Serverless functions

Deliver your values to Lambda, Cloud Run, Workers, Vercel, and Deno Deploy with an export sync, or run penv inside Lambda through the layer.

Most function platforms have no wrapper process for penv run, and penv ships no boot-time fetch library. We deliver your values with an export sync into the platform's own store; AWS Lambda can also run penv through a layer. Sync mechanics and write policies: how syncs work.

Platforms

Platform	Integration	Writes	Value goes live
AWS Lambda	aws-lambda-env	Function environment on `$LATEST`	Next provisioned instance
Google Cloud Run	gcp-cloud-run-env	Container environment in a new revision	When the revision takes traffic
Cloudflare Workers	cloudflare-workers	Secret bindings	Immediately (the write rolls a new script version)
Vercel	vercel-env	Project environment variables	Next deploy. Builds can also run penv: deploy to Vercel.
Deno Deploy	deno-deploy-env	One app's variables for one context	Next deploy
Deno Deploy layers	deno-deploy-layer-env	One layer's variables, read by every app including it	Next deploy

Each integration page lists the credential, connection fields, mapping fields, and probed permissions.

AWS Lambda layer

aws lambda update-function-configuration --function-name app \
  --layers arn:aws:lambda:<region>:<account>:layer:penv:1 \
  --environment 'Variables={AWS_LAMBDA_EXEC_WRAPPER=/opt/penv-wrapper,PENV_ENV=production}'

Since 1.0.0-beta.2, penv ships a layer (bin/penv plus penv-wrapper) that you build with packaging/lambda/build-layer.sh from the penv release and publish to your account. The wrapper starts the runtime under penv run.

Fact	Detail
Runtimes	Managed Node.js, Python, Java, .NET, Ruby. Container-image functions and `provided.al2023` ignore the wrapper: use `penv run --` as the image entrypoint (Docker).
Schema	`.env.schema` at the root of the function package; without it the wrapper exits 78.
Reads	One read from us per cold start; warm invocations reuse the process.
Credential	The execution role against an AWS trust, from penv 1.0.0-beta.3 (1.0.0-beta.2 does not sign your workspace id). Or set `PENV_TOKEN`, or ship a bundle with `PENV_BUNDLE_KEY`.
Masking	Function stdout and stderr. Not the invocation result.

Platform write behavior

Platform	Behavior
AWS Lambda	The API replaces the whole variable map, so we read the configuration and write the merged map pinned to the revision we read. Published versions are locked; writes target `$LATEST`. The write is asynchronous. Import needs `kms:Decrypt`; a variable under a customer managed key is reported unreadable, never treated as empty.
Google Cloud Run	We write the merged list pinned to the `etag` we read; `409` and `412` are a lost race and trigger a re-read. A Secret Manager reference is listed and preserved byte for byte, never fetched or flattened to a literal.
Cloudflare Workers	Export only: Cloudflare returns secret names, never values.
Deno Deploy	Export only: we mark every variable secret and Deno omits secret values from responses. Deno does not state whether running isolates see a change, so we report it live on the next deploy.

Audit coverage

Audit entry	No audit entry
The sync write and what it changed	The function reading its variable
A reveal, write, or delete in your workspace	A person reading the value in the platform console

We record a read at runtime only under penv run. See the audit log.

Dynamic values

We skip a dynamic value in a sync and name it in the run report. See dynamic values.

Deno Deploy as an identity

issuer    https://oidc.deno.com
subject   deployment:<organization>/<app>/<context>
audience  <workspace id>

A Deno Deploy deployment can also mint a token and authenticate to us as its own identity, the only function platform where that holds. The organization slug scopes the trust, because every Deno organization shares the issuer. Snippet and fields: connect Deno Deploy.

Setup

Open Integrations in the console (integrations), connect the platform, and wait for the connection to verify.

Map one environment in your workspace onto one function, service, Worker, Vercel project, or Deno Deploy context.

Choose the write policy. Prune deletes keys absent from your environment.

Run a dry run and read the plan.

Apply, then redeploy or restart so the platform picks up the values.