@ant.sh/colony 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 rune-config contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,172 @@
+# Colony
+
+**Environment-aware config for Node.js. One file, multiple environments.**
+
+[![npm version](https://img.shields.io/npm/v/@ant.sh/colony.svg)](https://www.npmjs.com/package/@ant.sh/colony)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+
+```
+# config/app.colony
+*.database.host = "localhost";
+prod.database.host = "prod-db.example.com";
+```
+
+```js
+import { loadColony } from "@ant.sh/colony";
+
+const config = await loadColony({
+  entry: "./config/app.colony",
+  ctx: { env: "prod" }
+});
+
+config.database.host // => "prod-db.example.com"
+```
+
+## Features
+
+- **Single config file** for all environments (dev, staging, prod)
+- **Wildcard matching** - `*` sets defaults, specific rules override
+- **Multiple dimensions** - env, region, feature flags, anything
+- **Secret management** - AWS Secrets Manager, Vault, OpenBao
+- **Interpolation** - `${ENV:VAR}`, `${ctx.region}`, `${VAR:custom}`
+- **CLI tools** - validate, diff, lint, print
+- **TypeScript** - Full type definitions included
+- **Zero runtime deps** - Only `fast-glob` and `json5`
+
+## Installation
+
+```bash
+npm install @ant.sh/colony
+```
+
+## Quick Start
+
+**1. Create `config/app.colony`**
+
+```
+@dims env;
+
+# Defaults
+*.app.name = "MyApp";
+*.database.host = "localhost";
+*.database.port = 5432;
+
+# Production overrides
+prod.database.host = "prod-db.example.com";
+```
+
+**2. Load in your app**
+
+```js
+import { loadColony } from "@ant.sh/colony";
+
+const config = await loadColony({
+  entry: "./config/app.colony",
+  ctx: { env: process.env.NODE_ENV || "dev" }
+});
+
+console.log(config.database.host);
+// dev:  "localhost"
+// prod: "prod-db.example.com"
+```
+
+## Multiple Dimensions
+
+```
+@dims env, region;
+
+*.*.database.host = "localhost";
+prod.*.database.host = "prod-db.example.com";
+prod.eu.database.host = "prod-db-eu.example.com";
+```
+
+```js
+const config = await loadColony({
+  entry: "./config/app.colony",
+  ctx: { env: "prod", region: "eu" }
+});
+// => "prod-db-eu.example.com"
+```
+
+## Secrets Integration
+
+```
+*.db.password = "${AWS:myapp/db#password}";
+*.api.key = "${OPENBAO:secret/data/app#api_key}";
+```
+
+```js
+import { loadColony, AwsSecretsProvider, OpenBaoProvider } from "@ant.sh/colony";
+
+const config = await loadColony({
+  entry: "./config/app.colony",
+  secrets: {
+    providers: [
+      new AwsSecretsProvider({ region: "us-east-1" }),
+      new OpenBaoProvider(),
+    ],
+  },
+});
+```
+
+**Built-in providers:** AWS Secrets Manager, HashiCorp Vault, OpenBao
+
+## CLI
+
+```bash
+colony print --entry ./config/app.colony --ctx "env=prod"
+colony diff --entry ./config/app.colony --ctx1 "env=dev" --ctx2 "env=prod"
+colony validate --entry ./config/app.colony
+colony lint --entry ./config/app.colony
+```
+
+## package.json Setup
+
+```json
+{
+  "scripts": {
+    "dev": "NODE_ENV=dev node src/index.js",
+    "prod": "NODE_ENV=prod node src/index.js",
+    "start": "node src/index.js",
+    "config:validate": "colony validate --entry ./config/app.colony",
+    "config:lint": "colony lint --entry ./config/app.colony",
+    "config:diff": "colony diff --entry ./config/app.colony --ctx1 \"env=dev\" --ctx2 \"env=prod\""
+  }
+}
+```
+
+```bash
+npm run dev    # Run with dev config
+npm run prod   # Run with prod config
+```
+
+Your app picks up the environment automatically:
+
+```js
+// src/index.js
+import { loadColony } from "@ant.sh/colony";
+
+const config = await loadColony({
+  entry: "./config/app.colony",
+  ctx: { env: process.env.NODE_ENV || "dev" }
+});
+
+console.log(`Running in ${process.env.NODE_ENV} mode`);
+console.log(`Database: ${config.database.host}`);
+```
+
+## Documentation
+
+See [DOCS.md](./DOCS.md) for complete documentation including:
+
+- Config syntax reference
+- All operators (`=`, `:=`, `+=`, `-=`, `|=`)
+- Interpolation patterns
+- Secret providers
+- Security sandbox options
+- API reference
+- TypeScript types
+
+## License
+
+MIT

package/dist/cjs/cli.js

@@ -0,0 +1,281 @@
+#!/usr/bin/env node
+var import_index = require("./index.js");
+var import_util = require("./util.js");
+function parseArgs(argv) {
+  const args = { _: [] };
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (a.startsWith("--")) {
+      const k = a.slice(2);
+      const v = i + 1 < argv.length && !argv[i + 1].startsWith("--") ? argv[++i] : true;
+      args[k] = v;
+    } else {
+      args._.push(a);
+    }
+  }
+  return args;
+}
+function parseCtx(s) {
+  const out = {};
+  if (!s || s === true) return out;
+  const parts = String(s).split(/\s+/).filter(Boolean);
+  for (const p of parts) {
+    const idx = p.indexOf("=");
+    if (idx === -1) continue;
+    out[p.slice(0, idx)] = p.slice(idx + 1);
+  }
+  return out;
+}
+function printUsage() {
+  console.error(`Usage:
+  colony print --entry ./config/app.colony [options]
+  colony validate --entry ./config/app.colony
+  colony dry-run --entry ./config/app.colony
+  colony diff --entry ./config/app.colony --ctx1 "env=dev" --ctx2 "env=prod"
+  colony keys --entry ./config/app.colony [--ctx "..."]
+  colony env --entry ./config/app.colony [--ctx "..."]
+  colony lint --entry ./config/app.colony
+
+Commands:
+  print      Resolve and print the configuration
+  validate   Check syntax of all colony files without resolving
+  dry-run    List all files that would be included
+  diff       Compare configs between two contexts
+  keys       List all config keys in dot notation
+  env        Output config as KEY=value for shell sourcing
+  lint       Check for potential issues (unused rules, shadows, etc.)
+
+Options for 'print':
+  --entry <file>           Entry colony file (required)
+  --dims <d1,d2,...>       Dimension names (comma-separated)
+  --ctx "k1=v1 k2=v2"      Context values (space-separated key=value pairs)
+  --format <json|env>      Output format (default: json)
+  --query <key.path>       Extract specific value (like jq)
+  --explain <key.path>     Show which rule set a specific key
+  --base-path <dir>        Restrict includes to this directory (security)
+  --allowed-env <v1,v2>    Whitelist of allowed env vars (security)
+  --allowed-vars <v1,v2>   Whitelist of allowed custom vars (security)
+  --max-file-size <bytes>  Maximum file size for includes (security)
+  --warn-skipped           Warn when skipping already-visited includes
+  --show-warnings          Show all warnings after output
+  --strict                 Exit with error if there are any warnings
+
+Options for 'diff':
+  --entry <file>           Entry colony file (required)
+  --dims <d1,d2,...>       Dimension names (comma-separated)
+  --ctx1 "k1=v1 ..."       First context
+  --ctx2 "k1=v1 ..."       Second context
+  --format <json|text>     Output format (default: text)
+`);
+}
+function formatDiff(diff, format = "text") {
+  if (format === "json") {
+    return JSON.stringify(diff, null, 2);
+  }
+  const lines = [];
+  if (diff.added.length > 0) {
+    lines.push("Added:");
+    for (const key of diff.added) {
+      lines.push(`  + ${key}`);
+    }
+  }
+  if (diff.removed.length > 0) {
+    if (lines.length > 0) lines.push("");
+    lines.push("Removed:");
+    for (const key of diff.removed) {
+      lines.push(`  - ${key}`);
+    }
+  }
+  if (diff.changed.length > 0) {
+    if (lines.length > 0) lines.push("");
+    lines.push("Changed:");
+    for (const { key, from, to } of diff.changed) {
+      lines.push(`  ~ ${key}`);
+      lines.push(`    from: ${JSON.stringify(from)}`);
+      lines.push(`    to:   ${JSON.stringify(to)}`);
+    }
+  }
+  if (lines.length === 0) {
+    return "No differences found.";
+  }
+  return lines.join("\n");
+}
+function formatAsEnv(cfg, prefix = "") {
+  const lines = [];
+  function flatten(obj, currentPrefix) {
+    for (const [key, value] of Object.entries(obj)) {
+      const envKey = currentPrefix ? `${currentPrefix}_${key}`.toUpperCase().replace(/[^A-Z0-9_]/g, "_") : key.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+      if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        flatten(value, envKey);
+      } else {
+        const envValue = typeof value === "string" ? value : JSON.stringify(value);
+        const escaped = envValue.replace(/'/g, "'\\''");
+        lines.push(`${envKey}='${escaped}'`);
+      }
+    }
+  }
+  flatten(cfg, prefix);
+  return lines.sort().join("\n");
+}
+(async () => {
+  try {
+    const args = parseArgs(process.argv);
+    const cmd = args._[0];
+    if (!cmd || cmd === "help" || args.help) {
+      printUsage();
+      process.exit(cmd === "help" || args.help ? 0 : 1);
+    }
+    const entry = args.entry;
+    if (!entry) {
+      console.error("Error: Missing --entry\n");
+      printUsage();
+      process.exit(1);
+    }
+    if (cmd === "validate") {
+      const result = await (0, import_index.validateColony)(entry);
+      if (result.valid) {
+        console.log(`\u2713 All ${result.files.length} file(s) valid:`);
+        for (const f of result.files) {
+          console.log(`  ${f}`);
+        }
+        process.exit(0);
+      } else {
+        console.error(`\u2717 Validation failed with ${result.errors.length} error(s):`);
+        for (const e of result.errors) {
+          console.error(`
+  ${e.file}:`);
+          console.error(`    ${e.error}`);
+        }
+        process.exit(1);
+      }
+    }
+    if (cmd === "dry-run") {
+      const files = await (0, import_index.dryRunIncludes)(entry);
+      console.log(`Files that would be included (${files.length}):`);
+      for (const f of files) {
+        console.log(`  ${f}`);
+      }
+      process.exit(0);
+    }
+    if (cmd === "diff") {
+      if (!args.ctx1 || !args.ctx2) {
+        console.error("Error: diff command requires both --ctx1 and --ctx2\n");
+        printUsage();
+        process.exit(1);
+      }
+      const dims2 = typeof args.dims === "string" ? args.dims.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+      const ctx1 = parseCtx(args.ctx1);
+      const ctx2 = parseCtx(args.ctx2);
+      const result = await (0, import_index.diffColony)({ entry, dims: dims2, ctx1, ctx2 });
+      const format = args.format || "text";
+      console.log(formatDiff(result.diff, format));
+      const hasDiffs = result.diff.added.length > 0 || result.diff.removed.length > 0 || result.diff.changed.length > 0;
+      process.exit(hasDiffs ? 1 : 0);
+    }
+    if (cmd === "lint") {
+      const dims2 = typeof args.dims === "string" ? args.dims.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+      const result = await (0, import_index.lintColony)({ entry, dims: dims2 });
+      if (result.issues.length === 0) {
+        console.log("\u2713 No issues found");
+        process.exit(0);
+      }
+      console.error(`Found ${result.issues.length} issue(s):
+`);
+      for (const issue of result.issues) {
+        const icon = issue.severity === "error" ? "\u2717" : "\u26A0";
+        console.error(`${icon} [${issue.type}] ${issue.message}`);
+        if (issue.file) {
+          console.error(`  at ${issue.file}:${issue.line || 0}`);
+        }
+      }
+      process.exit(result.issues.some((i) => i.severity === "error") ? 1 : 0);
+    }
+    if (cmd === "keys") {
+      const dims2 = typeof args.dims === "string" ? args.dims.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+      const ctx2 = parseCtx(args.ctx);
+      const cfg2 = await (0, import_index.loadColony)({ entry, dims: dims2, ctx: ctx2 });
+      const keys = cfg2.keys();
+      for (const key of keys) {
+        console.log(key);
+      }
+      process.exit(0);
+    }
+    if (cmd === "env") {
+      const dims2 = typeof args.dims === "string" ? args.dims.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+      const ctx2 = parseCtx(args.ctx);
+      const cfg2 = await (0, import_index.loadColony)({ entry, dims: dims2, ctx: ctx2 });
+      console.log(formatAsEnv(cfg2.toJSON(), args.prefix || ""));
+      process.exit(0);
+    }
+    if (cmd !== "print") {
+      console.error(`Error: Unknown command "${cmd}"
+`);
+      printUsage();
+      process.exit(1);
+    }
+    const dims = typeof args.dims === "string" ? args.dims.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+    const ctx = parseCtx(args.ctx);
+    const sandbox = {};
+    if (args["base-path"]) {
+      sandbox.basePath = args["base-path"];
+    }
+    if (args["allowed-env"]) {
+      sandbox.allowedEnvVars = args["allowed-env"].split(",").map((s) => s.trim()).filter(Boolean);
+    }
+    if (args["allowed-vars"]) {
+      sandbox.allowedVars = args["allowed-vars"].split(",").map((s) => s.trim()).filter(Boolean);
+    }
+    if (args["max-file-size"]) {
+      sandbox.maxFileSize = parseInt(args["max-file-size"], 10);
+    }
+    const warnOnSkippedIncludes = !!args["warn-skipped"];
+    const cfg = await (0, import_index.loadColony)({ entry, dims, ctx, sandbox, warnOnSkippedIncludes });
+    if (args.query) {
+      const value = (0, import_util.getByPath)(cfg, args.query);
+      if (value === void 0) {
+        console.error(`Key not found: ${args.query}`);
+        process.exit(1);
+      }
+      if (typeof value === "object") {
+        console.log(JSON.stringify(value, null, 2));
+      } else {
+        console.log(value);
+      }
+    } else {
+      const format = args.format || "json";
+      if (format === "env") {
+        console.log(formatAsEnv(cfg.toJSON(), args.prefix || ""));
+      } else {
+        console.log(JSON.stringify(cfg, null, 2));
+      }
+    }
+    if (args.strict && cfg._warnings?.length > 0) {
+      console.error(`
+\u2717 Strict mode: ${cfg._warnings.length} warning(s) found:`);
+      for (const w of cfg._warnings) {
+        console.error(`  [${w.type}] ${w.message}`);
+      }
+      process.exit(1);
+    }
+    if (args["show-warnings"] && cfg._warnings?.length > 0) {
+      console.error(`
+Warnings (${cfg._warnings.length}):`);
+      for (const w of cfg._warnings) {
+        console.error(`  [${w.type}] ${w.message}`);
+      }
+    }
+    if (typeof args.explain === "string") {
+      const info = cfg.explain(args.explain);
+      console.error(`
+Explain ${args.explain}:`);
+      console.error(info ? JSON.stringify(info, null, 2) : "(no matching rule / unset)");
+    }
+  } catch (err) {
+    console.error(`Error: ${err.message}`);
+    if (process.env.DEBUG) {
+      console.error(err.stack);
+    }
+    process.exit(1);
+  }
+})();
+//# sourceMappingURL=cli.js.map

package/dist/cjs/cli.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/cli.js"],
+  "sourcesContent": ["#!/usr/bin/env node\nimport { loadColony, validateColony, dryRunIncludes, diffColony, lintColony } from \"./index.js\";\nimport { getByPath } from \"./util.js\";\n\nfunction parseArgs(argv) {\n  const args = { _: [] };\n  for (let i = 2; i < argv.length; i++) {\n    const a = argv[i];\n    if (a.startsWith(\"--\")) {\n      const k = a.slice(2);\n      const v = (i + 1 < argv.length && !argv[i + 1].startsWith(\"--\")) ? argv[++i] : true;\n      args[k] = v;\n    } else {\n      args._.push(a);\n    }\n  }\n  return args;\n}\n\nfunction parseCtx(s) {\n  const out = {};\n  if (!s || s === true) return out;\n  const parts = String(s).split(/\\s+/).filter(Boolean);\n  for (const p of parts) {\n    const idx = p.indexOf(\"=\");\n    if (idx === -1) continue;\n    out[p.slice(0, idx)] = p.slice(idx + 1);\n  }\n  return out;\n}\n\nfunction printUsage() {\n  console.error(`Usage:\n  colony print --entry ./config/app.colony [options]\n  colony validate --entry ./config/app.colony\n  colony dry-run --entry ./config/app.colony\n  colony diff --entry ./config/app.colony --ctx1 \"env=dev\" --ctx2 \"env=prod\"\n  colony keys --entry ./config/app.colony [--ctx \"...\"]\n  colony env --entry ./config/app.colony [--ctx \"...\"]\n  colony lint --entry ./config/app.colony\n\nCommands:\n  print      Resolve and print the configuration\n  validate   Check syntax of all colony files without resolving\n  dry-run    List all files that would be included\n  diff       Compare configs between two contexts\n  keys       List all config keys in dot notation\n  env        Output config as KEY=value for shell sourcing\n  lint       Check for potential issues (unused rules, shadows, etc.)\n\nOptions for 'print':\n  --entry <file>           Entry colony file (required)\n  --dims <d1,d2,...>       Dimension names (comma-separated)\n  --ctx \"k1=v1 k2=v2\"      Context values (space-separated key=value pairs)\n  --format <json|env>      Output format (default: json)\n  --query <key.path>       Extract specific value (like jq)\n  --explain <key.path>     Show which rule set a specific key\n  --base-path <dir>        Restrict includes to this directory (security)\n  --allowed-env <v1,v2>    Whitelist of allowed env vars (security)\n  --allowed-vars <v1,v2>   Whitelist of allowed custom vars (security)\n  --max-file-size <bytes>  Maximum file size for includes (security)\n  --warn-skipped           Warn when skipping already-visited includes\n  --show-warnings          Show all warnings after output\n  --strict                 Exit with error if there are any warnings\n\nOptions for 'diff':\n  --entry <file>           Entry colony file (required)\n  --dims <d1,d2,...>       Dimension names (comma-separated)\n  --ctx1 \"k1=v1 ...\"       First context\n  --ctx2 \"k1=v1 ...\"       Second context\n  --format <json|text>     Output format (default: text)\n`);\n}\n\nfunction formatDiff(diff, format = \"text\") {\n  if (format === \"json\") {\n    return JSON.stringify(diff, null, 2);\n  }\n\n  const lines = [];\n\n  if (diff.added.length > 0) {\n    lines.push(\"Added:\");\n    for (const key of diff.added) {\n      lines.push(`  + ${key}`);\n    }\n  }\n\n  if (diff.removed.length > 0) {\n    if (lines.length > 0) lines.push(\"\");\n    lines.push(\"Removed:\");\n    for (const key of diff.removed) {\n      lines.push(`  - ${key}`);\n    }\n  }\n\n  if (diff.changed.length > 0) {\n    if (lines.length > 0) lines.push(\"\");\n    lines.push(\"Changed:\");\n    for (const { key, from, to } of diff.changed) {\n      lines.push(`  ~ ${key}`);\n      lines.push(`    from: ${JSON.stringify(from)}`);\n      lines.push(`    to:   ${JSON.stringify(to)}`);\n    }\n  }\n\n  if (lines.length === 0) {\n    return \"No differences found.\";\n  }\n\n  return lines.join(\"\\n\");\n}\n\n/**\n * Format config as KEY=value for shell sourcing\n */\nfunction formatAsEnv(cfg, prefix = \"\") {\n  const lines = [];\n\n  function flatten(obj, currentPrefix) {\n    for (const [key, value] of Object.entries(obj)) {\n      const envKey = currentPrefix\n        ? `${currentPrefix}_${key}`.toUpperCase().replace(/[^A-Z0-9_]/g, \"_\")\n        : key.toUpperCase().replace(/[^A-Z0-9_]/g, \"_\");\n\n      if (value !== null && typeof value === \"object\" && !Array.isArray(value)) {\n        flatten(value, envKey);\n      } else {\n        const envValue = typeof value === \"string\"\n          ? value\n          : JSON.stringify(value);\n        // Escape single quotes for shell\n        const escaped = envValue.replace(/'/g, \"'\\\\''\");\n        lines.push(`${envKey}='${escaped}'`);\n      }\n    }\n  }\n\n  flatten(cfg, prefix);\n  return lines.sort().join(\"\\n\");\n}\n\n(async () => {\n  try {\n    const args = parseArgs(process.argv);\n    const cmd = args._[0];\n\n    if (!cmd || cmd === \"help\" || args.help) {\n      printUsage();\n      process.exit(cmd === \"help\" || args.help ? 0 : 1);\n    }\n\n    const entry = args.entry;\n    if (!entry) {\n      console.error(\"Error: Missing --entry\\n\");\n      printUsage();\n      process.exit(1);\n    }\n\n    // Handle validate command\n    if (cmd === \"validate\") {\n      const result = await validateColony(entry);\n      if (result.valid) {\n        console.log(`\u2713 All ${result.files.length} file(s) valid:`);\n        for (const f of result.files) {\n          console.log(`  ${f}`);\n        }\n        process.exit(0);\n      } else {\n        console.error(`\u2717 Validation failed with ${result.errors.length} error(s):`);\n        for (const e of result.errors) {\n          console.error(`\\n  ${e.file}:`);\n          console.error(`    ${e.error}`);\n        }\n        process.exit(1);\n      }\n    }\n\n    // Handle dry-run command\n    if (cmd === \"dry-run\") {\n      const files = await dryRunIncludes(entry);\n      console.log(`Files that would be included (${files.length}):`);\n      for (const f of files) {\n        console.log(`  ${f}`);\n      }\n      process.exit(0);\n    }\n\n    // Handle diff command\n    if (cmd === \"diff\") {\n      if (!args.ctx1 || !args.ctx2) {\n        console.error(\"Error: diff command requires both --ctx1 and --ctx2\\n\");\n        printUsage();\n        process.exit(1);\n      }\n\n      const dims = typeof args.dims === \"string\"\n        ? args.dims.split(\",\").map((s) => s.trim()).filter(Boolean)\n        : undefined;\n\n      const ctx1 = parseCtx(args.ctx1);\n      const ctx2 = parseCtx(args.ctx2);\n\n      const result = await diffColony({ entry, dims, ctx1, ctx2 });\n\n      const format = args.format || \"text\";\n      console.log(formatDiff(result.diff, format));\n\n      // Exit with code 1 if there are differences (useful for CI)\n      const hasDiffs = result.diff.added.length > 0 ||\n                       result.diff.removed.length > 0 ||\n                       result.diff.changed.length > 0;\n      process.exit(hasDiffs ? 1 : 0);\n    }\n\n    // Handle lint command\n    if (cmd === \"lint\") {\n      const dims = typeof args.dims === \"string\"\n        ? args.dims.split(\",\").map((s) => s.trim()).filter(Boolean)\n        : undefined;\n\n      const result = await lintColony({ entry, dims });\n\n      if (result.issues.length === 0) {\n        console.log(\"\u2713 No issues found\");\n        process.exit(0);\n      }\n\n      console.error(`Found ${result.issues.length} issue(s):\\n`);\n      for (const issue of result.issues) {\n        const icon = issue.severity === \"error\" ? \"\u2717\" : \"\u26A0\";\n        console.error(`${icon} [${issue.type}] ${issue.message}`);\n        if (issue.file) {\n          console.error(`  at ${issue.file}:${issue.line || 0}`);\n        }\n      }\n      process.exit(result.issues.some((i) => i.severity === \"error\") ? 1 : 0);\n    }\n\n    // Handle keys command\n    if (cmd === \"keys\") {\n      const dims = typeof args.dims === \"string\"\n        ? args.dims.split(\",\").map((s) => s.trim()).filter(Boolean)\n        : undefined;\n\n      const ctx = parseCtx(args.ctx);\n      const cfg = await loadColony({ entry, dims, ctx });\n\n      const keys = cfg.keys();\n      for (const key of keys) {\n        console.log(key);\n      }\n      process.exit(0);\n    }\n\n    // Handle env command\n    if (cmd === \"env\") {\n      const dims = typeof args.dims === \"string\"\n        ? args.dims.split(\",\").map((s) => s.trim()).filter(Boolean)\n        : undefined;\n\n      const ctx = parseCtx(args.ctx);\n      const cfg = await loadColony({ entry, dims, ctx });\n\n      console.log(formatAsEnv(cfg.toJSON(), args.prefix || \"\"));\n      process.exit(0);\n    }\n\n    // Handle print command\n    if (cmd !== \"print\") {\n      console.error(`Error: Unknown command \"${cmd}\"\\n`);\n      printUsage();\n      process.exit(1);\n    }\n\n    const dims = typeof args.dims === \"string\"\n      ? args.dims.split(\",\").map((s) => s.trim()).filter(Boolean)\n      : undefined;\n\n    const ctx = parseCtx(args.ctx);\n\n    // Build sandbox options\n    const sandbox = {};\n    if (args[\"base-path\"]) {\n      sandbox.basePath = args[\"base-path\"];\n    }\n    if (args[\"allowed-env\"]) {\n      sandbox.allowedEnvVars = args[\"allowed-env\"].split(\",\").map((s) => s.trim()).filter(Boolean);\n    }\n    if (args[\"allowed-vars\"]) {\n      sandbox.allowedVars = args[\"allowed-vars\"].split(\",\").map((s) => s.trim()).filter(Boolean);\n    }\n    if (args[\"max-file-size\"]) {\n      sandbox.maxFileSize = parseInt(args[\"max-file-size\"], 10);\n    }\n\n    const warnOnSkippedIncludes = !!args[\"warn-skipped\"];\n\n    const cfg = await loadColony({ entry, dims, ctx, sandbox, warnOnSkippedIncludes });\n\n    // Handle --query option\n    if (args.query) {\n      const value = getByPath(cfg, args.query);\n      if (value === undefined) {\n        console.error(`Key not found: ${args.query}`);\n        process.exit(1);\n      }\n      if (typeof value === \"object\") {\n        console.log(JSON.stringify(value, null, 2));\n      } else {\n        console.log(value);\n      }\n    } else {\n      // Format output\n      const format = args.format || \"json\";\n      if (format === \"env\") {\n        console.log(formatAsEnv(cfg.toJSON(), args.prefix || \"\"));\n      } else {\n        console.log(JSON.stringify(cfg, null, 2));\n      }\n    }\n\n    // Handle --strict flag\n    if (args.strict && cfg._warnings?.length > 0) {\n      console.error(`\\n\u2717 Strict mode: ${cfg._warnings.length} warning(s) found:`);\n      for (const w of cfg._warnings) {\n        console.error(`  [${w.type}] ${w.message}`);\n      }\n      process.exit(1);\n    }\n\n    // Show warnings if requested\n    if (args[\"show-warnings\"] && cfg._warnings?.length > 0) {\n      console.error(`\\nWarnings (${cfg._warnings.length}):`);\n      for (const w of cfg._warnings) {\n        console.error(`  [${w.type}] ${w.message}`);\n      }\n    }\n\n    if (typeof args.explain === \"string\") {\n      const info = cfg.explain(args.explain);\n      console.error(`\\nExplain ${args.explain}:`);\n      console.error(info ? JSON.stringify(info, null, 2) : \"(no matching rule / unset)\");\n    }\n\n  } catch (err) {\n    console.error(`Error: ${err.message}`);\n    if (process.env.DEBUG) {\n      console.error(err.stack);\n    }\n    process.exit(1);\n  }\n})();\n"],
+  "mappings": ";AACA,mBAAmF;AACnF,kBAA0B;AAE1B,SAAS,UAAU,MAAM;AACvB,QAAM,OAAO,EAAE,GAAG,CAAC,EAAE;AACrB,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,EAAE,WAAW,IAAI,GAAG;AACtB,YAAM,IAAI,EAAE,MAAM,CAAC;AACnB,YAAM,IAAK,IAAI,IAAI,KAAK,UAAU,CAAC,KAAK,IAAI,CAAC,EAAE,WAAW,IAAI,IAAK,KAAK,EAAE,CAAC,IAAI;AAC/E,WAAK,CAAC,IAAI;AAAA,IACZ,OAAO;AACL,WAAK,EAAE,KAAK,CAAC;AAAA,IACf;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,SAAS,GAAG;AACnB,QAAM,MAAM,CAAC;AACb,MAAI,CAAC,KAAK,MAAM,KAAM,QAAO;AAC7B,QAAM,QAAQ,OAAO,CAAC,EAAE,MAAM,KAAK,EAAE,OAAO,OAAO;AACnD,aAAW,KAAK,OAAO;AACrB,UAAM,MAAM,EAAE,QAAQ,GAAG;AACzB,QAAI,QAAQ,GAAI;AAChB,QAAI,EAAE,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC;AAAA,EACxC;AACA,SAAO;AACT;AAEA,SAAS,aAAa;AACpB,UAAQ,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAuCf;AACD;AAEA,SAAS,WAAW,MAAM,SAAS,QAAQ;AACzC,MAAI,WAAW,QAAQ;AACrB,WAAO,KAAK,UAAU,MAAM,MAAM,CAAC;AAAA,EACrC;AAEA,QAAM,QAAQ,CAAC;AAEf,MAAI,KAAK,MAAM,SAAS,GAAG;AACzB,UAAM,KAAK,QAAQ;AACnB,eAAW,OAAO,KAAK,OAAO;AAC5B,YAAM,KAAK,OAAO,GAAG,EAAE;AAAA,IACzB;AAAA,EACF;AAEA,MAAI,KAAK,QAAQ,SAAS,GAAG;AAC3B,QAAI,MAAM,SAAS,EAAG,OAAM,KAAK,EAAE;AACnC,UAAM,KAAK,UAAU;AACrB,eAAW,OAAO,KAAK,SAAS;AAC9B,YAAM,KAAK,OAAO,GAAG,EAAE;AAAA,IACzB;AAAA,EACF;AAEA,MAAI,KAAK,QAAQ,SAAS,GAAG;AAC3B,QAAI,MAAM,SAAS,EAAG,OAAM,KAAK,EAAE;AACnC,UAAM,KAAK,UAAU;AACrB,eAAW,EAAE,KAAK,MAAM,GAAG,KAAK,KAAK,SAAS;AAC5C,YAAM,KAAK,OAAO,GAAG,EAAE;AACvB,YAAM,KAAK,aAAa,KAAK,UAAU,IAAI,CAAC,EAAE;AAC9C,YAAM,KAAK,aAAa,KAAK,UAAU,EAAE,CAAC,EAAE;AAAA,IAC9C;AAAA,EACF;AAEA,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;AAKA,SAAS,YAAY,KAAK,SAAS,IAAI;AACrC,QAAM,QAAQ,CAAC;AAEf,WAAS,QAAQ,KAAK,eAAe;AACnC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,YAAM,SAAS,gBACX,GAAG,aAAa,IAAI,GAAG,GAAG,YAAY,EAAE,QAAQ,eAAe,GAAG,IAClE,IAAI,YAAY,EAAE,QAAQ,eAAe,GAAG;AAEhD,UAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AACxE,gBAAQ,OAAO,MAAM;AAAA,MACvB,OAAO;AACL,cAAM,WAAW,OAAO,UAAU,WAC9B,QACA,KAAK,UAAU,KAAK;AAExB,cAAM,UAAU,SAAS,QAAQ,MAAM,OAAO;AAC9C,cAAM,KAAK,GAAG,MAAM,KAAK,OAAO,GAAG;AAAA,MACrC;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,KAAK,MAAM;AACnB,SAAO,MAAM,KAAK,EAAE,KAAK,IAAI;AAC/B;AAAA,CAEC,YAAY;AACX,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,IAAI;AACnC,UAAM,MAAM,KAAK,EAAE,CAAC;AAEpB,QAAI,CAAC,OAAO,QAAQ,UAAU,KAAK,MAAM;AACvC,iBAAW;AACX,cAAQ,KAAK,QAAQ,UAAU,KAAK,OAAO,IAAI,CAAC;AAAA,IAClD;AAEA,UAAM,QAAQ,KAAK;AACnB,QAAI,CAAC,OAAO;AACV,cAAQ,MAAM,0BAA0B;AACxC,iBAAW;AACX,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,QAAI,QAAQ,YAAY;AACtB,YAAM,SAAS,UAAM,6BAAe,KAAK;AACzC,UAAI,OAAO,OAAO;AAChB,gBAAQ,IAAI,cAAS,OAAO,MAAM,MAAM,iBAAiB;AACzD,mBAAW,KAAK,OAAO,OAAO;AAC5B,kBAAQ,IAAI,KAAK,CAAC,EAAE;AAAA,QACtB;AACA,gBAAQ,KAAK,CAAC;AAAA,MAChB,OAAO;AACL,gBAAQ,MAAM,iCAA4B,OAAO,OAAO,MAAM,YAAY;AAC1E,mBAAW,KAAK,OAAO,QAAQ;AAC7B,kBAAQ,MAAM;AAAA,IAAO,EAAE,IAAI,GAAG;AAC9B,kBAAQ,MAAM,OAAO,EAAE,KAAK,EAAE;AAAA,QAChC;AACA,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAGA,QAAI,QAAQ,WAAW;AACrB,YAAM,QAAQ,UAAM,6BAAe,KAAK;AACxC,cAAQ,IAAI,iCAAiC,MAAM,MAAM,IAAI;AAC7D,iBAAW,KAAK,OAAO;AACrB,gBAAQ,IAAI,KAAK,CAAC,EAAE;AAAA,MACtB;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,QAAI,QAAQ,QAAQ;AAClB,UAAI,CAAC,KAAK,QAAQ,CAAC,KAAK,MAAM;AAC5B,gBAAQ,MAAM,uDAAuD;AACrE,mBAAW;AACX,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAEA,YAAMA,QAAO,OAAO,KAAK,SAAS,WAC9B,KAAK,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,IACxD;AAEJ,YAAM,OAAO,SAAS,KAAK,IAAI;AAC/B,YAAM,OAAO,SAAS,KAAK,IAAI;AAE/B,YAAM,SAAS,UAAM,yBAAW,EAAE,OAAO,MAAAA,OAAM,MAAM,KAAK,CAAC;AAE3D,YAAM,SAAS,KAAK,UAAU;AAC9B,cAAQ,IAAI,WAAW,OAAO,MAAM,MAAM,CAAC;AAG3C,YAAM,WAAW,OAAO,KAAK,MAAM,SAAS,KAC3B,OAAO,KAAK,QAAQ,SAAS,KAC7B,OAAO,KAAK,QAAQ,SAAS;AAC9C,cAAQ,KAAK,WAAW,IAAI,CAAC;AAAA,IAC/B;AAGA,QAAI,QAAQ,QAAQ;AAClB,YAAMA,QAAO,OAAO,KAAK,SAAS,WAC9B,KAAK,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,IACxD;AAEJ,YAAM,SAAS,UAAM,yBAAW,EAAE,OAAO,MAAAA,MAAK,CAAC;AAE/C,UAAI,OAAO,OAAO,WAAW,GAAG;AAC9B,gBAAQ,IAAI,wBAAmB;AAC/B,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAEA,cAAQ,MAAM,SAAS,OAAO,OAAO,MAAM;AAAA,CAAc;AACzD,iBAAW,SAAS,OAAO,QAAQ;AACjC,cAAM,OAAO,MAAM,aAAa,UAAU,WAAM;AAChD,gBAAQ,MAAM,GAAG,IAAI,KAAK,MAAM,IAAI,KAAK,MAAM,OAAO,EAAE;AACxD,YAAI,MAAM,MAAM;AACd,kBAAQ,MAAM,QAAQ,MAAM,IAAI,IAAI,MAAM,QAAQ,CAAC,EAAE;AAAA,QACvD;AAAA,MACF;AACA,cAAQ,KAAK,OAAO,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,OAAO,IAAI,IAAI,CAAC;AAAA,IACxE;AAGA,QAAI,QAAQ,QAAQ;AAClB,YAAMA,QAAO,OAAO,KAAK,SAAS,WAC9B,KAAK,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,IACxD;AAEJ,YAAMC,OAAM,SAAS,KAAK,GAAG;AAC7B,YAAMC,OAAM,UAAM,yBAAW,EAAE,OAAO,MAAAF,OAAM,KAAAC,KAAI,CAAC;AAEjD,YAAM,OAAOC,KAAI,KAAK;AACtB,iBAAW,OAAO,MAAM;AACtB,gBAAQ,IAAI,GAAG;AAAA,MACjB;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,QAAI,QAAQ,OAAO;AACjB,YAAMF,QAAO,OAAO,KAAK,SAAS,WAC9B,KAAK,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,IACxD;AAEJ,YAAMC,OAAM,SAAS,KAAK,GAAG;AAC7B,YAAMC,OAAM,UAAM,yBAAW,EAAE,OAAO,MAAAF,OAAM,KAAAC,KAAI,CAAC;AAEjD,cAAQ,IAAI,YAAYC,KAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;AACxD,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,QAAI,QAAQ,SAAS;AACnB,cAAQ,MAAM,2BAA2B,GAAG;AAAA,CAAK;AACjD,iBAAW;AACX,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,OAAO,OAAO,KAAK,SAAS,WAC9B,KAAK,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,IACxD;AAEJ,UAAM,MAAM,SAAS,KAAK,GAAG;AAG7B,UAAM,UAAU,CAAC;AACjB,QAAI,KAAK,WAAW,GAAG;AACrB,cAAQ,WAAW,KAAK,WAAW;AAAA,IACrC;AACA,QAAI,KAAK,aAAa,GAAG;AACvB,cAAQ,iBAAiB,KAAK,aAAa,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAAA,IAC7F;AACA,QAAI,KAAK,cAAc,GAAG;AACxB,cAAQ,cAAc,KAAK,cAAc,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAAA,IAC3F;AACA,QAAI,KAAK,eAAe,GAAG;AACzB,cAAQ,cAAc,SAAS,KAAK,eAAe,GAAG,EAAE;AAAA,IAC1D;AAEA,UAAM,wBAAwB,CAAC,CAAC,KAAK,cAAc;AAEnD,UAAM,MAAM,UAAM,yBAAW,EAAE,OAAO,MAAM,KAAK,SAAS,sBAAsB,CAAC;AAGjF,QAAI,KAAK,OAAO;AACd,YAAM,YAAQ,uBAAU,KAAK,KAAK,KAAK;AACvC,UAAI,UAAU,QAAW;AACvB,gBAAQ,MAAM,kBAAkB,KAAK,KAAK,EAAE;AAC5C,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA,UAAI,OAAO,UAAU,UAAU;AAC7B,gBAAQ,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,MAC5C,OAAO;AACL,gBAAQ,IAAI,KAAK;AAAA,MACnB;AAAA,IACF,OAAO;AAEL,YAAM,SAAS,KAAK,UAAU;AAC9B,UAAI,WAAW,OAAO;AACpB,gBAAQ,IAAI,YAAY,IAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;AAAA,MAC1D,OAAO;AACL,gBAAQ,IAAI,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA,MAC1C;AAAA,IACF;AAGA,QAAI,KAAK,UAAU,IAAI,WAAW,SAAS,GAAG;AAC5C,cAAQ,MAAM;AAAA,sBAAoB,IAAI,UAAU,MAAM,oBAAoB;AAC1E,iBAAW,KAAK,IAAI,WAAW;AAC7B,gBAAQ,MAAM,MAAM,EAAE,IAAI,KAAK,EAAE,OAAO,EAAE;AAAA,MAC5C;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,QAAI,KAAK,eAAe,KAAK,IAAI,WAAW,SAAS,GAAG;AACtD,cAAQ,MAAM;AAAA,YAAe,IAAI,UAAU,MAAM,IAAI;AACrD,iBAAW,KAAK,IAAI,WAAW;AAC7B,gBAAQ,MAAM,MAAM,EAAE,IAAI,KAAK,EAAE,OAAO,EAAE;AAAA,MAC5C;AAAA,IACF;AAEA,QAAI,OAAO,KAAK,YAAY,UAAU;AACpC,YAAM,OAAO,IAAI,QAAQ,KAAK,OAAO;AACrC,cAAQ,MAAM;AAAA,UAAa,KAAK,OAAO,GAAG;AAC1C,cAAQ,MAAM,OAAO,KAAK,UAAU,MAAM,MAAM,CAAC,IAAI,4BAA4B;AAAA,IACnF;AAAA,EAEF,SAAS,KAAK;AACZ,YAAQ,MAAM,UAAU,IAAI,OAAO,EAAE;AACrC,QAAI,QAAQ,IAAI,OAAO;AACrB,cAAQ,MAAM,IAAI,KAAK;AAAA,IACzB;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,GAAG;",
+  "names": ["dims", "ctx", "cfg"]
+}