feat: encrypt env blob with _VARLOCK_ENV_KEY by theoephraim · Pull Request #656 · dmno-dev/varlock

theoephraim · 2026-04-24T21:50:13Z

Summary

Adds opt-in encryption for the resolved env blob (__VARLOCK_ENV) that gets injected into build output by the Next.js and Vite integrations.

When _VARLOCK_ENV_KEY (64-char hex) is set at build time, the JSON blob is encrypted with AES-256-GCM before injection
At runtime, init bundles detect the varlock:v1: prefix and decrypt using the same key from the runtime environment
The key is never baked into the build — it must come from the deployment platform's env vars (e.g., a single Vercel env var)
New varlock generate-key CLI command with --plain flag for piping to platform CLIs
_VARLOCK_ENV_KEY can be defined in .env.schema for validation — it's automatically excluded from the injected blob and type generation

NOTE — Ideally we'd reinject vars back into the platform's native secret storage, but doing this atomically with a deployment is not always possible.

Quick setup (Vercel)

varlock generate-key --plain | vercel env add _VARLOCK_ENV_KEY production preview development --sensitive

Changes

Area	What
`varlock`	New `runtime/crypto.ts` with sync (node:crypto) + async (Web Crypto) encrypt/decrypt
`varlock`	`init-server.ts` / `init-edge.ts` decrypt before `initVarlockEnv()`
`varlock`	`env.ts` handles encrypted strings on `globalThis.__varlockLoadedEnv`
`varlock`	New `generate-key` CLI command with `--plain` flag
`varlock`	New `./encrypt-env` subpath export
`@varlock/nextjs-integration`	webpack + turbopack injection encrypts when key present
`@varlock/vite-integration`	`resolved-env` SSR mode encrypts when key present

Docs

Next.js and Vite integration docs updated with "Encrypting the env blob" section
CLI reference updated with generate-key command

Test plan

Unit tests for crypto round-trip (sync, async, cross-compat, error cases)
Typecheck passes across all packages
Framework tests: Next.js build with _VARLOCK_ENV_KEY, verify varlock:v1: prefix in output, verify runtime decryption
Framework tests: Vite resolved-env mode with encryption

bumpy-bot · 2026-04-24T21:50:53Z

The changes in this PR will be included in the next version bump.

Minor releases

@varlock/1password-plugin 0.3.5 → 0.4.0 (dep)
@varlock/akeyless-plugin 0.0.2 → 0.1.0 (dep)
@varlock/astro-integration 0.2.7 → 0.3.0 (dep)
@varlock/aws-secrets-plugin 0.0.6 → 0.1.0 (dep)
@varlock/azure-key-vault-plugin 0.1.0 → 0.2.0 (dep)
@varlock/bitwarden-plugin 0.0.6 → 0.1.0 (dep)
@varlock/cloudflare-integration 0.1.1 → 0.2.0 (dep)
@varlock/dashlane-plugin 0.0.1 → 0.1.0 (dep)
@varlock/doppler-plugin 0.0.2 → 0.1.0 (dep)
@varlock/expo-integration 0.0.1 → 0.1.0 (dep)
@varlock/google-secret-manager-plugin 0.2.1 → 0.3.0 (dep)
@varlock/hashicorp-vault-plugin 0.0.4 → 0.1.0 (dep)
@varlock/infisical-plugin 0.0.6 → 0.1.0 (dep)
@varlock/keepass-plugin 0.0.2 → 0.1.0 (dep)
@varlock/keeper-plugin 0.0.2 → 0.1.0 (dep)
@varlock/nextjs-integration 0.3.6 → 0.4.0 (dep)
@varlock/pass-plugin 0.0.6 → 0.1.0 (dep)
@varlock/passbolt-plugin 0.0.1 → 0.1.0 (dep)
@varlock/proton-pass-plugin 0.0.3 → 0.1.0 (dep)
@varlock/vite-integration 0.2.10 → 0.3.0 (dep)
varlock 0.9.1 → 0.10.0

Bump files in this PR

encrypted-env-blob.md (view diff) (edit)

Warnings

⚠️ @varlock/astro-integration gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/cloudflare-integration gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^0.9.1" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/expo-integration gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/nextjs-integration gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/vite-integration gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/1password-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/akeyless-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/aws-secrets-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/azure-key-vault-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/bitwarden-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/dashlane-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/doppler-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/google-secret-manager-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/hashicorp-vault-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/infisical-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/keepass-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/keeper-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/pass-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/passbolt-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/proton-pass-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/astro-integration gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/cloudflare-integration gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^0.9.1" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/expo-integration gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/nextjs-integration gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/vite-integration gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/1password-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/akeyless-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/aws-secrets-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/azure-key-vault-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/bitwarden-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/dashlane-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/doppler-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/google-secret-manager-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/hashicorp-vault-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/infisical-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/keepass-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/keeper-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/pass-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/passbolt-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.
⚠️ @varlock/proton-pass-plugin gets a minor bump because varlock@0.10.0 is out of range for its peer dep "workspace:^" (resolves to ^0.9.1). npm treats ^ on 0.x as minor-breaking. Consider using >=0.x ranges for pre-1.0 peer deps.

Click here if you want to add another bump file to this PR

This comment is maintained by bumpy.

pkg-pr-new · 2026-04-24T21:52:28Z

Open in StackBlitz

varlock

npm i https://pkg.pr.new/varlock@656

@varlock/astro-integration

npm i https://pkg.pr.new/@varlock/astro-integration@656

@varlock/cloudflare-integration

npm i https://pkg.pr.new/@varlock/cloudflare-integration@656

@varlock/expo-integration

npm i https://pkg.pr.new/@varlock/expo-integration@656

@varlock/nextjs-integration

npm i https://pkg.pr.new/@varlock/nextjs-integration@656

@varlock/vite-integration

npm i https://pkg.pr.new/@varlock/vite-integration@656

@varlock/1password-plugin

npm i https://pkg.pr.new/@varlock/1password-plugin@656

@varlock/akeyless-plugin

npm i https://pkg.pr.new/@varlock/akeyless-plugin@656

@varlock/aws-secrets-plugin

npm i https://pkg.pr.new/@varlock/aws-secrets-plugin@656

@varlock/azure-key-vault-plugin

npm i https://pkg.pr.new/@varlock/azure-key-vault-plugin@656

@varlock/bitwarden-plugin

npm i https://pkg.pr.new/@varlock/bitwarden-plugin@656

@varlock/dashlane-plugin

npm i https://pkg.pr.new/@varlock/dashlane-plugin@656

@varlock/doppler-plugin

npm i https://pkg.pr.new/@varlock/doppler-plugin@656

@varlock/google-secret-manager-plugin

npm i https://pkg.pr.new/@varlock/google-secret-manager-plugin@656

@varlock/hashicorp-vault-plugin

npm i https://pkg.pr.new/@varlock/hashicorp-vault-plugin@656

@varlock/infisical-plugin

npm i https://pkg.pr.new/@varlock/infisical-plugin@656

@varlock/keepass-plugin

npm i https://pkg.pr.new/@varlock/keepass-plugin@656

@varlock/keeper-plugin

npm i https://pkg.pr.new/@varlock/keeper-plugin@656

@varlock/pass-plugin

npm i https://pkg.pr.new/@varlock/pass-plugin@656

@varlock/passbolt-plugin

npm i https://pkg.pr.new/@varlock/passbolt-plugin@656

@varlock/proton-pass-plugin

npm i https://pkg.pr.new/@varlock/proton-pass-plugin@656

commit: 93ac514

When _VARLOCK_ENV_KEY (64-char hex) is set at build time, the resolved env blob injected into build output is encrypted with AES-256-GCM. At runtime, the init bundles detect the varlock:v1: prefix and decrypt using the same key from the runtime environment. This lets Vercel users set a single env var and have all other config travel encrypted inside the deployment artifact. - New crypto module with sync (node:crypto) and async (Web Crypto) paths - All integration injection points (Next.js, Vite) encrypt when key is present - _VARLOCK_ENV_KEY auto-excluded from injected blob and type generation - varlock generate-key CLI command with --plain flag for piping - Docs for Next.js and Vite integrations - Framework tests for encrypted blob flow

cloudflare-workers-and-pages · 2026-04-25T08:35:37Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	varlock-website	`93ac514`	Commit Preview URL Branch Preview URL	Apr 25 2026, 08:37 AM

github-actions Bot added maintainer core:varlock integration:nextjs integration:vite labels Apr 24, 2026

theoephraim changed the title ~~feat: encrypt env blob with VARLOCK_ENV_KEY~~ feat: encrypt env blob with _VARLOCK_ENV_KEY Apr 25, 2026

theoephraim force-pushed the feat/encrypted-env-blob branch from d467143 to 93ac514 Compare April 25, 2026 08:35

github-actions Bot added the core:website label Apr 25, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: encrypt env blob with _VARLOCK_ENV_KEY#656

feat: encrypt env blob with _VARLOCK_ENV_KEY#656
theoephraim wants to merge 1 commit intomainfrom
feat/encrypted-env-blob

theoephraim commented Apr 24, 2026 •

edited

Loading

Uh oh!

bumpy-bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 25, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

theoephraim commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Quick setup (Vercel)

Changes

Docs

Test plan

Uh oh!

bumpy-bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Minor releases

Bump files in this PR

Warnings

Uh oh!

pkg-pr-new Bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

theoephraim commented Apr 24, 2026 •

edited

Loading

bumpy-bot commented Apr 24, 2026 •

edited

Loading

pkg-pr-new Bot commented Apr 24, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Apr 25, 2026 •

edited

Loading