varlock() native local encryption by theoephraim · Pull Request #567 · dmno-dev/varlock

theoephraim · 2026-04-08T07:07:39Z

Summary

Adds built-in device-local encryption to varlock via a new varlock() resolver function and native platform binaries. Encrypted secrets can be stored directly in .env files and are automatically decrypted at load time — no external secret manager required.

Encryption backends

The best available backend is selected automatically at runtime:

Platform	Backend	Key Storage	Biometric
macOS	Secure Enclave (Swift binary)	Hardware Secure Enclave	Touch ID / Face ID
Windows	DPAPI + Windows Hello (Rust binary)	Windows credential store	Windows Hello (face/fingerprint/PIN)
Linux	TPM2 (Rust binary)	TPM2 hardware (sealed keys)	No
All	File-based fallback (pure JS)	`~/.varlock/` directory	No

All backends use the same ECIES wire format (P-256 ECDH + HKDF-SHA256 + AES-256-GCM), so encrypted payloads are portable across implementations.

On macOS, the Secure Enclave provides hardware-backed keys that cannot be extracted, with optional biometric gating via Touch ID. On Windows, DPAPI protects keys scoped to the current user with optional Windows Hello biometric verification. On Linux, keys are sealed to the TPM2 chip when available. A daemon process manages biometric sessions and IPC on all native platforms.

New CLI commands

varlock encrypt — Encrypt values interactively or in bulk (--file .env.local encrypts all @sensitive plaintext values in-place)
varlock reveal — Securely view/copy decrypted sensitive values (uses alternate screen buffer to avoid scrollback capture, --copy for clipboard with auto-clear)
varlock lock — Invalidate the biometric session, requiring re-authentication for next decrypt

The `varlock()` resolver

Two modes:

Decrypt: varlock("local:<ciphertext>") — decrypts an encrypted payload at load time
Prompt: varlock(prompt) — prompts for a secret on first load, encrypts it, and writes the encrypted value back to the source file

New packages

@varlock/encryption-binary-swift — macOS Secure Enclave binary (Swift, universal arm64+x86_64)
@varlock/encryption-binary-rust — Windows/Linux encryption binary (Rust, cross-compiled for x64/arm64)

Local encryption library (`src/lib/local-encrypt/`)

index.ts — Public API: encryptValue, decryptValue, ensureKey, getBackendInfo, lockSession
crypto.ts — Pure JS ECIES implementation (wire-compatible with native binaries)
file-backend.ts — File-based key storage fallback
daemon-client.ts — IPC client for native binary daemons (Unix sockets / named pipes)
binary-resolver.ts — Platform-specific binary discovery (SEA sibling → npm bundled → dev fallback)
builtin-resolver.ts — The varlock() resolver registration

CI/CD

New workflows: build-native-macos.yaml, build-native-rust.yaml, notarize-native-macos.yaml, binary-release.yaml
Updated test.yaml and release.yaml to include native binary build steps

Documentation

CLI reference: added encrypt, reveal, lock commands
Functions reference: added varlock() resolver docs
Secrets guide: replaced "coming soon" placeholder with full local encryption guide
Introduction: updated features list to mention built-in encryption
Usage guide: added encrypt and reveal command overviews

Test plan

changeset-bot · 2026-04-08T07:08:22Z

🦋 Changeset detected

Latest commit: 653c7b1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 18 packages

Name	Type
varlock	Minor
@varlock/astro-integration	Major
@varlock/cloudflare-integration	Major
@varlock/expo-integration	Major
@varlock/nextjs-integration	Major
@varlock/vite-integration	Major
@varlock/1password-plugin	Major
@varlock/aws-secrets-plugin	Major
@varlock/azure-key-vault-plugin	Major
@varlock/bitwarden-plugin	Major
@varlock/dashlane-plugin	Major
@varlock/google-secret-manager-plugin	Major
@varlock/hashicorp-vault-plugin	Major
@varlock/infisical-plugin	Major
@varlock/keepass-plugin	Major
@varlock/pass-plugin	Major
@varlock/passbolt-plugin	Major
@varlock/proton-pass-plugin	Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

.github/workflows/binary-release.yaml

.github/workflows/build-native-macos.yaml

.github/workflows/notarize-native-macos.yaml

.github/workflows/release-preview.yaml

.github/workflows/release.yaml

.github/workflows/test.yaml

pkg-pr-new · 2026-04-08T07:33:04Z

Open in StackBlitz

@varlock/ci-env-info

npm i https://pkg.pr.new/@varlock/ci-env-info@567

varlock

npm i https://pkg.pr.new/varlock@567

@varlock/astro-integration

npm i https://pkg.pr.new/@varlock/astro-integration@567

@varlock/cloudflare-integration

npm i https://pkg.pr.new/@varlock/cloudflare-integration@567

@varlock/expo-integration

npm i https://pkg.pr.new/@varlock/expo-integration@567

@varlock/nextjs-integration

npm i https://pkg.pr.new/@varlock/nextjs-integration@567

@varlock/vite-integration

npm i https://pkg.pr.new/@varlock/vite-integration@567

@varlock/1password-plugin

npm i https://pkg.pr.new/@varlock/1password-plugin@567

@varlock/aws-secrets-plugin

npm i https://pkg.pr.new/@varlock/aws-secrets-plugin@567

@varlock/azure-key-vault-plugin

npm i https://pkg.pr.new/@varlock/azure-key-vault-plugin@567

@varlock/bitwarden-plugin

npm i https://pkg.pr.new/@varlock/bitwarden-plugin@567

@varlock/dashlane-plugin

npm i https://pkg.pr.new/@varlock/dashlane-plugin@567

@varlock/google-secret-manager-plugin

npm i https://pkg.pr.new/@varlock/google-secret-manager-plugin@567

@varlock/hashicorp-vault-plugin

npm i https://pkg.pr.new/@varlock/hashicorp-vault-plugin@567

@varlock/infisical-plugin

npm i https://pkg.pr.new/@varlock/infisical-plugin@567

@varlock/keepass-plugin

npm i https://pkg.pr.new/@varlock/keepass-plugin@567

@varlock/pass-plugin

npm i https://pkg.pr.new/@varlock/pass-plugin@567

@varlock/passbolt-plugin

npm i https://pkg.pr.new/@varlock/passbolt-plugin@567

@varlock/proton-pass-plugin

npm i https://pkg.pr.new/@varlock/proton-pass-plugin@567

commit: 653c7b1

socket-security · 2026-04-09T04:04:38Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/libc@0.2.184
	cargo/nix@0.29.0
	cargo/serde@1.0.228
	cargo/serde_json@1.0.149
	cargo/aes-gcm@0.10.3
	cargo/base64@0.22.1
	cargo/elliptic-curve@0.13.8
	cargo/hkdf@0.12.4
	cargo/hmac@0.12.1
	cargo/p256@0.13.2
	cargo/rand@0.8.5
	cargo/sha2@0.10.9
	cargo/windows@0.58.0

View full report

cloudflare-workers-and-pages · 2026-04-09T06:33:42Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	varlock-website	`653c7b1`	Commit Preview URL Branch Preview URL	Apr 09 2026, 07:13 AM

philmillman · 2026-04-09T18:27:31Z

Testing in Windows:

WSL2:

(this is a pretty old image, I will update and try again)

Native windows works (including fingerprint prompt)

github-actions bot added maintainer core:varlock labels Apr 8, 2026

github-advanced-security bot found potential problems Apr 8, 2026

View reviewed changes

theoephraim force-pushed the feature/secure-enclave-plugin branch 4 times, most recently from 9fe515d to d89302e Compare April 8, 2026 07:29

theoephraim force-pushed the feature/secure-enclave-plugin branch 10 times, most recently from 5fb2d57 to 48f4feb Compare April 8, 2026 23:29

theoephraim force-pushed the feature/secure-enclave-plugin branch 3 times, most recently from 7de0e68 to 10d20b2 Compare April 9, 2026 06:14

theoephraim added 2 commits April 8, 2026 23:33

mac/swift encryption binary + cross platform client

5e09db0

gh actions changes

a2a5563

theoephraim force-pushed the feature/secure-enclave-plugin branch from 10d20b2 to 17081fd Compare April 9, 2026 06:33

github-actions bot added the core:website label Apr 9, 2026

theoephraim added 2 commits April 8, 2026 23:40

add rust binary for windows/linux

af4e33f

add reveal command

6338b15

theoephraim force-pushed the feature/secure-enclave-plugin branch from 17081fd to f4767ee Compare April 9, 2026 06:40

update docs

653c7b1

theoephraim force-pushed the feature/secure-enclave-plugin branch from f4767ee to 653c7b1 Compare April 9, 2026 07:11

theoephraim mentioned this pull request Apr 9, 2026

[Feature Request] Encryption support #223

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

varlock() native local encryption#567

varlock() native local encryption#567
theoephraim wants to merge 5 commits intomainfrom
feature/secure-enclave-plugin

theoephraim commented Apr 8, 2026 •

edited

Loading

Uh oh!

changeset-bot bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pkg-pr-new bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Apr 9, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages bot commented Apr 9, 2026 •

edited

Loading

Uh oh!

philmillman commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

theoephraim commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Encryption backends

New CLI commands

The varlock() resolver

New packages

Local encryption library (src/lib/local-encrypt/)

CI/CD

Documentation

Test plan

Uh oh!

changeset-bot bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pkg-pr-new bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cloudflare-workers-and-pages bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

philmillman commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

theoephraim commented Apr 8, 2026 •

edited

Loading

The `varlock()` resolver

Local encryption library (`src/lib/local-encrypt/`)

changeset-bot bot commented Apr 8, 2026 •

edited

Loading

pkg-pr-new bot commented Apr 8, 2026 •

edited

Loading

socket-security bot commented Apr 9, 2026 •

edited

Loading

cloudflare-workers-and-pages bot commented Apr 9, 2026 •

edited

Loading