dmno-dev/varlock

Features

• Environment Variable Validation - Defines types, rules and descriptions for environment variables in a committed schema, then validates loaded values and coerces them to the right types.
• Env Schema Type Generators - Generates type definitions from the environment schema so application code reads variables with autocomplete, type checking and built-in documentation.
• AI Agent Secret Redaction - Hides secret values from AI coding agents while exposing variable names, types and rules, and blocks sensitive values from leaking into logs, bundles and responses.
• External Secret Resolution - Resolves secret values at load time from password managers, cloud secret stores, and vaults through declarative references and plugins.
• Plugin-Driven Secret Backends - Fetches secrets at load time through installable plugins that evaluate function-call syntax, letting each backend add its own decorators and functions.
• Secret Leak Prevention - Varlock detects sensitive values in build output and runtime responses, blocks them from being exposed in client bundles or served code, and redacts them from build-time logs.
• Secret Management Integrations - Pulls secrets at load time from password managers, cloud secret services, vaults and Kubernetes through plugins with multiple authentication methods.
• Secret Vault Integrations - Offers a plugin system that fetches secrets at load time from password managers, cloud secret stores, vaults and Kubernetes.
• Comment-Based Schemas - Defines variable types, validation rules and sensitivity flags as JSDoc-style decorator comments inside plain env files, parsed into one schema.
• Decorator-Based Validation - Attaches types, requirements and validation rules to variables via JSDoc-style decorator comments in env files, backed by a parser and open specification.
• Framework Environment Loader Integrations - Provides integrations for Vite, Next.js, Nuxt, Cloudflare Workers and containers that load and validate environment variables from one schema.
• Declarative Environment Schemas - Describes each variable's name, type, rules and description in a single schema file that serves as the shared source of truth.
• Build-Time Variable Injection - Replaces non-sensitive environment variable references with resolved literal values at build time, producing bundles with no runtime lookup.
• Dotenv Schema Language Tooling - Provides an editor extension and parser for decorator comments in env files with highlighting, autocomplete, hover details and inline validation.
• Environment-Injected Command Runners - Runs any command from the command line with validated, resolved environment variables injected so the program starts fully configured.
• Standalone CLI Runtimes - Ships a self-contained binary CLI that validates the schema, resolves values and launches child processes with variables injected, needing no separate runtime.
• Secret Leak Detection - Scans compiled bundles, source maps and server responses for known sensitive values, blocking or redacting matches before they can be published.
• Environment File Loaders - Combines a committed schema file, per-environment value files, and shell variables in a fixed override order into one resolved configuration.
• Framework Package Integration - Provides drop-in packages for common web frameworks and build tools so validated, protected environment variables work inside those projects.
• Cloud Secret Managers - Retrieves secret values from cloud secret managers into config items at resolution time, using the item key as the default secret name.
• Function-Call Value Resolution - Resolves unquoted function-call syntax in env values to decrypt data or fetch from external sources without application code.
• Response Leak Blocking - Varlock inspects outgoing responses and blocks sensitive environment values from being sent to clients by accident.
• Sensitive Variable Redaction - Masks sensitive environment variable values in output printed during the build so secrets are not exposed in build logs.
• Client Bundle Exclusion - Keeps sensitive variables out of inlined JavaScript, warns on client-side references at build time, and throws if native code reads them.
• Type Generation - Generates TypeScript types from the environment schema for autocomplete, type checking and inline documentation when reading variables.
• Type-Safe Schema Validators - Checks loaded variables against declared types and rules, converts them to expected types, and provides type safety before application code runs.
• Next.js Integrations - Replaces Next.js's built-in env-file loader with a small config plugin, adding schema validation and leak protection on Next.js 14+ with Webpack or Turbopack.
• Vite Integrations - Ships a Vite plugin that replaces default env file loading with schema-driven loading for plain Vite and framework-based projects.
• Plugin Architectures - Adds new decorators, functions and data types through installable plugins, so each secret backend integrates without touching core code.
• Nuxt Integrations - Ships a Nuxt module hooking into Vite config and the server build so env files load and validate consistently across dev, build, and production.
• Environment Loading Plugins - Wraps Vite, Next.js, Nuxt and Cloudflare tooling to load and validate variables before builds, inline public values and keep secrets out of output.

Star history