Package Bindings
Package bindings are an optional nproxy policy layer for environment variables and secret-like capabilities.
By default, bindings are off. Your package managers and production entrypoints inherit environment variables exactly as they do today. When you turn bindings on, nproxy can observe, warn, or enforce which sensitive env vars are available to install, build, test, publish, CI, and production runtime commands.
Modes
| Mode | Behavior |
|---|---|
off | Env vars pass through unchanged. No binding decisions are made. |
observe | Env vars pass through unchanged. Sensitive env var names are recorded for audit. |
warn | Env vars pass through unchanged. nproxy warns when a var would be stripped in enforce mode. |
enforce | Sensitive env vars are stripped unless an explicit binding grant allows them. |
Non-sensitive env vars continue to pass through in every mode. Secret values are not sent to nproxy cloud in v1; policy stores source references such as env:STRIPE_KEY, and the local daemon resolves the value on your machine.
Binding Shape
A binding has:
| Field | Example |
|---|---|
| Name | STRIPE_KEY |
| Kind | env |
| Target | STRIPE_KEY |
| Source | env:STRIPE_KEY or file:~/.config/acme/stripe-key |
| Grant | build, publish, install, test, ci, prod, or package-manager |
Rollout Path
- Start in
offto keep current behavior. - Move to
observeto see which sensitive env vars are present during package-manager and production runs. - Move to
warnto identify what enforce mode would strip. - Move to
enforceafter adding grants for the commands that truly need each secret.
For package-manager commands, enforcement is transparent through nproxy-managed wrappers. For production runtime commands, bindings are projected into native platform configuration from .nproxy/contract.json:
nproxy setup acme --bindings
nproxy inspect bindings
nproxy projects bindings into native surfaces such as PM2 env_file, Docker/Compose env files, Kubernetes Secrets/ConfigMaps, Cloudflare Wrangler vars/secrets, GitHub Actions env, and local shell config. Apps keep starting through their normal commands.