@chriscode/hush 2.2.0 → 2.4.0

package/dist/cli.js

@@ -13,7 +13,9 @@ import { inspectCommand } from './commands/inspect.js';
 import { hasCommand } from './commands/has.js';
 import { checkCommand } from './commands/check.js';
 import { skillCommand } from './commands/skill.js';
-const VERSION = '2.1.0';
+import { keysCommand } from './commands/keys.js';
+import { findConfigPath, loadConfig, checkSchemaVersion } from './config/loader.js';
+const VERSION = '2.3.0';
 function printHelp() {
     console.log(`
 ${pc.bold('hush')} - SOPS-based secrets management for monorepos
@@ -34,6 +36,7 @@ ${pc.bold('Commands:')}
   push              Push secrets to Cloudflare Workers
   status            Show configuration and status
   skill             Install Claude Code / OpenCode skill
+  keys <cmd>        Manage SOPS age keys (setup, generate, pull, push, list)
   
 ${pc.bold('Deprecated Commands:')}
   decrypt           Write secrets to disk (unsafe - use 'run' instead)
@@ -48,20 +51,24 @@ ${pc.bold('Options:')}
   --json            Output machine-readable JSON (check only)
   --only-changed    Only check git-modified files (check only)
   --require-source  Fail if source file is missing (check only)
+  --allow-plaintext Allow plaintext .env files (check only, not recommended)
   --global          Install skill to ~/.claude/skills/ (skill only)
   --local           Install skill to ./.claude/skills/ (skill/set only)
+  --gui             Use macOS dialog for input (set only, for AI agents)
   -h, --help        Show this help message
   -v, --version     Show version number
 
 ${pc.bold('Examples:')}
-  hush init                     Initialize hush.yaml config
+  hush init                     Initialize config + generate keys
   hush encrypt                  Encrypt .env files
   hush run -- npm start         Run with secrets in memory (AI-safe!)
   hush run -e prod -- npm build Run with production secrets
   hush run -t api -- wrangler dev  Run filtered for 'api' target
   hush set DATABASE_URL         Set a secret interactively (AI-safe)
+  hush set API_KEY --gui        Set secret via macOS dialog (for AI agents)
   hush set API_KEY -e prod      Set a production secret
-  hush set API_KEY --local      Set a personal local override
+  hush keys setup               Pull key from 1Password or verify local
+  hush keys generate            Generate new key + backup to 1Password
   hush edit                     Edit all shared secrets in $EDITOR
   hush edit development         Edit development secrets in $EDITOR
   hush edit local               Edit personal local overrides
@@ -92,6 +99,7 @@ function parseFileKey(value) {
 }
 function parseArgs(args) {
     let command = '';
+    let subcommand;
     let env = 'development';
     let envExplicit = false;
     let root = process.cwd();
@@ -101,8 +109,12 @@ function parseArgs(args) {
     let json = false;
     let onlyChanged = false;
     let requireSource = false;
+    let allowPlaintext = false;
     let global = false;
     let local = false;
+    let force = false;
+    let gui = false;
+    let vault;
     let file;
     let key;
     let target;
@@ -159,6 +171,10 @@ function parseArgs(args) {
             requireSource = true;
             continue;
         }
+        if (arg === '--allow-plaintext') {
+            allowPlaintext = true;
+            continue;
+        }
         if (arg === '--global') {
             global = true;
             continue;
@@ -167,6 +183,18 @@ function parseArgs(args) {
             local = true;
             continue;
         }
+        if (arg === '--force' || arg === '-f') {
+            force = true;
+            continue;
+        }
+        if (arg === '--gui') {
+            gui = true;
+            continue;
+        }
+        if (arg === '--vault') {
+            vault = args[++i];
+            continue;
+        }
         if (arg === '-t' || arg === '--target') {
             target = args[++i];
             continue;
@@ -199,8 +227,40 @@ function parseArgs(args) {
             key = arg;
             continue;
         }
+        if (command === 'keys' && !arg.startsWith('-') && !subcommand) {
+            subcommand = arg;
+            continue;
+        }
+    }
+    return { command, subcommand, env, envExplicit, root, dryRun, quiet, warn, json, onlyChanged, requireSource, allowPlaintext, global, local, force, gui, vault, file, key, target, cmdArgs };
+}
+function checkMigrationNeeded(root, command) {
+    const skipCommands = ['', 'help', 'version', 'init', 'skill'];
+    if (skipCommands.includes(command))
+        return;
+    const configPath = findConfigPath(root);
+    if (!configPath)
+        return;
+    const config = loadConfig(root);
+    const { needsMigration, from, to } = checkSchemaVersion(config);
+    if (needsMigration) {
+        console.log('');
+        console.log(pc.yellow('━'.repeat(60)));
+        console.log(pc.yellow(pc.bold('  Migration Required')));
+        console.log(pc.yellow('━'.repeat(60)));
+        console.log('');
+        console.log(`  Your ${pc.cyan('hush.yaml')} uses schema version ${pc.bold(String(from))}.`);
+        console.log(`  Hush ${VERSION} uses schema version ${pc.bold(String(to))}.`);
+        console.log('');
+        console.log(pc.dim('  Migration guide:'));
+        console.log(`  ${pc.cyan(`https://hush-docs.pages.dev/migrations/v${from}-to-v${to}`)}`);
+        console.log('');
+        console.log(pc.dim('  Or ask your AI assistant:'));
+        console.log(pc.dim(`  "Help me migrate hush.yaml from schema v${from} to v${to}"`));
+        console.log('');
+        console.log(pc.yellow('━'.repeat(60)));
+        console.log('');
     }
-    return { command, env, envExplicit, root, dryRun, quiet, warn, json, onlyChanged, requireSource, global, local, file, key, target, cmdArgs };
 }
 async function main() {
     const args = process.argv.slice(2);
@@ -208,7 +268,8 @@ async function main() {
         printHelp();
         process.exit(0);
     }
-    const { command, env, envExplicit, root, dryRun, quiet, warn, json, onlyChanged, requireSource, global, local, file, key, target, cmdArgs } = parseArgs(args);
+    const { command, subcommand, env, envExplicit, root, dryRun, quiet, warn, json, onlyChanged, requireSource, allowPlaintext, global, local, force, gui, vault, file, key, target, cmdArgs } = parseArgs(args);
+    checkMigrationNeeded(root, command);
     try {
         switch (command) {
             case 'init':
@@ -241,7 +302,7 @@ async function main() {
                 else if (envExplicit) {
                     setFile = env;
                 }
-                await setCommand({ root, file: setFile, key });
+                await setCommand({ root, file: setFile, key, gui });
                 break;
             }
             case 'edit':
@@ -261,7 +322,7 @@ async function main() {
                 await hasCommand({ root, env, key, quiet });
                 break;
             case 'check':
-                await checkCommand({ root, warn, json, quiet, onlyChanged, requireSource });
+                await checkCommand({ root, warn, json, quiet, onlyChanged, requireSource, allowPlaintext });
                 break;
             case 'push':
                 await pushCommand({ root, dryRun });
@@ -272,6 +333,14 @@ async function main() {
             case 'skill':
                 await skillCommand({ root, global, local });
                 break;
+            case 'keys':
+                if (!subcommand) {
+                    console.error(pc.red('Usage: hush keys <command>'));
+                    console.error(pc.dim('Commands: setup, generate, pull, push, list'));
+                    process.exit(1);
+                }
+                await keysCommand({ root, subcommand, vault, force });
+                break;
             default:
                 if (command) {
                     console.error(pc.red(`Unknown command: ${command}`));

package/dist/commands/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAmB,WAAW,EAAc,MAAM,aAAa,CAAC;AA+C1F,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA4BvE;AAmLD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BvE"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAmB,WAAW,EAAmC,MAAM,aAAa,CAAC;AAkF/G,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA+BvE;AAuMD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCvE"}

package/dist/commands/check.js

@@ -1,8 +1,8 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { execSync } from 'node:child_process';
 import pc from 'picocolors';
-import { loadConfig, findConfigPath } from '../config/loader.js';
+import { loadConfig } from '../config/loader.js';
 import { parseEnvContent } from '../core/parse.js';
 import { decrypt as sopsDecrypt, isSopsInstalled } from '../core/sops.js';
 import { computeDiff, isInSync } from '../lib/diff.js';
@@ -42,8 +42,41 @@ function getGitChangedFiles(root) {
         return new Set();
     }
 }
+function findPlaintextEnvFiles(root) {
+    const results = [];
+    const plaintextPatterns = ['.env', '.env.development', '.env.production', '.env.local', '.env.staging', '.env.test', '.dev.vars'];
+    const skipDirs = new Set(['node_modules', '.git', 'dist', 'build', '.next', '.nuxt']);
+    function scanDir(dir, relativePath = '') {
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (skipDirs.has(entry))
+                continue;
+            const fullPath = join(dir, entry);
+            const relPath = relativePath ? `${relativePath}/${entry}` : entry;
+            try {
+                if (statSync(fullPath).isDirectory()) {
+                    scanDir(fullPath, relPath);
+                }
+                else if (plaintextPatterns.includes(entry)) {
+                    results.push({ file: relPath, keyCount: 0 });
+                }
+            }
+            catch {
+                continue;
+            }
+        }
+    }
+    scanDir(root);
+    return results;
+}
 export async function check(options) {
-    const { root, requireSource, onlyChanged } = options;
+    const { root, requireSource, onlyChanged, allowPlaintext } = options;
     if (!isSopsInstalled()) {
         return {
             status: 'error',
@@ -58,15 +91,17 @@ export async function check(options) {
                 }],
         };
     }
-    const configPath = findConfigPath(root);
-    if (!configPath) {
-        const config = loadConfig(root);
-        const pairs = getSourceEncryptedPairs(config);
-        return checkPairs(root, pairs, requireSource, onlyChanged);
-    }
     const config = loadConfig(root);
     const pairs = getSourceEncryptedPairs(config);
-    return checkPairs(root, pairs, requireSource, onlyChanged);
+    const result = checkPairs(root, pairs, requireSource, onlyChanged);
+    if (!allowPlaintext) {
+        const plaintextFiles = findPlaintextEnvFiles(root);
+        if (plaintextFiles.length > 0) {
+            result.plaintextFiles = plaintextFiles;
+            result.status = 'plaintext';
+        }
+    }
+    return result;
 }
 function checkPairs(root, pairs, requireSource, onlyChanged) {
     const changedFiles = onlyChanged ? getGitChangedFiles(root) : null;
@@ -160,6 +195,25 @@ function checkPairs(root, pairs, requireSource, onlyChanged) {
 function formatTextOutput(result) {
     const lines = [];
     lines.push('Checking secrets...\n');
+    if (result.plaintextFiles && result.plaintextFiles.length > 0) {
+        lines.push(pc.red(pc.bold('⚠ PLAINTEXT SECRETS DETECTED')));
+        lines.push('');
+        lines.push(pc.red('The following unencrypted .env files were found:'));
+        for (const pf of result.plaintextFiles) {
+            lines.push(pc.red(`  • ${pf.file}`));
+        }
+        lines.push('');
+        lines.push(pc.yellow('These files contain plaintext secrets that could be exposed to AI assistants.'));
+        lines.push('');
+        lines.push(pc.bold('To fix:'));
+        lines.push(pc.dim('  1. Run: hush encrypt'));
+        lines.push(pc.dim('  2. Delete the plaintext files (the .encrypted versions are your source of truth)'));
+        lines.push(pc.dim('  3. Add to .gitignore: .env, .env.*, .dev.vars'));
+        lines.push('');
+        lines.push(pc.dim('To allow plaintext files (not recommended): --allow-plaintext'));
+        lines.push('');
+        return lines.join('\n');
+    }
     for (const file of result.files) {
         if (file.error === 'SOPS_NOT_INSTALLED') {
             lines.push(pc.red('Error: SOPS is not installed'));
@@ -232,6 +286,9 @@ export async function checkCommand(options) {
             console.log(formatTextOutput(result));
         }
     }
+    if (result.status === 'plaintext' && !options.warn) {
+        process.exit(4);
+    }
     if (result.status === 'error') {
         const hasSopsError = result.files.some(f => f.error === 'SOPS_NOT_INSTALLED');
         const hasDecryptError = result.files.some(f => f.error === 'DECRYPT_FAILED');

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAc,WAAW,EAAU,MAAM,aAAa,CAAC;AAqCnE,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCrE"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAc,WAAW,EAAU,MAAM,aAAa,CAAC;AA2InE,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCrE"}

package/dist/commands/init.js

@@ -1,9 +1,99 @@
-import { existsSync, readdirSync, writeFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import pc from 'picocolors';
 import { stringify as stringifyYaml } from 'yaml';
 import { findConfigPath } from '../config/loader.js';
+import { ageAvailable, ageGenerate, keyExists, keySave, keyPath } from '../lib/age.js';
+import { opAvailable, opGetKey, opStoreKey } from '../lib/onepassword.js';
 import { DEFAULT_SOURCES } from '../types.js';
+function getProjectFromPackageJson(root) {
+    const pkgPath = join(root, 'package.json');
+    if (!existsSync(pkgPath))
+        return null;
+    try {
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+        if (typeof pkg.repository === 'string') {
+            const match = pkg.repository.match(/github\.com[/:]([\w-]+\/[\w-]+)/);
+            if (match)
+                return match[1];
+        }
+        if (pkg.repository?.url) {
+            const match = pkg.repository.url.match(/github\.com[/:]([\w-]+\/[\w-]+)/);
+            if (match)
+                return match[1];
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+async function tryExistingLocalKey(project) {
+    if (!keyExists(project))
+        return null;
+    const existing = await import('../lib/age.js').then(m => m.keyLoad(project));
+    if (!existing)
+        return null;
+    console.log(pc.green(`Using existing key for ${pc.cyan(project)}`));
+    return { publicKey: existing.public, source: 'existing' };
+}
+async function tryPullFrom1Password(project) {
+    if (!opAvailable())
+        return null;
+    console.log(pc.dim('Checking 1Password for existing key...'));
+    const priv = opGetKey(project);
+    if (!priv)
+        return null;
+    const { agePublicFromPrivate } = await import('../lib/age.js');
+    const pub = agePublicFromPrivate(priv);
+    keySave(project, { private: priv, public: pub });
+    console.log(pc.green(`Pulled key from 1Password for ${pc.cyan(project)}`));
+    return { publicKey: pub, source: '1password' };
+}
+function generateAndBackupKey(project) {
+    if (!ageAvailable()) {
+        console.log(pc.yellow('age not installed. Run: brew install age'));
+        return null;
+    }
+    console.log(pc.blue(`Generating new key for ${pc.cyan(project)}...`));
+    const key = ageGenerate();
+    keySave(project, key);
+    console.log(pc.green(`Saved to ${keyPath(project)}`));
+    console.log(pc.dim(`Public: ${key.public}`));
+    if (opAvailable()) {
+        try {
+            opStoreKey(project, key.private, key.public);
+            console.log(pc.green('Backed up to 1Password.'));
+        }
+        catch (e) {
+            console.warn(pc.yellow(`Could not backup to 1Password: ${e.message}`));
+        }
+    }
+    return { publicKey: key.public, source: 'generated' };
+}
+async function setupKey(root, project) {
+    if (!project) {
+        console.log(pc.yellow('No project identifier found. Skipping key setup.'));
+        console.log(pc.dim('Add "project: my-project" to hush.yaml or set repository in package.json'));
+        return null;
+    }
+    return ((await tryExistingLocalKey(project)) ||
+        (await tryPullFrom1Password(project)) ||
+        generateAndBackupKey(project));
+}
+function createSopsConfig(root, publicKey) {
+    const sopsPath = join(root, '.sops.yaml');
+    if (existsSync(sopsPath)) {
+        console.log(pc.yellow('.sops.yaml already exists. Add this public key if needed:'));
+        console.log(`  ${publicKey}`);
+        return;
+    }
+    const sopsConfig = stringifyYaml({
+        creation_rules: [{ encrypted_regex: '.*', age: publicKey }]
+    });
+    writeFileSync(sopsPath, sopsConfig, 'utf-8');
+    console.log(pc.green('Created .sops.yaml'));
+}
 function detectTargets(root) {
     const targets = [{ name: 'root', path: '.', format: 'dotenv' }];
     const entries = readdirSync(root, { withFileTypes: true });
@@ -43,10 +133,16 @@ export async function initCommand(options) {
         process.exit(1);
     }
     console.log(pc.blue('Initializing hush...'));
+    const project = getProjectFromPackageJson(root);
+    const keyResult = await setupKey(root, project);
+    if (keyResult) {
+        createSopsConfig(root, keyResult.publicKey);
+    }
     const targets = detectTargets(root);
     const config = {
         sources: DEFAULT_SOURCES,
         targets,
+        ...(project && { project }),
     };
     const yaml = stringifyYaml(config, { indent: 2 });
     const configPath = join(root, 'hush.yaml');
@@ -57,7 +153,6 @@ export async function initCommand(options) {
         console.log(`  ${pc.cyan(target.name)} ${pc.dim(target.path)} ${pc.magenta(target.format)}`);
     }
     console.log(pc.dim('\nNext steps:'));
-    console.log('  1. Create your .env files (.env, .env.development, .env.production)');
-    console.log('  2. Run "hush encrypt" to encrypt them');
-    console.log('  3. Run "hush decrypt" to generate local env files');
+    console.log('  1. Run "hush set <KEY>" to add secrets');
+    console.log('  2. Run "hush run -- <command>" to run with secrets in memory');
 }

package/dist/commands/keys.d.ts

@@ -0,0 +1,8 @@
+export interface KeysOptions {
+    root: string;
+    subcommand: string;
+    vault?: string;
+    force?: boolean;
+}
+export declare function keysCommand(options: KeysOptions): Promise<void>;
+//# sourceMappingURL=keys.d.ts.map

package/dist/commands/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/commands/keys.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAwBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA6HrE"}

package/dist/commands/keys.js

@@ -0,0 +1,136 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import pc from 'picocolors';
+import { stringify as yamlStringify } from 'yaml';
+import { loadConfig } from '../config/loader.js';
+import { opAvailable, opGetKey, opStoreKey, opListKeys } from '../lib/onepassword.js';
+import { ageAvailable, ageGenerate, agePublicFromPrivate, keyExists, keySave, keyLoad, keysList, keyPath } from '../lib/age.js';
+function getProject(root) {
+    const config = loadConfig(root);
+    if (config.project)
+        return config.project;
+    const pkgPath = join(root, 'package.json');
+    if (existsSync(pkgPath)) {
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+        if (typeof pkg.repository === 'string') {
+            const match = pkg.repository.match(/github\.com[/:]([\w-]+\/[\w-]+)/);
+            if (match)
+                return match[1];
+        }
+        if (pkg.repository?.url) {
+            const match = pkg.repository.url.match(/github\.com[/:]([\w-]+\/[\w-]+)/);
+            if (match)
+                return match[1];
+        }
+    }
+    console.error(pc.red('No project identifier found.'));
+    console.error(pc.dim('Add "project: my-project" to hush.yaml'));
+    process.exit(1);
+}
+export async function keysCommand(options) {
+    const { root, subcommand, vault, force } = options;
+    switch (subcommand) {
+        case 'setup': {
+            const project = getProject(root);
+            console.log(pc.blue(`Setting up keys for ${pc.cyan(project)}...`));
+            if (keyExists(project)) {
+                console.log(pc.green('Key already exists locally.'));
+                return;
+            }
+            if (opAvailable()) {
+                const priv = opGetKey(project, vault);
+                if (priv) {
+                    const pub = agePublicFromPrivate(priv);
+                    keySave(project, { private: priv, public: pub });
+                    console.log(pc.green('Pulled key from 1Password.'));
+                    return;
+                }
+            }
+            console.log(pc.yellow('No key found. Run "hush keys generate" to create one.'));
+            break;
+        }
+        case 'generate': {
+            if (!ageAvailable()) {
+                console.error(pc.red('age not installed. Run: brew install age'));
+                process.exit(1);
+            }
+            const project = getProject(root);
+            if (keyExists(project) && !force) {
+                console.error(pc.yellow(`Key exists for ${project}. Use --force to overwrite.`));
+                process.exit(1);
+            }
+            console.log(pc.blue(`Generating key for ${pc.cyan(project)}...`));
+            const key = ageGenerate();
+            keySave(project, key);
+            console.log(pc.green(`Saved to ${keyPath(project)}`));
+            console.log(pc.dim(`Public: ${key.public}`));
+            if (opAvailable()) {
+                try {
+                    opStoreKey(project, key.private, key.public, vault);
+                    console.log(pc.green('Stored in 1Password.'));
+                }
+                catch (e) {
+                    console.warn(pc.yellow(`Could not store in 1Password: ${e.message}`));
+                }
+            }
+            const sopsPath = join(root, '.sops.yaml');
+            if (!existsSync(sopsPath)) {
+                writeFileSync(sopsPath, yamlStringify({ creation_rules: [{ encrypted_regex: '.*', age: key.public }] }));
+                console.log(pc.green('Created .sops.yaml'));
+            }
+            else {
+                console.log(pc.yellow('.sops.yaml exists. Add this public key:'));
+                console.log(`  ${key.public}`);
+            }
+            break;
+        }
+        case 'pull': {
+            if (!opAvailable()) {
+                console.error(pc.red('1Password CLI not available or not signed in.'));
+                process.exit(1);
+            }
+            const project = getProject(root);
+            const priv = opGetKey(project, vault);
+            if (!priv) {
+                console.error(pc.red(`No key in 1Password for ${project}`));
+                process.exit(1);
+            }
+            const pub = agePublicFromPrivate(priv);
+            keySave(project, { private: priv, public: pub });
+            console.log(pc.green(`Pulled and saved to ${keyPath(project)}`));
+            break;
+        }
+        case 'push': {
+            if (!opAvailable()) {
+                console.error(pc.red('1Password CLI not available or not signed in.'));
+                process.exit(1);
+            }
+            const project = getProject(root);
+            const key = keyLoad(project);
+            if (!key) {
+                console.error(pc.red(`No local key for ${project}`));
+                process.exit(1);
+            }
+            opStoreKey(project, key.private, key.public, vault);
+            console.log(pc.green('Pushed to 1Password.'));
+            break;
+        }
+        case 'list': {
+            console.log(pc.blue('Local keys:'));
+            for (const k of keysList()) {
+                console.log(`  ${pc.cyan(k.project)} ${pc.dim(k.public.slice(0, 20))}...`);
+            }
+            if (opAvailable()) {
+                console.log(pc.blue('\n1Password keys:'));
+                for (const project of opListKeys(vault)) {
+                    console.log(`  ${pc.cyan(project)}`);
+                }
+            }
+            break;
+        }
+        default:
+            console.error(pc.red(`Unknown: hush keys ${subcommand}`));
+            console.log(pc.dim('Commands: setup, generate, pull, push, list'));
+            process.exit(1);
+    }
+}

package/dist/commands/set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../src/commands/set.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuD9C,wBAAsB,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CnE"}
+{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../src/commands/set.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAyF9C,wBAAsB,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CnE"}

package/dist/commands/set.js

@@ -1,14 +1,25 @@
+import { execSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { platform } from 'node:os';
 import pc from 'picocolors';
 import { loadConfig } from '../config/loader.js';
 import { setKey } from '../core/sops.js';
-function promptForValue(key) {
+function promptViaMacOSDialog(key) {
+    try {
+        const script = `display dialog "Enter value for ${key}:" default answer "" with hidden answer with title "Hush - Set Secret"`;
+        const result = execSync(`osascript -e '${script}' -e 'text returned of result'`, {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return result.trim();
+    }
+    catch {
+        return null;
+    }
+}
+function promptViaTTY(key) {
     return new Promise((resolve, reject) => {
-        if (!process.stdin.isTTY) {
-            reject(new Error('Interactive input requires a terminal (TTY)'));
-            return;
-        }
         process.stdout.write(`Enter value for ${pc.cyan(key)}: `);
         const stdin = process.stdin;
         stdin.setRawMode(true);
@@ -19,21 +30,21 @@ function promptForValue(key) {
             switch (char) {
                 case '\n':
                 case '\r':
-                case '\u0004': // Ctrl+D
+                case '\u0004':
                     stdin.setRawMode(false);
                     stdin.pause();
                     stdin.removeListener('data', onData);
                     process.stdout.write('\n');
                     resolve(value);
                     break;
-                case '\u0003': // Ctrl+C
+                case '\u0003':
                     stdin.setRawMode(false);
                     stdin.pause();
                     stdin.removeListener('data', onData);
                     process.stdout.write('\n');
                     reject(new Error('Cancelled'));
                     break;
-                case '\u007F': // Backspace
+                case '\u007F':
                 case '\b':
                     if (value.length > 0) {
                         value = value.slice(0, -1);
@@ -42,14 +53,36 @@ function promptForValue(key) {
                     break;
                 default:
                     value += char;
-                    process.stdout.write('\u2022'); // Bullet character for hidden input
+                    process.stdout.write('\u2022');
             }
         };
         stdin.on('data', onData);
     });
 }
+async function promptForValue(key, forceGui) {
+    if (forceGui && platform() === 'darwin') {
+        console.log(pc.dim('Opening dialog for secret input...'));
+        const value = promptViaMacOSDialog(key);
+        if (value !== null) {
+            return value;
+        }
+        throw new Error('Dialog cancelled or failed');
+    }
+    if (process.stdin.isTTY) {
+        return promptViaTTY(key);
+    }
+    if (platform() === 'darwin') {
+        console.log(pc.dim('Opening dialog for secret input...'));
+        const value = promptViaMacOSDialog(key);
+        if (value !== null) {
+            return value;
+        }
+        throw new Error('Dialog cancelled or failed');
+    }
+    throw new Error('Interactive input requires a terminal (TTY) or macOS');
+}
 export async function setCommand(options) {
-    const { root, file, key } = options;
+    const { root, file, key, gui } = options;
     const config = loadConfig(root);
     const fileKey = file ?? 'shared';
     const sourcePath = config.sources[fileKey];
@@ -67,7 +100,7 @@ export async function setCommand(options) {
         process.exit(1);
     }
     try {
-        const value = await promptForValue(key);
+        const value = await promptForValue(key, gui ?? false);
         if (!value) {
             console.error(pc.yellow('No value entered, aborting'));
             process.exit(1);

package/dist/config/loader.d.ts

@@ -1,5 +1,10 @@
 import type { HushConfig } from '../types.js';
 export declare function findConfigPath(root: string): string | null;
 export declare function loadConfig(root: string): HushConfig;
+export declare function checkSchemaVersion(config: HushConfig): {
+    needsMigration: boolean;
+    from: number;
+    to: number;
+};
 export declare function validateConfig(config: HushConfig): string[];
 //# sourceMappingURL=loader.d.ts.map

package/dist/config/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAU,MAAM,aAAa,CAAC;AAKtD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ1D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAiBnD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAuB3D"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAK9C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ1D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAmBnD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAO5G;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAuB3D"}

package/dist/config/loader.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { parse as parseYaml } from 'yaml';
-import { DEFAULT_SOURCES } from '../types.js';
+import { DEFAULT_SOURCES, CURRENT_SCHEMA_VERSION } from '../types.js';
 const CONFIG_FILENAMES = ['hush.yaml', 'hush.yml'];
 export function findConfigPath(root) {
     for (const filename of CONFIG_FILENAMES) {
@@ -23,10 +23,20 @@ export function loadConfig(root) {
     const content = readFileSync(configPath, 'utf-8');
     const parsed = parseYaml(content);
     return {
+        schema_version: parsed.schema_version,
+        project: parsed.project,
         sources: { ...DEFAULT_SOURCES, ...parsed.sources },
         targets: parsed.targets ?? [{ name: 'root', path: '.', format: 'dotenv' }],
     };
 }
+export function checkSchemaVersion(config) {
+    const configVersion = config.schema_version ?? 1;
+    return {
+        needsMigration: configVersion < CURRENT_SCHEMA_VERSION,
+        from: configVersion,
+        to: CURRENT_SCHEMA_VERSION,
+    };
+}
 export function validateConfig(config) {
     const errors = [];
     if (!config.sources.shared) {
@@ -42,7 +52,7 @@ export function validateConfig(config) {
         if (!target.format) {
             errors.push(`Target "${target.name}" must have a format`);
         }
-        if (!['dotenv', 'wrangler', 'json', 'shell'].includes(target.format)) {
+        if (!['dotenv', 'wrangler', 'json', 'shell', 'yaml'].includes(target.format)) {
             errors.push(`Target "${target.name}" has invalid format "${target.format}"`);
         }
     }

package/dist/lib/age.d.ts

@@ -0,0 +1,16 @@
+export interface AgeKey {
+    private: string;
+    public: string;
+}
+export declare function ageAvailable(): boolean;
+export declare function ageGenerate(): AgeKey;
+export declare function agePublicFromPrivate(privateKey: string): string;
+export declare function keyPath(project: string): string;
+export declare function keyExists(project: string): boolean;
+export declare function keySave(project: string, key: AgeKey): void;
+export declare function keyLoad(project: string): AgeKey | null;
+export declare function keysList(): {
+    project: string;
+    public: string;
+}[];
+//# sourceMappingURL=age.d.ts.map

package/dist/lib/age.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"age.d.ts","sourceRoot":"","sources":["../../src/lib/age.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,wBAAgB,YAAY,IAAI,OAAO,CAOtC;AAED,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAI1D;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAStD;AAED,wBAAgB,QAAQ,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,CAYhE"}

package/dist/lib/age.js

@@ -0,0 +1,61 @@
+import { execSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { homedir } from 'node:os';
+const KEYS_DIR = join(homedir(), '.config', 'sops', 'age', 'keys');
+export function ageAvailable() {
+    try {
+        execSync('which age-keygen', { stdio: 'pipe' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function ageGenerate() {
+    const output = execSync('age-keygen', { encoding: 'utf-8' });
+    const pub = output.match(/public key: (age1[a-z0-9]+)/)?.[1];
+    const priv = output.match(/(AGE-SECRET-KEY-[A-Z0-9]+)/)?.[1];
+    if (!pub || !priv)
+        throw new Error('Failed to generate age key');
+    return { private: priv, public: pub };
+}
+export function agePublicFromPrivate(privateKey) {
+    return execSync(`echo "${privateKey}" | age-keygen -y`, {
+        encoding: 'utf-8',
+        shell: '/bin/bash',
+    }).trim();
+}
+export function keyPath(project) {
+    return join(KEYS_DIR, `${project.replace(/\//g, '-')}.txt`);
+}
+export function keyExists(project) {
+    return existsSync(keyPath(project));
+}
+export function keySave(project, key) {
+    const path = keyPath(project);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `# project: ${project}\n# public key: ${key.public}\n${key.private}\n`, { mode: 0o600 });
+}
+export function keyLoad(project) {
+    const path = keyPath(project);
+    if (!existsSync(path))
+        return null;
+    const content = readFileSync(path, 'utf-8');
+    const pub = content.match(/# public key: (age1[a-z0-9]+)/)?.[1];
+    const priv = content.match(/(AGE-SECRET-KEY-[A-Z0-9]+)/)?.[1];
+    return pub && priv ? { private: priv, public: pub } : null;
+}
+export function keysList() {
+    if (!existsSync(KEYS_DIR))
+        return [];
+    return readdirSync(KEYS_DIR)
+        .filter(f => f.endsWith('.txt'))
+        .map(f => {
+        const content = readFileSync(join(KEYS_DIR, f), 'utf-8');
+        const project = content.match(/# project: (.+)/)?.[1] ?? content.match(/# repo: (.+)/)?.[1];
+        const pub = content.match(/# public key: (age1[a-z0-9]+)/)?.[1];
+        return project && pub ? { project, public: pub } : null;
+    })
+        .filter((k) => k !== null);
+}

package/dist/lib/onepassword.d.ts

@@ -0,0 +1,6 @@
+export declare const OP_ITEM_PREFIX = "SOPS Key - ";
+export declare function opAvailable(): boolean;
+export declare function opGetKey(project: string, vault?: string): string | null;
+export declare function opStoreKey(project: string, privateKey: string, publicKey: string, vault?: string): void;
+export declare function opListKeys(vault?: string): string[];
+//# sourceMappingURL=onepassword.d.ts.map

package/dist/lib/onepassword.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onepassword.d.ts","sourceRoot":"","sources":["../../src/lib/onepassword.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAE5C,wBAAgB,WAAW,IAAI,OAAO,CAOrC;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvE;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAcvG;AAED,wBAAgB,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAcnD"}

package/dist/lib/onepassword.js

@@ -0,0 +1,48 @@
+import { execSync, spawnSync } from 'node:child_process';
+export const OP_ITEM_PREFIX = 'SOPS Key - ';
+export function opAvailable() {
+    try {
+        execSync('op whoami', { stdio: 'pipe' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function opGetKey(project, vault) {
+    try {
+        const vaultArgs = vault ? ['--vault', vault] : [];
+        const result = execSync(['op', 'item', 'get', `${OP_ITEM_PREFIX}${project}`, ...vaultArgs, '--fields', 'password', '--reveal'].join(' '), { encoding: 'utf-8', stdio: 'pipe' });
+        return result.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+export function opStoreKey(project, privateKey, publicKey, vault) {
+    const args = [
+        'item', 'create',
+        '--category', 'password',
+        '--title', `${OP_ITEM_PREFIX}${project}`,
+        ...(vault ? ['--vault', vault] : []),
+        `password=${privateKey}`,
+        `public_key[text]=${publicKey}`,
+    ];
+    const result = spawnSync('op', args, { stdio: 'pipe', encoding: 'utf-8' });
+    if (result.status !== 0) {
+        throw new Error(result.stderr || 'Failed to store in 1Password');
+    }
+}
+export function opListKeys(vault) {
+    try {
+        const vaultArgs = vault ? ['--vault', vault] : [];
+        const result = execSync(['op', 'item', 'list', '--categories', 'password', ...vaultArgs, '--format', 'json'].join(' '), { encoding: 'utf-8', stdio: 'pipe' });
+        const items = JSON.parse(result);
+        return items
+            .filter(i => i.title.startsWith(OP_ITEM_PREFIX))
+            .map(i => i.title.replace(OP_ITEM_PREFIX, ''));
+    }
+    catch {
+        return [];
+    }
+}

package/dist/types.d.ts

@@ -14,9 +14,12 @@ export interface SourceFiles {
     local: string;
 }
 export interface HushConfig {
+    schema_version?: number;
+    project?: string;
     sources: SourceFiles;
     targets: Target[];
 }
+export declare const CURRENT_SCHEMA_VERSION = 2;
 export interface EnvVar {
     key: string;
     value: string;
@@ -36,6 +39,7 @@ export interface SetOptions {
     root: string;
     file?: 'shared' | 'development' | 'production' | 'local';
     key?: string;
+    gui?: boolean;
 }
 export interface RunOptions {
     root: string;
@@ -64,6 +68,7 @@ export interface CheckOptions {
     quiet: boolean;
     onlyChanged: boolean;
     requireSource: boolean;
+    allowPlaintext?: boolean;
 }
 export type CheckErrorType = 'SOURCE_MISSING' | 'ENCRYPTED_MISSING' | 'DECRYPT_FAILED' | 'SOPS_NOT_INSTALLED';
 export interface CheckFileResult {
@@ -75,9 +80,14 @@ export interface CheckFileResult {
     changed: string[];
     error?: CheckErrorType;
 }
+export interface PlaintextFileResult {
+    file: string;
+    keyCount: number;
+}
 export interface CheckResult {
-    status: 'ok' | 'drift' | 'error';
+    status: 'ok' | 'drift' | 'error' | 'plaintext';
     files: CheckFileResult[];
+    plaintextFiles?: PlaintextFileResult[];
 }
 export interface SkillOptions {
     root: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC;IACjC,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}

package/dist/types.js

@@ -1,3 +1,4 @@
+export const CURRENT_SCHEMA_VERSION = 2;
 export const DEFAULT_SOURCES = {
     shared: '.env',
     development: '.env.development',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chriscode/hush",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "SOPS-based secrets management for monorepos. Encrypt once, decrypt everywhere.",
   "type": "module",
   "bin": {
@@ -12,6 +12,14 @@
       "types": "./dist/index.d.ts"
     }
   },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepublishOnly": "pnpm build && pnpm test",
+    "type-check": "tsc --noEmit"
+  },
   "keywords": [
     "secrets",
     "sops",
@@ -53,12 +61,5 @@
   ],
   "publishConfig": {
     "access": "public"
-  },
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsc --watch",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "type-check": "tsc --noEmit"
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2025 Chris Hasson
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.