envlock-next 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Benjamin Davies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,134 @@
+# envlock-next
+
+Inject secrets from 1Password into your Next.js app at dev/build/start time using [dotenvx](https://dotenvx.com) encrypted env files.
+
+## Prerequisites
+
+- [1Password CLI](https://developer.1password.com/docs/cli/get-started/) (`op`) installed and signed in
+- [dotenvx](https://dotenvx.com/docs/install) installed (`npm install -g @dotenvx/dotenvx`)
+- Encrypted `.env.*` files committed to your repo (see [dotenvx quickstart](https://dotenvx.com/docs/quickstart))
+
+## Install
+
+```bash
+pnpm add envlock-next
+```
+
+## Setup
+
+### 1. Configure `next.config.js`
+
+```js
+import { withEnvlock } from 'envlock-next';
+
+export default withEnvlock(
+  {
+    // your existing Next.js config
+  },
+  {
+    onePasswordEnvId: 'ca6uypwvab5mevel44gqdc2zae', // your 1Password Environment ID
+  },
+);
+```
+
+Find your **Environment ID** in 1Password → Settings → Developer → Environments.
+
+### 2. Update `package.json` scripts
+
+```json
+{
+  "scripts": {
+    "dev": "envlock dev",
+    "build": "envlock build",
+    "start": "envlock start"
+  }
+}
+```
+
+That's it. `envlock dev` will pull your dotenvx private key from 1Password, decrypt `.env.development`, and start Next.js with your secrets injected.
+
+## Environment flags
+
+By default, `envlock dev` uses `.env.development`. Use flags to target other environments:
+
+```bash
+envlock dev --staging       # uses .env.staging
+envlock dev --production    # uses .env.production
+envlock build --staging
+envlock build --production
+envlock start --production
+```
+
+## Custom env file paths
+
+Override the default file paths in `next.config.js`:
+
+```js
+export default withEnvlock(
+  {},
+  {
+    onePasswordEnvId: 'ca6uypwvab5mevel44gqdc2zae',
+    envFiles: {
+      development: '.env.local',
+      staging: '.env.staging.local',
+      production: '.env.production',
+    },
+  },
+);
+```
+
+## Environment variable fallback
+
+If `ENVLOCK_OP_ENV_ID` is set, envlock uses it instead of reading `next.config.js`. Useful for CI environments where you don't want to load the config file.
+
+```bash
+ENVLOCK_OP_ENV_ID=ca6uypwvab5mevel44gqdc2zae envlock build --production
+```
+
+## CI usage
+
+In CI, set `DOTENV_PRIVATE_KEY_<ENV>` directly. envlock detects this and skips `op run`, calling `dotenvx run` only:
+
+```yaml
+- name: Build
+  run: pnpm build
+  env:
+    DOTENV_PRIVATE_KEY_PRODUCTION: ${{ secrets.DOTENV_PRIVATE_KEY_PRODUCTION }}
+```
+
+## `createEnv` wrapper
+
+envlock re-exports a `createEnv` wrapper around [`@t3-oss/env-nextjs`](https://env.t3.gg) with sensible defaults:
+
+```js
+// src/env.js
+import { createEnv } from 'envlock-next';
+import { z } from 'zod';
+
+export const env = createEnv({
+  server: {
+    DATABASE_URL: z.string().url(),
+    API_SECRET: z.string().min(1),
+  },
+  client: {
+    NEXT_PUBLIC_APP_URL: z.string().url(),
+  },
+  runtimeEnv: {
+    DATABASE_URL: process.env.DATABASE_URL,
+    API_SECRET: process.env.API_SECRET,
+    NEXT_PUBLIC_APP_URL: process.env.NEXT_PUBLIC_APP_URL,
+  },
+});
+```
+
+Defaults applied: `emptyStringAsUndefined: true`, `skipValidation` reads from `SKIP_ENV_VALIDATION` env var.
+
+Requires `@t3-oss/env-nextjs` and `zod` as peer dependencies:
+
+```bash
+pnpm add @t3-oss/env-nextjs zod
+```
+
+## License
+
+MIT — [Benjamin Davies](https://github.com/BenDavies1218)

package/dist/cli/index.js

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+
+// src/cli/index.ts
+import { Command } from "commander";
+import { runWithSecrets, validateEnvFilePath } from "envlock-core";
+
+// src/cli/resolve-config.ts
+import { existsSync } from "fs";
+import { resolve } from "path";
+import { pathToFileURL } from "url";
+import { validateOnePasswordEnvId } from "envlock-core";
+var CONFIG_CANDIDATES = ["next.config.js", "next.config.mjs"];
+async function resolveConfig(cwd) {
+  for (const candidate of CONFIG_CANDIDATES) {
+    const fullPath = resolve(cwd, candidate);
+    if (!existsSync(fullPath)) continue;
+    try {
+      const mod = await import(pathToFileURL(fullPath).href);
+      const config = mod.default ?? mod;
+      if (config && typeof config === "object" && "__envlock" in config && config.__envlock && typeof config.__envlock === "object" && "onePasswordEnvId" in config.__envlock) {
+        return config.__envlock;
+      }
+    } catch (err) {
+      console.warn(
+        `[envlock] Failed to load ${candidate}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  if (process.env["ENVLOCK_OP_ENV_ID"]) {
+    const id = process.env["ENVLOCK_OP_ENV_ID"];
+    validateOnePasswordEnvId(id);
+    return { onePasswordEnvId: id };
+  }
+  throw new Error(
+    "[envlock] Could not find configuration.\nAdd withEnvlock() to your next.config.js:\n\n  import { withEnvlock } from 'envlock-next';\n  export default withEnvlock({}, { onePasswordEnvId: 'your-env-id' });\n\nOr set the ENVLOCK_OP_ENV_ID environment variable."
+  );
+}
+
+// src/cli/index.ts
+var DEFAULT_ENV_FILES = {
+  development: ".env.development",
+  staging: ".env.staging",
+  production: ".env.production"
+};
+async function runNextCommand(subcommand, environment, passthroughArgs) {
+  const config = await resolveConfig(process.cwd());
+  const envFile = config.envFiles?.[environment] ?? DEFAULT_ENV_FILES[environment];
+  validateEnvFilePath(envFile, process.cwd());
+  runWithSecrets({
+    envFile,
+    environment,
+    onePasswordEnvId: config.onePasswordEnvId,
+    command: "next",
+    args: [subcommand, ...passthroughArgs]
+  });
+}
+function addEnvFlags(cmd) {
+  return cmd.option("--staging", "use staging environment").option("--production", "use production environment").allowUnknownOption(true);
+}
+function getEnvironment(opts) {
+  if (opts.production) return "production";
+  if (opts.staging) return "staging";
+  return "development";
+}
+var program = new Command("envlock");
+program.name("envlock").description("Run Next.js commands with 1Password + dotenvx secret injection").version("0.1.0");
+var devCmd = new Command("dev").description("Start Next.js development server").allowUnknownOption(true);
+addEnvFlags(devCmd).action(async (opts) => {
+  const passthrough = devCmd.args.filter(
+    (a) => a !== "--staging" && a !== "--production"
+  );
+  await runNextCommand("dev", getEnvironment(opts), passthrough);
+});
+var buildCmd = new Command("build").description("Build Next.js application").allowUnknownOption(true);
+addEnvFlags(buildCmd).action(async (opts) => {
+  const passthrough = buildCmd.args.filter(
+    (a) => a !== "--staging" && a !== "--production"
+  );
+  await runNextCommand("build", getEnvironment(opts), passthrough);
+});
+var startCmd = new Command("start").description("Start Next.js production server").allowUnknownOption(true);
+addEnvFlags(startCmd).action(async (opts) => {
+  const passthrough = startCmd.args.filter(
+    (a) => a !== "--staging" && a !== "--production"
+  );
+  await runNextCommand("start", getEnvironment(opts), passthrough);
+});
+program.addCommand(devCmd);
+program.addCommand(buildCmd);
+program.addCommand(startCmd);
+program.parse(process.argv);

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+import { NextConfig } from 'next';
+import { EnvlockOptions } from 'envlock-core';
+export { EnvlockOptions } from 'envlock-core';
+import { createEnv as createEnv$1 } from '@t3-oss/env-nextjs';
+
+type EnvlockNextConfig = NextConfig & {
+    __envlock: EnvlockOptions;
+};
+declare function withEnvlock(nextConfig: NextConfig, options?: EnvlockOptions): EnvlockNextConfig;
+
+type CreateEnvArgs = Parameters<typeof createEnv$1>[0];
+declare function createEnv(options: CreateEnvArgs): never;
+
+export { type EnvlockNextConfig, createEnv, withEnvlock };

package/dist/index.js

@@ -0,0 +1,29 @@
+// src/plugin.ts
+import { validateOnePasswordEnvId } from "envlock-core";
+function withEnvlock(nextConfig, options) {
+  if (!options?.onePasswordEnvId) {
+    console.warn(
+      "[envlock] No onePasswordEnvId provided to withEnvlock(). Set it to your 1Password Environment ID for automatic secret injection. Alternatively, set ENVLOCK_OP_ENV_ID in your environment."
+    );
+  } else {
+    validateOnePasswordEnvId(options.onePasswordEnvId);
+  }
+  return {
+    ...nextConfig,
+    __envlock: options ?? { onePasswordEnvId: "" }
+  };
+}
+
+// src/env/index.ts
+import { createEnv as t3CreateEnv } from "@t3-oss/env-nextjs";
+function createEnv(options) {
+  return t3CreateEnv({
+    skipValidation: !!process.env["SKIP_ENV_VALIDATION"],
+    emptyStringAsUndefined: true,
+    ...options
+  });
+}
+export {
+  createEnv,
+  withEnvlock
+};

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "envlock-next",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Next.js plugin, createEnv wrapper, and CLI for envlock",
+  "license": "MIT",
+  "author": "Benjamin Davies",
+  "homepage": "https://github.com/BenDavies1218/envlock#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/BenDavies1218/envlock.git",
+    "directory": "packages/next"
+  },
+  "bugs": {
+    "url": "https://github.com/BenDavies1218/envlock/issues"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "bin": {
+    "envlock": "./dist/cli/index.js"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "commander": "^12.0.0",
+    "envlock-core": "0.1.0"
+  },
+  "peerDependencies": {
+    "@t3-oss/env-nextjs": ">=0.12.0",
+    "next": ">=14.0.0",
+    "zod": ">=3.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@t3-oss/env-nextjs": {
+      "optional": true
+    },
+    "zod": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@t3-oss/env-nextjs": "^0.12.0",
+    "@types/node": "^20.14.10",
+    "next": "^15.2.3",
+    "tsup": "^8.0.0",
+    "typescript": "^5.8.2",
+    "vitest": "^3.0.0",
+    "zod": "^3.24.2",
+    "envlock-core": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
+}