Repository navigation
Add @varlock/alchemy-integration - #1228
theoephraim wants to merge 15 commits into
Conversation
|
The changes in this PR will be included in the next version bump.
|
📦 Bundle size
dist/ only; native binaries are versioned separately and not counted here. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
varlock-website | 53f2ef9 | Commit Preview URL Branch Preview URL |
Nov 03 2026, 07:33 PM |
varlock
@varlock/alchemy-integration
@varlock/astro-integration
@varlock/cloudflare-integration
@varlock/nuxt-integration
@varlock/vite-integration
@varlock/native-helper-darwin
@varlock/native-helper-linux-arm64
@varlock/native-helper-linux-x64
@varlock/native-helper-win32-x64
@varlock/1password-plugin
@varlock/bitwarden-plugin
@varlock/keepass-plugin
@varlock/pass-plugin
@varlock/proton-pass-plugin
commit: |
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
filter currently drops the intended configuration, and the binding types can make valid Worker code fail at runtime for composite values. Both should be addressed before merging.
Reviewed changes: Reviewed the Alchemy provider, shared blob refactor, serialized filtering, and deployment documentation; integration builds, Alchemy typechecking, 66 focused tests, and the website build passed.
- Alchemy provider: Adds single-schema and multi-service providers, stage-aware resolution, Config precedence, binding filters, and runtime blob injection.
- Shared blob transport: Centralizes chunking and encryption for Alchemy, Cloudflare Vite, Wrangler, and Worker initialization.
- Serialized filtering: Exposes item tags in
json-fulland adds filtering over resolved graph metadata. - Documentation: Adds Alchemy setup and monorepo guidance and documents the auto-load deployment alternative.
gpt-6.1-sol ｜ 𝕏
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes: Reviewed the changes since the prior review, including the provider API consolidation and both behavioral fixes. All 13 Alchemy integration tests, the package typecheck, and the integration build passed.
- Renamed Provider API to
Varlock.Secrets(), with overloads for single-schema and multi-service stacks, and updated examples. - Fixed CLI filtering by passing validated selectors without literal quotes, with regression coverage for key globs and negated tags.
- Corrected Composite binding types to describe their string wire values while retaining numeric and boolean types, and documented the distinction from parsed
ENVvalues. - Added Runtime opt-out guidance for validation and binding injection without the Worker runtime, plus clarification about the planned encrypted local state store.
gpt-6.1-sol ｜ 𝕏
|
Pullfrog stalled The agent stopped emitting events for 125s and was killed by the activity-timeout watchdog. The model produced no output at all before the stall — the request was sent but nothing came back. This is usually transient; re-running often succeeds.
|
There was a problem hiding this comment.
Important
The new conditional hook example can select development configuration during a production deploy and should be corrected before merging.
Reviewed changes: Reviewed the new environment inference and related documentation since the previous substantive review. All 14 Alchemy integration tests, the package typecheck, and the integration build passed.
- Added Environment inference through
inferVarlockEnv(), supplyingVARLOCK_ENVfrom Alchemy's stage and local-dev mode to single-schema and multi-service resolution. - Expanded Regression coverage for development, preview, production, staging, and explicit hook overrides.
- Updated Integration guidance with the stage mapping, hook customization example, and Alchemy sidebar entry.
gpt-6.1-sol ｜ 𝕏
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes: Reviewed 4176dcc..4c78207, including the environment opt-out and revised custom-stage examples. All 15 Alchemy integration tests, the package typecheck, the integration build, and the website build passed.
- Added Environment opt-out with
varlockEnv: falsefor single-schema and multi-service providers, leaving environment selection to ambient configuration or varlock's own detection. - Replaced Custom mapping examples with explicit
APP_ENVmappings in the schema or environment hook, removing the unsafeundefinedfallback. - Added Regression coverage for opting out of the Alchemy-derived environment.
gpt-6.1-sol ｜ 𝕏
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes: Reviewed 4c78207..5e436be, focusing on the separation of Alchemy-derived environment selection from varlock's built-in detection. All 14 Alchemy integration tests, the package typecheck, the integration build, and the website build passed.
- Replaced Environment injection with
ALCHEMY_ENVand renamed the inference helper toinferAlchemyEnv(), leavingVARLOCK_ENVunchanged for single-schema and multi-service stacks. - Removed The environment opt-out because the provider no longer overrides varlock's own detection.
- Updated Schemas and guidance to declare
ALCHEMY_ENV, use it for@currentEnv, and demonstrate hook overrides, with matching regression coverage.
gpt-6.1-sol ｜ 𝕏
There was a problem hiding this comment.
Important
The environment example fails the documented plain varlock load workflow because its context variables remain required.
Reviewed changes: Reviewed 5e436be..44afe01, moving environment derivation from the provider into a shipped schema fragment. All 14 integration tests, the package typecheck, the integration build, and the website build passed.
- Added Schema-based environment derivation with a packaged
.env.schemafragment usingif()andremap(), including a development fallback when no stage exists. - Removed Provider-side inference and direct
ALCHEMY_ENVinjection, retaining raw Alchemy context and hook overrides. - Updated Fixtures and guidance to derive
ALCHEMY_ENVin the schema and describe copying and customizing the fragment.
gpt-6.1-sol ｜ 𝕏
There was a problem hiding this comment.
Important
No new issues found in this commit. The existing documentation finding about required Alchemy context variables remains unresolved, so approval is still pending.
Reviewed changes: Reviewed 44afe01..87788bf, validating the explicit regex conversion against varlock's resolver implementation and the shipped schema.
- Replaced Stage-matching syntax with
regex()in the packaged fragment, server fixture, and documentation, preserving exact production/staging aliases and the preview fallback. - Updated Customization examples to use
regex("^pr-")andregex("^dev_").
All 14 integration tests, the package typecheck, and the integration build passed. Direct CLI checks also passed for stage aliases, local-dev precedence, unknown stages, and absent context in the shipped fragment.
gpt-6.1-sol ｜ 𝕏
87788bf to
e0d0b56
Compare
There was a problem hiding this comment.
Important
The updated Cloudflare imports require a separate package that the setup instructions do not install.
Reviewed changes: Reviewed 87788bf..e0d0b56, covering the environment example fix and compatibility updates for Alchemy beta.84. All 14 integration tests, the package typecheck, and the integration build passed; the copied schema also resolves development with plain varlock load.
- Fixed Environment declarations by marking the Alchemy context optional/public while preserving defaults for application items.
- Updated Dependency compatibility to test against Alchemy beta.84 and Effect 4.0.6.
- Replaced Cloudflare imports in documentation and JSDoc with
@alchemy.run/cloudflare, with an older-version note on the Alchemy page.
gpt-6.1-sol ｜ 𝕏
A secrets provider for Alchemy stacks (alchemy 2.0.0-beta.80 or later): varlock() resolves one .env.schema, varlockServices() one per service. Resolved values feed the stack's Effect Config (so alchemy's own Cloudflare credential reads come from varlock) and every schema item, or those passing a bindingsFilter, is offered as a typed Worker binding: sensitive items as Redacted (secret_text), the rest plain text or JSON, plus the __VARLOCK_ENV blob so @varlock/cloudflare-integration/init boots the varlock runtime inside the Worker. Alchemy's stack, stage and dev mode are exposed to the schema as ALCHEMY_STACK / ALCHEMY_STAGE / ALCHEMY_DEV so @currentEnv can be derived with remap(). The provider contributes nothing during auth-provider discovery. Supporting core changes: varlock/env-blob exports buildEnvBlobBindings() and readEnvBlob() (the __VARLOCK_ENV wire format, with optional chunking and encryption), shared by varlock-wrangler, the Cloudflare Vite plugin and this package; filterSerializedGraphKeys() applies a --filter expression to a serialized graph; varlock load --format json-full lists @tag names as tags. The Cloudflare integration's env-bindings export and init runtime are thin wrappers over the core module. Docs: new integrations/alchemy page; the Cloudflare page's non-wrangler caution becomes a Deploying with Alchemy section.
…composite bindings as strings - Secrets() replaces varlock() and varlockServices(): one name matching alchemy's Doppler.Secrets() / Infisical.Secrets() convention, with overloads keyed on the presence of `services`. - The `filter` option was passed to the CLI JSON-quoted, which execFileSync handed through literally, so any filter selected nothing. The expression is now validated against the filter grammar and passed unquoted. - Arrays and objects are bound as their process.env string form, and VarlockBindings now says so (BindingValue<T>), instead of promising the coerced type that only the blob carries.
The provider now sets varlock's built-in VARLOCK_ENV so @currentEnv=$VARLOCK_ENV works with no mapping in the schema: alchemy dev is development, the production/prod stage is production, staging and test map to themselves, and every other stage (dev_<user>, pr-<n>) is preview. The env hook can override it.
The derived environment name now arrives as ALCHEMY_ENV (same vocabulary as VARLOCK_ENV), so a schema opts in with @currentEnv=$ALCHEMY_ENV and varlock's own VARLOCK_ENV detection is never touched. Drops the varlockEnv option.
…d of the integration The integration now only exposes the raw ALCHEMY_STACK, ALCHEMY_STAGE and ALCHEMY_DEV. The package ships a .env.schema fragment that declares them and derives ALCHEMY_ENV with if() and remap(), so the stage mapping is ordinary schema logic users copy (and later @import) and change like any other value.
…lts; test against alchemy beta.84
…y beta.84 package split)
…uidance in the zero-package guide
e0d0b56 to
0ce9923
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes: Reviewed the delta since e0d0b56, focusing on the Cloudflare package-split setup correction.
- Added Cloudflare installation guidance for Alchemy beta.84+ using the existing package-manager widget.
- Clarified Version compatibility by documenting matching package versions and the older
alchemy/Cloudflareimport in both integration guides. - Refreshed Generated workspace versions in the lockfile.
Verified the installation widget and published beta.84 package contract. Tests and the website build were not rerun for this small documentation correction.
gpt-6.1-sol ｜ 𝕏
…t version guidance
There was a problem hiding this comment.
Important
Removing the historical version note also removed a required installation step from the standalone Cloudflare guide.
Reviewed changes: Reviewed the delta since 0ce9923, covering the minimum-version change and associated setup guidance. Verified the dependency contract against published beta.84 manifests; tests and the website build were not rerun for these manifest and prose changes.
- Raised Alchemy minimum version to
2.0.0-beta.84in the peer dependency, lockfile, README, and release description. - Simplified Compatibility guidance to track current Alchemy releases while retaining the matching Cloudflare package installation in the Alchemy setup.
- Removed Historical import guidance from the standalone Cloudflare deployment section.
gpt-6.1-sol ｜ 𝕏
|
|
||
| ```ts title="alchemy.run.ts" | ||
| import "varlock/auto-load"; | ||
| import * as Cloudflare from "@alchemy.run/cloudflare"; |
There was a problem hiding this comment.
[P2] Preserve the current Cloudflare package prerequisite
Deleting the parenthetical above also deletes this standalone guide's only instruction to install @alchemy.run/cloudflare at the same version as alchemy. Alchemy beta.84 does not supply that dependency, so readers who follow this zero-package path without the separate integration setup can hit Cannot find package '@alchemy.run/cloudflare'; retain the current installation prerequisite without restoring the historical-beta notes.
Adds
@varlock/alchemy-integration, a secrets provider for Alchemy stacks (alchemy 2.0.0-beta.84+; the integration tracks the latest alchemy release rather than carrying compatibility notes for older betas).Varlock.Secrets()resolves one.env.schemabefore alchemy builds providers;Secrets({ services })loads one schema per service for monorepos, with a root schema that feeds alchemy'sConfig(Cloudflare credentials) but is never bound into a Worker.Config, so alchemy's own reads (includingCLOUDFLARE_*) come from varlock.@internalitems never reach alchemy.env.bindings/env.bindingsFor(name)give typed Worker bindings:@sensitiveitems asRedacted(secret_text), the rest plain text or JSON, plus the__VARLOCK_ENVblob so@varlock/cloudflare-integration/initgives the Worker log redaction, leak detection and a typedENV.bindingsFilter(--filtersyntax, e.g."!#deploy") keeps tagged items out of the Worker.ALCHEMY_STACK,ALCHEMY_STAGEandALCHEMY_DEVare visible to the schema while it resolves. The package ships a.env.schemafragment that derivesALCHEMY_ENVfrom them withif()andremap()(alchemy devis development,productionis production, other stages are preview), so@currentEnv=$ALCHEMY_ENVis plain schema logic users copy and adjust.alchemy loginworks before any vault credential exists.Core changes it rests on:
varlock/env-blob:buildEnvBlobBindings()/readEnvBlob(), the__VARLOCK_ENVwire format (optional chunking at a per-variable byte limit, optional encryption).varlock-wrangler, the Cloudflare Vite plugin and the Cloudflareinitruntime now use it, so the writer and reader share one implementation.filterSerializedGraphKeys()on the main entry applies a--filterexpression to a serialized graph.varlock load --format json-fulllists@tagnames astags.Docs: new
integrations/alchemypage; the Cloudflare page's non-wrangler caution becomes a "Deploying with Alchemy" section (the zero-packagevarlock/auto-loadpath, which also works on older alchemy).Verified against published alchemy 2.0.0-beta.84 (the release that split Cloudflare and the Doppler/Infisical providers into their own packages; the secrets provider contract is unchanged) in a Better-T-Stack scaffold (Astro + Hono on Workers, one schema per app):
alchemy devruns, Worker bindings and blob match the schemas, leak detection fires in workerd. A real deploy of that example is tracked in varlock-examples.