[theoephraim]

Fixes #1280.

Boot exit on Vercel. On Vercel, Next turns on experimental.runtimeServerDeploymentId, which writes env: undefined into .next/required-server-files.json. readFrozenBuildEnv read that as "the build did not freeze" (null), so a frozen build with no varlock CLI in the function printed NOT_FROZEN_BOOT_HINT and exited before the frozen runtime prelude could run. A recorded config with no env now returns undefined ("can't tell"), so boot defers to the runtime prelude, which carries the frozen env. A config that has env without the frozen key still exits with the hint.

Stale trace hashes. Turbopack writes a content hash for each traced file into its .nft.json traces (fileHashes) before we inject the prelude into [turbopack]_runtime.js. Next's adapter passes those hashes on, and Vercel writes them into each function's .vc-config.json. The recorded hash of the runtime file was identical across builds whose frozen env differed. After injecting, we now replace that entry in every trace with a hash of the rewritten file. Vercel did not serve stale content without this fix in our tests, but nothing guarantees it won't key on those hashes.

Verified on real Vercel (Next 16.4.6, Turbopack, Vercel's adapter, committed .env files): two deploys of identical source with only a sensitive value changed each boot and serve their own value, both before and after the hash fix.

Tests cover the Vercel config case (both required-server-files.json and the standalone config), the trace hash rewrite, and related boot paths that had no coverage: standalone frozen boot, encrypted frozen env with and without _VARLOCK_ENV_KEY, missing or unparseable recorded config, and ambient __VARLOCK_ENV handling.

[github-actions]

The changes in this PR will be included in the next version bump.

Patch releases

• @varlock/nextjs-integration 2.0.0 → 2.0.1

Bump files in this PR

• nextjs-vercel-frozen-boot.md (view diff) (edit)

Click here if you want to add another bump file to this PR

---

This comment is maintained by bumpy.

[pullfrog]

✅ No new issues found.

Reviewed changes: Reviewed the frozen boot detection fix, regression tests, and integration patch release entry.

• Boot detection: Recorded configs without env now defer to runtime initialization, while explicit non-frozen configs retain the boot failure hint.
• Regression coverage: Tests cover both recorded config sources, unavailable configs, standalone and encrypted boot, and ambient frozen env handling. All 90 integration tests and package typecheck passed after building workspace dependencies.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/varlock@1297

npm i https://pkg.pr.new/@varlock/nextjs-integration@1297

commit: 3ae39aa

[pullfrog]

✅ No new issues found.

Reviewed changes: Reviewed the trace hash repair added since the previous review.

• Updated runtime hashes: Replaced stale NFT hashes with fingerprints of rewritten runtime files while preserving unrelated entries and hashless traces.
• Added regression coverage: Covered hash replacement, differing frozen preludes, and webpack trace preservation. The integration build, all 93 tests, typecheck, and targeted lint passed.
• Extended release notes: Included the trace hash repair in the integration patch entry.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}