Varlock now includes "credential brokering" functionality - your agent (or whatever process) gets only _placeholder_ credentials, and real secrets are swapped in over the wire (MITM proxy). Rules are configured in your existing .env.schema Would love to hear your feedback!

I was previously tending a booth for a product called Varlock. They're incredibly useful for credentials management. Definitely worth a look. They brand themselves as "credentials management in the AI era". https://github.com/dmno-dev/varlock

GitHub - dmno-dev/varlock: AI-safe .env files: Schemas for agents, Secrets for humans.

AI-safe .env files: Schemas for agents, Secrets for humans. - dmno-dev/varlock

github.com

Random q - do folks out there care / think about how much plastic they are exposed to? Talking things like coffee gear, water bottles / mugs, cookware, baby products. Do you research before you buy? Would you like to minimize but takes too much work? Never think about it? I'm cooking something :)

Building a new CLI tool? Here is your toolkit: - gunshi (cli framework) - clack/prompts (cli prompts) - lefthook (git hooks) - tsdown (ts build tool) - bumpy (changelog + publishing) - fledgling (bonus) - for initial npm claim and oidc setup

Citing the recent bun drama, David Bowie will be re-releasing old albums as "Rusty Stardust"

Super fun chatting with @brandonwhichard.com about varlock. He is a real user - found us through a listener and has been using it ever since. Have a listen! 🎧

Software Defined Talk@softwaredefinedtalk.com · 4w ago

Every project has environment variables. Almost nobody manages them well. This week @brandonwhichard.com talks with Phil Miller and @theozero.bsky.social, who built varlock to fix that — bringing structure and security to the humble .env file. https://www.softwaredefinedtalk.com/580

All varlock docs package links and readmes (as of their next publish) now point to @npmx.dev ♥️🧙‍♂️

PSA - @astro.build + yaml w/ md + @cloudflare.social + LLMs is a killer toolkit to build comprehensive resources of info gathered from all over the web. No servers, no DB, no tedious hand-maintaining data. Ideas that would take way too much effort before are now easily within reach.

🧙‍♂️ varlock@1.10 adds arbitrary codegen. As well as built-in support for php, python, go, rust - so you get a fully typed+coerced env loader to use in your code. Plugins can add codegen types - new possibilities to generate for k8s, terraform... anything! varlock.dev/guides/code-...

Code generation

Generate types and other code from your env schema, and extend it with plugins

varlock.dev

Finally digging into a proper plugin system for bumpy 🐸 (bumpy.varlock.dev). This means native support / recipes to release to common js targets like jsr, vscode marketplace, and non-js things like PyPi, and crates.io

GitHub - dmno-dev/bumpy: 🐸 Modern monorepo friendly version management + changelog tool

🐸 Modern monorepo friendly version management + changelog tool - dmno-dev/bumpy

bumpy.varlock.dev

btw - I added condiments to my food storage tips site 🫙🍓

Mustard storage guide | HowToStore.food

Mustard is shelf-stable thanks to its vinegar and salt, so the pantry is perfectly safe before and after opening. Refrigerating an open jar keeps it spi...

howtostore.food

varlock will soon support arbitrary codegen registered in plugins. Opens up fun possibilities - generate zod schema, k8s configmap/secret split based on what's marked @sensitive, terraform vars Plus new built-in env generation for rust, go, python, php. Excited to see how you will use it! 🧙‍♂️✨

varlock credential broker is coming very soon! child process (usually AI agent) gets _placeholders_, swapped for real creds at the network boundary. Rules managed from your .env.schema - use our existing plugins to pull from anywhere. Can't wait to share it :)

Hey @pnpm.io - following up on our recent thread about using valid env vars for configuring npmrc auth -- github.com/orgs/pnpm/di...

Using valid env vars names for .npmrc · pnpm · Discussion #12746

First off, thanks for the env-variables-in-repository-npmrc post and for closing the ${ENV}-in-repo-file exfiltration hole. Locking expansion to trusted sources is the right call. This is a follow-...

github.com

npm staged publishing approval tool MVP is working. Batch approve multiple packages, multi-sig approval policies, audit trails, batches created in CI via OIDC. NPM token encrypted by passkeys so we never see them. Using staged publishing? Wanting to but avoiding because its clunky? Let me know!

My new npm staged publishing approval tool is called "stageflight" - HMU if you want to beta test! Provides batch approvals, multi-sig policies w/ audit trails, approvers don't need publishing rights. Cloud-hosted but secrets encrypted w/ your passkeys. optional ai review too in future

Working on something pretty rad that’s going to help make npm staged publishing feel much nicer - and even more secure. Like/comment/DM if this is up your alley and you want to help me beta test.

🐸 bumpy.varlock.dev continues to get better and more solid. If you release npm packages - take it for a spin and let me know what you think! Couples very nicely with 🐣 fledgling.varlock.dev especially in a monorepo :)

GitHub - dmno-dev/bumpy: 🐸 Modern monorepo friendly version management + changelog tool

🐸 Modern monorepo friendly version management + changelog tool - dmno-dev/bumpy

bumpy.varlock.dev

Doesn't exactly inspire confidence when things show an error message even when they work. A few npm interactions regularly do this for me - approving staged publishing being one of them.

Say hello to 🐣 fledgling - a new tool to create new npm packages and setup/sync trusted publishing (OIDC) settings. Works great for one offs, but even better in a monorepo! just `npx fledgling`

🥚🐣🐥 Hatching something fun tomorrow. A very nice complement to bumpy 🐸

New varlock+mise guide varlock.dev/integrations... Would appreciate a look from any heavy mise users!

mise

Install varlock with mise and wire validated env vars into your tasks

varlock.dev

How many of y'all use @1password.bsky.social wired into dev/agent workflows? varlock now has built-in caching (secured by secure enclave), meaning fewer roundtrips to 1pass servers. Much smoother for when things are reloading a lot. varlock.dev/plugins/1pas... varlock.dev/guides/cachi...

1Password Plugin

Using 1Password with Varlock

varlock.dev

Honestly didn't know what to expect when I started on prerelease channels for 🐸 bumpy (publish v1.2.3-rc.1 and tag as "next") I knew it's awkward and hard to deal with - one of most complained about parts of changesets 🦋 But the end result is actually really good! github.com/dmno-dev/bum...

pre-release channels are looking good on bumpy 🐸 Same workflow, just merge to _next_. Then merge _next_ to _main_. Anyone out there using a npm preview release channel and not quite happy with their current setup? Hit me up! bumpy.varlock.dev

Looking at adding long-lived pre-release channels to bumpy.varlock.dev (one most confusing/complained about parts of changesets 🦋) not implemented yet, but here is the plan -- github.com/dmno-dev/bum... If anyone has thought about this deeply and has any feedback I'd be very grateful!

GitHub - dmno-dev/bumpy: 🐸 Modern monorepo friendly version management + changelog tool

🐸 Modern monorepo friendly version management + changelog tool - dmno-dev/bumpy

bumpy.varlock.dev

when starting a new project repo, choosing a tech stack, etc, i try to always ask the hard and important questions right up front, such as: “how do i work this?”, “what is that beautiful house?”, “where does that highway go to?”, “am I right? am I wrong?”, and “my god! what have I done?”

set up bumpy.varlock.dev in your repo and I'll send you a sweet bumpy sticker 🐸

that's what I like to see 🧙‍♂️✨🔐