> [Agent navigation index](/llms.txt)

# Secrets and deployment snapshots

Resolve trusted secret-provider references and publish immutable, narrowly exported AWS environment snapshots.

## Resolve 1Password references

Brix bundles its pinned Varlock 1Password plugin. Register it in the schema header:

```dotenv
# @plugin(brix)
# @initOp(token=$OP_SERVICE_ACCOUNT_TOKEN, allowAppAuth=true)
# @currentEnv=$VARLOCK_ENV
# @generateTsTypes(path=../src/env.generated.d.ts, auto=false, exposeEnv=none, processEnv=none, importMetaEnv=none)
# ---

# @type=opServiceAccountToken @sensitive @internal @required=false
OP_SERVICE_ACCOUNT_TOKEN=

# @type=string @sensitive @required
CATALOG_TOKEN=op("op://Storefront/Production/token")

```

No application plugin install is needed. Authenticate the 1Password CLI locally. In trusted CI, provide `OP_SERVICE_ACCOUNT_TOKEN`; it takes precedence. Plugins and imported schemas are executable trusted configuration, so never resolve providers in untrusted fork jobs.

## Upload an immutable AWS snapshot

Configure the stable secret prefix and narrow CI export allowlist in `package.json`:

```json
{
  "brix": {
    "project": "application",
    "env": {
      "secretsPrefix": "booking",
      "ciExports": {
        "literals": ["PORT"],
        "secrets": ["DEPLOY_TOKEN"]
      }
    }
  }
}

```

Run upload only in a protected deployment job:

```sh
brix env upload production

```

Upload validates the complete environment, checks sensitivity, masks sensitive values in GitHub Actions, and replaces `<prefix>-secrets-<stage>` with a complete `brix-env-v1` JSON snapshot. Unlisted values remain in the AWS snapshot but do not cross into later CI steps.

Brix exports only `STAGE`, allowlisted values, `SECRETS_ARN`, and exact `SECRETS_VERSION`. Masking is log redaction, not access control; every later job step can read exports.

Deploy the ARN/version pair, AWS region, and workload identity. The Node runtime adapter fetches exactly that immutable version and supplies the snapshot to the inert `createEnv` parser for each request. Both identifiers are required together; malformed snapshots and provider failures do not fall back to process values. Production needs no Varlock files or provider credentials in its runtime artifact.