basic @import implementation

[theoephraim]

This PR is a first implementation of a new @import decorator, which allows explicitly importing more data sources (.env files). This will be especially useful in large projects where you want to break up a large .env file, or in a monorepo, where you want shared info at the root, or to pick specific items from a relevant sibling service - single source of truth!!

This also starts opening up the door for pre-made schemas for popular platforms and libraries -- e.g. all the env vars injected by vercel, or the env vars that a particular tool/library will be looking for.

--
In order to do this, we did a lot of refactoring around data sources, and moved the logic of automatically loading .env.* files into a new "directory data source". This is so that we can explicitly import a directory, and have all the appropriate files loaded. This also forced me to rework how @envFlag is handled.

Some notes:

• Data sources now always have a parent chain and there is a single root source
• all auto-imported sources within a directory are a child of the directory source (.env, .env.*)
• We realized that Next.js by default does not load .env.local in test mode. We contemplated mimicking this behaviour, but ultimately decided to follow Vite's lead (and load it), but provide a way to explicitly follow that pattern with # @disable=forEnv(test)
• We allow multiple envFlag values to exist now, so that if you are importing from another service, you could have something like WEB_ENV and API_ENV, and still pull the staging api url into a dev web build. This works by walking up the parent chain

Next steps for imports:

• allow imports over http, and via npm (either locally from node_modules or remotely)
• allow renaming keys while importing them
• figure out how to handle importing a key that depends on another that is not imported (we may import implicitly?)

[changeset-bot]

🦋 Changeset detected

Latest commit: a518f3f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
@env-spec/parser	Patch
varlock	Patch
@varlock/astro-integration	Patch
@varlock/nextjs-integration	Patch
@varlock/vite-integration	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	varlock-website	a518f3f	Commit Preview URL Branch Preview URL	Sep 19 2025, 05:45 AM

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​builder.io/​qwik@​1.15.0
	@​builder.io/​qwik-city@​1.15.0
	@​astrojs/​check@​0.9.4
	@​types/​node@​24.3.0 ⏵ 24.1.0			-1
	@​astrojs/​node@​9.3.0
	@​astrojs/​netlify@​6.5.3
	@​astrojs/​cloudflare@​12.6.0
	@​astrojs/​vercel@​8.2.3
	@​vue/​tsconfig@​0.7.0
	prettier@​3.6.2
	@​vitejs/​plugin-vue@​6.0.1
	eslint-plugin-qwik@​1.15.0
	openai@​5.10.2

View full report

[pkg-pr-new]

Open in StackBlitz

@env-spec/parser

npm i https://pkg.pr.new/dmno-dev/varlock/@env-spec/parser@147

varlock

npm i https://pkg.pr.new/dmno-dev/varlock@147

@varlock/astro-integration

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/astro-integration@147

@varlock/nextjs-integration

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/nextjs-integration@147

@varlock/vite-integration

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/vite-integration@147

commit: a518f3f

[philmillman]

LGTM

give the docs I added a once over and feel free to edit!