@dotenvx/dotenvx 2.24.1 → 2.26.0

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.24.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.26.0...main)
+
+## [2.25.0](https://github.com/dotenvx/dotenvx/compare/v2.25.0...v2.26.0) (2026-09-15)
+
+### Added
+
+* Add support for storing private key to bitwarden or 1password ([#968](https://github.com/dotenvx/dotenvx/pull/968))
+
+## [2.25.0](https://github.com/dotenvx/dotenvx/compare/v2.24.1...v2.25.0) (2026-09-14)
+
+### Changed
+
+* Store private key to os secret store rather than `.env.keys` by default ([#967](https://github.com/dotenvx/dotenvx/pull/967))
 
 ## [2.24.1](https://github.com/dotenvx/dotenvx/compare/v2.24.0...v2.24.1) (2026-09-11)
 

package/README.md

@@ -872,6 +872,18 @@ $ dotenvx encrypt
 
 > A `DOTENV_PUBLIC_KEY` (encryption key) and a `DOTENV_PRIVATE_KEY` (decryption key) are generated using the same public-key cryptography as [Bitcoin](https://en.bitcoin.it/wiki/Secp256k1).
 
+New private keys created by `encrypt` and encrypted `set` default to your OS secret store: macOS Keychain, Windows Credential Manager, or Linux Secret Service. The interactive picker offers Local Custody through your OS secret store, Local Custody through 1Password when available, and Managed Custody through Armor when logged in. When only the OS store is available, it is selected automatically. Existing `.env.keys` files are not automatically migrated.
+
+Linux requires `secret-tool` (typically the `libsecret-tools` package), a running Secret Service such as GNOME Keyring, and a user D-Bus session. When native tooling or the service is missing, dotenvx reports the fallback to `.env.keys`. Locked, denied, timed-out, or unverified storage operations fail without falling back to a plaintext key file.
+
+CI uses file storage. To explicitly use file storage elsewhere, run `dotenvx encrypt --no-native --no-armor --no-1password` (or pass all three flags to `set`). For deployment, continue supplying the private key through your platform's secret injection.
+
+The 1Password option appears when CLI version 2 is installed and an account is configured (or `OP_SERVICE_ACCOUNT_TOKEN` is set). Detection does not sign in or unlock your vault. Selecting it authenticates as needed, uses the default vault selected by the 1Password CLI, and verifies the saved key before writing the encrypted env file. An unavailable, denied, or cancelled 1Password operation fails without falling back to local key storage.
+
+1Password custody stores the key in your default vault and saves only its account/item reference in dotenvx's per-user settings. `run`, `get`, and `keypair` then retrieve it automatically, subject to 1Password authorization. `--no-1password` (where supported) or `DOTENVX_NO_1PASSWORD=true` disables that integration. The local reference is needed for automatic lookup on this machine; on another machine, the key is still accessible in the vault but its locator must also be configured for automatic lookup. No plaintext private key is written to `.env.keys` or passed in command arguments. The “Local Custody” label refers to using your own password manager; 1Password vaults may sync off-machine.
+
+To move an existing key into the OS store, run `dotenvx native up`. It verifies the stored key before removing it from `.env.keys`. Use `dotenvx native push` to keep a file copy, `dotenvx native pull` to export a copy, or `dotenvx native down` to move it back to `.env.keys`. Add `-f .env.production` for a particular env file. Keep a recoverable copy in your team's secret manager or backup before replacing or losing the machine.
+
 More examples
 
 <details><summary>`.env`</summary><br>

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.24.1",
+  "version": "2.26.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/encrypt.js

@@ -23,11 +23,14 @@ async function encryptAction () {
   const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
   const noKeychain = options.native === false || options.noNative === true
 
+  const noBitwarden = options.bitwarden === false || options.noBitwarden === true
+  const no1Password = options['1password'] === false || options.no1Password === true
+
   let errorCount = 0
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
-    const { processedEnvs } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate, noKeychain })
+    const { processedEnvs } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate, noKeychain, no1Password, noBitwarden })
 
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
@@ -35,7 +38,7 @@ async function encryptAction () {
         errorCount += 1
         logger.error(processedEnv.error.messageWithHelp || processedEnv.error.message)
       }
-      if (processedEnv.envSrc) {
+      if (!processedEnv.error && processedEnv.envSrc) {
         console.log(processedEnv.envSrc)
       }
     }
@@ -48,7 +51,7 @@ async function encryptAction () {
   }
 
   try {
-    const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate, noKeychain })
+    const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate, noKeychain, no1Password, noBitwarden })
 
     if (keysSrc) {
       await fsx.writeFileX(fk, keysSrc)

package/src/cli/actions/keypair.js

@@ -22,6 +22,8 @@ async function keypair (key) {
       envKeysFile: options.envKeysFile,
       armor: options.armor,
       noKeychain: options.native === false || options.noNative === true,
+      noBitwarden: options.bitwarden === false || options.noBitwarden === true,
+      no1Password: options['1password'] === false || options.no1Password === true,
       token: options.token,
       command: process.argv.slice(2),
       onStatus: (text) => {

package/src/cli/actions/set.js

@@ -61,10 +61,13 @@ async function set (key, value) {
   const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
   const noKeychain = options.native === false || options.noNative === true
 
+  const noBitwarden = options.bitwarden === false || options.noBitwarden === true
+  const no1Password = options['1password'] === false || options.no1Password === true
+
   let errorCount = 0
 
   try {
-    const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await setTransform({ envs, key, value, fk, noArmor, noCreate, encrypt, noKeychain })
+    const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await setTransform({ envs, key, value, fk, noArmor, noCreate, encrypt, noKeychain, no1Password, noBitwarden })
 
     if (keysSrc) {
       await fsx.writeFileX(fk, keysSrc)

package/src/cli/dotenvx.js

@@ -131,6 +131,8 @@ program.command('set')
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')
+  .option('--no-1password', 'disable 1Password features')
+  .option('--no-bitwarden', 'disable Bitwarden features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/set').apply(this, args)
@@ -161,6 +163,8 @@ function configureEncryptCommand (command) {
     .option('--no-create', 'do not create .env file(s) when missing')
     .option('--no-armor', 'disable Dotenvx Armor features')
     .option('--no-native', 'disable OS secret store features')
+    .option('--no-1password', 'disable 1Password features')
+    .option('--no-bitwarden', 'disable Bitwarden features')
     .action(function (...args) {
       this.envs = envs
       return require('./actions/encrypt').apply(this, args)
@@ -198,6 +202,8 @@ program.command('keypair')
   .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')
+  .option('--no-1password', 'disable 1Password features')
+  .option('--no-bitwarden', 'disable Bitwarden features')
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
   .option('--format <type>', 'format of the output (json, shell, colon)', 'json')

package/src/lib/helpers/bitwardenCustody.js

@@ -0,0 +1,162 @@
+const { execFile, execFileSync } = require('child_process')
+const { derive } = require('@dotenvx/primitives')
+const Session = require('../../db/session')
+const prompts = require('./prompts')
+const createSpinner = require('./createSpinner')
+let unlockedSession
+
+const armoredKeyDisplay = require('./armoredKeyDisplay')
+
+const PREFIX = 'DOTENVX_BITWARDEN_'
+const ID = /^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/i
+const COMMAND_OPTIONS = { encoding: 'utf8', windowsHide: true, timeout: 120000, killSignal: 'SIGKILL', maxBuffer: 1024 * 1024 }
+
+function failure (message) {
+  const error = new Error(message)
+  error.code = 'BITWARDEN_FAILED'
+  return error
+}
+
+function commandFailure () {
+  return failure('Bitwarden CLI operation failed; check sign-in and unlock your vault with BW_SESSION')
+}
+
+function run (args, input, timeout = COMMAND_OPTIONS.timeout, env = commandEnv()) {
+  return new Promise((resolve, reject) => {
+    const child = execFile('bw', [...args, '--nointeraction'], { ...COMMAND_OPTIONS, timeout, env }, (error, stdout) => {
+      if (error) reject(commandFailure())
+      else resolve(stdout)
+    })
+    if (child.stdin) {
+      child.stdin.on('error', () => {})
+      child.stdin.end(input)
+    }
+  })
+}
+
+function parse (value) {
+  try { return JSON.parse(value) } catch {
+    throw failure('Bitwarden CLI returned an invalid response')
+  }
+}
+
+async function available () {
+  try { return /^\d+\.\d+\.\d+/.test((await run(['--version'], undefined, 2000)).trim()) } catch { return false }
+}
+
+function configured () {
+  const store = new Session().openStore()
+  return !!store && Object.keys(store.store).some(key => key.startsWith(PREFIX))
+}
+
+function location (publicKey) {
+  const store = new Session().openStore()
+  const value = store && store.get(`${PREFIX}${publicKey}`)
+  if (!value) return null
+  // Base64 keeps the nonsecret JSON locator safe in the dotenv settings file.
+  const loc = parse(Buffer.from(String(value), 'base64').toString('utf8'))
+  if (!loc || !ID.test(loc.item || '') || !ID.test(loc.userId || '') || typeof loc.serverUrl !== 'string') {
+    throw failure('invalid Bitwarden private-key reference in dotenvx settings')
+  }
+  return loc
+}
+
+function commandEnv () {
+  return { ...process.env, ...(unlockedSession ? { BW_SESSION: unlockedSession } : {}) }
+}
+
+async function authenticate (loc) {
+  let status = parse(await run(['status']))
+  if (loc && status && status.userId && (status.userId !== loc.userId || (status.serverUrl || '') !== loc.serverUrl)) {
+    throw failure('Bitwarden account or server does not match the stored private-key reference')
+  }
+  if (status && status.status === 'unlocked') return checkIdentity(status, loc)
+  unlockedSession = undefined
+  if (status && status.status === 'unauthenticated') throw failure('Sign in to Bitwarden once with bw login, then retry; dotenvx will prompt to unlock your vault')
+  if (!status || status.status !== 'locked') throw commandFailure()
+  if (!process.stdin.isTTY || !process.stderr.isTTY || process.env.CI) {
+    throw failure('Bitwarden is locked; set an unlocked BW_SESSION for noninteractive use')
+  }
+  let password
+  createSpinner.pause()
+  try {
+    password = await prompts.password({ message: 'Bitwarden master password', prefix: '◇', separator: '=' }, { input: process.stdin, output: process.stderr })
+  } finally {
+    createSpinner.resume()
+  }
+  const passwordEnv = 'DOTENVX_BITWARDEN_PASSWORD'
+  const session = (await run(['unlock', '--passwordenv', passwordEnv, '--raw'], undefined, COMMAND_OPTIONS.timeout, { ...process.env, [passwordEnv]: password })).trim()
+  if (!session) throw commandFailure()
+  unlockedSession = session
+  try {
+    status = parse(await run(['status']))
+    return checkIdentity(status, loc)
+  } catch (error) {
+    unlockedSession = undefined
+    throw error
+  }
+}
+
+function requireSession () {
+  if (!unlockedSession && !process.env.BW_SESSION) throw failure('Bitwarden requires an unlocked BW_SESSION; run bw login, then bw unlock --raw and set BW_SESSION')
+}
+
+function checkIdentity (status, loc) {
+  if (!status || status.status !== 'unlocked' || !ID.test(status.userId || '')) throw commandFailure()
+  if (loc && (status.userId !== loc.userId || (status.serverUrl || '') !== loc.serverUrl)) {
+    throw failure('Bitwarden account or server does not match the stored private-key reference')
+  }
+  return status
+}
+
+function verified (publicKey, privateKey) {
+  try { if (derive(privateKey) === publicKey) return { [publicKey]: privateKey } } catch {}
+  throw failure('Bitwarden private key does not match the .env public key')
+}
+
+async function get (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return {}
+  await authenticate(loc)
+  return verified(publicKey, (await run(['get', 'password', loc.item])).trim())
+}
+
+function getSync (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return {}
+  requireSession()
+  function read (args) {
+    try { return execFileSync('bw', [...args, '--nointeraction'], { ...COMMAND_OPTIONS, env: commandEnv(), stdio: ['ignore', 'pipe', 'pipe'] }) } catch { throw commandFailure() }
+  }
+  checkIdentity(parse(read(['status'])), loc)
+  return verified(publicKey, read(['get', 'password', loc.item]).trim())
+}
+
+async function set (publicKey, privateKey) {
+  verified(publicKey, privateKey)
+  if (location(publicKey)) {
+    await get(publicKey)
+    return
+  }
+  const status = await authenticate()
+  const template = {
+    organizationId: null,
+    collectionIds: [],
+    folderId: null,
+    type: 1,
+    name: `dotenvx (${armoredKeyDisplay(publicKey)})`,
+    notes: null,
+    favorite: false,
+    fields: [{ name: 'public_key', value: publicKey, type: 0 }],
+    login: { username: 'private_key', password: privateKey, totp: null, uris: [] }
+  }
+  // Pass encoded JSON on stdin, never secrets in command arguments or files.
+  const item = parse(await run(['create', 'item'], Buffer.from(JSON.stringify(template)).toString('base64')))
+  if (!item || !ID.test(item.id || '') || item.organizationId) throw failure('Bitwarden did not return a personal vault item')
+  const saved = (await run(['get', 'password', item.id])).trim()
+  verified(publicKey, saved)
+  const loc = { item: item.id, userId: status.userId, serverUrl: status.serverUrl || '' }
+  new Session().createStore().set(`${PREFIX}${publicKey}`, Buffer.from(JSON.stringify(loc)).toString('base64'))
+}
+
+module.exports = { available, configured, get, getSync, set }

package/src/lib/helpers/linuxSecretService.js

@@ -1,4 +1,5 @@
 const { execFileSync } = require('child_process')
+const nativeStoreError = require('./nativeStoreError')
 
 const SECRET_TOOL_BIN = 'secret-tool'
 const SERVICE = 'dotenvx'
@@ -10,11 +11,13 @@ function attributes (publicKey) {
 function get (publicKey) {
   try {
     return execFileSync(SECRET_TOOL_BIN, ['lookup', ...attributes(publicKey)], {
+      timeout: 10000,
+      killSignal: 'SIGKILL',
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe']
     }).trim() || null
-  } catch {
-    throw new Error('failed to read private key from Linux Secret Service')
+  } catch (error) {
+    throw nativeStoreError('failed to read private key from Linux Secret Service', error, true)
   }
 }
 
@@ -22,11 +25,13 @@ function set (publicKey, privateKey, label) {
   try {
     execFileSync(SECRET_TOOL_BIN, ['store', `--label=${label}`, ...attributes(publicKey)], {
       input: privateKey,
+      timeout: 10000,
+      killSignal: 'SIGKILL',
       encoding: 'utf8',
       stdio: ['pipe', 'ignore', 'pipe']
     })
-  } catch {
-    throw new Error('failed to save private key to Linux Secret Service')
+  } catch (error) {
+    throw nativeStoreError('failed to save private key to Linux Secret Service', error, true)
   }
 }
 
@@ -36,10 +41,12 @@ module.exports = {
   delete (publicKey) {
     try {
       execFileSync(SECRET_TOOL_BIN, ['clear', ...attributes(publicKey)], {
+        timeout: 10000,
+        killSignal: 'SIGKILL',
         stdio: ['ignore', 'ignore', 'pipe']
       })
-    } catch {
-      throw new Error('failed to delete private key from Linux Secret Service')
+    } catch (error) {
+      throw nativeStoreError('failed to delete private key from Linux Secret Service', error, true)
     }
   }
 }

package/src/lib/helpers/macosKeychain.js

@@ -1,26 +1,36 @@
 const { execFileSync } = require('child_process')
+const nativeStoreError = require('./nativeStoreError')
 
 const SECURITY_BIN = '/usr/bin/security'
 const SERVICE = 'dotenvx'
 
 module.exports = {
   get (key) {
-    return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', key, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+    try {
+      return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', key, '-w'], {
+        timeout: 10000,
+        killSignal: 'SIGKILL',
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore']
+      }).trim()
+    } catch (error) {
+      throw nativeStoreError('failed to read private key from macOS Keychain', error)
+    }
   },
 
   set (key, value, label) {
     try {
-      execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', key, '-l', label, '-w', value], { stdio: 'ignore' })
-    } catch {
-      throw new Error('failed to save private key to macOS Keychain')
+      execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', key, '-l', label, '-w', value], { timeout: 10000, killSignal: 'SIGKILL', stdio: 'ignore' })
+    } catch (error) {
+      throw nativeStoreError('failed to save private key to macOS Keychain', error)
     }
   },
 
   delete (key) {
     try {
-      execFileSync(SECURITY_BIN, ['delete-generic-password', '-s', SERVICE, '-a', key], { stdio: 'ignore' })
-    } catch {
-      throw new Error('failed to delete private key from macOS Keychain')
+      execFileSync(SECURITY_BIN, ['delete-generic-password', '-s', SERVICE, '-a', key], { timeout: 10000, killSignal: 'SIGKILL', stdio: 'ignore' })
+    } catch (error) {
+      throw nativeStoreError('failed to delete private key from macOS Keychain', error)
     }
   }
 }

package/src/lib/helpers/nativeStoreError.js

@@ -0,0 +1,10 @@
+// Never attach subprocess errors: their command/output may contain private keys.
+function nativeStoreError (message, error, linux = false) {
+  const unavailable = error.code === 'ENOENT' || (linux &&
+    /org\.freedesktop\.DBus\.Error\.(ServiceUnknown|NoServer)|Cannot autolaunch D-Bus without X11|Failed to connect to socket .*: No such file or directory/.test(String(error.stderr || '')))
+  const result = new Error(message)
+  result.code = unavailable ? 'NATIVE_UNAVAILABLE' : 'NATIVE_ACCESS_FAILED'
+  return result
+}
+
+module.exports = nativeStoreError

package/src/lib/helpers/onePasswordCustody.js

@@ -0,0 +1,159 @@
+const { execFile, execFileSync } = require('child_process')
+const { derive } = require('@dotenvx/primitives')
+const Session = require('../../db/session')
+const armoredKeyDisplay = require('./armoredKeyDisplay')
+
+const PREFIX = 'DOTENVX_ONEPASSWORD_'
+const ID = /^[a-z0-9]{26}$/i
+const COMMAND_OPTIONS = { encoding: 'utf8', windowsHide: true, timeout: 120000, killSignal: 'SIGKILL', maxBuffer: 1024 * 1024 }
+
+function failure (message) {
+  const error = new Error(message)
+  error.code = '1PASSWORD_FAILED'
+  return error
+}
+
+function commandError (args, stderr) {
+  const step = args[0] === 'item'
+    ? 'create the key item'
+    : {
+        whoami: 'check the signed-in account',
+        signin: 'sign in',
+        read: 'read the private key'
+      }[args[0]] || 'check availability'
+  if (/account is not signed in/i.test(String(stderr || ''))) {
+    const error = failure(`1Password could not ${step}: account is not signed in. Sign in with op signin or enable the desktop app CLI integration`)
+    error.reason = 'NOT_SIGNED_IN'
+    return error
+  }
+  return failure(`1Password could not ${step}; check sign-in and vault permissions`)
+}
+
+function run (args, input, timeout = COMMAND_OPTIONS.timeout) {
+  return new Promise((resolve, reject) => {
+    // On Unix, Node supplies a socket for stdin. op only detects piped JSON
+    // through a real pipe, so cat bridges the socket without writing a file.
+    const pipeInput = input !== undefined && process.platform !== 'win32'
+    const command = pipeInput ? '/bin/sh' : 'op'
+    const commandArgs = pipeInput ? ['-c', 'cat | op "$@"', 'dotenvx-op', ...args] : args
+    let timer
+    const child = execFile(command, commandArgs, {
+      ...COMMAND_OPTIONS,
+      timeout: pipeInput ? 0 : timeout,
+      ...(pipeInput ? { detached: true } : {})
+    }, (error, stdout, stderr) => {
+      clearTimeout(timer)
+      // Subprocess errors may include secrets from stdin or stdout.
+      if (error) reject(commandError(args, stderr))
+      else resolve(stdout)
+    })
+    if (pipeInput) {
+      timer = setTimeout(() => {
+        // Kill the whole pipeline, including op, if authentication times out.
+        try { process.kill(-child.pid, 'SIGKILL') } catch {}
+      }, timeout)
+      timer.unref()
+    }
+    if (child.stdin) {
+      child.stdin.on('error', () => {})
+      child.stdin.end(input)
+    }
+  })
+}
+
+function parseResponse (value) {
+  try { return JSON.parse(value) } catch {
+    throw failure('1Password CLI returned an invalid response')
+  }
+}
+
+async function available () {
+  try {
+    const version = await run(['--version'], undefined, 2000)
+    if (!/^2\./.test(version.trim())) return false
+    if (process.env.OP_SERVICE_ACCOUNT_TOKEN) return true
+    // Account discovery is local; authenticate only after the user selects 1Password.
+    const accounts = parseResponse(await run(['account', 'list', '--format=json'], undefined, 2000))
+    return Array.isArray(accounts) && accounts.length > 0
+  } catch {
+    return false
+  }
+}
+
+function configured () {
+  const store = new Session().openStore()
+  return !!store && Object.keys(store.store).some(key => key.startsWith(PREFIX))
+}
+
+function location (publicKey) {
+  const store = new Session().openStore()
+  const value = store && store.get(`${PREFIX}${publicKey}`)
+  if (!value) return null
+  const [account, reference] = String(value).split('|')
+  if (!ID.test(account) || !/^op:\/\/[a-z0-9]{26}\/[a-z0-9]{26}\/(?:private_key|password)$/i.test(reference || '')) {
+    throw failure('invalid 1Password private-key reference in dotenvx settings')
+  }
+  return { account, reference }
+}
+
+function verified (publicKey, privateKey) {
+  try {
+    if (derive(privateKey) === publicKey) return { [publicKey]: privateKey }
+  } catch {}
+  throw failure('1Password private key does not match the .env public key')
+}
+
+async function get (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return {}
+  const privateKey = await run(['read', loc.reference, '--no-newline', `--account=${loc.account}`])
+  return verified(publicKey, privateKey.trim())
+}
+
+function getSync (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return {}
+  let privateKey
+  try {
+    privateKey = execFileSync('op', ['read', loc.reference, '--no-newline', `--account=${loc.account}`], {
+      ...COMMAND_OPTIONS, stdio: ['ignore', 'pipe', 'pipe']
+    }).trim()
+  } catch {
+    throw failure('1Password CLI could not read the private key; check sign-in and vault permissions')
+  }
+  return verified(publicKey, privateKey)
+}
+
+async function set (publicKey, privateKey) {
+  let identity
+  try {
+    identity = parseResponse(await run(['whoami', '--format=json']))
+  } catch (error) {
+    if (error.reason !== 'NOT_SIGNED_IN' || process.env.OP_SERVICE_ACCOUNT_TOKEN) throw error
+    // whoami checks authentication but does not initiate the desktop app flow.
+    // Discard signin output; never print or evaluate a returned session token.
+    await run(['signin'])
+    identity = parseResponse(await run(['whoami', '--format=json']))
+  }
+  const account = identity.account_uuid
+  if (!ID.test(account || '')) throw failure('could not identify the signed-in 1Password account')
+  const item = parseResponse(await run(['item', 'create', '-', '--format=json', `--account=${account}`], JSON.stringify({
+    title: `dotenvx (${armoredKeyDisplay(publicKey)})`,
+    category: 'PASSWORD',
+    tags: ['dotenvx'],
+    fields: [
+      { id: 'password', label: 'private_key', type: 'CONCEALED', purpose: 'PASSWORD', value: privateKey },
+      { id: 'public_key', label: 'public_key', type: 'STRING', value: publicKey }
+    ]
+  })))
+  if (!ID.test(item.id || '')) throw failure('1Password did not return a saved item ID')
+  const vault = item.vault && item.vault.id
+  if (!ID.test(vault || '')) throw failure('1Password did not return the saved item vault ID')
+  const reference = `op://${vault}/${item.id}/password`
+  const saved = await run(['read', reference, '--no-newline', `--account=${account}`])
+  if (saved.trim() !== privateKey) throw failure('could not verify private key in 1Password')
+  // Only a nonsecret locator is persisted locally, never the private key.
+  new Session().createStore().set(`${PREFIX}${publicKey}`, `${account}|${reference}`)
+}
+
+module.exports = { available, configured, get, getSync, set }

package/src/lib/helpers/selectKeyStorage.js

@@ -0,0 +1,34 @@
+const prompts = require('./prompts')
+const onePasswordCustody = require('./onePasswordCustody')
+const bitwardenCustody = require('./bitwardenCustody')
+
+const secretStoreNames = {
+  darwin: 'macOS Keychain',
+  win32: 'Windows Credential Manager',
+  linux: 'Linux Secret Service'
+}
+
+async function selectKeyStorage (options = {}) {
+  const useNative = !options.noKeychain && !process.env.CI && ['darwin', 'linux', 'win32'].includes(process.platform)
+  const defaultStorage = useNative ? 'native' : 'file'
+  if (process.env.CI || options.noCreate || !process.stdin.isTTY || !process.stderr.isTTY) return defaultStorage
+
+  const choices = [
+    ...(useNative ? [{ name: `□ Local Custody (${secretStoreNames[process.platform]})`, value: 'native' }] : [])
+  ]
+  if (!options.no1Password && process.env.DOTENVX_NO_1PASSWORD !== 'true' && await onePasswordCustody.available()) {
+    choices.push({ name: '□ Local Custody (1Password)', value: 'onepassword' })
+  }
+  if (!options.noBitwarden && process.env.DOTENVX_NO_BITWARDEN !== 'true' && await bitwardenCustody.available()) {
+    choices.push({ name: '□ Local Custody (Bitwarden)', value: 'bitwarden' })
+  }
+  if (!options.noArmor) choices.push({ name: '⛨ Managed Custody (Armor)', value: 'armored' })
+  if (choices.length < 2) return choices.length ? choices[0].value : defaultStorage
+
+  return prompts.select({
+    message: 'Choose private key storage',
+    choices
+  }, { input: process.stdin, output: process.stderr })
+}
+
+module.exports = selectKeyStorage

package/src/lib/helpers/storeNativePrivateKey.js

@@ -0,0 +1,24 @@
+const nativeProvider = require('../providers/native')
+const armoredKeyDisplay = require('./armoredKeyDisplay')
+const { logger } = require('../../shared/logger')
+
+function storeNativePrivateKey (publicKey, privateKey, keysFilepath) {
+  try {
+    nativeProvider.set(publicKey, privateKey, `dotenvx (${armoredKeyDisplay(publicKey)})`)
+  } catch (error) {
+    if (error.code !== 'NATIVE_UNAVAILABLE') throw error
+    logger.warn(`OS secret store unavailable; saving private key to ${keysFilepath}`)
+    return false
+  }
+
+  // A successful write must be readable before committing the encrypted file.
+  // Read failures must never fall back to plaintext storage.
+  if (nativeProvider.get(publicKey) !== privateKey) {
+    const error = new Error('could not verify private key in OS secret store')
+    error.code = 'NATIVE_VERIFY_FAILED'
+    throw error
+  }
+  return true
+}
+
+module.exports = storeNativePrivateKey

package/src/lib/helpers/windowsCredentialManager.js

@@ -1,4 +1,5 @@
 const { execFileSync } = require('child_process')
+const nativeStoreError = require('./nativeStoreError')
 
 const POWERSHELL_BIN = 'powershell.exe'
 const SERVICE = 'dotenvx'
@@ -128,6 +129,8 @@ function target (publicKey) {
 function run (payload) {
   return execFileSync(POWERSHELL_BIN, ['-NoProfile', '-NonInteractive', '-EncodedCommand', encodedScript], {
     input: JSON.stringify(payload),
+    timeout: 10000,
+    killSignal: 'SIGKILL',
     encoding: 'utf8',
     stdio: ['pipe', 'pipe', 'pipe'],
     windowsHide: true
@@ -137,16 +140,16 @@ function run (payload) {
 function get (publicKey) {
   try {
     return run({ action: 'read', target: target(publicKey) }).trim() || null
-  } catch {
-    throw new Error('failed to read private key from Windows Credential Manager')
+  } catch (error) {
+    throw nativeStoreError('failed to read private key from Windows Credential Manager', error)
   }
 }
 
 function set (publicKey, privateKey) {
   try {
     run({ action: 'write', target: target(publicKey), username: publicKey, secret: privateKey })
-  } catch {
-    throw new Error('failed to save private key to Windows Credential Manager')
+  } catch (error) {
+    throw nativeStoreError('failed to save private key to Windows Credential Manager', error)
   }
 }
 
@@ -156,8 +159,8 @@ module.exports = {
   delete (publicKey) {
     try {
       run({ action: 'delete', target: target(publicKey) })
-    } catch {
-      throw new Error('failed to delete private key from Windows Credential Manager')
+    } catch (error) {
+      throw nativeStoreError('failed to delete private key from Windows Credential Manager', error)
     }
   }
 }

package/src/lib/main.d.ts

@@ -293,6 +293,12 @@ export interface SetOptions {
    */
   noNative?: boolean;
 
+  /** Disable 1Password custody and secret-reference resolution. */
+  no1Password?: boolean;
+
+  /** Disable Bitwarden custody and secret-reference resolution. */
+  noBitwarden?: boolean;
+
 }
 
 export type SetProcessedEnv = {
@@ -306,6 +312,7 @@ export type SetProcessedEnv = {
   publicKey?: string;
   privateKey?: string;
   localPrivateKeyAdded?: boolean;
+  nativePrivateKeyAdded?: boolean;
   remotePrivateKeyAdded?: boolean;
   privateKeyName?: string;
   error?: Error;

package/src/lib/main.js

@@ -257,6 +257,8 @@ const set = async function (key, value, options = {}) {
     fk: envKeysFilepath,
     noArmor,
     noKeychain,
+    no1Password: options.no1Password,
+    noBitwarden: options.noBitwarden,
     noCreate,
     encrypt
   })

package/src/lib/providers/index.js

@@ -2,6 +2,8 @@ const Session = require('./../../db/session')
 
 const armorProvider = require('./armor/index')
 const nativeProvider = require('./native/index')
+const onePasswordCustody = require('../helpers/onePasswordCustody')
+const bitwardenCustody = require('../helpers/bitwardenCustody')
 
 function syncArmorProvider (publicKeyHex) {
   const { createSyncFn } = require('@dotenvx/tooling')
@@ -49,6 +51,14 @@ function useNative (options) {
   return options.noNative !== true && options.native !== false && options.noKeychain !== true
 }
 
+function useOnePassword (options) {
+  return options.no1Password !== true && process.env.DOTENVX_NO_1PASSWORD !== 'true' && onePasswordCustody.configured()
+}
+
+function useBitwarden (options) {
+  return options.noBitwarden !== true && process.env.DOTENVX_NO_BITWARDEN !== 'true' && bitwardenCustody.configured()
+}
+
 function useArmor (options, noArmor) {
   return options.noArmor !== true && options.armor !== false && !noArmor
 }
@@ -71,6 +81,9 @@ async function providers (options = {}) {
     providerFns.push(nativeProvider)
   }
 
+  if (useOnePassword(options)) providerFns.push(onePasswordCustody.get)
+  if (useBitwarden(options)) providerFns.push(bitwardenCustody.get)
+
   if (options.noArmor !== true && options.armor !== false) {
     const sesh = new Session()
     const noArmor = !options.token && await sesh.noArmor()
@@ -93,6 +106,9 @@ providers.sync = function providersSync (options = {}) {
     providerFns.push(nativeProvider)
   }
 
+  if (useOnePassword(options)) providerFns.push(onePasswordCustody.getSync)
+  if (useBitwarden(options)) providerFns.push(bitwardenCustody.getSync)
+
   if (options.noArmor !== true && options.armor !== false) {
     const sesh = new Session()
     const noArmor = !options.token && sesh.noArmorSync()

package/src/lib/services/keychainUp.js

@@ -54,6 +54,9 @@ class KeychainUp {
     }
 
     nativeProvider.set(publicKey, privateKey, label)
+    if (nativeProvider.get(publicKey) !== privateKey) {
+      throw new Error('could not verify private key in OS secret store; .env.keys unchanged')
+    }
     removeEnvKey(privateKeyName, envKeysFile)
 
     return {

package/src/lib/transforms/encrypt.js

@@ -16,27 +16,17 @@ const teamChoicesFromMeta = require('../helpers/teamChoicesFromMeta')
 const isTeamRequiredError = require('../helpers/isTeamRequiredError')
 const Session = require('../../db/session')
 
-async function selectKeyStorage () {
-  const selected = await prompts.select({
-    message: 'Choose private key storage',
-    choices: [
-      { name: '◫ File (.env.keys)', value: 'file' },
-      { name: '⛨ Armor (armor.dotenvx.com)', value: 'armored' }
-    ]
-  }, {
-    input: process.stdin,
-    output: process.stderr
-  })
-
-  return selected
-}
+const selectKeyStorage = require('../helpers/selectKeyStorage')
+const storeNativePrivateKey = require('../helpers/storeNativePrivateKey')
+const onePasswordCustody = require('../helpers/onePasswordCustody')
+const bitwardenCustody = require('../helpers/bitwardenCustody')
 
 async function encryptTransform (options = {}) {
   const envs = options.envs || []
   const ik = options.ik
   const ek = options.ek
   const fk = options.fk || '.env.keys'
-  let noArmor = options.noArmor // key storage selector below
+  let storage
   const noCreate = options.noCreate
 
   const processedEnvs = []
@@ -85,9 +75,7 @@ async function encryptTransform (options = {}) {
       let publicKey = publickeys(row.envSrc)[0]
 
       if (!publicKey) {
-        if (!noCreate && !noArmor && selectKeyStorage) {
-          noArmor = await selectKeyStorage() !== 'armored'
-        }
+        storage = storage || await selectKeyStorage(options)
 
         // upsert public key to .env file
         const kp = keypair() // local
@@ -99,7 +87,13 @@ async function encryptTransform (options = {}) {
 
         const comment = path.basename(envFilepath)
 
-        if (noArmor) {
+        if (storage === 'bitwarden') {
+          await bitwardenCustody.set(publicKey, privateKey)
+        } else if (storage === 'onepassword') {
+          await onePasswordCustody.set(publicKey, privateKey)
+        } else if (storage === 'native' && storeNativePrivateKey(publicKey, privateKey, fk)) {
+          row.nativePrivateKeyAdded = true
+        } else if (storage !== 'armored') {
           const mutated = mutateKeysSrc({ keysSrc, privateKeyName, privateKeyValue: privateKey, comment })
           keysSrc = mutated.keysSrc
         } else {

package/src/lib/transforms/set.js

@@ -16,27 +16,18 @@ const teamChoicesFromMeta = require('../helpers/teamChoicesFromMeta')
 const isTeamRequiredError = require('../helpers/isTeamRequiredError')
 const Session = require('../../db/session')
 
-async function selectKeyStorage () {
-  const selected = await prompts.select({
-    message: 'Choose private key storage',
-    choices: [
-      { name: '◫ File (.env.keys)', value: 'file' },
-      { name: '⛨ Armor (armor.dotenvx.com)', value: 'armored' }
-    ]
-  }, {
-    input: process.stdin,
-    output: process.stderr
-  })
-
-  return selected
-}
+const selectKeyStorage = require('../helpers/selectKeyStorage')
+const storeNativePrivateKey = require('../helpers/storeNativePrivateKey')
+const onePasswordCustody = require('../helpers/onePasswordCustody')
+const bitwardenCustody = require('../helpers/bitwardenCustody')
 
 async function setTransform (options = {}) {
   const envs = options.envs || []
   const key = options.key
   const value = options.value
   const fk = options.fk || '.env.keys'
-  let noArmor = options.noArmor // key storage selector below
+  const noArmor = options.noArmor
+  let storage
   const noKeychain = options.noKeychain
   const noCreate = options.noCreate
   const noEncrypt = !options.encrypt || isPlainKey(key)
@@ -88,9 +79,7 @@ async function setTransform (options = {}) {
 
       // only create if missing public key and encryption needed
       if (!publicKey && !noEncrypt) {
-        if (!noCreate && !noArmor && selectKeyStorage) {
-          noArmor = await selectKeyStorage() !== 'armored'
-        }
+        storage = storage || await selectKeyStorage(options)
 
         // upsert public key to .env file
         const kp = keypair() // local
@@ -102,7 +91,13 @@ async function setTransform (options = {}) {
 
         const comment = path.basename(envFilepath)
 
-        if (noArmor) {
+        if (storage === 'bitwarden') {
+          await bitwardenCustody.set(publicKey, privateKey)
+        } else if (storage === 'onepassword') {
+          await onePasswordCustody.set(publicKey, privateKey)
+        } else if (storage === 'native' && storeNativePrivateKey(publicKey, privateKey, fk)) {
+          row.nativePrivateKeyAdded = true
+        } else if (storage !== 'armored') {
           const mutated = mutateKeysSrc({ keysSrc, privateKeyName, privateKeyValue: privateKey, comment })
           keysSrc = mutated.keysSrc
         } else {
@@ -152,7 +147,9 @@ async function setTransform (options = {}) {
           all: true,
           envKeysFile: fk,
           noArmor,
-          noKeychain
+          noKeychain,
+          no1Password: options.no1Password,
+          noBitwarden: options.noBitwarden
         })
 
         const before = parsed[key]