@dotenvx/dotenvx 2.26.1 → 2.28.0

package/CHANGELOG.md

@@ -2,7 +2,30 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.26.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.28.0...main)
+
+## [2.28.0](https://github.com/dotenvx/dotenvx/compare/v2.27.0...v2.28.0) (2026-09-16)
+
+### Added
+
+* Choose where you custody your keys ([#972](https://github.com/dotenvx/dotenvx/pull/972))
+
+```text
+Your private key
+├── ⛉ Local Custody
+│   ├── OS (macOS Keychain / Windows Credential Manager / Linux Secret Service)
+│   ├── 1Password
+│   ├── Bitwarden
+│   └── File (.env.keys)
+└── ⛊ Managed Custody
+    └── ⛨ Armor
+```
+
+## [2.27.0](https://github.com/dotenvx/dotenvx/compare/v2.26.1...v2.27.0) (2026-09-16)
+
+### Removed
+
+* BREAKING: Removed `run --validate` flag and `validate` command against .env.example file. To be replaced soon with a modern validation scheme.
 
 ## [2.26.1](https://github.com/dotenvx/dotenvx/compare/v2.26.0...v2.26.1) (2026-09-15)
 

package/README.md

@@ -1565,29 +1565,44 @@ Hello production
 Available log levels are `error, warn, info, verbose, debug, silly` ([source](https://docs.npmjs.com/cli/v8/using-npm/logging#setting-log-levels))
 
 </details>
-<details><summary>`run --validate`</summary><br>
+<details><summary>`run` with an Envfile</summary><br>
 
-Validate your environment against `.env.example`.
+When an `Envfile` is present, `run` automatically validates the resolved environment before starting your command. No validation flag is needed.
 
-```ini
-# .env.example
-DATABASE_URL=
-API_KEY=
-SENTRY_DSN= # optional
+```ruby
+# Envfile
+env "DATABASE_URL", type: "url"
+env "API_KEY"
+env "SENTRY_DSN", optional: true
 ```
 
 ```sh
-$ dotenvx run --validate -- node index.js
-[VALIDATION_FAILED] missing required (DATABASE_URL, API_KEY). fix: [https://github.com/dotenvx/dotenvx/issues/907]
+$ dotenvx run -- node index.js
+[INVALID_ENV] DATABASE_URL is required; API_KEY is required
 ```
 
-Validation errors are reported without stopping your command. Combine `--validate` with `--strict` to exit with code `1` before the command runs.
+Envfile validation failures stop the command. Other loading errors require `--strict` to stop execution.
 
-```sh
-$ dotenvx run --validate --strict -- node index.js
+Use exact file blocks to override rules for selected files:
+
+```ruby
+env "HELLO"
+env "PORT", type: "port"
+env "STRIPE_SECRET_KEY", optional: true
+
+file ".env.production" do
+  encrypted true
+  env "STRIPE_SECRET_KEY", required: true
+  env "PORT", min: 1024
+end
 ```
 
-Any inline comment containing the word `optional` marks that key as optional. If `.env.example` is missing, dotenvx reports `MISSING_ENV_EXAMPLE`. An empty `.env.example` is valid and declares no required variables.
+Both `dotenvx run -f .env.production -- node index.js` and `dotenvx validate -f .env.production` use the production rules. Block declarations inherit top-level options and override only the options they specify. A block's `encrypted` directive applies to all inherited and newly declared variables; a per-variable `encrypted:` option inside that block overrides it.
+
+Paths in file blocks are relative to the Envfile. They match the selected paths exactly after path normalization (`./.env.production` matches `.env.production`); they are not basename matches or globs. Directory inputs and `DOTENV_PATH` use their resolved file paths.
+
+When no file block matches, top-level rules apply. When one or more blocks match, each matching block's inherited rules must hold for the final resolved environment. Shell values, fallback files, and `--overload` cannot bypass them. A selected missing file still activates its block. Multiple matching blocks cannot cancel each other's restrictions; conflicting proxy domains are rejected. Blocks cannot be nested, and duplicate declarations within one scope or duplicate file blocks are errors.
+
 
 </details>
 <details><summary>`run --strict`</summary><br>
@@ -2778,46 +2793,38 @@ $ dotenvx ls --json > dotenv-files.json
 </details>
 <details><summary>`validate`</summary><br>
 
-Validate `.env` file(s) against `.env.example` without running a command.
+Validate resolved `.env` values against an `Envfile` without running a command. An `Envfile` in the current directory is required; `.env.example` is not used for validation.
 
-```ini
-# .env.example
-DATABASE_URL=
-API_KEY=
-SENTRY_DSN= # optional
+```ruby
+# Envfile
+env "DATABASE_URL", type: "url"
+env "PORT", type: "port"
+env "SENTRY_DSN", optional: true
 ```
 
 ```sh
 $ dotenvx validate
-[VALIDATION_FAILED] missing required (DATABASE_URL, API_KEY). fix: [https://github.com/dotenvx/dotenvx/issues/907]
-```
-
-Use `-f` and `-fk` to validate a specific env file and keys file. The command exits with code `1` when validation fails and prints errors to stderr. On success, it exits with code `0`.
+[INVALID_ENV] DATABASE_URL is required; PORT is required
 
-```sh
 $ dotenvx validate -f .env.production -fk .env.keys
 ```
 
-</details>
-<details><summary>`validate --ignore`</summary><br>
+The command enforces required values, types, enums, bounds, and encryption requirements. It exits with code `1` on validation or other loading errors. Missing env files are reported but do not fail validation when the resolved values satisfy Envfile; use `--strict` to make missing files fatal too. On success, it prints `▣ valid (.env)` (listing the loaded input files) and exits with code `0` on success. It does not change your shell's environment.
 
-Ignore specific validation error codes.
+A missing Envfile reports `ENVFILE_REQUIRED`; invalid syntax reports `MALFORMED_ENVFILE`.
 
-```sh
-$ dotenvx validate --ignore=MISSING_ENV_EXAMPLE
-```
+</details>
+<details><summary>`validate --ignore`</summary><br>
 
-Ignore multiple error codes by separating them with spaces.
+Ignore specific loading or value-validation errors:
 
 ```sh
-$ dotenvx validate --ignore=MISSING_ENV_FILE MISSING_ENV_EXAMPLE
+$ dotenvx validate --ignore=MISSING_ENV_FILE
+$ dotenvx validate --ignore=MISSING_ENV_FILE INVALID_ENV
+$ DOTENV_IGNORE=MISSING_ENV_FILE dotenvx validate
 ```
 
-You can also set `DOTENV_IGNORE`. Its value is a comma-separated list.
-
-```sh
-$ DOTENV_IGNORE=MISSING_ENV_FILE,OTHER dotenvx validate
-```
+An Envfile is still required, even when errors are ignored.
 
 </details>
 <details><summary>`genexample`</summary><br>
@@ -3784,7 +3791,7 @@ INVALID_PUBLIC_KEY= # a public key is malformed or otherwise invalid
 MALFORMED_ENCRYPTED_DATA= # the encrypted value is malformed
 MISPAIRED_PRIVATE_KEY= # a private key does not match the existing public key
 MISSING_DIRECTORY= # the requested directory does not exist
-MISSING_ENV_EXAMPLE= # the required .env.example file does not exist
+ENVFILE_REQUIRED= # the required Envfile does not exist
 MISSING_ENV_FILE= # a requested environment file does not exist
 MISSING_ENV_FILES= # no .env* files were found
 MISSING_ENV_KEYS_FILE= # the requested .env.keys file does not exist
@@ -3792,11 +3799,12 @@ MISSING_KEY= # a requested environment key does not exist
 MISSING_LOG_LEVEL= # the requested log level is not supported
 MISSING_PRIVATE_KEY= # the private key required to decrypt a value is missing
 MISSING_PUBLIC_KEY= # the public key required to encrypt a value is missing
-MISSING_REQUIRED= # validation detail for which required variables are missing; surfaced by VALIDATION_FAILED
+MISSING_REQUIRED= # validation detail for which required variables are missing; surfaced by INVALID_ENV
 MISSING_VALUE= # no value was supplied for a key
 NOT_FOUND= # a private key was not found in the native secret store
 PRECOMMIT_HOOK_MODIFY_FAILED= # dotenvx could not update the pre-commit hook
-VALIDATION_FAILED= # one or more required variables declared by .env.example are missing
+INVALID_ENV= # resolved values do not satisfy Envfile rules
+MALFORMED_ENVFILE= # Envfile syntax or configuration is invalid
 WRONG_PRIVATE_KEY= # the supplied private key cannot decrypt the value
 ```
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.26.1",
+  "version": "2.28.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -49,18 +49,23 @@
     "testshell": "shellspec --shell /bin/bash",
     "release:check": "npm test && npm run testshell",
     "prerelease": "npm run release:check",
-    "release": "npm run release:check && standard-version"
+    "release": "npm run release:check && standard-version",
+    "build:envfile": "peggy --format commonjs -o src/lib/helpers/envfileParser.js src/lib/grammars/envfile.peggy"
   },
   "funding": "https://dotenvx.com",
   "dependencies": {
     "@dotenvx/primitives": "^3.0.2",
     "@dotenvx/tooling": "^1.0.3",
+    "global-agent": "^3.0.0",
+    "node-forge": "^1.4.0",
+    "undici": "^6.28.1",
     "yocto-spinner": "^1.2.1"
   },
   "devDependencies": {
     "@yao-pkg/pkg": "^6.12.0",
     "capture-console": "^1.0.2",
     "esbuild": "^0.28.1",
+    "peggy": "^5.1.0",
     "proxyquire": "^2.1.3",
     "sinon": "^14.0.1",
     "standard": "^17.1.2",
@@ -74,5 +79,10 @@
   "publishConfig": {
     "access": "public",
     "provenance": true
+  },
+  "standard": {
+    "ignore": [
+      "src/lib/helpers/envfileParser.js"
+    ]
   }
 }

package/src/cli/actions/decrypt.js

@@ -18,7 +18,7 @@ async function decrypt () {
   const envs = this.envs
   const sesh = new Session()
   const noArmor = options.armor === false || (await sesh.noArmor())
-  const noKeychain = options.native === false || options.noNative === true
+  const noNative = options.native === false || options.noNative === true
 
   let errorCount = 0
 
@@ -32,7 +32,7 @@ async function decrypt () {
       ek: options.excludeKey,
       fk: options.envKeysFile,
       noArmor,
-      noKeychain,
+      noNative,
       onStatus: (text) => {
         if (spinner && text) {
           spinner.text = text
@@ -76,7 +76,7 @@ async function decrypt () {
         ek: options.excludeKey,
         fk: options.envKeysFile,
         noArmor,
-        noKeychain,
+        noNative,
         onStatus: (text) => {
           if (spinner && text) {
             spinner.text = text

package/src/cli/actions/encrypt.js

@@ -21,7 +21,7 @@ async function encryptAction () {
   const fk = options.envKeysFile || '.env.keys'
   const noCreate = options.create === false
   const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
-  const noKeychain = options.native === false || options.noNative === true
+  const noNative = options.native === false || options.noNative === true
 
   const noBitwarden = options.bitwarden === false || options.noBitwarden === true
   const no1Password = options['1password'] === false || options.no1Password === true
@@ -30,7 +30,7 @@ async function encryptAction () {
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
-    const { processedEnvs } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate, noKeychain, no1Password, noBitwarden })
+    const { processedEnvs } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate, noNative, no1Password, noBitwarden })
 
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
@@ -51,7 +51,7 @@ async function encryptAction () {
   }
 
   try {
-    const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate, noKeychain, no1Password, noBitwarden })
+    const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate, noNative, no1Password, noBitwarden })
 
     if (keysSrc) {
       await fsx.writeFileX(fk, keysSrc)

package/src/cli/actions/get.js

@@ -32,7 +32,7 @@ async function get (key) {
   try {
     const sesh = new Session()
     const noArmor = options.armor === false || (await sesh.noArmor())
-    const noKeychain = options.native === false || options.noNative === true
+    const noNative = options.native === false || options.noNative === true
     const { parsed: resolved, errors } = await getResolver({
       key,
       envs,
@@ -40,7 +40,7 @@ async function get (key) {
       all: options.all,
       envKeysFile: resolveEnvKeysFile(options.envKeysFile),
       noArmor,
-      noKeychain,
+      noNative,
       no1Password: options['1password'] === false || options.no1Password === true,
       noBitwarden: options.bitwarden === false || options.noBitwarden === true,
       onStatus: (text) => {

package/src/cli/actions/keypair.js

@@ -21,7 +21,7 @@ async function keypair (key) {
       envFile: options.envFile,
       envKeysFile: options.envKeysFile,
       armor: options.armor,
-      noKeychain: options.native === false || options.noNative === true,
+      noNative: options.native === false || options.noNative === true,
       noBitwarden: options.bitwarden === false || options.noBitwarden === true,
       no1Password: options['1password'] === false || options.no1Password === true,
       token: options.token,

package/src/cli/actions/run.js

@@ -2,24 +2,18 @@ const path = require('path')
 const { logger } = require('./../../shared/logger')
 
 const executeCommand = require('./../../lib/helpers/executeCommand')
-const envsResolver = require('./../../lib/resolvers/envs')
 const catchAndLog = require('./../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
-const Session = require('../../db/session')
+const prepareValidatedEnv = require('../../lib/services/validate')
 const normalizeDotenvConfigQuiet = require('../../lib/helpers/normalizeDotenvConfigQuiet')
 const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDotenvConfigConvention')
 const normalizeDotenvConfigIgnore = require('../../lib/helpers/normalizeDotenvConfigIgnore')
-const normalizeDotenvConfigPath = require('../../lib/helpers/normalizeDotenvConfigPath')
-const buildCommandEnvs = require('../../lib/helpers/buildCommandEnvs')
-const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
 const mask = require('../../lib/helpers/mask')
 const maskEnvSrc = require('../../lib/helpers/maskEnvSrc')
 const maskProcessedEnvs = require('../../lib/helpers/maskProcessedEnvs')
 const redactedValues = require('../../lib/helpers/redactedValues')
 const { redactOutput } = require('../../lib/helpers/redactOutput')
-const validateEnvExample = require('../../lib/helpers/validateEnvExample')
-
-const { determine } = require('./../../lib/helpers/envResolution')
+const configureProxy = require('../../lib/proxy/configureProxy')
 
 function inferCommandArgsFromProcessArgv (argv) {
   const runIndex = argv.indexOf('run')
@@ -65,6 +59,7 @@ async function run () {
   }
   let commandEnv = process.env
   let sensitiveValues = []
+  let closeProxy
 
   let commandArgs = this.args
   if (commandArgs.length < 1) {
@@ -87,10 +82,6 @@ async function run () {
 
   const ignore = options.ignore || []
 
-  const sesh = new Session()
-  const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
-  const noKeychain = options.native === false || options.noNative === true
-
   if (commandArgs.length < 1) {
     if (spinner) spinner.stop()
 
@@ -107,29 +98,26 @@ async function run () {
   }
 
   try {
-    let envs = buildCommandEnvs(normalizeDotenvConfigPath(this.envs), options.convention)
-    envs = determine(envs, process.env)
-
     const {
       processedEnvs,
-      readableFilepaths
-    } = await envsResolver({
-      envs,
-      overload: options.overload,
+      readableFilepaths,
+      hasEnvfile,
+      proxyCredentials,
+      proxyToken,
+      session: sesh,
+      proxyError,
+      validationError: error
+    } = await prepareValidatedEnv({
+      envs: this.envs,
+      options,
       processEnv: process.env,
-      envKeysFile: resolveEnvKeysFile(options.envKeysFile),
-      noArmor,
-      noKeychain,
-      no1Password: options['1password'] === false || options.no1Password === true,
-      noBitwarden: options.bitwarden === false || options.noBitwarden === true,
-      token: options.token,
+      requireEnvfile: false,
       command: commandArgs,
       onStatus: (text) => {
-        if (spinner && text) {
-          spinner.text = text
-        }
+        if (spinner && text) spinner.text = text
       }
     })
+    if (proxyError) throw proxyError
 
     if (redactEnabled) {
       sensitiveValues = redactedValues(processedEnvs)
@@ -140,17 +128,13 @@ async function run () {
       maskProcessedEnvs(processedEnvs, commandEnv, showChar)
     }
 
-    if (options.validate) {
-      const error = validateEnvExample(process.env)
-
-      if (error) {
-        if (ignore.includes(error.code)) {
-          logger.verbose(`ignored: ${error.message}`)
-        } else if (options.strict) {
-          throw error
-        } else {
-          logger.error(error.messageWithHelp || error.message)
-        }
+    if (error) {
+      if (ignore.includes(error.code)) {
+        logger.verbose(`ignored: ${error.message}`)
+      } else if (options.strict || hasEnvfile) {
+        throw error
+      } else {
+        logger.error(error.messageWithHelp || error.message)
       }
     }
 
@@ -198,7 +182,21 @@ async function run () {
       }
     }
 
-    let msg = `injected env (${uniqueInjectedKeys(processedEnvs).size})`
+    const proxy = await configureProxy(commandArgs, commandEnv, proxyCredentials, sesh, proxyToken)
+    closeProxy = proxy.close
+    commandArgs = proxy.commandArgs
+    commandEnv = proxy.env
+
+    const gatedKeys = new Set((proxyCredentials || [])
+      .filter(credential => commandEnv[credential.name] === credential.placeholder)
+      .map(credential => credential.name))
+    const injectedKeys = uniqueInjectedKeys(processedEnvs)
+    for (const key of gatedKeys) {
+      injectedKeys.delete(key)
+      logger.verbose(`${key} proxied via Armor proxy`)
+    }
+
+    let msg = ''
     const envStringCount = processedEnvs.filter((processedEnv) => processedEnv.type === 'env' && processedEnv.parsed).length
     if (readableFilepaths.length > 0 && envStringCount > 0) {
       msg += ` from ${readableFilepaths.join(', ')}, and --env flag${envStringCount > 1 ? 's' : ''}`
@@ -209,8 +207,10 @@ async function run () {
     }
 
     if (spinner) spinner.stop()
-    logger.success(`⟐ ${msg}`)
+    if (gatedKeys.size > 0) logger.success(`⧈ proxied (${gatedKeys.size})${msg}`)
+    logger.success(`⟐ injected env (${injectedKeys.size})${msg}`)
   } catch (error) {
+    if (closeProxy) await closeProxy()
     if (spinner) spinner.stop()
     if (error.code === 'PROMPT_CANCELLED') {
       process.exit(130)
@@ -220,7 +220,11 @@ async function run () {
     process.exit(1)
   }
 
-  await executeCommand(commandArgs, commandEnv, sensitiveValues)
+  try {
+    await executeCommand(commandArgs, commandEnv, sensitiveValues, closeProxy)
+  } finally {
+    if (closeProxy) await closeProxy()
+  }
 }
 
 module.exports = run

package/src/cli/actions/set.js

@@ -59,7 +59,7 @@ async function set (key, value) {
   const fk = options.envKeysFile || '.env.keys'
   const noCreate = options.create === false
   const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
-  const noKeychain = options.native === false || options.noNative === true
+  const noNative = options.native === false || options.noNative === true
 
   const noBitwarden = options.bitwarden === false || options.noBitwarden === true
   const no1Password = options['1password'] === false || options.no1Password === true
@@ -67,7 +67,7 @@ async function set (key, value) {
   let errorCount = 0
 
   try {
-    const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await setTransform({ envs, key, value, fk, noArmor, noCreate, encrypt, noKeychain, no1Password, noBitwarden })
+    const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await setTransform({ envs, key, value, fk, noArmor, noCreate, encrypt, noNative, no1Password, noBitwarden })
 
     if (keysSrc) {
       await fsx.writeFileX(fk, keysSrc)

package/src/cli/actions/validate.js

@@ -1,53 +1,35 @@
 const { logger } = require('./../../shared/logger')
 
-const envsResolver = require('./../../lib/resolvers/envs')
 const catchAndLog = require('./../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
-const Session = require('../../db/session')
+const prepareValidatedEnv = require('../../lib/services/validate')
 const normalizeDotenvConfigQuiet = require('../../lib/helpers/normalizeDotenvConfigQuiet')
 const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDotenvConfigConvention')
 const normalizeDotenvConfigIgnore = require('../../lib/helpers/normalizeDotenvConfigIgnore')
-const buildCommandEnvs = require('../../lib/helpers/buildCommandEnvs')
-const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
-const validateEnvExample = require('../../lib/helpers/validateEnvExample')
-
-const { determine } = require('./../../lib/helpers/envResolution')
 
 async function validate () {
   const options = normalizeDotenvConfigIgnore(normalizeDotenvConfigConvention(normalizeDotenvConfigQuiet(this.opts())))
   const spinnerOptions = typeof this.optsWithGlobals === 'function' ? this.optsWithGlobals() : options
   const spinner = await createSpinner({ ...spinnerOptions, ...options, text: 'validating' })
   const ignore = options.ignore || []
-  const validateEnv = { ...process.env }
   let errorCount = 0
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
   try {
-    let envs = buildCommandEnvs(this.envs, options.convention)
-    envs = determine(envs, process.env)
-
-    const sesh = new Session()
-    const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
-    const noKeychain = options.native === false || options.noNative === true
-
-    const { processedEnvs } = await envsResolver({
-      envs,
-      overload: options.overload,
-      processEnv: validateEnv,
-      envKeysFile: resolveEnvKeysFile(options.envKeysFile),
-      noArmor,
-      noKeychain,
-      no1Password: options['1password'] === false || options.no1Password === true,
-      noBitwarden: options.bitwarden === false || options.noBitwarden === true,
-      token: options.token,
+    const { processedEnvs, readableFilepaths, proxyError, validationError } = await prepareValidatedEnv({
+      envs: this.envs,
+      options,
       onStatus: (text) => {
-        if (spinner && text) {
-          spinner.text = text
-        }
+        if (spinner && text) spinner.text = text
       }
     })
 
+    const sources = [...readableFilepaths]
+    if (processedEnvs.some(env => env.type === 'env' && env.parsed)) sources.push('--env')
+    if (sources.length === 0) sources.push('shell environment')
+    const sourceSummary = `(${sources.join(', ')})`
+
     for (const processedEnv of processedEnvs) {
       for (const error of processedEnv.errors || []) {
         if (ignore.includes(error.code)) {
@@ -55,18 +37,24 @@ async function validate () {
           continue
         }
 
-        errorCount += 1
+        if (error.code !== 'MISSING_ENV_FILE' || options.strict) errorCount += 1
+        if (error.code === 'MISSING_ENV_FILE' && options.convention && !options.strict) continue
         logger.error(error.messageWithHelp || error.message)
       }
     }
 
-    const validationError = validateEnvExample(validateEnv)
+    if (proxyError) {
+      proxyError.message += ` ${sourceSummary}`
+      throw proxyError
+    }
+
     if (validationError) {
+      const message = `${validationError.message} ${sourceSummary}`
       if (ignore.includes(validationError.code)) {
-        logger.verbose(`ignored: ${validationError.message}`)
+        logger.verbose(`ignored: ${message}`)
       } else {
         errorCount += 1
-        logger.error(validationError.messageWithHelp || validationError.message)
+        logger.error(message)
       }
     }
 
@@ -75,7 +63,7 @@ async function validate () {
     if (errorCount > 0) {
       process.exit(1)
     } else {
-      logger.success('▣ validated')
+      logger.success(`▣ valid ${sourceSummary}`)
     }
   } catch (error) {
     if (spinner) spinner.stop()

package/src/cli/dotenvx.js

@@ -73,7 +73,6 @@ program.command('run')
   .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
   .option('--redact', 'redact injected values except keys ending in _PLAIN', false)
   .option('-o, --overload', 'override existing env variables (by default, existing env vars take precedence over .env files)')
-  .option('--validate', 'validate against .env.example', false)
   .option('--strict', 'process.exit(1) on any errors', false)
   .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
@@ -224,7 +223,8 @@ program.command('ls')
 
 // dotenvx validate
 program.command('validate')
-  .description('validate .env file(s) against .env.example')
+  .description('validate .env file(s) against Envfile')
+  .option('--strict', 'process.exit(1) on any errors, including missing env files', false)
   .option('-e, --env <strings...>', 'environment variable(s) set as string (example: "HELLO=World")', collectEnvs('env'), [])
   .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
   .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)