@chriscode/hush 2.1.0 → 2.3.0

package/dist/config/loader.d.ts

@@ -1,5 +1,10 @@
 import type { HushConfig } from '../types.js';
 export declare function findConfigPath(root: string): string | null;
 export declare function loadConfig(root: string): HushConfig;
+export declare function checkSchemaVersion(config: HushConfig): {
+    needsMigration: boolean;
+    from: number;
+    to: number;
+};
 export declare function validateConfig(config: HushConfig): string[];
 //# sourceMappingURL=loader.d.ts.map

package/dist/config/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAU,MAAM,aAAa,CAAC;AAKtD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ1D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAiBnD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAuB3D"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAK9C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ1D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAmBnD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAO5G;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAuB3D"}

package/dist/config/loader.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { parse as parseYaml } from 'yaml';
-import { DEFAULT_SOURCES } from '../types.js';
+import { DEFAULT_SOURCES, CURRENT_SCHEMA_VERSION } from '../types.js';
 const CONFIG_FILENAMES = ['hush.yaml', 'hush.yml'];
 export function findConfigPath(root) {
     for (const filename of CONFIG_FILENAMES) {
@@ -23,10 +23,20 @@ export function loadConfig(root) {
     const content = readFileSync(configPath, 'utf-8');
     const parsed = parseYaml(content);
     return {
+        schema_version: parsed.schema_version,
+        project: parsed.project,
         sources: { ...DEFAULT_SOURCES, ...parsed.sources },
         targets: parsed.targets ?? [{ name: 'root', path: '.', format: 'dotenv' }],
     };
 }
+export function checkSchemaVersion(config) {
+    const configVersion = config.schema_version ?? 1;
+    return {
+        needsMigration: configVersion < CURRENT_SCHEMA_VERSION,
+        from: configVersion,
+        to: CURRENT_SCHEMA_VERSION,
+    };
+}
 export function validateConfig(config) {
     const errors = [];
     if (!config.sources.shared) {
@@ -42,7 +52,7 @@ export function validateConfig(config) {
         if (!target.format) {
             errors.push(`Target "${target.name}" must have a format`);
         }
-        if (!['dotenv', 'wrangler', 'json', 'shell'].includes(target.format)) {
+        if (!['dotenv', 'wrangler', 'json', 'shell', 'yaml'].includes(target.format)) {
             errors.push(`Target "${target.name}" has invalid format "${target.format}"`);
         }
     }

package/dist/core/sops.d.ts

@@ -3,4 +3,9 @@ export declare function isAgeKeyConfigured(): boolean;
 export declare function decrypt(filePath: string): string;
 export declare function encrypt(inputPath: string, outputPath: string): void;
 export declare function edit(filePath: string): void;
+/**
+ * Set a single key in an encrypted file.
+ * Decrypts to memory, updates the key, re-encrypts.
+ */
+export declare function setKey(filePath: string, key: string, value: string): void;
 //# sourceMappingURL=sops.d.ts.map

package/dist/core/sops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sops.d.ts","sourceRoot":"","sources":["../../src/core/sops.ts"],"names":[],"mappings":"AAyBA,wBAAgB,eAAe,IAAI,OAAO,CAOzC;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CA6BhD;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuBnE;AAED,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAqB3C"}
+{"version":3,"file":"sops.d.ts","sourceRoot":"","sources":["../../src/core/sops.ts"],"names":[],"mappings":"AA0BA,wBAAgB,eAAe,IAAI,OAAO,CAOzC;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CA6BhD;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuBnE;AAED,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAqB3C;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAqDzE"}

package/dist/core/sops.js

@@ -1,6 +1,7 @@
 import { execSync, spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, writeFileSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
+import { tmpdir } from 'node:os';
 function getAgeKeyFile() {
     if (process.env.SOPS_AGE_KEY_FILE) {
         return process.env.SOPS_AGE_KEY_FILE;
@@ -89,3 +90,50 @@ export function edit(filePath) {
         throw new Error(`SOPS edit failed with exit code ${result.status}`);
     }
 }
+/**
+ * Set a single key in an encrypted file.
+ * Decrypts to memory, updates the key, re-encrypts.
+ */
+export function setKey(filePath, key, value) {
+    if (!isSopsInstalled()) {
+        throw new Error('SOPS is not installed. Install with: brew install sops');
+    }
+    let content = '';
+    // If file exists, decrypt it first
+    if (existsSync(filePath)) {
+        content = decrypt(filePath);
+    }
+    // Parse existing content into lines
+    const lines = content.split('\n').filter(line => line.trim() !== '');
+    // Find and update or add the key
+    let found = false;
+    const updatedLines = lines.map(line => {
+        const match = line.match(/^([^=]+)=/);
+        if (match && match[1] === key) {
+            found = true;
+            return `${key}=${value}`;
+        }
+        return line;
+    });
+    if (!found) {
+        updatedLines.push(`${key}=${value}`);
+    }
+    const newContent = updatedLines.join('\n') + '\n';
+    const tempFile = join(tmpdir(), `hush-temp-${Date.now()}.env`);
+    try {
+        writeFileSync(tempFile, newContent, 'utf-8');
+        // Encrypt temp file to the target
+        execSync(`sops --input-type dotenv --output-type dotenv --encrypt "${tempFile}" > "${filePath}"`, {
+            encoding: 'utf-8',
+            shell: '/bin/bash',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            env: getSopsEnv(),
+        });
+    }
+    finally {
+        // Always clean up temp file
+        if (existsSync(tempFile)) {
+            unlinkSync(tempFile);
+        }
+    }
+}

package/dist/lib/age.d.ts

@@ -0,0 +1,16 @@
+export interface AgeKey {
+    private: string;
+    public: string;
+}
+export declare function ageAvailable(): boolean;
+export declare function ageGenerate(): AgeKey;
+export declare function agePublicFromPrivate(privateKey: string): string;
+export declare function keyPath(project: string): string;
+export declare function keyExists(project: string): boolean;
+export declare function keySave(project: string, key: AgeKey): void;
+export declare function keyLoad(project: string): AgeKey | null;
+export declare function keysList(): {
+    project: string;
+    public: string;
+}[];
+//# sourceMappingURL=age.d.ts.map

package/dist/lib/age.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"age.d.ts","sourceRoot":"","sources":["../../src/lib/age.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,wBAAgB,YAAY,IAAI,OAAO,CAOtC;AAED,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAI1D;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAStD;AAED,wBAAgB,QAAQ,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,CAYhE"}

package/dist/lib/age.js

@@ -0,0 +1,61 @@
+import { execSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { homedir } from 'node:os';
+const KEYS_DIR = join(homedir(), '.config', 'sops', 'age', 'keys');
+export function ageAvailable() {
+    try {
+        execSync('which age-keygen', { stdio: 'pipe' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function ageGenerate() {
+    const output = execSync('age-keygen', { encoding: 'utf-8' });
+    const pub = output.match(/public key: (age1[a-z0-9]+)/)?.[1];
+    const priv = output.match(/(AGE-SECRET-KEY-[A-Z0-9]+)/)?.[1];
+    if (!pub || !priv)
+        throw new Error('Failed to generate age key');
+    return { private: priv, public: pub };
+}
+export function agePublicFromPrivate(privateKey) {
+    return execSync(`echo "${privateKey}" | age-keygen -y`, {
+        encoding: 'utf-8',
+        shell: '/bin/bash',
+    }).trim();
+}
+export function keyPath(project) {
+    return join(KEYS_DIR, `${project.replace(/\//g, '-')}.txt`);
+}
+export function keyExists(project) {
+    return existsSync(keyPath(project));
+}
+export function keySave(project, key) {
+    const path = keyPath(project);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `# project: ${project}\n# public key: ${key.public}\n${key.private}\n`, { mode: 0o600 });
+}
+export function keyLoad(project) {
+    const path = keyPath(project);
+    if (!existsSync(path))
+        return null;
+    const content = readFileSync(path, 'utf-8');
+    const pub = content.match(/# public key: (age1[a-z0-9]+)/)?.[1];
+    const priv = content.match(/(AGE-SECRET-KEY-[A-Z0-9]+)/)?.[1];
+    return pub && priv ? { private: priv, public: pub } : null;
+}
+export function keysList() {
+    if (!existsSync(KEYS_DIR))
+        return [];
+    return readdirSync(KEYS_DIR)
+        .filter(f => f.endsWith('.txt'))
+        .map(f => {
+        const content = readFileSync(join(KEYS_DIR, f), 'utf-8');
+        const project = content.match(/# project: (.+)/)?.[1] ?? content.match(/# repo: (.+)/)?.[1];
+        const pub = content.match(/# public key: (age1[a-z0-9]+)/)?.[1];
+        return project && pub ? { project, public: pub } : null;
+    })
+        .filter((k) => k !== null);
+}

package/dist/lib/onepassword.d.ts

@@ -0,0 +1,6 @@
+export declare const OP_ITEM_PREFIX = "SOPS Key - ";
+export declare function opAvailable(): boolean;
+export declare function opGetKey(project: string, vault?: string): string | null;
+export declare function opStoreKey(project: string, privateKey: string, publicKey: string, vault?: string): void;
+export declare function opListKeys(vault?: string): string[];
+//# sourceMappingURL=onepassword.d.ts.map

package/dist/lib/onepassword.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onepassword.d.ts","sourceRoot":"","sources":["../../src/lib/onepassword.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAE5C,wBAAgB,WAAW,IAAI,OAAO,CAOrC;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvE;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAcvG;AAED,wBAAgB,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAcnD"}

package/dist/lib/onepassword.js

@@ -0,0 +1,48 @@
+import { execSync, spawnSync } from 'node:child_process';
+export const OP_ITEM_PREFIX = 'SOPS Key - ';
+export function opAvailable() {
+    try {
+        execSync('op whoami', { stdio: 'pipe' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function opGetKey(project, vault) {
+    try {
+        const vaultArgs = vault ? ['--vault', vault] : [];
+        const result = execSync(['op', 'item', 'get', `${OP_ITEM_PREFIX}${project}`, ...vaultArgs, '--fields', 'password', '--reveal'].join(' '), { encoding: 'utf-8', stdio: 'pipe' });
+        return result.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+export function opStoreKey(project, privateKey, publicKey, vault) {
+    const args = [
+        'item', 'create',
+        '--category', 'password',
+        '--title', `${OP_ITEM_PREFIX}${project}`,
+        ...(vault ? ['--vault', vault] : []),
+        `password=${privateKey}`,
+        `public_key[text]=${publicKey}`,
+    ];
+    const result = spawnSync('op', args, { stdio: 'pipe', encoding: 'utf-8' });
+    if (result.status !== 0) {
+        throw new Error(result.stderr || 'Failed to store in 1Password');
+    }
+}
+export function opListKeys(vault) {
+    try {
+        const vaultArgs = vault ? ['--vault', vault] : [];
+        const result = execSync(['op', 'item', 'list', '--categories', 'password', ...vaultArgs, '--format', 'json'].join(' '), { encoding: 'utf-8', stdio: 'pipe' });
+        const items = JSON.parse(result);
+        return items
+            .filter(i => i.title.startsWith(OP_ITEM_PREFIX))
+            .map(i => i.title.replace(OP_ITEM_PREFIX, ''));
+    }
+    catch {
+        return [];
+    }
+}

package/dist/types.d.ts

@@ -11,11 +11,15 @@ export interface SourceFiles {
     shared: string;
     development: string;
     production: string;
+    local: string;
 }
 export interface HushConfig {
+    schema_version?: number;
+    project?: string;
     sources: SourceFiles;
     targets: Target[];
 }
+export declare const CURRENT_SCHEMA_VERSION = 2;
 export interface EnvVar {
     key: string;
     value: string;
@@ -29,7 +33,19 @@ export interface EncryptOptions {
 }
 export interface EditOptions {
     root: string;
-    file?: 'shared' | 'development' | 'production';
+    file?: 'shared' | 'development' | 'production' | 'local';
+}
+export interface SetOptions {
+    root: string;
+    file?: 'shared' | 'development' | 'production' | 'local';
+    key?: string;
+    gui?: boolean;
+}
+export interface RunOptions {
+    root: string;
+    env: Environment;
+    target?: string;
+    command: string[];
 }
 export interface PushOptions {
     root: string;
@@ -52,6 +68,7 @@ export interface CheckOptions {
     quiet: boolean;
     onlyChanged: boolean;
     requireSource: boolean;
+    allowPlaintext?: boolean;
 }
 export type CheckErrorType = 'SOURCE_MISSING' | 'ENCRYPTED_MISSING' | 'DECRYPT_FAILED' | 'SOPS_NOT_INSTALLED';
 export interface CheckFileResult {
@@ -63,9 +80,14 @@ export interface CheckFileResult {
     changed: string[];
     error?: CheckErrorType;
 }
+export interface PlaintextFileResult {
+    file: string;
+    keyCount: number;
+}
 export interface CheckResult {
-    status: 'ok' | 'drift' | 'error';
+    status: 'ok' | 'drift' | 'error' | 'plaintext';
     files: CheckFileResult[];
+    plaintextFiles?: PlaintextFileResult[];
 }
 export interface SkillOptions {
     root: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,CAAC;CAChD;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC;IACjC,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,eAAO,MAAM,eAAe,EAAE,WAI7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}

package/dist/types.js

@@ -1,7 +1,9 @@
+export const CURRENT_SCHEMA_VERSION = 2;
 export const DEFAULT_SOURCES = {
     shared: '.env',
     development: '.env.development',
     production: '.env.production',
+    local: '.env.local',
 };
 export const FORMAT_OUTPUT_FILES = {
     dotenv: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chriscode/hush",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "description": "SOPS-based secrets management for monorepos. Encrypt once, decrypt everywhere.",
   "type": "module",
   "bin": {