Add printenv command for printing a single resolved env var

[Copilot]

Adds a varlock printenv MY_VAR command that resolves and prints a single env var's value — useful for embedding in larger shell pipelines where varlock run -- echo $MY_VAR won't work (shell expands $MY_VAR before varlock runs).

Changes

• getTransitiveDeps(key, adjacencyList) — new utility in graph-utils.ts that computes all transitive dependencies of a node via iterative DFS
• EnvGraph.resolveItemWithDeps(key) — new method that resolves only the requested item and its transitive deps, skipping unrelated items entirely. Includes a comment documenting that currentEnv/conditional import deps are already handled at load time, and that decorator-based validation/coercion deps are captured in dependencyKeys
• printenv.command.ts — new CLI command; accepts a positional var name, runs selective resolution, and prints the raw value to stdout
• cli-executable.ts — registers the new printenv subcommand
• cli-commands.mdx — added varlock printenv section to the CLI reference docs on the website, including usage examples and an explanation of why varlock run -- echo $MY_VAR doesn't work

Usage

varlock printenv MY_VAR
varlock printenv --path .env.prod MY_VAR

# Embed in shell commands using subshell expansion
sh -c 'some-tool --token $(varlock printenv MY_TOKEN)'

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Feature Request] printenv command to output single var</issue_title>
<issue_description>### Description

DMNO has a printenv command which outputs a single env var. It's largely a convenience, but can be useful within larger more complex commands.

Additionally we need to add some docs about why varlock run -- echo $SOME_VAR does not work -- which is that the shell does expansion before calling varlock.

Motivation

No response

Proposed Solution

No response

Alternatives

No response

Additional Information

No response</issue_description>

<agent_instructions>adding a simple printenv command is striaghtforward.

But ideally rather than resolving the entire graph and then printing a single item, we would load the graph and then only resolve the minimal number of items to resolve the one config item that is being requested.

Explore this possibility and if possible implement it. If not, then we can just do the simple version.
</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes [Feature Request] printenv command to output single var #89

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[changeset-bot]

🦋 Changeset detected

Latest commit: 228de31

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages

Name	Type
varlock	Patch
@varlock/astro-integration	Patch
@varlock/nextjs-integration	Patch
@varlock/vite-integration	Patch
@varlock/1password-plugin	Patch
@varlock/aws-secrets-plugin	Patch
@varlock/azure-key-vault-plugin	Patch
@varlock/bitwarden-plugin	Patch
@varlock/google-secret-manager-plugin	Patch
@varlock/infisical-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[theoephraim]

@copilot - this looks great. Some additional complexity comes from certain values needing to be resolved to load the schema itself, like the currentEnv, or anything else that could affect conditional imports which might affect the item. Also any items that affect the item's validation/coercion/etc

[Copilot]

@copilot - this looks great. Some additional complexity comes from certain values needing to be resolved to load the schema itself, like the currentEnv, or anything else that could a...

Good catch — I traced through both concerns carefully:

currentEnv / conditional imports: Both are resolved via earlyResolve() during loadEnvGraph() itself (in DirectoryDataSource._finishInit() and the @import(enabled=...) handling in finishInit()). By the time resolveItemWithDeps() is called, the envFlag item already has isResolved=true and env-specific files (.env.production, etc.) are already in the data source tree. When those items appear in the transitive dep set, ConfigItem.resolve() simply returns early.

Items affecting validation/coercion: ConfigItem.dependencyKeys already collects deps from both the value resolver AND all item decorator value resolvers (e.g. @required($APP_ENV == "prod") adds APP_ENV as a dep). getTransitiveDeps walks the full graphAdjacencyList which is built from dependencyKeys, so these are correctly included.

Added a comment in resolveItemWithDeps (cf7a93f) to document this reasoning for future maintainers.

[philmillman]

@theoephraim We may want to consider a different name for this since printenv in the *nix world means either a single env var or the entire env. Maybe printitem or printenvvar, which are both slightly more clunky unfortunately 🤔

[pkg-pr-new]

Open in StackBlitz

varlock

npm i https://pkg.pr.new/dmno-dev/varlock@314

@varlock/astro-integration

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/astro-integration@314

@varlock/nextjs-integration

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/nextjs-integration@314

@varlock/vite-integration

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/vite-integration@314

@varlock/1password-plugin

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/1password-plugin@314

@varlock/aws-secrets-plugin

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/aws-secrets-plugin@314

@varlock/azure-key-vault-plugin

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/azure-key-vault-plugin@314

@varlock/bitwarden-plugin

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/bitwarden-plugin@314

@varlock/google-secret-manager-plugin

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/google-secret-manager-plugin@314

@varlock/infisical-plugin

npm i https://pkg.pr.new/dmno-dev/varlock/@varlock/infisical-plugin@314

commit: df4c9db

[theoephraim]

@copilot - add docs for this on the website

[Copilot]

@copilot - add docs for this on the website

Added docs for printenv to the CLI reference page (commit 228de31). The new section covers the command syntax, options, examples, and includes a note explaining why varlock run -- echo $MY_VAR doesn't work and how printenv solves it.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	varlock-website	228de31	Commit Preview URL Branch Preview URL	Feb 24 2026, 11:53 PM