@chriscode/hush 2.8.2 → 2.9.0

package/dist/cli.js

@@ -15,6 +15,8 @@ import { hasCommand } from './commands/has.js';
 import { checkCommand } from './commands/check.js';
 import { skillCommand } from './commands/skill.js';
 import { keysCommand } from './commands/keys.js';
+import { resolveCommand } from './commands/resolve.js';
+import { traceCommand } from './commands/trace.js';
 import { findConfigPath, loadConfig, checkSchemaVersion } from './config/loader.js';
 import { checkForUpdate } from './utils/version-check.js';
 const require = createRequire(import.meta.url);
@@ -40,6 +42,10 @@ ${pc.bold('Commands:')}
   status            Show configuration and status
   skill             Install Claude Code / OpenCode skill
   keys <cmd>        Manage SOPS age keys (setup, generate, pull, push, list)
+
+${pc.bold('Debugging Commands:')}
+  resolve <target>  Show what variables a target receives (AI-safe)
+  trace <key>       Trace a variable through sources and targets (AI-safe)
   
 ${pc.bold('Deprecated Commands:')}
   decrypt           Write secrets to disk (unsafe - use 'run' instead)
@@ -47,9 +53,10 @@ ${pc.bold('Deprecated Commands:')}
 ${pc.bold('Options:')}
   -e, --env <env>   Environment: development or production (default: development)
   -r, --root <dir>  Root directory (default: current directory)
-  -t, --target <t>  Target name from hush.yaml (run only)
+  -t, --target <t>  Target name from hush.yaml (run/resolve only)
   -q, --quiet       Suppress output (has/check commands)
   --dry-run         Preview changes without applying (push only)
+  --verbose         Show detailed output (push --dry-run only)
   --warn            Warn but exit 0 on drift (check only)
   --json            Output machine-readable JSON (check only)
   --only-changed    Only check git-modified files (check only)
@@ -107,6 +114,7 @@ function parseArgs(args) {
     let envExplicit = false;
     let root = process.cwd();
     let dryRun = false;
+    let verbose = false;
     let quiet = false;
     let warn = false;
     let json = false;
@@ -154,6 +162,10 @@ function parseArgs(args) {
             dryRun = true;
             continue;
         }
+        if (arg === '--verbose') {
+            verbose = true;
+            continue;
+        }
         if (arg === '-q' || arg === '--quiet') {
             quiet = true;
             continue;
@@ -230,12 +242,20 @@ function parseArgs(args) {
             key = arg;
             continue;
         }
+        if (command === 'trace' && !arg.startsWith('-') && !key) {
+            key = arg;
+            continue;
+        }
+        if (command === 'resolve' && !arg.startsWith('-') && !target) {
+            target = arg;
+            continue;
+        }
         if (command === 'keys' && !arg.startsWith('-') && !subcommand) {
             subcommand = arg;
             continue;
         }
     }
-    return { command, subcommand, env, envExplicit, root, dryRun, quiet, warn, json, onlyChanged, requireSource, allowPlaintext, global, local, force, gui, vault, file, key, target, cmdArgs };
+    return { command, subcommand, env, envExplicit, root, dryRun, verbose, quiet, warn, json, onlyChanged, requireSource, allowPlaintext, global, local, force, gui, vault, file, key, target, cmdArgs };
 }
 function checkMigrationNeeded(root, command) {
     const skipCommands = ['', 'help', 'version', 'init', 'skill'];
@@ -271,7 +291,7 @@ async function main() {
         printHelp();
         process.exit(0);
     }
-    const { command, subcommand, env, envExplicit, root, dryRun, quiet, warn, json, onlyChanged, requireSource, allowPlaintext, global, local, force, gui, vault, file, key, target, cmdArgs } = parseArgs(args);
+    const { command, subcommand, env, envExplicit, root, dryRun, verbose, quiet, warn, json, onlyChanged, requireSource, allowPlaintext, global, local, force, gui, vault, file, key, target, cmdArgs } = parseArgs(args);
     if (command !== 'run' && !json && !quiet) {
         checkForUpdate(VERSION);
     }
@@ -331,7 +351,7 @@ async function main() {
                 await checkCommand({ root, warn, json, quiet, onlyChanged, requireSource, allowPlaintext });
                 break;
             case 'push':
-                await pushCommand({ root, dryRun });
+                await pushCommand({ root, dryRun, verbose });
                 break;
             case 'status':
                 await statusCommand({ root });
@@ -347,6 +367,22 @@ async function main() {
                 }
                 await keysCommand({ root, subcommand, vault, force });
                 break;
+            case 'resolve':
+                if (!target) {
+                    console.error(pc.red('Usage: hush resolve <target>'));
+                    console.error(pc.dim('Example: hush resolve api-workers'));
+                    process.exit(1);
+                }
+                await resolveCommand({ root, env, target });
+                break;
+            case 'trace':
+                if (!key) {
+                    console.error(pc.red('Usage: hush trace <KEY>'));
+                    console.error(pc.dim('Example: hush trace DATABASE_URL'));
+                    process.exit(1);
+                }
+                await traceCommand({ root, env, key });
+                break;
             default:
                 if (command) {
                     console.error(pc.red(`Unknown command: ${command}`));

package/dist/commands/push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/commands/push.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAU,WAAW,EAAE,MAAM,aAAa,CAAC;AAsBvD,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAiErE"}
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/commands/push.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAU,WAAW,EAAE,MAAM,aAAa,CAAC;AA0BvD,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwErE"}

package/dist/commands/push.js

@@ -8,9 +8,14 @@ import { interpolateVars } from '../core/interpolate.js';
 import { mergeVars } from '../core/merge.js';
 import { parseEnvContent } from '../core/parse.js';
 import { decrypt as sopsDecrypt } from '../core/sops.js';
-function pushSecret(key, value, targetDir, dryRun) {
+function pushSecret(key, value, targetDir, dryRun, verbose) {
     if (dryRun) {
-        console.log(pc.dim(`    [dry-run] ${key}`));
+        if (verbose) {
+            console.log(pc.green(`    + ${key}`));
+        }
+        else {
+            console.log(pc.dim(`    [dry-run] ${key}`));
+        }
         return true;
     }
     try {
@@ -28,11 +33,14 @@ function pushSecret(key, value, targetDir, dryRun) {
     }
 }
 export async function pushCommand(options) {
-    const { root, dryRun } = options;
+    const { root, dryRun, verbose } = options;
     const config = loadConfig(root);
     console.log(pc.blue('Pushing production secrets to Cloudflare Workers...'));
     if (dryRun) {
         console.log(pc.yellow('(dry-run mode)'));
+        if (verbose) {
+            console.log(pc.dim('(verbose output enabled)'));
+        }
     }
     const sharedEncrypted = join(root, config.sources.shared + '.encrypted');
     const prodEncrypted = join(root, config.sources.production + '.encrypted');
@@ -59,11 +67,16 @@ export async function pushCommand(options) {
     for (const target of wranglerTargets) {
         const targetDir = join(root, target.path);
         const filtered = filterVarsForTarget(interpolated, target);
-        console.log(pc.blue(`\n${target.name} (${target.path}/)`));
+        if (dryRun && verbose) {
+            console.log(pc.blue(`\n[DRY RUN] Would push to ${target.name} (${target.path}/):`));
+        }
+        else {
+            console.log(pc.blue(`\n${target.name} (${target.path}/)`));
+        }
         let success = 0;
         let failed = 0;
         for (const { key, value } of filtered) {
-            if (pushSecret(key, value, targetDir, dryRun)) {
+            if (pushSecret(key, value, targetDir, dryRun, verbose)) {
                 if (!dryRun)
                     console.log(pc.green(`    ${key}`));
                 success++;

package/dist/commands/resolve.d.ts

@@ -0,0 +1,8 @@
+import type { Environment } from '../types.js';
+export interface ResolveOptions {
+    root: string;
+    env: Environment;
+    target: string;
+}
+export declare function resolveCommand(options: ResolveOptions): Promise<void>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/commands/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/commands/resolve.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAU,WAAW,EAAU,MAAM,aAAa,CAAC;AAG/D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AA6BD,wBAAsB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAmG3E"}

package/dist/commands/resolve.js

@@ -0,0 +1,111 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import pc from 'picocolors';
+import { loadConfig } from '../config/loader.js';
+import { interpolateVars } from '../core/interpolate.js';
+import { mergeVars } from '../core/merge.js';
+import { parseEnvContent } from '../core/parse.js';
+import { decrypt as sopsDecrypt } from '../core/sops.js';
+import { FORMAT_OUTPUT_FILES } from '../types.js';
+function matchesPattern(key, pattern) {
+    const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
+    return regex.test(key);
+}
+function matchesAnyPattern(key, patterns) {
+    for (const pattern of patterns) {
+        if (matchesPattern(key, pattern)) {
+            return pattern;
+        }
+    }
+    return null;
+}
+function getOutputFilename(target, env) {
+    if (target.filename) {
+        return target.filename;
+    }
+    return FORMAT_OUTPUT_FILES[target.format][env];
+}
+export async function resolveCommand(options) {
+    const { root, env, target: targetName } = options;
+    const config = loadConfig(root);
+    const target = config.targets.find(t => t.name === targetName);
+    if (!target) {
+        console.error(pc.red(`Target not found: ${targetName}`));
+        console.error(pc.dim('Available targets: ' + config.targets.map(t => t.name).join(', ')));
+        process.exit(1);
+    }
+    const sharedEncrypted = join(root, config.sources.shared + '.encrypted');
+    const envEncrypted = join(root, config.sources[env] + '.encrypted');
+    const localEncrypted = join(root, config.sources.local + '.encrypted');
+    const varsBySource = new Map();
+    const allVars = new Map();
+    const loadSource = (path, sourceName) => {
+        if (!existsSync(path))
+            return;
+        const content = sopsDecrypt(path);
+        const vars = parseEnvContent(content);
+        const sourceVars = [];
+        for (const v of vars) {
+            const varSource = { key: v.key, value: v.value, source: sourceName };
+            sourceVars.push(varSource);
+            allVars.set(v.key, varSource);
+        }
+        varsBySource.set(sourceName, sourceVars);
+    };
+    loadSource(sharedEncrypted, config.sources.shared);
+    loadSource(envEncrypted, config.sources[env]);
+    loadSource(localEncrypted, config.sources.local);
+    if (allVars.size === 0) {
+        console.error(pc.red('No encrypted files found'));
+        process.exit(1);
+    }
+    const merged = mergeVars(...Array.from(varsBySource.values()).map(sources => sources.map(s => ({ key: s.key, value: s.value }))));
+    const interpolated = interpolateVars(merged);
+    const included = [];
+    const excluded = [];
+    for (const v of interpolated) {
+        const varSource = allVars.get(v.key);
+        const source = varSource?.source || 'unknown';
+        if (target.include && target.include.length > 0) {
+            const matchedInclude = matchesAnyPattern(v.key, target.include);
+            if (!matchedInclude) {
+                excluded.push({ key: v.key, pattern: `not in include: ${target.include.join(', ')}` });
+                continue;
+            }
+        }
+        if (target.exclude && target.exclude.length > 0) {
+            const matchedExclude = matchesAnyPattern(v.key, target.exclude);
+            if (matchedExclude) {
+                excluded.push({ key: v.key, pattern: matchedExclude });
+                continue;
+            }
+        }
+        included.push({ key: v.key, source });
+    }
+    const outputFile = getOutputFilename(target, env);
+    console.log(pc.bold(`\nTarget: ${pc.cyan(target.name)}`));
+    console.log(`Path: ${pc.dim(target.path + '/')}`);
+    console.log(`Format: ${pc.dim(target.format)} ${pc.dim(`(${outputFile})`)}`);
+    console.log(`Environment: ${pc.dim(env)}`);
+    console.log(pc.green(`\n✅ INCLUDED VARIABLES (${included.length}):`));
+    if (included.length === 0) {
+        console.log(pc.dim('  (none)'));
+    }
+    else {
+        const maxKeyLen = Math.max(...included.map(v => v.key.length));
+        for (const v of included) {
+            console.log(`  ${v.key.padEnd(maxKeyLen)}  ${pc.dim(`(source: ${v.source})`)}`);
+        }
+    }
+    console.log(pc.red(`\n🚫 EXCLUDED VARIABLES (${excluded.length}):`));
+    if (excluded.length === 0) {
+        console.log(pc.dim('  (none)'));
+    }
+    else {
+        const maxKeyLen = Math.max(...excluded.map(v => v.key.length));
+        for (const v of excluded) {
+            console.log(`  ${v.key.padEnd(maxKeyLen)}  ${pc.dim(`(matches: ${v.pattern})`)}`);
+        }
+    }
+    console.log('');
+}

package/dist/commands/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA2jChD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvE"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAkqChD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvE"}

package/dist/commands/skill.js

@@ -105,6 +105,41 @@ npx hush run -e production -- npm build   # Production
 
 ---
 
+## Debugging Secret Issues
+
+When a variable is missing or not appearing where expected, use these commands:
+
+### Why is my variable missing from a target?
+
+\`\`\`bash
+npx hush resolve <target>           # See what variables a target receives
+npx hush resolve api-workers        # Example: check api-workers target
+npx hush resolve api-workers -e prod   # Check with production env
+\`\`\`
+
+This shows:
+- ✅ **Included variables** - what the target will receive
+- 🚫 **Excluded variables** - what was filtered out and WHY (which pattern matched)
+
+### Where does a specific variable go?
+
+\`\`\`bash
+npx hush trace <KEY>                # Trace a variable through all targets
+npx hush trace DATABASE_URL         # Example: trace DATABASE_URL
+\`\`\`
+
+This shows:
+- Which source files contain the variable
+- Which targets include/exclude it and why
+
+### Preview what would be pushed
+
+\`\`\`bash
+npx hush push --dry-run --verbose   # See exactly what would be pushed
+\`\`\`
+
+---
+
 ## Running Programs with Secrets
 
 **This is the primary way to use secrets - they never touch disk!**
@@ -413,6 +448,16 @@ Run \`npx hush init\` to generate configuration.
 
 ### "No sources defined in hush.yaml"
 Edit \`hush.yaml\` and add your source files under \`sources:\`.
+
+### "npm warn Unknown project config node-linker"
+This warning appears when running \`npx hush\` in a pnpm workspace because npm doesn't recognize pnpm-specific config in \`.npmrc\`.
+
+**Fix:** Add \`loglevel=error\` to the project's \`.npmrc\`:
+\`\`\`bash
+echo "loglevel=error" >> .npmrc
+\`\`\`
+
+This suppresses npm warnings while still showing errors. This is a per-project fix for any project using pnpm.
 `,
     'REFERENCE.md': `# Hush Command Reference
 
@@ -548,8 +593,45 @@ Push production secrets to Cloudflare Workers.
 \`\`\`bash
 hush push                          # Push secrets
 hush push --dry-run                # Preview without pushing
+hush push --dry-run --verbose      # Detailed preview of what would be pushed
+\`\`\`
+
+---
+
+## Debugging Commands
+
+### hush resolve <target>
+
+Show what variables a specific target will receive, with filtering details.
+
+\`\`\`bash
+hush resolve api-workers           # Check api-workers target
+hush resolve api-workers -e prod   # Check with production environment
 \`\`\`
 
+**Output shows:**
+- ✅ Included variables (with source file)
+- 🚫 Excluded variables (with matching pattern)
+
+**Use when:** A target is missing expected variables
+
+---
+
+### hush trace <KEY>
+
+Trace a specific variable through all sources and targets.
+
+\`\`\`bash
+hush trace DATABASE_URL            # Trace DATABASE_URL
+hush trace STRIPE_SECRET_KEY       # Trace another variable
+\`\`\`
+
+**Output shows:**
+- Which source files contain the variable
+- Which targets include/exclude it (and why)
+
+**Use when:** You need to understand why a variable appears in some places but not others
+
 ---
 
 ## Deprecated Commands (Avoid)
@@ -923,25 +1005,46 @@ Tell user: "Your editor will open. Add or modify secrets, then save and close."
 
 ### "My app can't find DATABASE_URL"
 
-1. Check if it exists:
+1. **Trace the variable** to see where it exists and where it goes:
    \`\`\`bash
-   npx hush has DATABASE_URL
+   npx hush trace DATABASE_URL
    \`\`\`
+   This shows which source files have it and which targets include/exclude it.
 
-2. Check target distribution:
+2. **Check if it exists** in your current environment:
    \`\`\`bash
-   npx hush inspect
+   npx hush has DATABASE_URL
    \`\`\`
 
-3. Check hush.yaml for filtering:
+3. **Resolve the target** to see what variables it receives:
    \`\`\`bash
-   cat hush.yaml        # Safe - this is config, not secrets
+   npx hush resolve api-workers
    \`\`\`
 
-4. Try running directly:
-   \`\`\`bash
-   npx hush run -- env | grep DATABASE
-   \`\`\`
+### "Target is missing expected variables"
+
+\`\`\`bash
+npx hush resolve <target-name>      # See included/excluded variables
+npx hush resolve <target-name> -e prod   # Check production
+\`\`\`
+
+Look at the 🚫 EXCLUDED section to see which pattern is filtering out your variable.
+
+### "Variable appears in wrong places"
+
+\`\`\`bash
+npx hush trace <VARIABLE_NAME>
+\`\`\`
+
+This shows the full disposition across all targets - which include it and which exclude it.
+
+### "Push is missing some secrets"
+
+\`\`\`bash
+npx hush push --dry-run --verbose
+\`\`\`
+
+This shows exactly what would be pushed to each target.
 
 ---
 

package/dist/commands/trace.d.ts

@@ -0,0 +1,8 @@
+import type { Environment } from '../types.js';
+export interface TraceOptions {
+    root: string;
+    env: Environment;
+    key: string;
+}
+export declare function traceCommand(options: TraceOptions): Promise<void>;
+//# sourceMappingURL=trace.d.ts.map

package/dist/commands/trace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace.d.ts","sourceRoot":"","sources":["../../src/commands/trace.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAU,MAAM,aAAa,CAAC;AAEvD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAuCD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA8DvE"}

package/dist/commands/trace.js

@@ -0,0 +1,87 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import pc from 'picocolors';
+import { loadConfig } from '../config/loader.js';
+import { parseEnvContent } from '../core/parse.js';
+import { decrypt as sopsDecrypt } from '../core/sops.js';
+function matchesPattern(key, pattern) {
+    const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
+    return regex.test(key);
+}
+function matchesAnyPattern(key, patterns) {
+    for (const pattern of patterns) {
+        if (matchesPattern(key, pattern)) {
+            return pattern;
+        }
+    }
+    return null;
+}
+function getTargetDisposition(key, target) {
+    if (target.include && target.include.length > 0) {
+        const matchedInclude = matchesAnyPattern(key, target.include);
+        if (!matchedInclude) {
+            return { status: 'not_included', reason: `not in include: ${target.include.join(', ')}` };
+        }
+    }
+    if (target.exclude && target.exclude.length > 0) {
+        const matchedExclude = matchesAnyPattern(key, target.exclude);
+        if (matchedExclude) {
+            return { status: 'excluded', reason: `matches exclude: ${matchedExclude}` };
+        }
+    }
+    return { status: 'included' };
+}
+export async function traceCommand(options) {
+    const { root, env, key } = options;
+    const config = loadConfig(root);
+    console.log(pc.bold(`\nTracing variable: ${pc.cyan(key)}\n`));
+    console.log(pc.blue('Source Status:'));
+    const sources = [
+        { name: config.sources.shared, path: join(root, config.sources.shared + '.encrypted'), found: false },
+        { name: config.sources.development, path: join(root, config.sources.development + '.encrypted'), found: false },
+        { name: config.sources.production, path: join(root, config.sources.production + '.encrypted'), found: false },
+        { name: config.sources.local, path: join(root, config.sources.local + '.encrypted'), found: false },
+    ];
+    const maxSourceLen = Math.max(...sources.map(s => s.name.length));
+    for (const source of sources) {
+        if (!existsSync(source.path)) {
+            console.log(`  ${source.name.padEnd(maxSourceLen)} : ${pc.dim('(file not found)')}`);
+            continue;
+        }
+        try {
+            const content = sopsDecrypt(source.path);
+            const vars = parseEnvContent(content);
+            const found = vars.some(v => v.key === key);
+            source.found = found;
+            if (found) {
+                console.log(`  ${source.name.padEnd(maxSourceLen)} : ${pc.green('✅ Present')}`);
+            }
+            else {
+                console.log(`  ${source.name.padEnd(maxSourceLen)} : ${pc.dim('❌ Not found')}`);
+            }
+        }
+        catch {
+            console.log(`  ${source.name.padEnd(maxSourceLen)} : ${pc.red('⚠️  Decrypt failed')}`);
+        }
+    }
+    const foundInAnySource = sources.some(s => s.found);
+    console.log(pc.blue(`\nTarget Disposition (Environment: ${env}):`));
+    const maxTargetLen = Math.max(...config.targets.map(t => t.name.length));
+    for (const target of config.targets) {
+        const disposition = getTargetDisposition(key, target);
+        const targetLabel = `[${target.name}]`.padEnd(maxTargetLen + 2);
+        if (!foundInAnySource) {
+            console.log(`  ${targetLabel} : ${pc.yellow('⚠️  Variable not in any source')}`);
+        }
+        else if (disposition.status === 'included') {
+            console.log(`  ${targetLabel} : ${pc.green('✅ Included')}`);
+        }
+        else if (disposition.status === 'excluded') {
+            console.log(`  ${targetLabel} : ${pc.red(`🚫 Excluded`)} ${pc.dim(`(${disposition.reason})`)}`);
+        }
+        else {
+            console.log(`  ${targetLabel} : ${pc.red(`🚫 Not included`)} ${pc.dim(`(${disposition.reason})`)}`);
+        }
+    }
+    console.log('');
+}

package/dist/types.d.ts

@@ -50,6 +50,7 @@ export interface RunOptions {
 export interface PushOptions {
     root: string;
     dryRun: boolean;
+    verbose: boolean;
 }
 export interface StatusOptions {
     root: string;
@@ -94,6 +95,16 @@ export interface SkillOptions {
     global?: boolean;
     local?: boolean;
 }
+export interface ResolveOptions {
+    root: string;
+    env: Environment;
+    target: string;
+}
+export interface TraceOptions {
+    root: string;
+    env: Environment;
+    key: string;
+}
 export declare const DEFAULT_SOURCES: SourceFiles;
 export declare const FORMAT_OUTPUT_FILES: Record<OutputFormat, Record<Environment, string>>;
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chriscode/hush",
-  "version": "2.8.2",
+  "version": "2.9.0",
   "description": "SOPS-based secrets management for monorepos. Encrypt once, decrypt everywhere.",
   "type": "module",
   "bin": {