@dotenvx/dotenvx 2.25.0 → 2.26.1

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.25.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.26.1...main)
+
+## [2.26.1](https://github.com/dotenvx/dotenvx/compare/v2.26.0...v2.26.1) (2026-09-15)
+
+### Changed
+
+* Add `dotenvx 1password up|down|push|pull` and `dotenvx bitwarden up|down|push|pull` ([#969](https://github.com/dotenvx/dotenvx/pull/969))
+
+## [2.26.0](https://github.com/dotenvx/dotenvx/compare/v2.25.0...v2.26.0) (2026-09-15)
+
+### Added
+
+* Add support for storing private key to bitwarden or 1password ([#968](https://github.com/dotenvx/dotenvx/pull/968))
 
 ## [2.25.0](https://github.com/dotenvx/dotenvx/compare/v2.24.1...v2.25.0) (2026-09-14)
 

package/README.md

@@ -872,11 +872,15 @@ $ dotenvx encrypt
 
 > A `DOTENV_PUBLIC_KEY` (encryption key) and a `DOTENV_PRIVATE_KEY` (decryption key) are generated using the same public-key cryptography as [Bitcoin](https://en.bitcoin.it/wiki/Secp256k1).
 
-New private keys created by `encrypt` and encrypted `set` default to your OS secret store: macOS Keychain, Windows Credential Manager, or Linux Secret Service. When logged into Armor, the interactive picker offers OS secret store or Armor. When Armor is off, OS storage is selected automatically. Existing `.env.keys` files are not automatically migrated.
+New private keys created by `encrypt` and encrypted `set` default to your OS secret store: macOS Keychain, Windows Credential Manager, or Linux Secret Service. The interactive picker offers Local Custody through your OS secret store, Local Custody through 1Password when available, and Managed Custody through Armor when logged in. When only the OS store is available, it is selected automatically. Existing `.env.keys` files are not automatically migrated.
 
 Linux requires `secret-tool` (typically the `libsecret-tools` package), a running Secret Service such as GNOME Keyring, and a user D-Bus session. When native tooling or the service is missing, dotenvx reports the fallback to `.env.keys`. Locked, denied, timed-out, or unverified storage operations fail without falling back to a plaintext key file.
 
-CI uses file storage. To explicitly use file storage elsewhere, run `dotenvx encrypt --no-native --no-armor` (or pass both flags to `set`). For deployment, continue supplying the private key through your platform's secret injection.
+CI uses file storage. To explicitly use file storage elsewhere, run `dotenvx encrypt --no-native --no-armor --no-1password` (or pass all three flags to `set`). For deployment, continue supplying the private key through your platform's secret injection.
+
+The 1Password option appears when CLI version 2 is installed and an account is configured (or `OP_SERVICE_ACCOUNT_TOKEN` is set). Detection does not sign in or unlock your vault. Selecting it authenticates as needed, uses the default vault selected by the 1Password CLI, and verifies the saved key before writing the encrypted env file. An unavailable, denied, or cancelled 1Password operation fails without falling back to local key storage.
+
+1Password custody stores the key in your default vault and saves only its account/item reference in dotenvx's per-user settings. `run`, `get`, and `keypair` then retrieve it automatically, subject to 1Password authorization. `--no-1password` (where supported) or `DOTENVX_NO_1PASSWORD=true` disables that integration. The local reference is needed for automatic lookup on this machine; on another machine, the key is still accessible in the vault but its locator must also be configured for automatic lookup. No plaintext private key is written to `.env.keys` or passed in command arguments. The “Local Custody” label refers to using your own password manager; 1Password vaults may sync off-machine.
 
 To move an existing key into the OS store, run `dotenvx native up`. It verifies the stored key before removing it from `.env.keys`. Use `dotenvx native push` to keep a file copy, `dotenvx native pull` to export a copy, or `dotenvx native down` to move it back to `.env.keys`. Add `-f .env.production` for a particular env file. Keep a recoverable copy in your team's secret manager or backup before replacing or losing the machine.
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.25.0",
+  "version": "2.26.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/encrypt.js

@@ -23,11 +23,14 @@ async function encryptAction () {
   const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
   const noKeychain = options.native === false || options.noNative === true
 
+  const noBitwarden = options.bitwarden === false || options.noBitwarden === true
+  const no1Password = options['1password'] === false || options.no1Password === true
+
   let errorCount = 0
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
-    const { processedEnvs } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate, noKeychain })
+    const { processedEnvs } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate, noKeychain, no1Password, noBitwarden })
 
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
@@ -48,7 +51,7 @@ async function encryptAction () {
   }
 
   try {
-    const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate, noKeychain })
+    const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate, noKeychain, no1Password, noBitwarden })
 
     if (keysSrc) {
       await fsx.writeFileX(fk, keysSrc)

package/src/cli/actions/keypair.js

@@ -22,6 +22,8 @@ async function keypair (key) {
       envKeysFile: options.envKeysFile,
       armor: options.armor,
       noKeychain: options.native === false || options.noNative === true,
+      noBitwarden: options.bitwarden === false || options.noBitwarden === true,
+      no1Password: options['1password'] === false || options.no1Password === true,
       token: options.token,
       command: process.argv.slice(2),
       onStatus: (text) => {

package/src/cli/actions/set.js

@@ -61,10 +61,13 @@ async function set (key, value) {
   const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
   const noKeychain = options.native === false || options.noNative === true
 
+  const noBitwarden = options.bitwarden === false || options.noBitwarden === true
+  const no1Password = options['1password'] === false || options.no1Password === true
+
   let errorCount = 0
 
   try {
-    const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await setTransform({ envs, key, value, fk, noArmor, noCreate, encrypt, noKeychain })
+    const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await setTransform({ envs, key, value, fk, noArmor, noCreate, encrypt, noKeychain, no1Password, noBitwarden })
 
     if (keysSrc) {
       await fsx.writeFileX(fk, keysSrc)

package/src/cli/commands/armor.js

@@ -2,7 +2,7 @@ const executeDynamic = require('./../../lib/helpers/executeDynamic')
 
 function configureArmorCommand (armor) {
   armor
-    .description('move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
+    .description('move private keys in/out of Dotenvx Armor [www.dotenvx.com/armor]')
     .allowUnknownOption()
     .argument('[command]', 'dotenvx-armor command')
     .argument('[args...]', 'dotenvx-armor command arguments')

package/src/cli/commands/custody.js

@@ -0,0 +1,43 @@
+function configureCustodyCommand (command, name, providerPath) {
+  command.hook('preAction', async () => {
+    const Session = require('../../db/session')
+    await new Session().notifyUpdate()
+  })
+  command.description(`move private keys in/out of ${name}`).action(function () { this.help() })
+  const descriptions = {
+    up: `move key from .env.keys into ${name}`,
+    down: `move key from ${name} to .env.keys`,
+    push: `copy key from .env.keys into ${name}`,
+    pull: `copy key from ${name} into .env.keys`
+  }
+  for (const [operation, description] of Object.entries(descriptions)) {
+    command.command(operation)
+      .description(description)
+      .option('-f, --env-file <path>', 'path to your env file')
+      .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
+      .action(async function () {
+        const { logger } = require('../../shared/logger')
+        const createSpinner = require('../../lib/helpers/createSpinner')
+        const armoredKeyDisplay = require('../../lib/helpers/armoredKeyDisplay')
+        const transfer = require('../../lib/services/custodyTransfer')
+        const options = this.opts()
+        const spinner = await createSpinner({ ...this.optsWithGlobals(), text: `${operation === 'up' || operation === 'push' ? 'storing in' : 'reading from'} ${name}` })
+        try {
+          const result = await transfer(require(providerPath), name, operation, options.envFile, options.envKeysFile)
+          if (spinner) spinner.stop()
+          const display = armoredKeyDisplay(result.publicKeyValue) || result.privateKeyName
+          const messages = { up: `stored in ${name}`, down: `moved to ${options.envKeysFile}`, push: `pushed to ${name}`, pull: `pulled to ${options.envKeysFile}` }
+          if (result.changed) logger.success(`□ ${messages[operation]} (${display})`)
+          else logger.info(`○ no change (${display})`)
+        } catch (error) {
+          if (spinner) spinner.stop()
+          if (error.code === 'PROMPT_CANCELLED') return process.exit(130)
+          logger.error(error.message)
+          process.exit(1)
+        }
+      })
+  }
+  return command
+}
+
+module.exports = configureCustodyCommand

package/src/cli/commands/native.js

@@ -6,7 +6,7 @@ function configureNativeCommand (native) {
   })
 
   native
-    .description('move private keys into your OS secret store')
+    .description('move private keys in/out of your OS secret store')
     .action(function () {
       this.help()
     })

package/src/cli/dotenvx.js

@@ -131,6 +131,8 @@ program.command('set')
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')
+  .option('--no-1password', 'disable 1Password features')
+  .option('--no-bitwarden', 'disable Bitwarden features')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/set').apply(this, args)
@@ -161,6 +163,8 @@ function configureEncryptCommand (command) {
     .option('--no-create', 'do not create .env file(s) when missing')
     .option('--no-armor', 'disable Dotenvx Armor features')
     .option('--no-native', 'disable OS secret store features')
+    .option('--no-1password', 'disable 1Password features')
+    .option('--no-bitwarden', 'disable Bitwarden features')
     .action(function (...args) {
       this.envs = envs
       return require('./actions/encrypt').apply(this, args)
@@ -198,6 +202,8 @@ program.command('keypair')
   .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')
+  .option('--no-1password', 'disable 1Password features')
+  .option('--no-bitwarden', 'disable Bitwarden features')
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
   .option('--format <type>', 'format of the output (json, shell, colon)', 'json')
@@ -340,14 +346,19 @@ program.command('help [command]')
 
 // security sections (hidden commands advertised here)
 program.addHelpText('after', ' ')
-program.addHelpText('after', 'Better Security:')
+program.addHelpText('after', 'Local Custody:')
 program.addHelpText('after', '  lock                     ⊡ lock private keys with a local passphrase')
-program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store')
+program.addHelpText('after', '  native                   ⌥ move private keys in/out of your OS secret store')
+program.addHelpText('after', '  1password                □ move private keys in/out of 1Password')
+program.addHelpText('after', '  bitwarden                □ move private keys in/out of Bitwarden')
 program.addHelpText('after', ' ')
-program.addHelpText('after', 'For Security Teams:')
-program.addHelpText('after', '  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
+program.addHelpText('after', 'Managed Custody:')
+program.addHelpText('after', '  armor                    ⛨ move private keys in/out of Dotenvx Armor [www.dotenvx.com/armor]')
 program.addHelpText('after', '  curl                     ⛨ call authenticated api Dotenvx Armor [www.dotenvx.com/armor]')
 
+require('./commands/custody')(program.command('1password', { hidden: true }), '1Password', '../../lib/helpers/onePasswordCustody')
+require('./commands/custody')(program.command('bitwarden', { hidden: true }), 'Bitwarden', '../../lib/helpers/bitwardenCustody')
+
 // dotenvx native
 require('./commands/native')(program.command('native', { hidden: true }))
 

package/src/lib/helpers/bitwardenCustody.js

@@ -0,0 +1,170 @@
+const { execFile, execFileSync } = require('child_process')
+const { derive } = require('@dotenvx/primitives')
+const Session = require('../../db/session')
+const prompts = require('./prompts')
+const createSpinner = require('./createSpinner')
+let unlockedSession
+
+const armoredKeyDisplay = require('./armoredKeyDisplay')
+
+const PREFIX = 'DOTENVX_BITWARDEN_'
+const ID = /^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/i
+const COMMAND_OPTIONS = { encoding: 'utf8', windowsHide: true, timeout: 120000, killSignal: 'SIGKILL', maxBuffer: 1024 * 1024 }
+
+function failure (message) {
+  const error = new Error(message)
+  error.code = 'BITWARDEN_FAILED'
+  return error
+}
+
+function commandFailure () {
+  return failure('Bitwarden CLI operation failed; check sign-in and unlock your vault with BW_SESSION')
+}
+
+function run (args, input, timeout = COMMAND_OPTIONS.timeout, env = commandEnv()) {
+  return new Promise((resolve, reject) => {
+    const child = execFile('bw', [...args, '--nointeraction'], { ...COMMAND_OPTIONS, timeout, env }, (error, stdout) => {
+      if (error) reject(commandFailure())
+      else resolve(stdout)
+    })
+    if (child.stdin) {
+      child.stdin.on('error', () => {})
+      child.stdin.end(input)
+    }
+  })
+}
+
+function parse (value) {
+  try { return JSON.parse(value) } catch {
+    throw failure('Bitwarden CLI returned an invalid response')
+  }
+}
+
+async function available () {
+  try { return /^\d+\.\d+\.\d+/.test((await run(['--version'], undefined, 2000)).trim()) } catch { return false }
+}
+
+function configured () {
+  const store = new Session().openStore()
+  return !!store && Object.keys(store.store).some(key => key.startsWith(PREFIX))
+}
+
+function location (publicKey) {
+  const store = new Session().openStore()
+  const value = store && store.get(`${PREFIX}${publicKey}`)
+  if (!value) return null
+  // Base64 keeps the nonsecret JSON locator safe in the dotenv settings file.
+  const loc = parse(Buffer.from(String(value), 'base64').toString('utf8'))
+  if (!loc || !ID.test(loc.item || '') || !ID.test(loc.userId || '') || typeof loc.serverUrl !== 'string') {
+    throw failure('invalid Bitwarden private-key reference in dotenvx settings')
+  }
+  return loc
+}
+
+function commandEnv () {
+  return { ...process.env, ...(unlockedSession ? { BW_SESSION: unlockedSession } : {}) }
+}
+
+async function authenticate (loc) {
+  let status = parse(await run(['status']))
+  if (loc && status && status.userId && (status.userId !== loc.userId || (status.serverUrl || '') !== loc.serverUrl)) {
+    throw failure('Bitwarden account or server does not match the stored private-key reference')
+  }
+  if (status && status.status === 'unlocked') return checkIdentity(status, loc)
+  unlockedSession = undefined
+  if (status && status.status === 'unauthenticated') throw failure('Sign in to Bitwarden once with bw login, then retry; dotenvx will prompt to unlock your vault')
+  if (!status || status.status !== 'locked') throw commandFailure()
+  if (!process.stdin.isTTY || !process.stderr.isTTY || process.env.CI) {
+    throw failure('Bitwarden is locked; set an unlocked BW_SESSION for noninteractive use')
+  }
+  let password
+  createSpinner.pause()
+  try {
+    password = await prompts.password({ message: 'Bitwarden master password', prefix: '◇', separator: '=' }, { input: process.stdin, output: process.stderr })
+  } finally {
+    createSpinner.resume()
+  }
+  const passwordEnv = 'DOTENVX_BITWARDEN_PASSWORD'
+  const session = (await run(['unlock', '--passwordenv', passwordEnv, '--raw'], undefined, COMMAND_OPTIONS.timeout, { ...process.env, [passwordEnv]: password })).trim()
+  if (!session) throw commandFailure()
+  unlockedSession = session
+  try {
+    status = parse(await run(['status']))
+    return checkIdentity(status, loc)
+  } catch (error) {
+    unlockedSession = undefined
+    throw error
+  }
+}
+
+function requireSession () {
+  if (!unlockedSession && !process.env.BW_SESSION) throw failure('Bitwarden requires an unlocked BW_SESSION; run bw login, then bw unlock --raw and set BW_SESSION')
+}
+
+function checkIdentity (status, loc) {
+  if (!status || status.status !== 'unlocked' || !ID.test(status.userId || '')) throw commandFailure()
+  if (loc && (status.userId !== loc.userId || (status.serverUrl || '') !== loc.serverUrl)) {
+    throw failure('Bitwarden account or server does not match the stored private-key reference')
+  }
+  return status
+}
+
+function verified (publicKey, privateKey) {
+  try { if (derive(privateKey) === publicKey) return { [publicKey]: privateKey } } catch {}
+  throw failure('Bitwarden private key does not match the .env public key')
+}
+
+async function get (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return {}
+  await authenticate(loc)
+  return verified(publicKey, (await run(['get', 'password', loc.item])).trim())
+}
+
+function getSync (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return {}
+  requireSession()
+  function read (args) {
+    try { return execFileSync('bw', [...args, '--nointeraction'], { ...COMMAND_OPTIONS, env: commandEnv(), stdio: ['ignore', 'pipe', 'pipe'] }) } catch { throw commandFailure() }
+  }
+  checkIdentity(parse(read(['status'])), loc)
+  return verified(publicKey, read(['get', 'password', loc.item]).trim())
+}
+
+async function set (publicKey, privateKey) {
+  verified(publicKey, privateKey)
+  if (location(publicKey)) {
+    await get(publicKey)
+    return
+  }
+  const status = await authenticate()
+  const template = {
+    organizationId: null,
+    collectionIds: [],
+    folderId: null,
+    type: 1,
+    name: `dotenvx (${armoredKeyDisplay(publicKey)})`,
+    notes: null,
+    favorite: false,
+    fields: [{ name: 'public_key', value: publicKey, type: 0 }],
+    login: { username: 'private_key', password: privateKey, totp: null, uris: [] }
+  }
+  // Pass encoded JSON on stdin, never secrets in command arguments or files.
+  const item = parse(await run(['create', 'item'], Buffer.from(JSON.stringify(template)).toString('base64')))
+  if (!item || !ID.test(item.id || '') || item.organizationId) throw failure('Bitwarden did not return a personal vault item')
+  const saved = (await run(['get', 'password', item.id])).trim()
+  verified(publicKey, saved)
+  const loc = { item: item.id, userId: status.userId, serverUrl: status.serverUrl || '' }
+  new Session().createStore().set(`${PREFIX}${publicKey}`, Buffer.from(JSON.stringify(loc)).toString('base64'))
+}
+
+async function remove (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return
+  await authenticate(loc)
+  await run(['delete', 'item', loc.item])
+  new Session().openStore().delete(`${PREFIX}${publicKey}`)
+}
+
+module.exports = { available, configured, get, getSync, set, delete: remove }

package/src/lib/helpers/onePasswordCustody.js

@@ -0,0 +1,167 @@
+const { execFile, execFileSync } = require('child_process')
+const { derive } = require('@dotenvx/primitives')
+const Session = require('../../db/session')
+const armoredKeyDisplay = require('./armoredKeyDisplay')
+
+const PREFIX = 'DOTENVX_ONEPASSWORD_'
+const ID = /^[a-z0-9]{26}$/i
+const COMMAND_OPTIONS = { encoding: 'utf8', windowsHide: true, timeout: 120000, killSignal: 'SIGKILL', maxBuffer: 1024 * 1024 }
+
+function failure (message) {
+  const error = new Error(message)
+  error.code = '1PASSWORD_FAILED'
+  return error
+}
+
+function commandError (args, stderr) {
+  const step = args[0] === 'item'
+    ? (args[1] === 'delete' ? 'delete the key item' : 'create the key item')
+    : {
+        whoami: 'check the signed-in account',
+        signin: 'sign in',
+        read: 'read the private key'
+      }[args[0]] || 'check availability'
+  if (/account is not signed in/i.test(String(stderr || ''))) {
+    const error = failure(`1Password could not ${step}: account is not signed in. Sign in with op signin or enable the desktop app CLI integration`)
+    error.reason = 'NOT_SIGNED_IN'
+    return error
+  }
+  return failure(`1Password could not ${step}; check sign-in and vault permissions`)
+}
+
+function run (args, input, timeout = COMMAND_OPTIONS.timeout) {
+  return new Promise((resolve, reject) => {
+    // On Unix, Node supplies a socket for stdin. op only detects piped JSON
+    // through a real pipe, so cat bridges the socket without writing a file.
+    const pipeInput = input !== undefined && process.platform !== 'win32'
+    const command = pipeInput ? '/bin/sh' : 'op'
+    const commandArgs = pipeInput ? ['-c', 'cat | op "$@"', 'dotenvx-op', ...args] : args
+    let timer
+    const child = execFile(command, commandArgs, {
+      ...COMMAND_OPTIONS,
+      timeout: pipeInput ? 0 : timeout,
+      ...(pipeInput ? { detached: true } : {})
+    }, (error, stdout, stderr) => {
+      clearTimeout(timer)
+      // Subprocess errors may include secrets from stdin or stdout.
+      if (error) reject(commandError(args, stderr))
+      else resolve(stdout)
+    })
+    if (pipeInput) {
+      timer = setTimeout(() => {
+        // Kill the whole pipeline, including op, if authentication times out.
+        try { process.kill(-child.pid, 'SIGKILL') } catch {}
+      }, timeout)
+      timer.unref()
+    }
+    if (child.stdin) {
+      child.stdin.on('error', () => {})
+      child.stdin.end(input)
+    }
+  })
+}
+
+function parseResponse (value) {
+  try { return JSON.parse(value) } catch {
+    throw failure('1Password CLI returned an invalid response')
+  }
+}
+
+async function available () {
+  try {
+    const version = await run(['--version'], undefined, 2000)
+    if (!/^2\./.test(version.trim())) return false
+    if (process.env.OP_SERVICE_ACCOUNT_TOKEN) return true
+    // Account discovery is local; authenticate only after the user selects 1Password.
+    const accounts = parseResponse(await run(['account', 'list', '--format=json'], undefined, 2000))
+    return Array.isArray(accounts) && accounts.length > 0
+  } catch {
+    return false
+  }
+}
+
+function configured () {
+  const store = new Session().openStore()
+  return !!store && Object.keys(store.store).some(key => key.startsWith(PREFIX))
+}
+
+function location (publicKey) {
+  const store = new Session().openStore()
+  const value = store && store.get(`${PREFIX}${publicKey}`)
+  if (!value) return null
+  const [account, reference] = String(value).split('|')
+  if (!ID.test(account) || !/^op:\/\/[a-z0-9]{26}\/[a-z0-9]{26}\/(?:private_key|password)$/i.test(reference || '')) {
+    throw failure('invalid 1Password private-key reference in dotenvx settings')
+  }
+  return { account, reference }
+}
+
+function verified (publicKey, privateKey) {
+  try {
+    if (derive(privateKey) === publicKey) return { [publicKey]: privateKey }
+  } catch {}
+  throw failure('1Password private key does not match the .env public key')
+}
+
+async function get (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return {}
+  const privateKey = await run(['read', loc.reference, '--no-newline', `--account=${loc.account}`])
+  return verified(publicKey, privateKey.trim())
+}
+
+function getSync (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return {}
+  let privateKey
+  try {
+    privateKey = execFileSync('op', ['read', loc.reference, '--no-newline', `--account=${loc.account}`], {
+      ...COMMAND_OPTIONS, stdio: ['ignore', 'pipe', 'pipe']
+    }).trim()
+  } catch {
+    throw failure('1Password CLI could not read the private key; check sign-in and vault permissions')
+  }
+  return verified(publicKey, privateKey)
+}
+
+async function set (publicKey, privateKey) {
+  let identity
+  try {
+    identity = parseResponse(await run(['whoami', '--format=json']))
+  } catch (error) {
+    if (error.reason !== 'NOT_SIGNED_IN' || process.env.OP_SERVICE_ACCOUNT_TOKEN) throw error
+    // whoami checks authentication but does not initiate the desktop app flow.
+    // Discard signin output; never print or evaluate a returned session token.
+    await run(['signin'])
+    identity = parseResponse(await run(['whoami', '--format=json']))
+  }
+  const account = identity.account_uuid
+  if (!ID.test(account || '')) throw failure('could not identify the signed-in 1Password account')
+  const item = parseResponse(await run(['item', 'create', '-', '--format=json', `--account=${account}`], JSON.stringify({
+    title: `dotenvx (${armoredKeyDisplay(publicKey)})`,
+    category: 'PASSWORD',
+    tags: ['dotenvx'],
+    fields: [
+      { id: 'password', label: 'private_key', type: 'CONCEALED', purpose: 'PASSWORD', value: privateKey },
+      { id: 'public_key', label: 'public_key', type: 'STRING', value: publicKey }
+    ]
+  })))
+  if (!ID.test(item.id || '')) throw failure('1Password did not return a saved item ID')
+  const vault = item.vault && item.vault.id
+  if (!ID.test(vault || '')) throw failure('1Password did not return the saved item vault ID')
+  const reference = `op://${vault}/${item.id}/password`
+  const saved = await run(['read', reference, '--no-newline', `--account=${account}`])
+  if (saved.trim() !== privateKey) throw failure('could not verify private key in 1Password')
+  // Only a nonsecret locator is persisted locally, never the private key.
+  new Session().createStore().set(`${PREFIX}${publicKey}`, `${account}|${reference}`)
+}
+
+async function remove (publicKey) {
+  const loc = location(publicKey)
+  if (!loc) return
+  const [vault, item] = loc.reference.slice('op://'.length).split('/')
+  await run(['item', 'delete', item, `--vault=${vault}`, `--account=${loc.account}`])
+  new Session().openStore().delete(`${PREFIX}${publicKey}`)
+}
+
+module.exports = { available, configured, get, getSync, set, delete: remove }

package/src/lib/helpers/selectKeyStorage.js

@@ -1,4 +1,6 @@
 const prompts = require('./prompts')
+const onePasswordCustody = require('./onePasswordCustody')
+const bitwardenCustody = require('./bitwardenCustody')
 
 const secretStoreNames = {
   darwin: 'macOS Keychain',
@@ -9,14 +11,23 @@ const secretStoreNames = {
 async function selectKeyStorage (options = {}) {
   const useNative = !options.noKeychain && !process.env.CI && ['darwin', 'linux', 'win32'].includes(process.platform)
   const defaultStorage = useNative ? 'native' : 'file'
-  if (process.env.CI || options.noCreate || options.noArmor || !process.stdin.isTTY || !process.stderr.isTTY) return defaultStorage
+  if (process.env.CI || options.noCreate || !process.stdin.isTTY || !process.stderr.isTTY) return defaultStorage
+
+  const choices = [
+    ...(useNative ? [{ name: `□ Local Custody (Native ${secretStoreNames[process.platform]})`, value: 'native' }] : [])
+  ]
+  if (!options.no1Password && process.env.DOTENVX_NO_1PASSWORD !== 'true' && await onePasswordCustody.available()) {
+    choices.push({ name: '□ Local Custody (1Password)', value: 'onepassword' })
+  }
+  if (!options.noBitwarden && process.env.DOTENVX_NO_BITWARDEN !== 'true' && await bitwardenCustody.available()) {
+    choices.push({ name: '□ Local Custody (Bitwarden)', value: 'bitwarden' })
+  }
+  if (!options.noArmor) choices.push({ name: '⛨ Managed Custody (Armor)', value: 'armored' })
+  if (choices.length < 2) return choices.length ? choices[0].value : defaultStorage
 
   return prompts.select({
     message: 'Choose private key storage',
-    choices: [
-      ...(useNative ? [{ name: `□ Local Custody (${secretStoreNames[process.platform]})`, value: 'native' }] : []),
-      { name: '⛨ Managed Custody (Armor)', value: 'armored' }
-    ]
+    choices
   }, { input: process.stdin, output: process.stderr })
 }
 

package/src/lib/main.d.ts

@@ -293,6 +293,12 @@ export interface SetOptions {
    */
   noNative?: boolean;
 
+  /** Disable 1Password custody and secret-reference resolution. */
+  no1Password?: boolean;
+
+  /** Disable Bitwarden custody and secret-reference resolution. */
+  noBitwarden?: boolean;
+
 }
 
 export type SetProcessedEnv = {

package/src/lib/main.js

@@ -257,6 +257,8 @@ const set = async function (key, value, options = {}) {
     fk: envKeysFilepath,
     noArmor,
     noKeychain,
+    no1Password: options.no1Password,
+    noBitwarden: options.noBitwarden,
     noCreate,
     encrypt
   })

package/src/lib/providers/index.js

@@ -2,6 +2,8 @@ const Session = require('./../../db/session')
 
 const armorProvider = require('./armor/index')
 const nativeProvider = require('./native/index')
+const onePasswordCustody = require('../helpers/onePasswordCustody')
+const bitwardenCustody = require('../helpers/bitwardenCustody')
 
 function syncArmorProvider (publicKeyHex) {
   const { createSyncFn } = require('@dotenvx/tooling')
@@ -49,6 +51,14 @@ function useNative (options) {
   return options.noNative !== true && options.native !== false && options.noKeychain !== true
 }
 
+function useOnePassword (options) {
+  return options.no1Password !== true && process.env.DOTENVX_NO_1PASSWORD !== 'true' && onePasswordCustody.configured()
+}
+
+function useBitwarden (options) {
+  return options.noBitwarden !== true && process.env.DOTENVX_NO_BITWARDEN !== 'true' && bitwardenCustody.configured()
+}
+
 function useArmor (options, noArmor) {
   return options.noArmor !== true && options.armor !== false && !noArmor
 }
@@ -71,6 +81,9 @@ async function providers (options = {}) {
     providerFns.push(nativeProvider)
   }
 
+  if (useOnePassword(options)) providerFns.push(onePasswordCustody.get)
+  if (useBitwarden(options)) providerFns.push(bitwardenCustody.get)
+
   if (options.noArmor !== true && options.armor !== false) {
     const sesh = new Session()
     const noArmor = !options.token && await sesh.noArmor()
@@ -93,6 +106,9 @@ providers.sync = function providersSync (options = {}) {
     providerFns.push(nativeProvider)
   }
 
+  if (useOnePassword(options)) providerFns.push(onePasswordCustody.getSync)
+  if (useBitwarden(options)) providerFns.push(bitwardenCustody.getSync)
+
   if (options.noArmor !== true && options.armor !== false) {
     const sesh = new Session()
     const noArmor = !options.token && sesh.noArmorSync()

package/src/lib/services/custodyTransfer.js

@@ -0,0 +1,50 @@
+const { derive } = require('@dotenvx/primitives')
+const keynames = require('../conventions/keynames')
+const readEnvKey = require('../helpers/readEnvKey')
+const removeEnvKey = require('../helpers/removeEnvKey')
+const upsertEnvKey = require('../helpers/upsertEnvKey')
+
+function verify (publicKey, privateKey) {
+  try {
+    if (derive(privateKey) === publicKey) return
+  } catch {}
+  throw new Error('private key does not match the .env public key')
+}
+
+async function custodyTransfer (provider, name, operation, envFile = '.env', envKeysFile = '.env.keys') {
+  if (!['up', 'down', 'push', 'pull'].includes(operation)) throw new Error('unknown custody operation')
+  const { publicKeyName, privateKeyName } = keynames(envFile)
+  const publicKey = readEnvKey(publicKeyName, envFile, { strict: true })
+  const result = changed => ({ changed, privateKeyName, publicKeyValue: publicKey })
+  const local = readEnvKey(privateKeyName, envKeysFile)
+  if (operation === 'up' || operation === 'push') {
+    if (local) verify(publicKey, local)
+    if (operation === 'push' && !local) throw new Error(`missing ${privateKeyName} in ${envKeysFile}`)
+    const existing = (await provider.get(publicKey))[publicKey]
+    if (existing) verify(publicKey, existing)
+    if (!local && !existing) throw new Error(`missing ${privateKeyName} in ${envKeysFile}`)
+    if (!existing) await provider.set(publicKey, local)
+    const saved = (await provider.get(publicKey))[publicKey]
+    if (!saved || saved !== (local || existing)) throw new Error(`could not verify private key in ${name}; ${envKeysFile} unchanged`)
+    if (operation === 'up') return result(removeEnvKey(privateKeyName, envKeysFile).changed || !existing)
+    return result(!existing)
+  }
+
+  const privateKey = (await provider.get(publicKey))[publicKey]
+  if (!privateKey) {
+    if (operation === 'down' && local) {
+      verify(publicKey, local)
+      return result(false)
+    }
+    throw new Error(`[NOT_FOUND] private key not found in ${name}`)
+  }
+  verify(publicKey, privateKey)
+  const written = upsertEnvKey(privateKeyName, privateKey, envKeysFile)
+  if (readEnvKey(privateKeyName, envKeysFile, { strict: true }) !== privateKey) {
+    throw new Error(`could not verify private key in ${envKeysFile}; ${name} unchanged`)
+  }
+  if (operation === 'down') await provider.delete(publicKey)
+  return result(written.changed || operation === 'down')
+}
+
+module.exports = custodyTransfer

package/src/lib/transforms/encrypt.js

@@ -18,6 +18,8 @@ const Session = require('../../db/session')
 
 const selectKeyStorage = require('../helpers/selectKeyStorage')
 const storeNativePrivateKey = require('../helpers/storeNativePrivateKey')
+const onePasswordCustody = require('../helpers/onePasswordCustody')
+const bitwardenCustody = require('../helpers/bitwardenCustody')
 
 async function encryptTransform (options = {}) {
   const envs = options.envs || []
@@ -85,7 +87,11 @@ async function encryptTransform (options = {}) {
 
         const comment = path.basename(envFilepath)
 
-        if (storage === 'native' && storeNativePrivateKey(publicKey, privateKey, fk)) {
+        if (storage === 'bitwarden') {
+          await bitwardenCustody.set(publicKey, privateKey)
+        } else if (storage === 'onepassword') {
+          await onePasswordCustody.set(publicKey, privateKey)
+        } else if (storage === 'native' && storeNativePrivateKey(publicKey, privateKey, fk)) {
           row.nativePrivateKeyAdded = true
         } else if (storage !== 'armored') {
           const mutated = mutateKeysSrc({ keysSrc, privateKeyName, privateKeyValue: privateKey, comment })

package/src/lib/transforms/set.js

@@ -18,6 +18,8 @@ const Session = require('../../db/session')
 
 const selectKeyStorage = require('../helpers/selectKeyStorage')
 const storeNativePrivateKey = require('../helpers/storeNativePrivateKey')
+const onePasswordCustody = require('../helpers/onePasswordCustody')
+const bitwardenCustody = require('../helpers/bitwardenCustody')
 
 async function setTransform (options = {}) {
   const envs = options.envs || []
@@ -89,7 +91,11 @@ async function setTransform (options = {}) {
 
         const comment = path.basename(envFilepath)
 
-        if (storage === 'native' && storeNativePrivateKey(publicKey, privateKey, fk)) {
+        if (storage === 'bitwarden') {
+          await bitwardenCustody.set(publicKey, privateKey)
+        } else if (storage === 'onepassword') {
+          await onePasswordCustody.set(publicKey, privateKey)
+        } else if (storage === 'native' && storeNativePrivateKey(publicKey, privateKey, fk)) {
           row.nativePrivateKeyAdded = true
         } else if (storage !== 'armored') {
           const mutated = mutateKeysSrc({ keysSrc, privateKeyName, privateKeyValue: privateKey, comment })
@@ -141,7 +147,9 @@ async function setTransform (options = {}) {
           all: true,
           envKeysFile: fk,
           noArmor,
-          noKeychain
+          noKeychain,
+          no1Password: options.no1Password,
+          noBitwarden: options.noBitwarden
         })
 
         const before = parsed[key]