Add @setValuesBulk decorator + bulk secret loaders for 1Password & Infisical

[theoephraim]

Summary

• Add @setValuesBulk root decorator — a new core feature that lets you inject many config values at once from a single resolver, avoiding boilerplate when secret key names already match your env var names
• Add opLoadEnvironment() resolver to the 1Password plugin for bulk-loading all variables from a 1Password environment via @setValuesBulk
• Add infisicalBulk() resolver to the Infisical plugin for bulk-loading all secrets from an Infisical project/environment, with support for filtering by path and tag
• Improve resolver error surfacing — errors thrown during resolution now carry source location info and tips are displayed in CLI output, making it much easier to diagnose plugin auth/access issues
• Document all new features in plugin READMEs, website docs, and the secrets management guide

@setValuesBulk decorator

New root decorator that injects values from a resolver into matching config items:

# @setValuesBulk(infisicalBulk())
# @setValuesBulk(opLoadEnvironment(your-environment-id))
# @setValuesBulk(op("op://vault/field/item"))
# @setValuesBulk(exec("vault kv get secret/myapp"))

opLoadEnvironment() (1Password)

# @setValuesBulk(opLoadEnvironment(your-environment-id))
# @setValuesBulk(opLoadEnvironment(prod, your-environment-id))

infisicalBulk() (Infisical)

Supports named path and tag params with optional positional instance ID:

# @setValuesBulk(infisicalBulk())
# @setValuesBulk(infisicalBulk(path="/database"))
# @setValuesBulk(infisicalBulk(tag="backend"))
# @setValuesBulk(infisicalBulk(prod, path="/database", tag="app"))

Resolver error improvements

• Resolver errors now include source file location (file + line number)
• Error tips from plugins are now propagated through decorator execution and displayed in CLI output
• Decorator execution preserves error location from nested resolvers

Test plan

• @setValuesBulk unit tests pass (set-values-bulk.test.ts)
• Build 1Password and Infisical plugins
• End-to-end: verify opLoadEnvironment() loads 1Password environment variables
• End-to-end: verify infisicalBulk() loads secrets, including path and tag filtering
• Verify resolver errors display location and tips in CLI output
• Review docs render correctly on the website

🤖 Generated with Claude Code

Closes #208

[changeset-bot]

🦋 Changeset detected

Latest commit: 1fa6efc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
varlock	Patch
@varlock/infisical-plugin	Patch
@varlock/1password-plugin	Patch
@env-spec/parser	Patch
@varlock/astro-integration	Patch
@varlock/nextjs-integration	Patch
@varlock/vite-integration	Patch
@varlock/aws-secrets-plugin	Patch
@varlock/azure-key-vault-plugin	Patch
@varlock/bitwarden-plugin	Patch
@varlock/google-secret-manager-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	varlock-website	1fa6efc	Commit Preview URL Branch Preview URL	Feb 25 2026, 12:25 AM

[pkg-pr-new]

Open in StackBlitz

@env-spec/parser

npm i https://pkg.pr.new/dmno-dev/varlock/@env-spec/parser@307

varlock

npm i https://pkg.pr.new/dmno-dev/varlock@307

@varlock/astro-integration

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/astro-integration@307

@varlock/nextjs-integration

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/nextjs-integration@307

@varlock/vite-integration

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/vite-integration@307

@varlock/1password-plugin

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/1password-plugin@307

@varlock/aws-secrets-plugin

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/aws-secrets-plugin@307

@varlock/azure-key-vault-plugin

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/azure-key-vault-plugin@307

@varlock/bitwarden-plugin

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/bitwarden-plugin@307

@varlock/google-secret-manager-plugin

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/google-secret-manager-plugin@307

@varlock/infisical-plugin

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/infisical-plugin@307

commit: 1fa6efc

[philmillman]

LGTM