@chriscode/hush 2.9.0 → 3.0.0

package/README.md

@@ -193,7 +193,6 @@ targets:
 | `hush skill` | Install AI skill | ✅ |
 | `hush check` | Verify encryption sync | ✅ |
 | `hush list` | List variables (shows values!) | ⚠️ |
-| `hush decrypt` | Write secrets to disk (deprecated) | ⚠️ |
 
 ## AI-Native Design
 

package/dist/cli.js

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import pc from 'picocolors';
-import { decryptCommand } from './commands/decrypt.js';
 import { encryptCommand } from './commands/encrypt.js';
 import { editCommand } from './commands/edit.js';
 import { setCommand } from './commands/set.js';
@@ -46,9 +45,6 @@ ${pc.bold('Commands:')}
 ${pc.bold('Debugging Commands:')}
   resolve <target>  Show what variables a target receives (AI-safe)
   trace <key>       Trace a variable through sources and targets (AI-safe)
-  
-${pc.bold('Deprecated Commands:')}
-  decrypt           Write secrets to disk (unsafe - use 'run' instead)
 
 ${pc.bold('Options:')}
   -e, --env <env>   Environment: development or production (default: development)
@@ -304,19 +300,6 @@ async function main() {
             case 'encrypt':
                 await encryptCommand({ root });
                 break;
-            case 'decrypt':
-                console.warn(pc.yellow('⚠️  Warning: "hush decrypt" is deprecated and writes unencrypted secrets to disk.'));
-                console.warn(pc.yellow('   Use "hush run -- <command>" instead for better security.'));
-                console.warn(pc.dim('   To suppress this warning, use "hush unsafe:decrypt"'));
-                console.warn('');
-                await decryptCommand({ root, env });
-                break;
-            case 'unsafe:decrypt':
-                console.warn(pc.red('⚠️  UNSAFE MODE: Writing unencrypted secrets to disk.'));
-                console.warn(pc.red('   These files will be readable by AI assistants and other tools.'));
-                console.warn('');
-                await decryptCommand({ root, env });
-                break;
             case 'run':
                 await runCommand({ root, env, target, command: cmdArgs });
                 break;

package/dist/commands/edit.js

@@ -18,5 +18,5 @@ export async function editCommand(options) {
     console.log(pc.dim('Changes will be encrypted on save'));
     sopsEdit(encryptedPath);
     console.log(pc.green('\nEdit complete'));
-    console.log(pc.dim('Run "hush decrypt" to regenerate local env files'));
+    console.log(pc.dim('Run "hush run -- <command>" to use updated secrets'));
 }

package/dist/commands/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAkqChD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvE"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAmpChD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvE"}

package/dist/commands/skill.js

@@ -100,8 +100,8 @@ npx hush run -e production -- npm build   # Production
 | \`npx hush keys setup\` | Set up encryption keys | New team member |
 
 ### Commands to AVOID:
-- \`hush decrypt\` - Writes plaintext to disk (security risk!)
 - \`cat .env\` - Never read plaintext .env files directly
+- \`hush list\` - Shows actual secret values (use \`hush inspect\` instead)
 
 ---
 
@@ -634,21 +634,6 @@ hush trace STRIPE_SECRET_KEY       # Trace another variable
 
 ---
 
-## Deprecated Commands (Avoid)
-
-### hush decrypt / hush unsafe:decrypt ⚠️
-
-**DEPRECATED:** Writes unencrypted secrets to disk, defeating the "encrypted at rest" model.
-
-\`\`\`bash
-hush decrypt                       # Writes plaintext .env files (avoid!)
-hush unsafe:decrypt                # Same, explicit unsafe mode
-\`\`\`
-
-Use \`hush run -- <command>\` instead.
-
----
-
 ## Quick Reference
 
 | Command | Purpose |

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export type { OutputFormat, Environment, Target, SourceFiles, HushConfig, EnvVar, DecryptOptions, EncryptOptions, EditOptions, PushOptions, StatusOptions, InitOptions, ListOptions, } from './types.js';
+export type { OutputFormat, Environment, Target, SourceFiles, HushConfig, EnvVar, EncryptOptions, EditOptions, PushOptions, StatusOptions, InitOptions, ListOptions, } from './types.js';
 export { DEFAULT_SOURCES, FORMAT_OUTPUT_FILES } from './types.js';
 export { loadConfig, findConfigPath, validateConfig } from './config/loader.js';
 export { parseEnvContent, parseEnvFile, varsToRecord, recordToVars } from './core/parse.js';
@@ -9,7 +9,6 @@ export { decrypt, encrypt, edit, isSopsInstalled, isAgeKeyConfigured } from './c
 export { maskValue, maskVars, formatMaskedVar } from './core/mask.js';
 export type { MaskedVar } from './core/mask.js';
 export { formatVars, formatDotenv, formatWrangler, formatJson, formatShell } from './formats/index.js';
-export { decryptCommand } from './commands/decrypt.js';
 export { encryptCommand } from './commands/encrypt.js';
 export { editCommand } from './commands/edit.js';
 export { statusCommand } from './commands/status.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,YAAY,EACZ,WAAW,EACX,MAAM,EACN,WAAW,EACX,UAAU,EACV,MAAM,EACN,cAAc,EACd,cAAc,EACd,WAAW,EACX,WAAW,EACX,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAElE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAChH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEvG,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,YAAY,EACZ,WAAW,EACX,MAAM,EACN,WAAW,EACX,UAAU,EACV,MAAM,EACN,cAAc,EACd,WAAW,EACX,WAAW,EACX,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAElE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAChH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEvG,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -7,7 +7,6 @@ export { mergeVars } from './core/merge.js';
 export { decrypt, encrypt, edit, isSopsInstalled, isAgeKeyConfigured } from './core/sops.js';
 export { maskValue, maskVars, formatMaskedVar } from './core/mask.js';
 export { formatVars, formatDotenv, formatWrangler, formatJson, formatShell } from './formats/index.js';
-export { decryptCommand } from './commands/decrypt.js';
 export { encryptCommand } from './commands/encrypt.js';
 export { editCommand } from './commands/edit.js';
 export { statusCommand } from './commands/status.js';

package/dist/types.d.ts

@@ -24,10 +24,6 @@ export interface EnvVar {
     key: string;
     value: string;
 }
-export interface DecryptOptions {
-    env: Environment;
-    root: string;
-}
 export interface EncryptOptions {
     root: string;
 }

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chriscode/hush",
-  "version": "2.9.0",
+  "version": "3.0.0",
   "description": "SOPS-based secrets management for monorepos. Encrypt once, decrypt everywhere.",
   "type": "module",
   "bin": {

package/dist/commands/decrypt.d.ts

@@ -1,3 +0,0 @@
-import type { DecryptOptions } from '../types.js';
-export declare function decryptCommand(options: DecryptOptions): Promise<void>;
-//# sourceMappingURL=decrypt.d.ts.map

package/dist/commands/decrypt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../src/commands/decrypt.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAU,MAAM,aAAa,CAAC;AAO1D,wBAAsB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA2E3E"}

package/dist/commands/decrypt.js

@@ -1,71 +0,0 @@
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import pc from 'picocolors';
-import { loadConfig } from '../config/loader.js';
-import { filterVarsForTarget } from '../core/filter.js';
-import { interpolateVars, getUnresolvedVars } from '../core/interpolate.js';
-import { mergeVars } from '../core/merge.js';
-import { parseEnvContent, parseEnvFile } from '../core/parse.js';
-import { decrypt as sopsDecrypt } from '../core/sops.js';
-import { formatVars } from '../formats/index.js';
-import { FORMAT_OUTPUT_FILES } from '../types.js';
-function getEncryptedPath(sourcePath) {
-    return sourcePath + '.encrypted';
-}
-export async function decryptCommand(options) {
-    const { root, env } = options;
-    const config = loadConfig(root);
-    console.log(pc.blue(`Decrypting for ${env}...`));
-    const sharedEncrypted = join(root, getEncryptedPath(config.sources.shared));
-    const envEncrypted = join(root, getEncryptedPath(config.sources[env]));
-    const localPath = join(root, '.env.local');
-    const varSources = [];
-    if (existsSync(sharedEncrypted)) {
-        const content = sopsDecrypt(sharedEncrypted);
-        const vars = parseEnvContent(content);
-        varSources.push(vars);
-        console.log(pc.dim(`  ${config.sources.shared}.encrypted: ${vars.length} vars`));
-    }
-    if (existsSync(envEncrypted)) {
-        const content = sopsDecrypt(envEncrypted);
-        const vars = parseEnvContent(content);
-        varSources.push(vars);
-        console.log(pc.dim(`  ${config.sources[env]}.encrypted: ${vars.length} vars`));
-    }
-    if (existsSync(localPath)) {
-        const vars = parseEnvFile(localPath);
-        varSources.push(vars);
-        console.log(pc.dim(`  .env.local: ${vars.length} vars (overrides)`));
-    }
-    if (varSources.length === 0) {
-        console.error(pc.red('No encrypted files found'));
-        console.error(pc.dim(`Expected: ${sharedEncrypted}`));
-        process.exit(1);
-    }
-    const merged = mergeVars(...varSources);
-    const interpolated = interpolateVars(merged);
-    const unresolved = getUnresolvedVars(interpolated);
-    if (unresolved.length > 0) {
-        console.warn(pc.yellow(`  Warning: ${unresolved.length} vars have unresolved references`));
-    }
-    console.log(pc.blue(`\nWriting to ${config.targets.length} targets:`));
-    for (const target of config.targets) {
-        const targetDir = join(root, target.path);
-        const filtered = filterVarsForTarget(interpolated, target);
-        if (filtered.length === 0) {
-            console.log(pc.dim(`  ${target.path}/ - no matching vars, skipped`));
-            continue;
-        }
-        const outputFilename = FORMAT_OUTPUT_FILES[target.format][env];
-        const outputPath = join(targetDir, outputFilename);
-        if (!existsSync(targetDir)) {
-            mkdirSync(targetDir, { recursive: true });
-        }
-        const content = formatVars(filtered, target.format);
-        writeFileSync(outputPath, content, 'utf-8');
-        const relativePath = target.path === '.' ? outputFilename : `${target.path}/${outputFilename}`;
-        console.log(pc.green(`  ${relativePath}`) +
-            pc.dim(` (${target.format}, ${filtered.length} vars)`));
-    }
-    console.log(pc.green('\nDecryption complete'));
-}