docs: add SvelteKit integration page and Cloudflare Workers Builds setup

- Add a new SvelteKit integration page. For most adapters it routes
  users to the Vite integration; for Cloudflare Workers it documents
  `varlockSvelteKitCloudflarePlugin` setup and the Workers Builds
  dashboard configuration (overriding the Deploy command, setting
  secret-zero vars in Build variables).
- Register the new page in the sidebar and the integrations overview.
- Add a small callout on the Cloudflare integration page pointing
  SvelteKit users to the SvelteKit guide instead of the two
  existing approaches.
- Add a Cloudflare Workers Builds (CI/CD) section to the Cloudflare
  integration page with the same dashboard-configuration guidance.
- Clarify on the Vite integration page that projects with SSR/server
  code on Cloudflare Workers should use the Cloudflare integration
  (not the plain Vite plugin) so secrets aren't bundled into the
  worker.
- Update the package README to list the SvelteKit variant.
- Drop the "new" badge on the Bun entry; add one on SvelteKit.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: theoephraim

packages/integrations/cloudflare/README.md

@@ -5,6 +5,7 @@ This package helps you integrate [varlock](https://varlock.dev) into a [Cloudfla
 It provides:
 
 - a Vite plugin (`varlockCloudflareVitePlugin`) that wraps `@cloudflare/vite-plugin` with automatic env var injection into miniflare bindings and Cloudflare's secret bindings at runtime
+- a SvelteKit-specific Vite plugin (`varlockSvelteKitCloudflarePlugin` at `@varlock/cloudflare-integration/sveltekit`) for projects deploying via `@sveltejs/adapter-cloudflare`
 - a `varlock-wrangler` CLI binary — a drop-in replacement for `wrangler` that injects env via named pipe in dev, uploads vars/secrets on deploy, and generates correct types
 - a standalone init module (`@varlock/cloudflare-integration/init`) for non-Vite workers
 - validation of your env vars against your `.env.schema`

packages/varlock-website/astro.config.ts

@@ -163,10 +163,11 @@ export default defineConfig({
           items: [
             { label: 'Overview', slug: 'integrations/overview' },
             { label: 'JavaScript / Node.js', slug: 'integrations/javascript' },
-            { label: 'Bun', slug: 'integrations/bun', badge: 'new' },
+            { label: 'Bun', slug: 'integrations/bun' },
             { label: 'Next.js', slug: 'integrations/nextjs' },
             { label: 'Vite-based', slug: 'integrations/vite' },
             { label: 'Astro', slug: 'integrations/astro' },
+            { label: 'SvelteKit', slug: 'integrations/sveltekit', badge: 'new' },
             { label: 'Expo / React Native', slug: 'integrations/expo', badge: 'new' },
             { label: 'Other languages', slug: 'integrations/other-languages' },
             { label: 'Cloudflare Workers', slug: 'integrations/cloudflare', badge: 'new' },

packages/varlock-website/src/content/docs/integrations/cloudflare.mdx

@@ -20,6 +20,10 @@ Both approaches below use `varlock-wrangler` — a thin wrapper around `wrangler
 1. **Using `varlock-wrangler`** - A thin wrapper for `wrangler` that injects env vars correctly, along with a one-line init import in your worker
 2. **With the Vite plugin** - If you're already using the [Cloudflare Workers Vite plugin](https://developers.cloudflare.com/workers/vite-plugin/), you can add the varlock Cloudflare Vite plugin to automatically inject env vars and init code
 
+:::note[SvelteKit on Cloudflare]
+Deploying SvelteKit via `@sveltejs/adapter-cloudflare`? See the [SvelteKit guide](/integrations/sveltekit/#sveltekit-on-cloudflare-workers) — it uses a dedicated `varlockSvelteKitCloudflarePlugin` instead of the approaches below.
+:::
+
 ## Approach 1: Using `varlock-wrangler`
 
 Replace your `wrangler` commands with `varlock-wrangler` and initialize varlock in your worker code with a single import. It's a thin wrapper that wires up your env vars correctly, and passes everything else through unchanged.
@@ -232,3 +236,29 @@ APP_ENV=remap($WORKERS_CI_BRANCH, "main", production, /.*/, preview, undefined,
 ```
 
 For more information, see the [environments guide](/guides/environments).
+
+----
+
+## Cloudflare Workers Builds (CI/CD)
+
+If you deploy via [Cloudflare Workers Builds](https://developers.cloudflare.com/workers/ci-cd/builds/), two pieces of setup are required in the dashboard — neither can be configured from a file in the repo:
+
+<Steps>
+
+1. **Override the Deploy command**
+
+    Under **Settings → Build → Deploy command**, replace the default `npx wrangler deploy` with:
+
+    ```sh
+    npx varlock-wrangler deploy
+    ```
+
+    Without this override, Cloudflare runs stock `wrangler deploy`, which skips varlock's env resolution and leaves your worker without its resolved vars/secrets at runtime.
+
+1. **Set any _secret-zero_ vars under Build variables**
+
+    Any env vars that varlock itself needs _during load_ — for example a 1Password service account token, a GCP key — must be set under **Settings → Build → Variables and Secrets**. These are made available to the build step, where `varlock-wrangler deploy` resolves your full env graph and uploads the result to the worker runtime as regular vars/secrets.
+
+    Vars that only your worker needs at runtime (not varlock itself) don't need to be set here — they'll be resolved by varlock and set  automatically by `varlock-wrangler deploy`.
+
+</Steps>

packages/varlock-website/src/content/docs/integrations/overview.mdx

@@ -19,6 +19,7 @@ Integrations allow you to:
 - [React Router](/integrations/vite/) — use the Vite integration
 - [Cloudflare Workers](/integrations/cloudflare/) — use the Vite integration or Wrangler vars/secrets directly
 - [Astro](/integrations/astro/) — Astro integration built on top of our Vite plugin
+- [SvelteKit](/integrations/sveltekit/) — use the Vite integration, or the Cloudflare integration's SvelteKit plugin when deploying to Workers
 - [Expo / React Native](/integrations/expo/) — Babel plugin + Metro config wrapper with compile-time replacements and server route support
 - [GitHub Actions](/integrations/github-action/) — validate your `.env.schema` in GitHub Actions workflows
 - [Other languages](/integrations/other-languages/) — guidance for piping varlock output into non-JS runtimes

packages/varlock-website/src/content/docs/integrations/sveltekit.mdx

@@ -0,0 +1,78 @@
+---
+title: SvelteKit
+description: How to integrate varlock with SvelteKit for secure, type-safe environment management
+---
+import { Steps } from "@astrojs/starlight/components";
+import Badge from '@/components/Badge.astro';
+import ExecCommandWidget from '@/components/ExecCommandWidget.astro';
+import InstallJsDepsWidget from '@/components/InstallJsDepsWidget.astro';
+
+[SvelteKit](https://svelte.dev/docs/kit) is built on [Vite](https://vite.dev), so there's no dedicated SvelteKit package — which integration you use depends on where you deploy.
+
+- **Node / Vercel / Netlify / self-hosted / most adapters** — use the [Vite integration](/integrations/vite/) as-is. Add `varlockVitePlugin()` before `sveltekit()` in your `vite.config.ts` and you're done.
+- **Cloudflare Workers (via `@sveltejs/adapter-cloudflare`)** — use the `varlockSvelteKitCloudflarePlugin` from `@varlock/cloudflare-integration`. See [setup below](#sveltekit-on-cloudflare-workers).
+
+---
+
+## SvelteKit on Cloudflare Workers
+
+<div class="page-badges">
+  <Badge npmPackage="@varlock/cloudflare-integration" />
+</div>
+
+For SvelteKit projects deploying to Cloudflare Workers via [`@sveltejs/adapter-cloudflare`](https://svelte.dev/docs/kit/adapter-cloudflare), use `varlockSvelteKitCloudflarePlugin`. It does **not** wrap `@cloudflare/vite-plugin` — SvelteKit doesn't currently work with that plugin ([cloudflare/workers-sdk#8922](https://github.com/cloudflare/workers-sdk/issues/8922)). Instead, it injects varlock's runtime env-loader directly into SvelteKit's SSR entry so the resolved env is available at runtime inside the worker.
+
+### Setup
+
+<Steps>
+
+1. **Install packages**
+    <InstallJsDepsWidget packages="@varlock/cloudflare-integration varlock" />
+
+1. **Run `varlock init` to set up your `.env.schema` file**
+
+    <ExecCommandWidget command="varlock init" showBinary={false} />
+
+1. **Add the plugin to your Vite config**
+
+    ```diff lang="ts" title="vite.config.ts"
+    import { sveltekit } from '@sveltejs/kit/vite';
+    import { defineConfig } from 'vite';
+    +import { varlockSvelteKitCloudflarePlugin } from '@varlock/cloudflare-integration/sveltekit';
+
+    export default defineConfig({
+      plugins: [
+    +    varlockSvelteKitCloudflarePlugin(),
+        sveltekit(),
+      ],
+    });
+    ```
+
+1. **Update your deploy script to use `varlock-wrangler`**
+
+    ```diff lang="json" title="package.json" add="varlock-"
+    {
+      "scripts": {
+        "dev": "vite dev",
+        "build": "vite build",
+        "deploy": "npm run build && varlock-wrangler deploy"
+      }
+    }
+    ```
+
+</Steps>
+
+### How it works
+
+- **In dev**: `vite dev` runs SvelteKit's dev server; varlock resolves env via its normal flow and makes it available on `ENV.*`.
+- **In production**: The SvelteKit SSR bundle has a `cloudflare:workers` runtime loader injected at the top of its server entry. At worker boot, it reads the `__VARLOCK_ENV` binding and hydrates varlock's runtime. The loader is guarded by a `navigator.userAgent === 'Cloudflare-Workers'` check so SvelteKit's Node-side postbuild steps (prerender, fallback) don't try to resolve `cloudflare:workers`.
+- `varlock-wrangler deploy` uploads non-sensitive values as Cloudflare vars and sensitive values as secrets.
+
+### Deploying via Cloudflare Workers Builds
+
+If you deploy through [Cloudflare Workers Builds](https://developers.cloudflare.com/workers/ci-cd/builds/), two pieces of configuration must be set in the dashboard — neither can be committed to the repo:
+
+- **Override the Deploy command** — Under **Settings → Build → Deploy command**, replace the default `npx wrangler deploy` with `npx varlock-wrangler deploy`. Without this, Cloudflare runs stock `wrangler deploy`, which skips varlock resolution and leaves your worker without its resolved vars/secrets.
+- **Set any _secret-zero_ vars under Build variables** — Any env vars varlock itself needs _during load_ (e.g. a 1Password service account token, a GCP key) must be set under **Settings → Build → Variables and Secrets** so they're available at build time. `varlock-wrangler deploy` then resolves your full env graph and uploads the result to the worker runtime as regular vars/secrets.
+
+See the [Cloudflare integration page](/integrations/cloudflare/) for more detail on `varlock-wrangler`, multi-environment setup, and [Workers Builds configuration](/integrations/cloudflare/#cloudflare-workers-builds-cicd).

packages/varlock-website/src/content/docs/integrations/vite.mdx

@@ -24,9 +24,17 @@ This plugin does a few things:
 For [Astro](https://astro.build) - which is also powered by Vite - you should use our [Astro integration](/integrations/astro/).
 ::::
 
+:::note[SvelteKit users]
+For [SvelteKit](https://svelte.dev/docs/kit), the plain Vite integration below works for most adapters. If you're deploying to Cloudflare Workers via `@sveltejs/adapter-cloudflare`, see our [SvelteKit guide](/integrations/sveltekit/) — it points you at the Cloudflare-specific plugin.
+::::
+
+:::caution[Deploying a non-static site to Cloudflare Workers?]
+If your project has an SSR/server component that runs on Cloudflare Workers, the plain Vite integration won't wire up runtime secrets correctly — secrets would end up bundled into the worker instead of being stored as Cloudflare secrets. Use the [Cloudflare integration](/integrations/cloudflare/) (or the [SvelteKit guide](/integrations/sveltekit/) for SvelteKit) instead. This page is fine for **static-only** Vite sites.
+:::
+
 ## Frameworks that use Vite ||frameworks||
 
-If you're using [Qwik](https://qwik.dev/) or [React Router](https://reactrouter.com/)/[Remix](https://remix.run/), you can follow the Vite instructions below. If you're using [Cloudflare Workers](https://developers.cloudflare.com/workers/) with the [Cloudflare Vite plugin](https://developers.cloudflare.com/workers/vite-plugin/) then these instructions also apply. For anything framework-specific on Cloudflare Workers (like Next.js) follow the [integration](/integrations/overview) docs for that framework.
+If you're using [Qwik](https://qwik.dev/) or [React Router](https://reactrouter.com/)/[Remix](https://remix.run/), you can follow the Vite instructions below. If you're using [Cloudflare Workers](https://developers.cloudflare.com/workers/) with the [Cloudflare Vite plugin](https://developers.cloudflare.com/workers/vite-plugin/), use the [Cloudflare integration](/integrations/cloudflare/) instead of this page. For anything framework-specific on Cloudflare Workers (like Next.js) follow the [integration](/integrations/overview) docs for that framework.
 
 ## Setup