@chriscode/hush 2.0.0 → 2.2.0

package/dist/core/sops.d.ts

@@ -3,4 +3,9 @@ export declare function isAgeKeyConfigured(): boolean;
 export declare function decrypt(filePath: string): string;
 export declare function encrypt(inputPath: string, outputPath: string): void;
 export declare function edit(filePath: string): void;
+/**
+ * Set a single key in an encrypted file.
+ * Decrypts to memory, updates the key, re-encrypts.
+ */
+export declare function setKey(filePath: string, key: string, value: string): void;
 //# sourceMappingURL=sops.d.ts.map

package/dist/core/sops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sops.d.ts","sourceRoot":"","sources":["../../src/core/sops.ts"],"names":[],"mappings":"AAyBA,wBAAgB,eAAe,IAAI,OAAO,CAOzC;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CA6BhD;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuBnE;AAED,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAqB3C"}
+{"version":3,"file":"sops.d.ts","sourceRoot":"","sources":["../../src/core/sops.ts"],"names":[],"mappings":"AA0BA,wBAAgB,eAAe,IAAI,OAAO,CAOzC;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CA6BhD;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuBnE;AAED,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAqB3C;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAqDzE"}

package/dist/core/sops.js

@@ -1,6 +1,7 @@
 import { execSync, spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, writeFileSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
+import { tmpdir } from 'node:os';
 function getAgeKeyFile() {
     if (process.env.SOPS_AGE_KEY_FILE) {
         return process.env.SOPS_AGE_KEY_FILE;
@@ -89,3 +90,50 @@ export function edit(filePath) {
         throw new Error(`SOPS edit failed with exit code ${result.status}`);
     }
 }
+/**
+ * Set a single key in an encrypted file.
+ * Decrypts to memory, updates the key, re-encrypts.
+ */
+export function setKey(filePath, key, value) {
+    if (!isSopsInstalled()) {
+        throw new Error('SOPS is not installed. Install with: brew install sops');
+    }
+    let content = '';
+    // If file exists, decrypt it first
+    if (existsSync(filePath)) {
+        content = decrypt(filePath);
+    }
+    // Parse existing content into lines
+    const lines = content.split('\n').filter(line => line.trim() !== '');
+    // Find and update or add the key
+    let found = false;
+    const updatedLines = lines.map(line => {
+        const match = line.match(/^([^=]+)=/);
+        if (match && match[1] === key) {
+            found = true;
+            return `${key}=${value}`;
+        }
+        return line;
+    });
+    if (!found) {
+        updatedLines.push(`${key}=${value}`);
+    }
+    const newContent = updatedLines.join('\n') + '\n';
+    const tempFile = join(tmpdir(), `hush-temp-${Date.now()}.env`);
+    try {
+        writeFileSync(tempFile, newContent, 'utf-8');
+        // Encrypt temp file to the target
+        execSync(`sops --input-type dotenv --output-type dotenv --encrypt "${tempFile}" > "${filePath}"`, {
+            encoding: 'utf-8',
+            shell: '/bin/bash',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            env: getSopsEnv(),
+        });
+    }
+    finally {
+        // Always clean up temp file
+        if (existsSync(tempFile)) {
+            unlinkSync(tempFile);
+        }
+    }
+}

package/dist/formats/index.d.ts

@@ -3,6 +3,7 @@ import { formatDotenv } from './dotenv.js';
 import { formatJson } from './json.js';
 import { formatShell } from './shell.js';
 import { formatWrangler } from './wrangler.js';
+import { formatYaml } from './yaml.js';
 export declare function formatVars(vars: EnvVar[], format: OutputFormat): string;
-export { formatDotenv, formatJson, formatShell, formatWrangler };
+export { formatDotenv, formatJson, formatShell, formatWrangler, formatYaml };
 //# sourceMappingURL=index.d.ts.map

package/dist/formats/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/formats/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAWvE;AAED,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/formats/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAavE;AAED,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC"}

package/dist/formats/index.js

@@ -2,6 +2,7 @@ import { formatDotenv } from './dotenv.js';
 import { formatJson } from './json.js';
 import { formatShell } from './shell.js';
 import { formatWrangler } from './wrangler.js';
+import { formatYaml } from './yaml.js';
 export function formatVars(vars, format) {
     switch (format) {
         case 'dotenv':
@@ -12,6 +13,8 @@ export function formatVars(vars, format) {
             return formatJson(vars);
         case 'shell':
             return formatShell(vars);
+        case 'yaml':
+            return formatYaml(vars);
     }
 }
-export { formatDotenv, formatJson, formatShell, formatWrangler };
+export { formatDotenv, formatJson, formatShell, formatWrangler, formatYaml };

package/dist/formats/yaml.d.ts

@@ -0,0 +1,13 @@
+import type { EnvVar } from '../types.js';
+/**
+ * Format environment variables as YAML.
+ * Useful for Kubernetes ConfigMaps, Docker Compose, and other YAML-based configs.
+ *
+ * Output format:
+ * ```yaml
+ * DATABASE_URL: "postgres://localhost/db"
+ * API_KEY: "sk_test_xxx"
+ * ```
+ */
+export declare function formatYaml(vars: EnvVar[]): string;
+//# sourceMappingURL=yaml.d.ts.map

package/dist/formats/yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../../src/formats/yaml.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CA6CjD"}

package/dist/formats/yaml.js

@@ -0,0 +1,50 @@
+/**
+ * Format environment variables as YAML.
+ * Useful for Kubernetes ConfigMaps, Docker Compose, and other YAML-based configs.
+ *
+ * Output format:
+ * ```yaml
+ * DATABASE_URL: "postgres://localhost/db"
+ * API_KEY: "sk_test_xxx"
+ * ```
+ */
+export function formatYaml(vars) {
+    if (vars.length === 0) {
+        return '{}\n';
+    }
+    return (vars
+        .map(({ key, value }) => {
+        // YAML string escaping rules:
+        // - Simple alphanumeric values don't need quotes
+        // - Values with special chars need double quotes
+        // - Double quotes inside values need escaping
+        const needsQuotes = value === '' ||
+            value.includes(':') ||
+            value.includes('#') ||
+            value.includes("'") ||
+            value.includes('"') ||
+            value.includes('\n') ||
+            value.includes('\\') ||
+            value.startsWith(' ') ||
+            value.endsWith(' ') ||
+            value.startsWith('!') ||
+            value.startsWith('&') ||
+            value.startsWith('*') ||
+            value.startsWith('|') ||
+            value.startsWith('>') ||
+            value.startsWith('%') ||
+            value.startsWith('@') ||
+            value.startsWith('`') ||
+            /^(true|false|yes|no|on|off|null|~)$/i.test(value) ||
+            /^-?\d+(\.\d+)?$/.test(value) ||
+            /^0x[0-9a-fA-F]+$/.test(value) ||
+            /^0o[0-7]+$/.test(value);
+        if (needsQuotes) {
+            // Escape backslashes and double quotes for YAML double-quoted strings
+            const escaped = value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n');
+            return `${key}: "${escaped}"`;
+        }
+        return `${key}: ${value}`;
+    })
+        .join('\n') + '\n');
+}

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-export type OutputFormat = 'dotenv' | 'wrangler' | 'json' | 'shell';
+export type OutputFormat = 'dotenv' | 'wrangler' | 'json' | 'shell' | 'yaml';
 export type Environment = 'development' | 'production';
 export interface Target {
     name: string;
@@ -11,6 +11,7 @@ export interface SourceFiles {
     shared: string;
     development: string;
     production: string;
+    local: string;
 }
 export interface HushConfig {
     sources: SourceFiles;
@@ -29,7 +30,18 @@ export interface EncryptOptions {
 }
 export interface EditOptions {
     root: string;
-    file?: 'shared' | 'development' | 'production';
+    file?: 'shared' | 'development' | 'production' | 'local';
+}
+export interface SetOptions {
+    root: string;
+    file?: 'shared' | 'development' | 'production' | 'local';
+    key?: string;
+}
+export interface RunOptions {
+    root: string;
+    env: Environment;
+    target?: string;
+    command: string[];
 }
 export interface PushOptions {
     root: string;
@@ -67,6 +79,11 @@ export interface CheckResult {
     status: 'ok' | 'drift' | 'error';
     files: CheckFileResult[];
 }
+export interface SkillOptions {
+    root: string;
+    global?: boolean;
+    local?: boolean;
+}
 export declare const DEFAULT_SOURCES: SourceFiles;
 export declare const FORMAT_OUTPUT_FILES: Record<OutputFormat, Record<Environment, string>>;
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AACpE,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,CAAC;CAChD;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC;IACjC,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,eAAe,EAAE,WAI7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAiBjF,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC;IACjC,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}

package/dist/types.js

@@ -2,6 +2,7 @@ export const DEFAULT_SOURCES = {
     shared: '.env',
     development: '.env.development',
     production: '.env.production',
+    local: '.env.local',
 };
 export const FORMAT_OUTPUT_FILES = {
     dotenv: {
@@ -20,4 +21,8 @@ export const FORMAT_OUTPUT_FILES = {
         development: '.env.development.sh',
         production: '.env.production.sh',
     },
+    yaml: {
+        development: '.env.development.yaml',
+        production: '.env.production.yaml',
+    },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chriscode/hush",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "SOPS-based secrets management for monorepos. Encrypt once, decrypt everywhere.",
   "type": "module",
   "bin": {