diff --git a/.changeset/beige-gorillas-tell.md b/.changeset/beige-gorillas-tell.md
new file mode 100644
index 000000000000..7912e6f4ea90
--- /dev/null
+++ b/.changeset/beige-gorillas-tell.md
@@ -0,0 +1,9 @@
+---
+'@sveltejs/adapter-cloudflare': patch
+'@sveltejs/adapter-cloudflare-workers': patch
+'@sveltejs/adapter-netlify': patch
+'@sveltejs/adapter-node': patch
+'@sveltejs/adapter-vercel': patch
+---
+
+Initialise `env`
diff --git a/.changeset/pretty-kings-care.md b/.changeset/pretty-kings-care.md
new file mode 100644
index 000000000000..fc1fd37e5ce7
--- /dev/null
+++ b/.changeset/pretty-kings-care.md
@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+Add `$env/static/private`, `$env/static/public`, `$env/dynamic/private` and `$env/dynamic/public` modules
diff --git a/documentation/docs/06-hooks.md b/documentation/docs/06-hooks.md
index a6b28d5d28f5..f1769fb23051 100644
--- a/documentation/docs/06-hooks.md
+++ b/documentation/docs/06-hooks.md
@@ -38,9 +38,6 @@ declare namespace App {
 	interface Locals {
 		user: User;
 	}
-	interface Platform {}
-	interface Session {}
-	interface Stuff {}
 }
 
 const getUserInformation: (cookie: string | null) => Promise<User>;
diff --git a/documentation/docs/15-configuration.md b/documentation/docs/15-configuration.md
index c51d158e81b5..6bd606854ec2 100644
--- a/documentation/docs/15-configuration.md
+++ b/documentation/docs/15-configuration.md
@@ -29,7 +29,9 @@ const config = {
 				// ...
 			}
 		},
-		moduleExtensions: ['.js', '.ts'],
+		env: {
+			publicPrefix: 'PUBLIC_'
+		},
 		files: {
 			assets: 'static',
 			hooks: 'src/hooks',
@@ -44,6 +46,7 @@ const config = {
 			parameter: '_method',
 			allowed: []
 		},
+		moduleExtensions: ['.js', '.ts'],
 		outDir: '.svelte-kit',
 		package: {
 			dir: 'package',
@@ -157,9 +160,11 @@ When pages are prerendered, the CSP header is added via a `<meta http-equiv>` ta
 
 > Note that most [Svelte transitions](https://svelte.dev/tutorial/transition) work by creating an inline `<style>` element. If you use these in your app, you must either leave the `style-src` directive unspecified or add `unsafe-inline`.
 
-### moduleExtensions
+### env
 
-An array of file extensions that SvelteKit will treat as modules. Files with extensions that match neither `config.extensions` nor `config.kit.moduleExtensions` will be ignored by the router.
+Environment variable configuration:
+
+- `publicPrefix` — a prefix that signals that an environment variable is safe to expose to client-side code. See [`$env/static/public`](/docs/modules#$env-static-public) and [`$env/dynamic/public`](/docs/modules#$env-dynamic-public). Note that Vite's [`envPrefix`](https://vitejs.dev/config/shared-options.html#envprefix) must be set separately if you are using Vite's environment variable handling - though use of that feature should generally be unnecessary.
 
 ### files
 
@@ -186,6 +191,10 @@ See [HTTP Method Overrides](/docs/routing#endpoints-http-method-overrides). An o
 - `parameter` — query parameter name to use for passing the intended method value
 - `allowed` - array of HTTP methods that can be used when overriding the original request method
 
+### moduleExtensions
+
+An array of file extensions that SvelteKit will treat as modules. Files with extensions that match neither `config.extensions` nor `config.kit.moduleExtensions` will be ignored by the router.
+
 ### outDir
 
 The directory that SvelteKit writes files to during `dev` and `build`. You should exclude this directory from version control.
diff --git a/documentation/faq/60-env-vars.md b/documentation/faq/60-env-vars.md
deleted file mode 100644
index 41d121f5bf15..000000000000
--- a/documentation/faq/60-env-vars.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-title: How do I use environment variables?
----
-
-Vite uses [dotenv](https://github.com/motdotla/dotenv) to load environment variables from a file named `.env` or similar. Only environment variables prefixed with `VITE_` are exposed ([you can set `envPrefix` to change this](https://vitejs.dev/config/shared-options.html#envprefix)). You can access the variable using `import.meta.env.VITE_ENV_VAR`, and Vite will statically replace them at build-time.
-
-To use environment variables at runtime, you would need to instantiate dotenv yourself in your server-side code so that they are exposed at `process.env.YOUR_ENV_VAR`. You may also use `$session` to pass them to the client if needed.
-
-Please see [the Vite documentation](https://vitejs.dev/guide/env-and-mode.html#env-files) for more info about environment variables.
diff --git a/documentation/faq/65-read-package-json.md b/documentation/faq/60-read-package-json.md
similarity index 100%
rename from documentation/faq/65-read-package-json.md
rename to documentation/faq/60-read-package-json.md
diff --git a/packages/adapter-cloudflare-workers/files/entry.js b/packages/adapter-cloudflare-workers/files/entry.js
index 1064a1547763..cd784e5d33c6 100644
--- a/packages/adapter-cloudflare-workers/files/entry.js
+++ b/packages/adapter-cloudflare-workers/files/entry.js
@@ -15,6 +15,8 @@ export default {
 	 * @param {any} context
 	 */
 	async fetch(req, env, context) {
+		server.init({ env });
+
 		const url = new URL(req.url);
 
 		// static assets
diff --git a/packages/adapter-cloudflare/src/worker.js b/packages/adapter-cloudflare/src/worker.js
index 1ba1bf8d145a..20993ee11beb 100644
--- a/packages/adapter-cloudflare/src/worker.js
+++ b/packages/adapter-cloudflare/src/worker.js
@@ -9,6 +9,7 @@ const prefix = `/${manifest.appDir}/`;
 /** @type {import('worktop/cfw').Module.Worker<{ ASSETS: import('worktop/cfw.durable').Durable.Object }>} */
 const worker = {
 	async fetch(req, env, context) {
+		server.init({ env });
 		// skip cache if "cache-control: no-cache" in request
 		let pragma = req.headers.get('cache-control') || '';
 		let res = !pragma.includes('no-cache') && (await Cache.lookup(req));
diff --git a/packages/adapter-netlify/src/serverless.js b/packages/adapter-netlify/src/serverless.js
index 8c4bcff5d945..aec29eef562a 100644
--- a/packages/adapter-netlify/src/serverless.js
+++ b/packages/adapter-netlify/src/serverless.js
@@ -9,6 +9,10 @@ import { split_headers } from './headers';
 export function init(manifest) {
 	const server = new Server(manifest);
 
+	server.init({
+		env: process.env
+	});
+
 	return async (event, context) => {
 		const response = await server.respond(to_request(event), {
 			platform: { context },
diff --git a/packages/adapter-node/src/handler.js b/packages/adapter-node/src/handler.js
index 4e3cfe1eeef3..e5e67bfa3af9 100644
--- a/packages/adapter-node/src/handler.js
+++ b/packages/adapter-node/src/handler.js
@@ -11,6 +11,7 @@ import { env } from './env.js';
 /* global ENV_PREFIX */
 
 const server = new Server(manifest);
+server.init({ env: process.env });
 const origin = env('ORIGIN', undefined);
 const xff_depth = parseInt(env('XFF_DEPTH', '1'));
 
diff --git a/packages/adapter-vercel/files/serverless.js b/packages/adapter-vercel/files/serverless.js
index 551b731f6f6f..639275b9b7a1 100644
--- a/packages/adapter-vercel/files/serverless.js
+++ b/packages/adapter-vercel/files/serverless.js
@@ -7,6 +7,10 @@ installPolyfills();
 
 const server = new Server(manifest);
 
+server.init({
+	env: process.env
+});
+
 /**
  * @param {import('http').IncomingMessage} req
  * @param {import('http').ServerResponse} res
diff --git a/packages/create-svelte/templates/default/src/app.d.ts b/packages/create-svelte/templates/default/src/app.d.ts
index 9ca010a6dc91..c9d56c4cab5c 100644
--- a/packages/create-svelte/templates/default/src/app.d.ts
+++ b/packages/create-svelte/templates/default/src/app.d.ts
@@ -10,6 +10,10 @@ declare namespace App {
 
 	// interface Platform {}
 
+	// interface PrivateEnv {}
+
+	// interface PublicEnv {}
+
 	// interface Session {}
 
 	// interface Stuff {}
diff --git a/packages/create-svelte/templates/skeleton/src/app.d.ts b/packages/create-svelte/templates/skeleton/src/app.d.ts
index b28d8405630d..ff717de9551f 100644
--- a/packages/create-svelte/templates/skeleton/src/app.d.ts
+++ b/packages/create-svelte/templates/skeleton/src/app.d.ts
@@ -6,6 +6,8 @@
 declare namespace App {
 	// interface Locals {}
 	// interface Platform {}
+	// interface PrivateEnv {}
+	// interface PublicEnv {}
 	// interface Session {}
 	// interface Stuff {}
 }
diff --git a/packages/kit/rollup.config.js b/packages/kit/rollup.config.js
index 1abcaa774219..884eba331230 100644
--- a/packages/kit/rollup.config.js
+++ b/packages/kit/rollup.config.js
@@ -23,6 +23,10 @@ export default [
 			'app/stores': 'src/runtime/app/stores.js',
 			'app/paths': 'src/runtime/app/paths.js',
 			'app/env': 'src/runtime/app/env.js',
+			'env/dynamic/private': 'src/runtime/env/dynamic/private.js',
+			'env/dynamic/public': 'src/runtime/env/dynamic/public.js',
+			'env-private': 'src/runtime/env-private.js',
+			'env-public': 'src/runtime/env-public.js',
 			paths: 'src/runtime/paths.js',
 			env: 'src/runtime/env.js'
 		},
diff --git a/packages/kit/scripts/extract-types.js b/packages/kit/scripts/extract-types.js
index 67e273e977e8..b3b8b17f2909 100644
--- a/packages/kit/scripts/extract-types.js
+++ b/packages/kit/scripts/extract-types.js
@@ -2,10 +2,11 @@ import fs from 'fs';
 import ts from 'typescript';
 import prettier from 'prettier';
 import { mkdirp } from '../src/utils/filesystem.js';
+import { fileURLToPath } from 'url';
 
 /** @typedef {{ name: string, comment: string, snippet: string }} Extracted */
 
-/** @type {Array<{ name: string, comment: string, exports: Extracted[], types: Extracted[] }>} */
+/** @type {Array<{ name: string, comment: string, exports: Extracted[], types: Extracted[], exempt?: boolean }>} */
 const modules = [];
 
 /**
@@ -19,59 +20,72 @@ function get_types(code, statements) {
 	/** @type {Extracted[]} */
 	const types = [];
 
-	for (const statement of statements) {
-		if (
-			ts.isClassDeclaration(statement) ||
-			ts.isInterfaceDeclaration(statement) ||
-			ts.isTypeAliasDeclaration(statement) ||
-			ts.isModuleDeclaration(statement) ||
-			ts.isVariableStatement(statement) ||
-			ts.isFunctionDeclaration(statement)
-		) {
-			const name_node = ts.isVariableStatement(statement)
-				? statement.declarationList.declarations[0]
-				: statement;
-
-			// @ts-ignore no idea why it's complaining here
-			const name = name_node.name?.escapedText;
-
-			let start = statement.pos;
-			let comment = '';
-
-			// @ts-ignore i think typescript is bad at typescript
-			if (statement.jsDoc) {
-				// @ts-ignore
-				comment = statement.jsDoc[0].comment;
-				// @ts-ignore
-				start = statement.jsDoc[0].end;
+	if (statements) {
+		for (const statement of statements) {
+			if (
+				ts.isClassDeclaration(statement) ||
+				ts.isInterfaceDeclaration(statement) ||
+				ts.isTypeAliasDeclaration(statement) ||
+				ts.isModuleDeclaration(statement) ||
+				ts.isVariableStatement(statement) ||
+				ts.isFunctionDeclaration(statement)
+			) {
+				const name_node = ts.isVariableStatement(statement)
+					? statement.declarationList.declarations[0]
+					: statement;
+
+				// @ts-ignore no idea why it's complaining here
+				const name = name_node.name?.escapedText;
+
+				let start = statement.pos;
+				let comment = '';
+
+				// @ts-ignore i think typescript is bad at typescript
+				if (statement.jsDoc) {
+					// @ts-ignore
+					comment = statement.jsDoc[0].comment;
+					// @ts-ignore
+					start = statement.jsDoc[0].end;
+				}
+
+				const i = code.indexOf('export', start);
+				start = i + 6;
+
+				const snippet = prettier.format(code.slice(start, statement.end).trim(), {
+					parser: 'typescript',
+					printWidth: 80,
+					useTabs: true,
+					singleQuote: true,
+					trailingComma: 'none'
+				});
+
+				const collection =
+					ts.isVariableStatement(statement) || ts.isFunctionDeclaration(statement)
+						? exports
+						: types;
+
+				collection.push({ name, comment, snippet });
 			}
-
-			const i = code.indexOf('export', start);
-			start = i + 6;
-
-			const snippet = prettier.format(code.slice(start, statement.end).trim(), {
-				parser: 'typescript',
-				printWidth: 80,
-				useTabs: true,
-				singleQuote: true,
-				trailingComma: 'none'
-			});
-
-			const collection =
-				ts.isVariableStatement(statement) || ts.isFunctionDeclaration(statement) ? exports : types;
-
-			collection.push({ name, comment, snippet });
-		} else {
-			// console.log(statement.kind);
 		}
-	}
 
-	types.sort((a, b) => (a.name < b.name ? -1 : 1));
-	exports.sort((a, b) => (a.name < b.name ? -1 : 1));
+		types.sort((a, b) => (a.name < b.name ? -1 : 1));
+		exports.sort((a, b) => (a.name < b.name ? -1 : 1));
+	}
 
 	return { types, exports };
 }
 
+/**
+ * Type declarations include fully qualified URLs so that they become links when
+ * you hover over names in an editor with TypeScript enabled. We need to remove
+ * the origin so that they become root-relative, so that they work in preview
+ * deployments and when developing locally
+ * @param {string} str
+ */
+function strip_origin(str) {
+	return str.replace(/https:\/\/kit\.svelte\.dev/g, '');
+}
+
 {
 	const code = fs.readFileSync('types/index.d.ts', 'utf-8');
 	const node = ts.createSourceFile('index.d.ts', code, ts.ScriptTarget.Latest);
@@ -95,13 +109,20 @@ function get_types(code, statements) {
 	});
 }
 
-modules.push({
-	name: '$lib',
-	comment:
-		'This is a simple alias to `src/lib`, or whatever directory is specified as [`config.kit.files.lib`](/docs/configuration#files). It allows you to access common components and utility modules without `../../../../` nonsense.',
-	exports: [],
-	types: []
-});
+const dir = fileURLToPath(new URL('./special-types', import.meta.url).href);
+for (const file of fs.readdirSync(dir)) {
+	if (!file.endsWith('.md')) continue;
+
+	const comment = strip_origin(fs.readFileSync(`${dir}/${file}`, 'utf-8'));
+
+	modules.push({
+		name: file.replace(/\+/g, '/').slice(0, -3),
+		comment,
+		exports: [],
+		types: [],
+		exempt: true
+	});
+}
 
 {
 	const code = fs.readFileSync('types/ambient.d.ts', 'utf-8');
@@ -113,13 +134,13 @@ modules.push({
 			const name = statement.name.text || statement.name.escapedText;
 
 			// @ts-ignore
-			const comment = statement.jsDoc?.[0].comment ?? '';
+			const comment = strip_origin(statement.jsDoc?.[0].comment ?? '');
 
 			modules.push({
 				name,
 				comment,
 				// @ts-ignore
-				...get_types(code, statement.body.statements)
+				...get_types(code, statement.body?.statements)
 			});
 		}
 	}
diff --git a/packages/kit/scripts/special-types/$env+static+private.md b/packages/kit/scripts/special-types/$env+static+private.md
new file mode 100644
index 000000000000..79fdc20b808a
--- /dev/null
+++ b/packages/kit/scripts/special-types/$env+static+private.md
@@ -0,0 +1,7 @@
+Environment variables [loaded by Vite](https://vitejs.dev/guide/env-and-mode.html#env-files) from `.env` files and `process.env`. Like [`$env/dynamic/private`](https://kit.svelte.dev/docs/modules#$env-dynamic-platform), this module cannot be imported into client-side code.
+
+_Unlike_ [`$env/dynamic/private`](https://kit.svelte.dev/docs/modules#$env-dynamic-platform), the values exported from this module are statically injected into your bundle at build time, enabling optimisations like dead code elimination.
+
+```ts
+import { API_KEY } from '$env/static/private';
+```
diff --git a/packages/kit/scripts/special-types/$env+static+public.md b/packages/kit/scripts/special-types/$env+static+public.md
new file mode 100644
index 000000000000..60fc224fa6d4
--- /dev/null
+++ b/packages/kit/scripts/special-types/$env+static+public.md
@@ -0,0 +1,7 @@
+Similar to [`$env/static/private`](https://kit.svelte.dev/docs/modules#$env-static-private), except that it only includes environment variables that begin with [`config.kit.env.publicPrefix`](https://kit.svelte.dev/docs/configuration#kit-env-publicprefix) (which defaults to `PUBLIC_`), and can therefore safely be exposed to client-side code.
+
+Values are replaced statically at build time.
+
+```ts
+import { PUBLIC_BASE_URL } from '$env/static/public';
+```
diff --git a/packages/kit/scripts/special-types/$lib.md b/packages/kit/scripts/special-types/$lib.md
new file mode 100644
index 000000000000..7365c4e6f96d
--- /dev/null
+++ b/packages/kit/scripts/special-types/$lib.md
@@ -0,0 +1 @@
+This is a simple alias to `src/lib`, or whatever directory is specified as [`config.kit.files.lib`](https://kit.svelte.dev/docs/configuration#files). It allows you to access common components and utility modules without `../../../../` nonsense.
diff --git a/packages/kit/src/cli.js b/packages/kit/src/cli.js
index 3f1a28f3764e..7168b2a67d67 100755
--- a/packages/kit/src/cli.js
+++ b/packages/kit/src/cli.js
@@ -38,7 +38,8 @@ prog
 prog
 	.command('sync')
 	.describe('Synchronise generated files')
-	.action(async () => {
+	.option('--mode', 'Specify a mode for loading environment variables', 'development')
+	.action(async ({ mode }) => {
 		if (!fs.existsSync('svelte.config.js')) {
 			console.warn('Missing svelte.config.js — skipping');
 			return;
@@ -47,7 +48,7 @@ prog
 		try {
 			const config = await load_config();
 			const sync = await import('./core/sync/sync.js');
-			sync.all(config);
+			sync.all(config, mode);
 		} catch (error) {
 			handle_error(error);
 		}
diff --git a/packages/kit/src/core/config/index.spec.js b/packages/kit/src/core/config/index.spec.js
index ad9973ec12dd..1467c74bb779 100644
--- a/packages/kit/src/core/config/index.spec.js
+++ b/packages/kit/src/core/config/index.spec.js
@@ -73,6 +73,9 @@ const get_defaults = (prefix = '') => ({
 			reportOnly: directive_defaults
 		},
 		endpointExtensions: undefined,
+		env: {
+			publicPrefix: 'PUBLIC_'
+		},
 		files: {
 			assets: join(prefix, 'static'),
 			hooks: join(prefix, 'src/hooks'),
diff --git a/packages/kit/src/core/config/options.js b/packages/kit/src/core/config/options.js
index 04cda79b7163..c83d3e9b009c 100644
--- a/packages/kit/src/core/config/options.js
+++ b/packages/kit/src/core/config/options.js
@@ -123,6 +123,10 @@ const options = object(
 				(keypath) => `${keypath} has been renamed to config.kit.moduleExtensions`
 			),
 
+			env: object({
+				publicPrefix: string('PUBLIC_')
+			}),
+
 			files: object({
 				assets: string('static'),
 				hooks: string(join('src', 'hooks')),
diff --git a/packages/kit/src/core/sync/sync.js b/packages/kit/src/core/sync/sync.js
index b88af92c7a0b..5493d477ceb1 100644
--- a/packages/kit/src/core/sync/sync.js
+++ b/packages/kit/src/core/sync/sync.js
@@ -6,14 +6,24 @@ import { write_matchers } from './write_matchers.js';
 import { write_root } from './write_root.js';
 import { write_tsconfig } from './write_tsconfig.js';
 import { write_types } from './write_types.js';
+import { write_env } from './write_env.js';
 
-/** @param {import('types').ValidatedConfig} config */
-export function init(config) {
+/**
+ * Initialize SvelteKit's generated files.
+ * @param {import('types').ValidatedConfig} config
+ * @param {string} mode
+ */
+export function init(config, mode) {
 	copy_assets(path.join(config.kit.outDir, 'runtime'));
+
 	write_tsconfig(config.kit);
+	write_env(config.kit, mode);
 }
 
-/** @param {import('types').ValidatedConfig} config */
+/**
+ * Update SvelteKit's generated files.
+ * @param {import('types').ValidatedConfig} config
+ */
 export function update(config) {
 	const manifest_data = create_manifest_data({ config });
 
@@ -28,8 +38,12 @@ export function update(config) {
 	return { manifest_data };
 }
 
-/** @param {import('types').ValidatedConfig} config */
-export function all(config) {
-	init(config);
+/**
+ * Run sync.init and sync.update in series, returning the result from sync.update.
+ * @param {import('types').ValidatedConfig} config
+ * @param {string} mode The Vite mode
+ */
+export function all(config, mode) {
+	init(config, mode);
 	return update(config);
 }
diff --git a/packages/kit/src/core/sync/utils.js b/packages/kit/src/core/sync/utils.js
index be1862cd1927..d8cce64dec8c 100644
--- a/packages/kit/src/core/sync/utils.js
+++ b/packages/kit/src/core/sync/utils.js
@@ -31,3 +31,56 @@ export function trim(str) {
 	const pattern = new RegExp(`^${indentation}`, 'gm');
 	return str.replace(pattern, '').trim();
 }
+
+export const reserved = new Set([
+	'do',
+	'if',
+	'in',
+	'for',
+	'let',
+	'new',
+	'try',
+	'var',
+	'case',
+	'else',
+	'enum',
+	'eval',
+	'null',
+	'this',
+	'true',
+	'void',
+	'with',
+	'await',
+	'break',
+	'catch',
+	'class',
+	'const',
+	'false',
+	'super',
+	'throw',
+	'while',
+	'yield',
+	'delete',
+	'export',
+	'import',
+	'public',
+	'return',
+	'static',
+	'switch',
+	'typeof',
+	'default',
+	'extends',
+	'finally',
+	'package',
+	'private',
+	'continue',
+	'debugger',
+	'function',
+	'arguments',
+	'interface',
+	'protected',
+	'implements',
+	'instanceof'
+]);
+
+export const valid_identifier = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
diff --git a/packages/kit/src/core/sync/write_env.js b/packages/kit/src/core/sync/write_env.js
new file mode 100644
index 000000000000..7ed0798832de
--- /dev/null
+++ b/packages/kit/src/core/sync/write_env.js
@@ -0,0 +1,84 @@
+import path from 'path';
+import colors from 'kleur';
+import { get_env } from '../../vite/utils.js';
+import { write_if_changed, reserved, valid_identifier } from './utils.js';
+
+const autogen_comment = '// this file is generated — do not edit it\n';
+
+/**
+ * Writes the existing environment variables in process.env to
+ * $env/static/private and $env/static/public
+ * @param {import('types').ValidatedKitConfig} config
+ * @param {string} mode The Vite mode
+ */
+export function write_env(config, mode) {
+	const env = get_env(mode, config.env.publicPrefix);
+
+	// TODO when testing src, `$app` points at `src/runtime/app`... will
+	// probably need to fiddle with aliases
+	write_if_changed(
+		path.join(config.outDir, 'runtime/env/static/public.js'),
+		create_module('$env/static/public', env.public)
+	);
+
+	write_if_changed(
+		path.join(config.outDir, 'runtime/env/static/private.js'),
+		create_module('$env/static/private', env.private)
+	);
+
+	write_if_changed(
+		path.join(config.outDir, 'ambient.d.ts'),
+		autogen_comment +
+			create_types('$env/static/public', env.public) +
+			'\n\n' +
+			create_types('$env/static/private', env.private)
+	);
+}
+
+/**
+ * @param {string} id
+ * @param {Record<string, string>} env
+ * @returns {string}
+ */
+function create_module(id, env) {
+	/** @type {string[]} */
+	const declarations = [];
+
+	for (const key in env) {
+		const warning = !valid_identifier.test(key)
+			? 'not a valid identifier'
+			: reserved.has(key)
+			? 'a reserved word'
+			: null;
+
+		if (warning) {
+			console.error(
+				colors
+					.bold()
+					.yellow(`Omitting environment variable "${key}" from ${id} as it is ${warning}`)
+			);
+			continue;
+		}
+
+		const comment = `/** @type {import('${id}'}').${key}} */`;
+		const declaration = `export const ${key} = ${JSON.stringify(env[key])};`;
+
+		declarations.push(`${comment}\n${declaration}`);
+	}
+
+	return autogen_comment + declarations.join('\n\n');
+}
+
+/**
+ * @param {string} id
+ * @param {Record<string, string>} env
+ * @returns {string}
+ */
+function create_types(id, env) {
+	const declarations = Object.keys(env)
+		.filter((k) => valid_identifier.test(k))
+		.map((k) => `\texport const ${k}: string;`)
+		.join('\n');
+
+	return `declare module '${id}' {\n${declarations}\n}`;
+}
diff --git a/packages/kit/src/core/sync/write_tsconfig.js b/packages/kit/src/core/sync/write_tsconfig.js
index 02bfa06a0c73..e93d60e4cd7e 100644
--- a/packages/kit/src/core/sync/write_tsconfig.js
+++ b/packages/kit/src/core/sync/write_tsconfig.js
@@ -24,18 +24,13 @@ export function write_tsconfig(config, cwd = process.cwd()) {
 	/** @param {string} file */
 	const config_relative = (file) => posixify(path.relative(config.outDir, file));
 
-	const dirs = new Set([
-		project_relative(path.dirname(config.files.routes)),
-		project_relative(path.dirname(config.files.lib))
-	]);
-
-	/** @type {string[]} */
-	const include = [];
-	dirs.forEach((dir) => {
-		include.push(config_relative(`${dir}/**/*.js`));
-		include.push(config_relative(`${dir}/**/*.ts`));
-		include.push(config_relative(`${dir}/**/*.svelte`));
-	});
+	const include = ['ambient.d.ts'];
+	for (const dir of [config.files.routes, config.files.lib]) {
+		const relative = project_relative(path.dirname(dir));
+		include.push(config_relative(`${relative}/**/*.js`));
+		include.push(config_relative(`${relative}/**/*.ts`));
+		include.push(config_relative(`${relative}/**/*.svelte`));
+	}
 
 	/** @type {Record<string, string[]>} */
 	const paths = {};
@@ -78,7 +73,7 @@ export function write_tsconfig(config, cwd = process.cwd()) {
 					target: 'esnext'
 				},
 				include,
-				exclude: [config_relative('node_modules/**'), './**']
+				exclude: [config_relative('node_modules/**'), './[!ambient.d.ts]**']
 			},
 			null,
 			'\t'
diff --git a/packages/kit/src/runtime/client/start.js b/packages/kit/src/runtime/client/start.js
index d63cf11c7016..fcba7c748bd6 100644
--- a/packages/kit/src/runtime/client/start.js
+++ b/packages/kit/src/runtime/client/start.js
@@ -2,6 +2,8 @@ import { create_client } from './client.js';
 import { init } from './singletons.js';
 import { set_paths } from '../paths.js';
 
+export { set_public_env } from '../env-public.js';
+
 /**
  * @param {{
  *   paths: {
diff --git a/packages/kit/src/runtime/env-private.js b/packages/kit/src/runtime/env-private.js
new file mode 100644
index 000000000000..9fdd71a7f3d2
--- /dev/null
+++ b/packages/kit/src/runtime/env-private.js
@@ -0,0 +1,7 @@
+/** @type {App.PrivateEnv} */
+export let env = {};
+
+/** @type {(environment: Record<string, string>) => void} */
+export function set_private_env(environment) {
+	env = environment;
+}
diff --git a/packages/kit/src/runtime/env-public.js b/packages/kit/src/runtime/env-public.js
new file mode 100644
index 000000000000..0b8c28cc6af4
--- /dev/null
+++ b/packages/kit/src/runtime/env-public.js
@@ -0,0 +1,7 @@
+/** @type {App.PublicEnv} */
+export let env = {};
+
+/** @type {(environment: Record<string, string>) => void} */
+export function set_public_env(environment) {
+	env = environment;
+}
diff --git a/packages/kit/src/runtime/env/dynamic/private.js b/packages/kit/src/runtime/env/dynamic/private.js
new file mode 100644
index 000000000000..971d61ed5667
--- /dev/null
+++ b/packages/kit/src/runtime/env/dynamic/private.js
@@ -0,0 +1 @@
+export { env } from '../../env-private.js';
diff --git a/packages/kit/src/runtime/env/dynamic/public.js b/packages/kit/src/runtime/env/dynamic/public.js
new file mode 100644
index 000000000000..34dc1950be3a
--- /dev/null
+++ b/packages/kit/src/runtime/env/dynamic/public.js
@@ -0,0 +1 @@
+export { env } from '../../env-public.js';
diff --git a/packages/kit/src/runtime/server/page/render.js b/packages/kit/src/runtime/server/page/render.js
index a03b342969c5..2d1d2e42566d 100644
--- a/packages/kit/src/runtime/server/page/render.js
+++ b/packages/kit/src/runtime/server/page/render.js
@@ -171,7 +171,10 @@ export async function render_response({
 
 	// prettier-ignore
 	const init_app = `
-		import { start } from ${s(options.prefix + entry.file)};
+		import { set_public_env, start } from ${s(options.prefix + entry.file)};
+
+		set_public_env(${s(options.public_env)});
+
 		start({
 			target: document.querySelector('[data-sveltekit-hydrate="${target}"]').parentNode,
 			paths: ${s(options.paths)},
diff --git a/packages/kit/src/vite/build/build_server.js b/packages/kit/src/vite/build/build_server.js
index 1b0e245b5872..ae8fc4e454bc 100644
--- a/packages/kit/src/vite/build/build_server.js
+++ b/packages/kit/src/vite/build/build_server.js
@@ -27,6 +27,8 @@ import root from '__GENERATED__/root.svelte';
 import { respond } from '${runtime}/server/index.js';
 import { set_paths, assets, base } from '${runtime}/paths.js';
 import { set_prerendering } from '${runtime}/env.js';
+import { set_private_env } from '${runtime}/env-private.js';
+import { set_public_env } from '${runtime}/env-public.js';
 
 const template = ({ head, body, assets, nonce }) => ${s(template)
 	.replace('%sveltekit.head%', '" + head + "')
@@ -78,6 +80,7 @@ export class Server {
 				default: ${config.kit.prerender.default},
 				enabled: ${config.kit.prerender.enabled}
 			},
+			public_env: {},
 			read,
 			root,
 			service_worker: ${has_service_worker ? "base + '/service-worker.js'" : 'null'},
@@ -88,6 +91,23 @@ export class Server {
 		};
 	}
 
+	init({ env }) {
+		const entries = Object.entries(env);
+
+		const prv = Object.fromEntries(Object.entries(env).filter(([k]) => !k.startsWith('${
+			config.kit.env.publicPrefix
+		}')));
+
+		const pub = Object.fromEntries(Object.entries(env).filter(([k]) => k.startsWith('${
+			config.kit.env.publicPrefix
+		}')));
+
+		set_private_env(prv);
+		set_public_env(pub);
+
+		this.options.public_env = pub;
+	}
+
 	async respond(request, options = {}) {
 		if (!(request instanceof Request)) {
 			throw new Error('The first argument to server.respond must be a Request object. See https://github.com/sveltejs/kit/pull/3384 for details');
diff --git a/packages/kit/src/vite/dev/index.js b/packages/kit/src/vite/dev/index.js
index 8d5cd48adfd8..0b967136efe1 100644
--- a/packages/kit/src/vite/dev/index.js
+++ b/packages/kit/src/vite/dev/index.js
@@ -12,7 +12,7 @@ import { load_template } from '../../core/config/index.js';
 import { SVELTE_KIT_ASSETS } from '../../core/constants.js';
 import * as sync from '../../core/sync/sync.js';
 import { get_mime_lookup, get_runtime_prefix } from '../../core/utils.js';
-import { resolve_entry } from '../utils.js';
+import { get_env, prevent_illegal_vite_imports, resolve_entry } from '../utils.js';
 
 // Vite doesn't expose this so we just copy the list for now
 // https://github.com/vitejs/vite/blob/3edd1af56e980aef56641a5a51cf2932bb580d41/packages/vite/src/node/plugins/css.ts#L96
@@ -24,12 +24,13 @@ const cwd = process.cwd();
  * @param {import('vite').ViteDevServer} vite
  * @param {import('vite').ResolvedConfig} vite_config
  * @param {import('types').ValidatedConfig} svelte_config
+ * @param {Set<string>} illegal_imports
  * @return {Promise<Promise<() => void>>}
  */
-export async function dev(vite, vite_config, svelte_config) {
+export async function dev(vite, vite_config, svelte_config, illegal_imports) {
 	installPolyfills();
 
-	sync.init(svelte_config);
+	sync.init(svelte_config, vite_config.mode);
 
 	const runtime = get_runtime_prefix(svelte_config.kit);
 
@@ -60,6 +61,11 @@ export async function dev(vite, vite_config, svelte_config) {
 							await vite.ssrLoadModule(url)
 						);
 
+						const node = await vite.moduleGraph.getModuleByUrl(url);
+						if (!node) throw new Error(`Could not find node for ${url}`);
+
+						prevent_illegal_vite_imports(node, illegal_imports, svelte_config.kit.outDir);
+
 						return {
 							module,
 							index,
@@ -68,10 +74,6 @@ export async function dev(vite, vite_config, svelte_config) {
 							stylesheets: [],
 							// in dev we inline all styles to avoid FOUC
 							inline_styles: async () => {
-								const node = await vite.moduleGraph.getModuleByUrl(url);
-
-								if (!node) throw new Error(`Could not find node for ${url}`);
-
 								const deps = new Set();
 								await find_deps(vite, node, deps);
 
@@ -248,6 +250,17 @@ export async function dev(vite, vite_config, svelte_config) {
 					? await vite.ssrLoadModule(`/${svelte_config.kit.files.hooks}`)
 					: {};
 
+				const runtime_base = process.env.BUNDLED
+					? `/${posixify(path.relative(cwd, `${svelte_config.kit.outDir}/runtime`))}`
+					: `/@fs${runtime}`;
+
+				const { set_private_env } = await vite.ssrLoadModule(`${runtime_base}/env-private.js`);
+				const { set_public_env } = await vite.ssrLoadModule(`${runtime_base}/env-public.js`);
+
+				const env = get_env(vite_config.mode, svelte_config.kit.env.publicPrefix);
+				set_private_env(env.private);
+				set_public_env(env.public);
+
 				const handle = user_hooks.handle || (({ event, resolve }) => resolve(event));
 
 				/** @type {import('types').Hooks} */
@@ -288,11 +301,7 @@ export async function dev(vite, vite_config, svelte_config) {
 					`/${posixify(path.relative(cwd, `${svelte_config.kit.outDir}/generated/root.svelte`))}`
 				);
 
-				const paths = await vite.ssrLoadModule(
-					process.env.BUNDLED
-						? `/${posixify(path.relative(cwd, `${svelte_config.kit.outDir}/runtime/paths.js`))}`
-						: `/@fs${runtime}/paths.js`
-				);
+				const paths = await vite.ssrLoadModule(`${runtime_base}/paths.js`);
 
 				paths.set_paths({
 					base: svelte_config.kit.paths.base,
@@ -351,6 +360,7 @@ export async function dev(vite, vite_config, svelte_config) {
 							default: svelte_config.kit.prerender.default,
 							enabled: svelte_config.kit.prerender.enabled
 						},
+						public_env: env.public,
 						read: (file) => fs.readFileSync(path.join(svelte_config.kit.files.assets, file)),
 						root,
 						router: svelte_config.kit.browser.router,
diff --git a/packages/kit/src/vite/index.js b/packages/kit/src/vite/index.js
index 4d9bd942e742..d01b45b40835 100644
--- a/packages/kit/src/vite/index.js
+++ b/packages/kit/src/vite/index.js
@@ -1,5 +1,5 @@
 import { fork } from 'node:child_process';
-import fs, { existsSync } from 'node:fs';
+import fs from 'node:fs';
 import path from 'node:path';
 import colors from 'kleur';
 import { svelte } from '@sveltejs/vite-plugin-svelte';
@@ -14,7 +14,7 @@ import { generate_manifest } from '../core/generate_manifest/index.js';
 import { get_runtime_directory, logger } from '../core/utils.js';
 import { find_deps, get_default_config as get_default_build_config } from './build/utils.js';
 import { preview } from './preview/index.js';
-import { get_aliases, resolve_entry } from './utils.js';
+import { get_aliases, resolve_entry, prevent_illegal_rollup_imports } from './utils.js';
 import { fileURLToPath } from 'node:url';
 
 const cwd = process.cwd();
@@ -101,6 +101,9 @@ function kit() {
 	/** @type {import('types').BuildData} */
 	let build_data;
 
+	/** @type {Set<string>} */
+	let illegal_imports;
+
 	/** @type {string | undefined} */
 	let deferred_warning;
 
@@ -187,8 +190,13 @@ function kit() {
 				client_out_dir: `${svelte_config.kit.outDir}/output/client/`
 			};
 
+			illegal_imports = new Set([
+				`${svelte_config.kit.outDir}/runtime/env/dynamic/private.js`,
+				`${svelte_config.kit.outDir}/runtime/env/static/private.js`
+			]);
+
 			if (is_build) {
-				manifest_data = sync.all(svelte_config).manifest_data;
+				manifest_data = sync.all(svelte_config, config_env.mode).manifest_data;
 
 				const new_config = vite_client_build_config();
 
@@ -274,8 +282,24 @@ function kit() {
 		 * then use this hook to kick off builds for the server and service worker.
 		 */
 		async writeBundle(_options, bundle) {
+			for (const file of manifest_data.components) {
+				const id = path.resolve(file);
+				const node = this.getModuleInfo(id);
+
+				if (node) {
+					prevent_illegal_rollup_imports(
+						this.getModuleInfo.bind(this),
+						node,
+						illegal_imports,
+						svelte_config.kit.outDir
+					);
+				}
+			}
+
 			const verbose = vite_config.logLevel === 'info';
-			log = logger({ verbose });
+			log = logger({
+				verbose
+			});
 
 			fs.writeFileSync(
 				`${paths.client_out_dir}/${svelte_config.kit.appDir}/version.json`,
@@ -405,7 +429,7 @@ function kit() {
 				if (deferred_warning) console.error('\n' + deferred_warning);
 			};
 
-			return await dev(vite, vite_config, svelte_config);
+			return await dev(vite, vite_config, svelte_config, illegal_imports);
 		},
 
 		/**
@@ -413,7 +437,7 @@ function kit() {
 		 * @see https://vitejs.dev/guide/api-plugin.html#configurepreviewserver
 		 */
 		configurePreviewServer(vite) {
-			return preview(vite, svelte_config, vite_config.preview.https ? 'https' : 'http');
+			return preview(vite, vite_config, svelte_config);
 		}
 	};
 }
diff --git a/packages/kit/src/vite/preview/index.js b/packages/kit/src/vite/preview/index.js
index 262eb48c9c24..c52ee6615568 100644
--- a/packages/kit/src/vite/preview/index.js
+++ b/packages/kit/src/vite/preview/index.js
@@ -5,6 +5,7 @@ import { pathToFileURL } from 'url';
 import { getRequest, setResponse } from '../../node/index.js';
 import { installPolyfills } from '../../node/polyfills.js';
 import { SVELTE_KIT_ASSETS } from '../../core/constants.js';
+import { loadEnv } from 'vite';
 
 /** @typedef {import('http').IncomingMessage} Req */
 /** @typedef {import('http').ServerResponse} Res */
@@ -15,20 +16,22 @@ import { SVELTE_KIT_ASSETS } from '../../core/constants.js';
  *   middlewares: import('connect').Server;
  *   httpServer: import('http').Server;
  * }} vite
- * @param {import('types').ValidatedConfig} config
- * @param {'http' | 'https'} protocol
+ * @param {import('vite').ResolvedConfig} vite_config
+ * @param {import('types').ValidatedConfig} svelte_config
  */
-export async function preview(vite, config, protocol) {
+export async function preview(vite, vite_config, svelte_config) {
 	installPolyfills();
 
-	const { paths } = config.kit;
+	const { paths } = svelte_config.kit;
 	const base = paths.base;
 	const assets = paths.assets ? SVELTE_KIT_ASSETS : paths.base;
 
+	const protocol = vite_config.preview.https ? 'https' : 'http';
+
 	const etag = `"${Date.now()}"`;
 
-	const index_file = join(config.kit.outDir, 'output/server/index.js');
-	const manifest_file = join(config.kit.outDir, 'output/server/manifest.js');
+	const index_file = join(svelte_config.kit.outDir, 'output/server/index.js');
+	const manifest_file = join(svelte_config.kit.outDir, 'output/server/manifest.js');
 
 	/** @type {import('types').ServerModule} */
 	const { Server, override } = await import(pathToFileURL(index_file).href);
@@ -38,20 +41,23 @@ export async function preview(vite, config, protocol) {
 		paths: { base, assets },
 		prerendering: false,
 		protocol,
-		read: (file) => fs.readFileSync(join(config.kit.files.assets, file))
+		read: (file) => fs.readFileSync(join(svelte_config.kit.files.assets, file))
 	});
 
 	const server = new Server(manifest);
+	server.init({
+		env: loadEnv(vite_config.mode, process.cwd(), '')
+	});
 
 	return () => {
 		// generated client assets and the contents of `static`
 		vite.middlewares.use(
 			scoped(
 				assets,
-				sirv(join(config.kit.outDir, 'output/client'), {
+				sirv(join(svelte_config.kit.outDir, 'output/client'), {
 					setHeaders: (res, pathname) => {
 						// only apply to immutable directory, not e.g. version.json
-						if (pathname.startsWith(`/${config.kit.appDir}/immutable`)) {
+						if (pathname.startsWith(`/${svelte_config.kit.appDir}/immutable`)) {
 							res.setHeader('cache-control', 'public,max-age=31536000,immutable');
 						}
 					}
@@ -73,7 +79,7 @@ export async function preview(vite, config, protocol) {
 
 		// prerendered dependencies
 		vite.middlewares.use(
-			scoped(base, mutable(join(config.kit.outDir, 'output/prerendered/dependencies')))
+			scoped(base, mutable(join(svelte_config.kit.outDir, 'output/prerendered/dependencies')))
 		);
 
 		// prerendered pages (we can't just use sirv because we need to
@@ -97,7 +103,7 @@ export async function preview(vite, config, protocol) {
 				// only treat this as a page if it doesn't include an extension
 				if (pathname === '/' || /\/[^./]+\/?$/.test(pathname)) {
 					const file = join(
-						config.kit.outDir,
+						svelte_config.kit.outDir,
 						'output/prerendered/pages' +
 							pathname +
 							(pathname.endsWith('/') ? 'index.html' : '.html')
diff --git a/packages/kit/src/vite/utils.js b/packages/kit/src/vite/utils.js
index d92024c960c7..721c9398cb90 100644
--- a/packages/kit/src/vite/utils.js
+++ b/packages/kit/src/vite/utils.js
@@ -1,6 +1,6 @@
 import fs from 'fs';
 import path from 'path';
-import { loadConfigFromFile } from 'vite';
+import { loadConfigFromFile, loadEnv } from 'vite';
 import { get_runtime_directory } from '../core/utils.js';
 
 /**
@@ -99,6 +99,7 @@ export function get_aliases(config) {
 	/** @type {Record<string, string>} */
 	const alias = {
 		__GENERATED__: path.posix.join(config.outDir, 'generated'),
+
 		$app: `${get_runtime_directory(config)}/app`,
 
 		// For now, we handle `$lib` specially here rather than make it a default value for
@@ -106,6 +107,13 @@ export function get_aliases(config) {
 		$lib: config.files.lib
 	};
 
+	if (!process.env.BUNDLED) {
+		alias['$env/static/public'] = path.posix.join(config.outDir, 'runtime/env/static/public.js');
+		alias['$env/static/private'] = path.posix.join(config.outDir, 'runtime/env/static/private.js');
+	}
+
+	alias['$env'] = `${get_runtime_directory(config)}/env`;
+
 	for (const [key, value] of Object.entries(config.alias)) {
 		alias[key] = path.resolve(value);
 	}
@@ -141,3 +149,133 @@ export function resolve_entry(entry) {
 
 	return null;
 }
+
+/**
+ * @param {string} str
+ * @param {number} times
+ */
+function repeat(str, times) {
+	return new Array(times + 1).join(str);
+}
+
+/**
+ * Create a formatted error for an illegal import.
+ * @param {Array<{name: string, dynamic: boolean}>} stack
+ * @param {string} out_dir The directory specified by config.kit.outDir
+ */
+function format_illegal_import_chain(stack, out_dir) {
+	const app = path.join(out_dir, 'runtime/env');
+
+	stack = stack.map((file) => {
+		if (file.name.startsWith(app)) return { ...file, name: file.name.replace(app, '$env') };
+		return { ...file, name: path.relative(process.cwd(), file.name) };
+	});
+
+	const pyramid = stack
+		.map(
+			(file, i) =>
+				`${repeat(' ', i * 2)}- ${file.name} ${
+					file.dynamic ? '(imported by parent dynamically)' : ''
+				}`
+		)
+		.join('\n');
+
+	return `Cannot import ${stack.at(-1)?.name} into client-side code:\n${pyramid}`;
+}
+
+/**
+ * Load environment variables from process.env and .env files
+ * @param {string} mode
+ * @param {string} prefix
+ */
+export function get_env(mode, prefix) {
+	const entries = Object.entries(loadEnv(mode, process.cwd(), ''));
+
+	return {
+		public: Object.fromEntries(entries.filter(([k]) => k.startsWith(prefix))),
+		private: Object.fromEntries(entries.filter(([k]) => !k.startsWith(prefix)))
+	};
+}
+
+/**
+ * @param {(id: string) => import('rollup').ModuleInfo | null} node_getter
+ * @param {import('rollup').ModuleInfo} node
+ * @param {Set<string>} illegal_imports
+ * @param {string} out_dir The directory specified by config.kit.outDir
+ */
+export function prevent_illegal_rollup_imports(node_getter, node, illegal_imports, out_dir) {
+	const chain = find_illegal_rollup_imports(node_getter, node, false, illegal_imports);
+	if (chain) throw new Error(format_illegal_import_chain(chain, out_dir));
+}
+
+/**
+ * @param {(id: string) => import('rollup').ModuleInfo | null} node_getter
+ * @param {import('rollup').ModuleInfo} node
+ * @param {boolean} dynamic
+ * @param {Set<string>} illegal_imports
+ * @param {Set<string>} seen
+ * @returns {Array<import('types').ImportNode> | undefined}
+ */
+const find_illegal_rollup_imports = (
+	node_getter,
+	node,
+	dynamic,
+	illegal_imports,
+	seen = new Set()
+) => {
+	if (seen.has(node.id)) return;
+	seen.add(node.id);
+
+	if (illegal_imports.has(node.id)) {
+		return [{ name: node.id, dynamic }];
+	}
+
+	for (const id of node.importedIds) {
+		const child = node_getter(id);
+		const chain =
+			child && find_illegal_rollup_imports(node_getter, child, false, illegal_imports, seen);
+		if (chain) return [{ name: node.id, dynamic }, ...chain];
+	}
+
+	for (const id of node.dynamicallyImportedIds) {
+		const child = node_getter(id);
+		const chain =
+			child && find_illegal_rollup_imports(node_getter, child, true, illegal_imports, seen);
+		if (chain) return [{ name: node.id, dynamic }, ...chain];
+	}
+};
+
+/**
+ * Throw an error if a private module is imported from a client-side node.
+ * @param {import('vite').ModuleNode} node
+ * @param {Set<string>} illegal_imports
+ * @param {string} out_dir The directory specified by config.kit.outDir
+ */
+export function prevent_illegal_vite_imports(node, illegal_imports, out_dir) {
+	const chain = find_illegal_vite_imports(node, illegal_imports);
+	if (chain) throw new Error(format_illegal_import_chain(chain, out_dir));
+}
+
+/**
+ * @param {import('vite').ModuleNode} node
+ * @param {Set<string>} illegal_imports
+ * @param {Set<string>} seen
+ * @returns {Array<import('types').ImportNode> | null}
+ */
+function find_illegal_vite_imports(node, illegal_imports, seen = new Set()) {
+	if (!node.id) return null; // TODO when does this happen?
+
+	if (seen.has(node.id)) return null;
+	seen.add(node.id);
+
+	if (node.id && illegal_imports.has(node.id)) {
+		return [{ name: node.id, dynamic: false }];
+	}
+
+	for (const child of node.importedModules) {
+		const chain = child && find_illegal_vite_imports(child, illegal_imports, seen);
+		if (chain) return [{ name: node.id, dynamic: false }, ...chain];
+	}
+
+	return null;
+}
diff --git a/packages/kit/src/vite/utils.spec.js b/packages/kit/src/vite/utils.spec.js
index 46146aa83b94..e0899957b3f3 100644
--- a/packages/kit/src/vite/utils.spec.js
+++ b/packages/kit/src/vite/utils.spec.js
@@ -1,6 +1,12 @@
+import { rollup } from 'rollup';
 import { test } from 'uvu';
 import * as assert from 'uvu/assert';
-import { deep_merge, merge_vite_configs } from './utils.js';
+import {
+	deep_merge,
+	merge_vite_configs,
+	prevent_illegal_rollup_imports,
+	prevent_illegal_vite_imports
+} from './utils.js';
 
 test('basic test no conflicts', async () => {
 	const merged = deep_merge(
@@ -195,4 +201,150 @@ test('merge resolve.alias', () => {
 	});
 });
 
+/** @typedef {{id: string, importedIds: Array<string>, dynamicallyImportedIds: Array<string> }} RollupNode */
+
+/** @type {(id: string) => RollupNode | null} */
+const rollup_node_getter = (id) => {
+	/** @type {{[key: string]: RollupNode}} */
+	const nodes = {
+		'/test/path1.js': {
+			id: '/test/path1.js',
+			importedIds: ['/test/path2.js', '/test/path3.js'],
+			dynamicallyImportedIds: ['/test/path4.js', '/test/path5.js']
+		},
+		'/test/path2.js': {
+			id: '/test/path2.js',
+			importedIds: ['/test/path3.js'],
+			dynamicallyImportedIds: ['/test/path5.js']
+		},
+		'/test/path3.js': {
+			id: '/test/path3.js',
+			importedIds: ['/test/path5.js'],
+			dynamicallyImportedIds: ['/test/path1.js']
+		},
+		'/test/path4.js': {
+			id: '/test/path4.js',
+			importedIds: ['/test/path5.js'],
+			dynamicallyImportedIds: ['/test/path3.js']
+		},
+		'/test/path5.js': {
+			id: '/test/path5.js',
+			importedIds: ['/test/path1.js'],
+			dynamicallyImportedIds: ['/test/path3.js']
+		},
+		'/bad/static.js': {
+			id: '/bad/static.js',
+			importedIds: ['/statically-imports/bad/module.js'],
+			dynamicallyImportedIds: ['/test/path1.js']
+		},
+		'/statically-imports/bad/module.js': {
+			id: '/statically-imports/bad/module.js',
+			importedIds: ['/illegal/boom.js'],
+			dynamicallyImportedIds: ['/test/path2.js']
+		},
+		'/bad/dynamic.js': {
+			id: '/bad/dynamic.js',
+			importedIds: ['/dynamically-imports/bad/module.js'],
+			dynamicallyImportedIds: ['/test/path1.js']
+		},
+		'/dynamically-imports/bad/module.js': {
+			id: '/dynamically-imports/bad/module.js',
+			importedIds: ['/test/path5.js'],
+			dynamicallyImportedIds: ['/test/path2.js', '/illegal/boom.js']
+		},
+		'/illegal/boom.js': {
+			id: '/illegal/boom.js',
+			importedIds: [],
+			dynamicallyImportedIds: []
+		}
+	};
+	return nodes[id] ?? null;
+};
+
+const illegal_imports = new Set(['/illegal/boom.js']);
+const ok_rollup_node = rollup_node_getter('/test/path1.js');
+const bad_rollup_node_static = rollup_node_getter('/bad/static.js');
+const bad_rollup_node_dynamic = rollup_node_getter('/bad/dynamic.js');
+
+test('allows ok rollup imports', () => {
+	assert.not.throws(() => {
+		// @ts-ignore
+		prevent_illegal_rollup_imports(rollup_node_getter, ok_rollup_node, illegal_imports, '');
+	});
+});
+
+test('does not allow bad static rollup imports', () => {
+	assert.throws(() => {
+		// @ts-ignore
+		prevent_illegal_rollup_imports(rollup_node_getter, bad_rollup_node_static, illegal_imports, '');
+	});
+});
+
+test('does not allow bad dynamic rollup imports', () => {
+	assert.throws(() => {
+		prevent_illegal_rollup_imports(
+			// @ts-ignore
+			rollup_node_getter,
+			bad_rollup_node_dynamic,
+			illegal_imports,
+			''
+		);
+	});
+});
+
+/** @typedef {{id: string, importedModules: Set<ViteNode>}} ViteNode */
+
+/** @type {ViteNode} */
+const ok_vite_node = {
+	id: '/test/ok.js',
+	importedModules: new Set([
+		{
+			id: '/test/path1.js',
+			importedModules: new Set([
+				{
+					id: '/test/path2.js',
+					importedModules: new Set()
+				}
+			])
+		},
+		{ id: '/test/path3.js', importedModules: new Set() }
+	])
+};
+
+/** @type {ViteNode} */
+const bad_vite_node = {
+	id: '/test/bad-static.js',
+	importedModules: new Set([
+		{
+			id: '/test/path1.js',
+			importedModules: new Set([
+				{
+					id: '/test/path2.js',
+					importedModules: new Set([
+						{
+							id: '/illegal/boom.js',
+							importedModules: new Set()
+						}
+					])
+				}
+			])
+		},
+		{ id: '/test/path3.js', importedModules: new Set() }
+	])
+};
+
+test('allows ok vite imports', () => {
+	assert.not.throws(() => {
+		// @ts-ignore
+		prevent_illegal_vite_imports(ok_vite_node, illegal_imports, '');
+	});
+});
+
+test('does not allow bad static rollup imports', () => {
+	assert.throws(() => {
+		// @ts-ignore
+		prevent_illegal_vite_imports(bad_vite_node, illegal_imports, '');
+	});
+});
+
 test.run();
diff --git a/packages/kit/test/apps/basics/.env b/packages/kit/test/apps/basics/.env
new file mode 100644
index 000000000000..1597af1243ec
--- /dev/null
+++ b/packages/kit/test/apps/basics/.env
@@ -0,0 +1,5 @@
+PRIVATE_STATIC="accessible to server-side code/replaced at build time"
+PRIVATE_DYNAMIC="accessible to server-side code/evaluated at run time"
+
+PUBLIC_STATIC="accessible anywhere/replaced at build time"
+PUBLIC_DYNAMIC="accessible anywhere/evaluated at run time"
diff --git a/packages/kit/test/apps/basics/.gitignore b/packages/kit/test/apps/basics/.gitignore
index 4959267f5bf4..fa2f5a579236 100644
--- a/packages/kit/test/apps/basics/.gitignore
+++ b/packages/kit/test/apps/basics/.gitignore
@@ -1 +1,2 @@
-/test/errors.json
\ No newline at end of file
+/test/errors.json
+!/.env
diff --git a/packages/kit/test/apps/basics/src/routes/env/index.js b/packages/kit/test/apps/basics/src/routes/env/index.js
new file mode 100644
index 000000000000..968b678a922d
--- /dev/null
+++ b/packages/kit/test/apps/basics/src/routes/env/index.js
@@ -0,0 +1,11 @@
+import { PRIVATE_STATIC } from '$env/static/private';
+import { env } from '$env/dynamic/private';
+
+export function GET() {
+	return {
+		body: {
+			PRIVATE_STATIC,
+			PRIVATE_DYNAMIC: env.PRIVATE_DYNAMIC
+		}
+	};
+}
diff --git a/packages/kit/test/apps/basics/src/routes/env/index.svelte b/packages/kit/test/apps/basics/src/routes/env/index.svelte
new file mode 100644
index 000000000000..4788b13e363f
--- /dev/null
+++ b/packages/kit/test/apps/basics/src/routes/env/index.svelte
@@ -0,0 +1,16 @@
+<script>
+	import { PUBLIC_STATIC } from '$env/static/public';
+	import { env } from '$env/dynamic/public';
+
+	/** @type {string} */
+	export let PRIVATE_STATIC;
+
+	/** @type {string} */
+	export let PRIVATE_DYNAMIC;
+</script>
+
+<p id="static-private">PRIVATE_STATIC: {PRIVATE_STATIC}</p>
+<p id="dynamic-private">PRIVATE_DYNAMIC: {PRIVATE_DYNAMIC}</p>
+
+<p id="static-public">PUBLIC_STATIC: {PUBLIC_STATIC}</p>
+<p id="dynamic-public">PUBLIC_DYNAMIC: {env.PUBLIC_DYNAMIC}</p>
diff --git a/packages/kit/test/apps/basics/test/test.js b/packages/kit/test/apps/basics/test/test.js
index 3820801f3e78..83a4c5b780b3 100644
--- a/packages/kit/test/apps/basics/test/test.js
+++ b/packages/kit/test/apps/basics/test/test.js
@@ -338,6 +338,26 @@ test.describe('Encoded paths', () => {
 	});
 });
 
+test.describe('Env', () => {
+	test('includes environment variables', async ({ page }) => {
+		await page.goto('/env');
+
+		expect(await page.textContent('#static-private')).toBe(
+			'PRIVATE_STATIC: accessible to server-side code/replaced at build time'
+		);
+		expect(await page.textContent('#dynamic-private')).toBe(
+			'PRIVATE_DYNAMIC: accessible to server-side code/evaluated at run time'
+		);
+
+		expect(await page.textContent('#static-public')).toBe(
+			'PUBLIC_STATIC: accessible anywhere/replaced at build time'
+		);
+		expect(await page.textContent('#dynamic-public')).toBe(
+			'PUBLIC_DYNAMIC: accessible anywhere/evaluated at run time'
+		);
+	});
+});
+
 test.describe('Errors', () => {
 	if (process.env.DEV) {
 		// TODO these probably shouldn't have the full render treatment,
diff --git a/packages/kit/types/ambient.d.ts b/packages/kit/types/ambient.d.ts
index 0662f091dacd..5035601d81c9 100644
--- a/packages/kit/types/ambient.d.ts
+++ b/packages/kit/types/ambient.d.ts
@@ -9,13 +9,17 @@
  *
  * 	interface Platform {}
  *
+ * 	interface PrivateEnv {}
+ *
+ * 	interface PublicEnv {}
+ *
  * 	interface Session {}
  *
  * 	interface Stuff {}
  * }
  * ```
  *
- * By populating these interfaces, you will gain type safety when using `event.locals`, `event.platform`, `session` and `stuff`.
+ * By populating these interfaces, you will gain type safety when using `env`, `event.locals`, `event.platform`, `session` and `stuff`.
  *
  * Note that since it's an ambient declaration file, you have to be careful when using `import` statements. Once you add an `import`
  * at the top level, the declaration file is no longer considered ambient and you lose access to these typings in other files.
@@ -43,22 +47,32 @@
  */
 declare namespace App {
 	/**
-	 * The interface that defines `event.locals`, which can be accessed in [hooks](/docs/hooks) (`handle`, `handleError` and `getSession`) and [endpoints](/docs/routing#endpoints).
+	 * The interface that defines `event.locals`, which can be accessed in [hooks](https://kit.svelte.dev/docs/hooks) (`handle`, `handleError` and `getSession`) and [endpoints](https://kit.svelte.dev/docs/routing#endpoints).
 	 */
 	export interface Locals {}
 
 	/**
-	 * If your adapter provides [platform-specific context](/docs/adapters#supported-environments-platform-specific-context) via `event.platform`, you can specify it here.
+	 * If your adapter provides [platform-specific context](https://kit.svelte.dev/docs/adapters#supported-environments-platform-specific-context) via `event.platform`, you can specify it here.
 	 */
 	export interface Platform {}
 
 	/**
-	 * The interface that defines `session`, both as an argument to [`load`](/docs/loading) functions and the value of the [session store](/docs/modules#$app-stores).
+	 * The interface that defines the dynamic environment variables exported from '$env/dynamic/private'.
+	 */
+	export interface PrivateEnv extends Record<string, string> {}
+
+	/**
+	 * The interface that defines the dynamic environment variables exported from '$env/dynamic/public'.
+	 */
+	export interface PublicEnv extends Record<string, string> {}
+
+	/**
+	 * The interface that defines `session`, both as an argument to [`load`](https://kit.svelte.dev/docs/loading) functions and the value of the [session store](https://kit.svelte.dev/docs/modules#$app-stores).
 	 */
 	export interface Session {}
 
 	/**
-	 * The interface that defines `stuff`, as input or output to [`load`](/docs/loading) or as the value of the `stuff` property of the [page store](/docs/modules#$app-stores).
+	 * The interface that defines `stuff`, as input or output to [`load`](https://kit.svelte.dev/docs/loading) or as the value of the `stuff` property of the [page store](https://kit.svelte.dev/docs/modules#$app-stores).
 	 */
 	export interface Stuff {}
 }
@@ -85,6 +99,38 @@ declare module '$app/env' {
 	export const prerendering: boolean;
 }
 
+/**
+ * This module provides access to runtime environment variables, as defined by the platform you're running on. For example
+ * if you're using [`adapter-node`](https://github.com/sveltejs/kit/tree/master/packages/adapter-node) (or running
+ * [`vite preview`](https://kit.svelte.dev/docs/cli)), this is equivalent to `process.env`.
+ *
+ * This module cannot be imported into client-side code.
+ *
+ * ```ts
+ * import { env } from '$env/dynamic/private';
+ * console.log(env.DEPLOYMENT_SPECIFIC_VARIABLE);
+ * ```
+ */
+declare module '$env/dynamic/private' {
+	export let env: App.PrivateEnv;
+}
+
+/**
+ * Similar to [`$env/dynamic/private`](https://kit.svelte.dev/docs/modules#$env-dynamic-private), but only includes
+ * variables that begin with [`config.kit.env.publicPrefix`](https://kit.svelte.dev/docs/configuration#kit-env-publicprefix)
+ * (which defaults to `PUBLIC_`), and can therefore safely be exposed to client-side code
+ *
+ * Note that public dynamic environment variables must all be sent from the server to the client, causing larger network requests — when possible, use `$env/static/public` instead.
+ *
+ * ```ts
+ * import { env } from '$env/dynamic/public';
+ * console.log(env.PUBLIC_DEPLOYMENT_SPECIFIC_VARIABLE);
+ * ```
+ */
+declare module '$env/dynamic/public' {
+	export let env: App.PublicEnv;
+}
+
 /**
  * ```ts
  * import {
@@ -167,11 +213,11 @@ declare module '$app/navigation' {
  */
 declare module '$app/paths' {
 	/**
-	 * A string that matches [`config.kit.paths.base`](/docs/configuration#paths). It must start, but not end with `/` (e.g. `/base-path`), unless it is the empty string.
+	 * A string that matches [`config.kit.paths.base`](https://kit.svelte.dev/docs/configuration#paths). It must start, but not end with `/` (e.g. `/base-path`), unless it is the empty string.
 	 */
 	export const base: `/${string}`;
 	/**
-	 * An absolute path that matches [`config.kit.paths.assets`](/docs/configuration#paths).
+	 * An absolute path that matches [`config.kit.paths.assets`](https://kit.svelte.dev/docs/configuration#paths).
 	 *
 	 * > If a value for `config.kit.paths.assets` is specified, it will be replaced with `'/_svelte_kit_assets'` during `vite dev` or `vite preview`, since the assets don't yet live at their eventual URL.
 	 */
@@ -213,12 +259,12 @@ declare module '$app/stores' {
 	 */
 	export const navigating: Readable<Navigation | null>;
 	/**
-	 * A writable store whose initial value is whatever was returned from [`getSession`](/docs/hooks#getsession).
+	 * A writable store whose initial value is whatever was returned from [`getSession`](https://kit.svelte.dev/docs/hooks#getsession).
 	 * It can be written to, but this will not cause changes to persist on the server — this is something you must implement yourself.
 	 */
 	export const session: Writable<App.Session>;
 	/**
-	 *  A readable store whose initial value is `false`. If [`version.pollInterval`](/docs/configuration#version) is a non-zero value, SvelteKit will poll for new versions of the app and update the store value to `true` when it detects one. `updated.check()` will force an immediate check, regardless of polling.
+	 *  A readable store whose initial value is `false`. If [`version.pollInterval`](https://kit.svelte.dev/docs/configuration#version) is a non-zero value, SvelteKit will poll for new versions of the app and update the store value to `true` when it detects one. `updated.check()` will force an immediate check, regardless of polling.
 	 */
 	export const updated: Readable<boolean> & { check: () => boolean };
 }
@@ -228,7 +274,7 @@ declare module '$app/stores' {
  * import { build, files, prerendered, version } from '$service-worker';
  * ```
  *
- * This module is only available to [service workers](/docs/service-workers).
+ * This module is only available to [service workers](https://kit.svelte.dev/docs/service-workers).
  */
 declare module '$service-worker' {
 	/**
@@ -236,7 +282,7 @@ declare module '$service-worker' {
 	 */
 	export const build: string[];
 	/**
-	 * An array of URL strings representing the files in your static directory, or whatever directory is specified by `config.kit.files.assets`. You can customize which files are included from `static` directory using [`config.kit.serviceWorker.files`](/docs/configuration)
+	 * An array of URL strings representing the files in your static directory, or whatever directory is specified by `config.kit.files.assets`. You can customize which files are included from `static` directory using [`config.kit.serviceWorker.files`](https://kit.svelte.dev/docs/configuration)
 	 */
 	export const files: string[];
 	/**
@@ -244,7 +290,7 @@ declare module '$service-worker' {
 	 */
 	export const prerendered: string[];
 	/**
-	 * See [`config.kit.version`](/docs/configuration#version). It's useful for generating unique cache names inside your service worker, so that a later deployment of your app can invalidate old caches.
+	 * See [`config.kit.version`](https://kit.svelte.dev/docs/configuration#version). It's useful for generating unique cache names inside your service worker, so that a later deployment of your app can invalidate old caches.
 	 */
 	export const version: string;
 }
diff --git a/packages/kit/types/index.d.ts b/packages/kit/types/index.d.ts
index dbf012c41eb3..02f2d277799c 100644
--- a/packages/kit/types/index.d.ts
+++ b/packages/kit/types/index.d.ts
@@ -102,6 +102,9 @@ export interface KitConfig {
 		directives?: CspDirectives;
 		reportOnly?: CspDirectives;
 	};
+	env?: {
+		publicPrefix: string;
+	};
 	moduleExtensions?: string[];
 	files?: {
 		assets?: string;
@@ -268,9 +271,14 @@ export type ResponseBody = JSONValue | Uint8Array | ReadableStream | Error;
 
 export class Server {
 	constructor(manifest: SSRManifest);
+	init(options: ServerInitOptions): void;
 	respond(request: Request, options: RequestOptions): Promise<Response>;
 }
 
+export interface ServerInitOptions {
+	env: Record<string, string>;
+}
+
 export interface SSRManifest {
 	appDir: string;
 	assets: Set<string>;
diff --git a/packages/kit/types/internal.d.ts b/packages/kit/types/internal.d.ts
index f7a88de58f37..3e05cf415983 100644
--- a/packages/kit/types/internal.d.ts
+++ b/packages/kit/types/internal.d.ts
@@ -11,6 +11,7 @@ import {
 	RequestHandler,
 	ResolveOptions,
 	Server,
+	ServerInitOptions,
 	SSRManifest
 } from './index.js';
 import {
@@ -91,7 +92,13 @@ export interface Hooks {
 	handleError: HandleError;
 }
 
+export interface ImportNode {
+	name: string;
+	dynamic: boolean;
+}
+
 export class InternalServer extends Server {
+	init(options: ServerInitOptions): void;
 	respond(
 		request: Request,
 		options: RequestOptions & {
@@ -249,6 +256,7 @@ export interface SSROptions {
 		default: boolean;
 		enabled: boolean;
 	};
+	public_env: Record<string, string>;
 	read(file: string): Buffer;
 	root: SSRComponent['default'];
 	router: boolean;
diff --git a/sites/kit.svelte.dev/src/lib/docs/server/modules.js b/sites/kit.svelte.dev/src/lib/docs/server/modules.js
index 219074992c75..97b8576db5a8 100644
--- a/sites/kit.svelte.dev/src/lib/docs/server/modules.js
+++ b/sites/kit.svelte.dev/src/lib/docs/server/modules.js
@@ -4,9 +4,9 @@ import { modules } from '../../../../../../packages/kit/docs/types.js';
 export function render_modules(kind) {
 	return modules
 		.map((module) => {
-			// special case — we want to include $lib in the modules page
-			const is_lib_exports = kind === 'exports' && module.name === '$lib';
-			const skip = module[kind].length === 0 && !is_lib_exports;
+			// special case — we want to include $lib etc in the modules page
+			const is_exempt = kind === 'exports' && module.exempt;
+			const skip = module[kind].length === 0 && !is_exempt;
 
 			if (skip) return '';
 
diff --git a/turbo.json b/turbo.json
index 7e3c4be01eaf..16e829cd6f5d 100644
--- a/turbo.json
+++ b/turbo.json
@@ -3,14 +3,14 @@
 	"pipeline": {
 		"@sveltejs/kit#build": {
 			"dependsOn": ["^build"],
-			"inputs": ["src/**", "scripts/**", "types/**"],
+			"inputs": ["rollup.config.js", "src/**", "scripts/**", "types/**"],
 			"outputs": ["dist/**", "docs/**", "assets/**"],
 			"outputMode": "new-only"
 		},
 		"kit.svelte.dev#build": {
 			"dependsOn": ["^build", "$VERCEL", "$ENABLE_VC_BUILD"],
 			"inputs": ["src/**", "../../packages/kit/docs/**", "../../documentation/**"],
-			"outputs": [".vercel_build_output/**", ".vercel/output/**" ],
+			"outputs": [".vercel_build_output/**", ".vercel/output/**"],
 			"outputMode": "new-only"
 		},
 		"build": {