readableFilepaths,
+        no1Password: options.no1Password,
+        noBitwarden: options.noBitwarden
       }))
     } else if (env.type === TYPE_ENV) {
       processedEnvs.push(injectEnvSync({
@@ -303,7 +370,9 @@ function envsSync (options = {}) {
         processEnv,
         envKeysFilepath,
         provider,
-        decryptor
+        decryptor,
+        no1Password: options.no1Password,
+        noBitwarden: options.noBitwarden
       }))
     }
   }

package/src/lib/resolvers/get.js

@@ -51,6 +51,8 @@ function buildOptions (options, processEnv) {
     envKeysFilepath: options.envKeysFilepath || options.envKeysFile || null,
     noArmor: options.noArmor,
     noKeychain: options.noKeychain,
+    no1Password: options.no1Password,
+    noBitwarden: options.noBitwarden,
     onStatus: options.onStatus
   }
 }