@chriscode/hush 3.0.0 → 3.1.0

package/dist/cli.js

@@ -2,6 +2,7 @@
 import { createRequire } from 'node:module';
 import pc from 'picocolors';
 import { encryptCommand } from './commands/encrypt.js';
+import { decryptCommand } from './commands/decrypt.js';
 import { editCommand } from './commands/edit.js';
 import { setCommand } from './commands/set.js';
 import { runCommand } from './commands/run.js';
@@ -46,6 +47,9 @@ ${pc.bold('Debugging Commands:')}
   resolve <target>  Show what variables a target receives (AI-safe)
   trace <key>       Trace a variable through sources and targets (AI-safe)
 
+${pc.bold('Advanced Commands:')}
+  decrypt --force   Write secrets to disk (requires confirmation, last resort)
+
 ${pc.bold('Options:')}
   -e, --env <env>   Environment: development or production (default: development)
   -r, --root <dir>  Root directory (default: current directory)
@@ -300,6 +304,9 @@ async function main() {
             case 'encrypt':
                 await encryptCommand({ root });
                 break;
+            case 'decrypt':
+                await decryptCommand({ root, env, force });
+                break;
             case 'run':
                 await runCommand({ root, env, target, command: cmdArgs });
                 break;

package/dist/commands/decrypt.d.ts

@@ -0,0 +1,3 @@
+import type { DecryptOptions } from '../types.js';
+export declare function decryptCommand(options: DecryptOptions): Promise<void>;
+//# sourceMappingURL=decrypt.d.ts.map

package/dist/commands/decrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../src/commands/decrypt.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAU,MAAM,aAAa,CAAC;AAmD1D,wBAAsB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA8F3E"}

package/dist/commands/decrypt.js

@@ -0,0 +1,129 @@
+import { createInterface } from 'node:readline';
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import pc from 'picocolors';
+import { loadConfig } from '../config/loader.js';
+import { filterVarsForTarget } from '../core/filter.js';
+import { interpolateVars, getUnresolvedVars } from '../core/interpolate.js';
+import { mergeVars } from '../core/merge.js';
+import { parseEnvContent, parseEnvFile } from '../core/parse.js';
+import { decrypt as sopsDecrypt } from '../core/sops.js';
+import { formatVars } from '../formats/index.js';
+import { FORMAT_OUTPUT_FILES } from '../types.js';
+function getEncryptedPath(sourcePath) {
+    return sourcePath + '.encrypted';
+}
+async function confirmDangerousOperation() {
+    if (!process.stdin.isTTY) {
+        console.error(pc.red('\nError: decrypt --force requires interactive confirmation.'));
+        console.error(pc.dim('This command cannot be run in non-interactive environments.'));
+        console.error(pc.dim('\nUse "hush run -- <command>" instead to inject secrets into memory.'));
+        return false;
+    }
+    console.log('');
+    console.log(pc.red('━'.repeat(70)));
+    console.log(pc.red(pc.bold('  ⚠️  WARNING: WRITING PLAINTEXT SECRETS TO DISK')));
+    console.log(pc.red('━'.repeat(70)));
+    console.log('');
+    console.log(pc.yellow('  This will create unencrypted .env files that:'));
+    console.log(pc.dim('    • Can be read by AI assistants, scripts, and other tools'));
+    console.log(pc.dim('    • May accidentally be committed to git'));
+    console.log(pc.dim('    • Defeat the "encrypted at rest" security model'));
+    console.log('');
+    console.log(pc.green('  Recommended alternative:'));
+    console.log(pc.cyan('    hush run -- <your-command>'));
+    console.log(pc.dim('    Decrypts to memory only, secrets never touch disk.'));
+    console.log('');
+    console.log(pc.red('━'.repeat(70)));
+    console.log('');
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(`${pc.bold('Type "yes" to proceed:')} `, (answer) => {
+            rl.close();
+            if (answer.toLowerCase() === 'yes') {
+                console.log('');
+                resolve(true);
+            }
+            else {
+                console.log(pc.dim('\nAborted. No files were written.'));
+                resolve(false);
+            }
+        });
+    });
+}
+export async function decryptCommand(options) {
+    const { root, env, force } = options;
+    if (!force) {
+        console.error(pc.red('Error: decrypt requires --force flag'));
+        console.error('');
+        console.error(pc.dim('This command writes plaintext secrets to disk, which is generally unsafe.'));
+        console.error(pc.dim('Use "hush run -- <command>" instead for memory-only decryption.'));
+        console.error('');
+        console.error(pc.dim('If you really need plaintext files:'));
+        console.error(pc.cyan('  hush decrypt --force'));
+        process.exit(1);
+    }
+    const confirmed = await confirmDangerousOperation();
+    if (!confirmed) {
+        process.exit(0);
+    }
+    const config = loadConfig(root);
+    console.log(pc.yellow(`⚠️  Writing unencrypted secrets for ${env}...`));
+    const sharedEncrypted = join(root, getEncryptedPath(config.sources.shared));
+    const envEncrypted = join(root, getEncryptedPath(config.sources[env]));
+    const localPath = join(root, '.env.local');
+    const varSources = [];
+    if (existsSync(sharedEncrypted)) {
+        const content = sopsDecrypt(sharedEncrypted);
+        const vars = parseEnvContent(content);
+        varSources.push(vars);
+        console.log(pc.dim(`  ${config.sources.shared}.encrypted: ${vars.length} vars`));
+    }
+    if (existsSync(envEncrypted)) {
+        const content = sopsDecrypt(envEncrypted);
+        const vars = parseEnvContent(content);
+        varSources.push(vars);
+        console.log(pc.dim(`  ${config.sources[env]}.encrypted: ${vars.length} vars`));
+    }
+    if (existsSync(localPath)) {
+        const vars = parseEnvFile(localPath);
+        varSources.push(vars);
+        console.log(pc.dim(`  .env.local: ${vars.length} vars (overrides)`));
+    }
+    if (varSources.length === 0) {
+        console.error(pc.red('No encrypted files found'));
+        console.error(pc.dim(`Expected: ${sharedEncrypted}`));
+        process.exit(1);
+    }
+    const merged = mergeVars(...varSources);
+    const interpolated = interpolateVars(merged);
+    const unresolved = getUnresolvedVars(interpolated);
+    if (unresolved.length > 0) {
+        console.warn(pc.yellow(`  Warning: ${unresolved.length} vars have unresolved references`));
+    }
+    console.log(pc.yellow(`\n⚠️  Writing to ${config.targets.length} targets:`));
+    for (const target of config.targets) {
+        const targetDir = join(root, target.path);
+        const filtered = filterVarsForTarget(interpolated, target);
+        if (filtered.length === 0) {
+            console.log(pc.dim(`  ${target.path}/ - no matching vars, skipped`));
+            continue;
+        }
+        const outputFilename = FORMAT_OUTPUT_FILES[target.format][env];
+        const outputPath = join(targetDir, outputFilename);
+        if (!existsSync(targetDir)) {
+            mkdirSync(targetDir, { recursive: true });
+        }
+        const content = formatVars(filtered, target.format);
+        writeFileSync(outputPath, content, 'utf-8');
+        const relativePath = target.path === '.' ? outputFilename : `${target.path}/${outputFilename}`;
+        console.log(pc.yellow(`  ⚠️  ${relativePath}`) +
+            pc.dim(` (${target.format}, ${filtered.length} vars)`));
+    }
+    console.log('');
+    console.log(pc.yellow('⚠️  Decryption complete - plaintext secrets on disk'));
+    console.log(pc.dim('   Delete these files when done, or use "hush run" next time.'));
+}

package/dist/commands/set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../src/commands/set.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAyF9C,wBAAsB,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CnE"}
+{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../src/commands/set.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAwK9C,wBAAsB,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CnE"}

package/dist/commands/set.js

@@ -18,6 +18,79 @@ function promptViaMacOSDialog(key) {
         return null;
     }
 }
+function promptViaWindowsDialog(key) {
+    try {
+        const psScript = `
+      Add-Type -AssemblyName System.Windows.Forms
+      Add-Type -AssemblyName System.Drawing
+      
+      $form = New-Object System.Windows.Forms.Form
+      $form.Text = 'Hush - Set Secret'
+      $form.Size = New-Object System.Drawing.Size(300,150)
+      $form.StartPosition = 'CenterScreen'
+      
+      $label = New-Object System.Windows.Forms.Label
+      $label.Location = New-Object System.Drawing.Point(10,20)
+      $label.Size = New-Object System.Drawing.Size(280,20)
+      $label.Text = 'Enter value for ${key}:'
+      $form.Controls.Add($label)
+      
+      $textBox = New-Object System.Windows.Forms.TextBox
+      $textBox.Location = New-Object System.Drawing.Point(10,50)
+      $textBox.Size = New-Object System.Drawing.Size(260,20)
+      $textBox.PasswordChar = '*'
+      $form.Controls.Add($textBox)
+      
+      $okButton = New-Object System.Windows.Forms.Button
+      $okButton.Location = New-Object System.Drawing.Point(10,80)
+      $okButton.Size = New-Object System.Drawing.Size(75,23)
+      $okButton.Text = 'OK'
+      $okButton.DialogResult = [System.Windows.Forms.DialogResult]::OK
+      $form.AcceptButton = $okButton
+      $form.Controls.Add($okButton)
+      
+      $form.TopMost = $true
+      
+      $result = $form.ShowDialog()
+      
+      if ($result -eq [System.Windows.Forms.DialogResult]::OK) {
+        Write-Output $textBox.Text
+      } else {
+        exit 1
+      }
+    `;
+        const encodedCommand = Buffer.from(psScript, 'utf16le').toString('base64');
+        const result = execSync(`powershell -EncodedCommand "${encodedCommand}"`, {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return result.trim();
+    }
+    catch {
+        return null;
+    }
+}
+function promptViaLinuxDialog(key) {
+    try {
+        const result = execSync(`zenity --password --title="Hush - Set Secret" --text="Enter value for ${key}:"`, {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return result.trim();
+    }
+    catch {
+        try {
+            const result = execSync(`kdialog --password "Enter value for ${key}:" --title "Hush - Set Secret"`, {
+                encoding: 'utf-8',
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            return result.trim();
+        }
+        catch {
+            return null;
+        }
+    }
+}
 function promptViaTTY(key) {
     return new Promise((resolve, reject) => {
         process.stdout.write(`Enter value for ${pc.cyan(key)}: `);
@@ -60,26 +133,29 @@ function promptViaTTY(key) {
     });
 }
 async function promptForValue(key, forceGui) {
-    if (forceGui && platform() === 'darwin') {
-        console.log(pc.dim('Opening dialog for secret input...'));
-        const value = promptViaMacOSDialog(key);
-        if (value !== null) {
-            return value;
-        }
-        throw new Error('Dialog cancelled or failed');
-    }
-    if (process.stdin.isTTY) {
+    if (process.stdin.isTTY && !forceGui) {
         return promptViaTTY(key);
     }
-    if (platform() === 'darwin') {
-        console.log(pc.dim('Opening dialog for secret input...'));
-        const value = promptViaMacOSDialog(key);
-        if (value !== null) {
-            return value;
-        }
-        throw new Error('Dialog cancelled or failed');
+    console.log(pc.dim('Opening dialog for secret input...'));
+    let value = null;
+    switch (platform()) {
+        case 'darwin':
+            value = promptViaMacOSDialog(key);
+            break;
+        case 'win32':
+            value = promptViaWindowsDialog(key);
+            break;
+        case 'linux':
+            value = promptViaLinuxDialog(key);
+            break;
+    }
+    if (value !== null) {
+        return value;
+    }
+    if (platform() === 'linux') {
+        throw new Error('GUI prompt failed. Please install "zenity" or "kdialog".');
     }
-    throw new Error('Interactive input requires a terminal (TTY) or macOS');
+    throw new Error('Dialog cancelled or failed. Interactive input requires a terminal (TTY) or a supported GUI environment.');
 }
 export async function setCommand(options) {
     const { root, file, key, gui } = options;

package/dist/commands/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAmpChD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvE"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAopChD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvE"}

package/dist/commands/skill.js

@@ -102,6 +102,7 @@ npx hush run -e production -- npm build   # Production
 ### Commands to AVOID:
 - \`cat .env\` - Never read plaintext .env files directly
 - \`hush list\` - Shows actual secret values (use \`hush inspect\` instead)
+- \`hush decrypt --force\` - Writes plaintext to disk (use \`hush run\` instead)
 
 ---
 

package/dist/core/sops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sops.d.ts","sourceRoot":"","sources":["../../src/core/sops.ts"],"names":[],"mappings":"AA0BA,wBAAgB,eAAe,IAAI,OAAO,CAOzC;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CA6BhD;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuBnE;AAED,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAqB3C;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAqDzE"}
+{"version":3,"file":"sops.d.ts","sourceRoot":"","sources":["../../src/core/sops.ts"],"names":[],"mappings":"AA0BA,wBAAgB,eAAe,IAAI,OAAO,CAUzC;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CA6BhD;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAsBnE;AAED,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAsB3C;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CA+CzE"}

package/dist/core/sops.js

@@ -1,12 +1,12 @@
 import { execSync, spawnSync } from 'node:child_process';
 import { existsSync, writeFileSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
-import { tmpdir } from 'node:os';
+import { tmpdir, homedir } from 'node:os';
 function getAgeKeyFile() {
     if (process.env.SOPS_AGE_KEY_FILE) {
         return process.env.SOPS_AGE_KEY_FILE;
     }
-    const defaultPath = join(process.env.HOME || '~', '.config/sops/age/key.txt');
+    const defaultPath = join(homedir(), '.config', 'sops', 'age', 'key.txt');
     if (existsSync(defaultPath)) {
         return defaultPath;
     }
@@ -21,8 +21,11 @@ function getSopsEnv() {
 }
 export function isSopsInstalled() {
     try {
-        execSync('which sops', { stdio: 'ignore' });
-        return true;
+        const result = spawnSync('sops', ['--version'], {
+            stdio: 'ignore',
+            shell: true
+        });
+        return result.status === 0;
     }
     catch {
         return false;
@@ -36,7 +39,7 @@ export function decrypt(filePath) {
         throw new Error(`Encrypted file not found: ${filePath}`);
     }
     if (!isSopsInstalled()) {
-        throw new Error('SOPS is not installed. Install with: brew install sops');
+        throw new Error('SOPS is not installed. Install with: brew install sops (Mac) or scoop install sops (Windows)');
     }
     try {
         const result = execSync(`sops --input-type dotenv --output-type dotenv --decrypt "${filePath}"`, {
@@ -60,12 +63,11 @@ export function encrypt(inputPath, outputPath) {
         throw new Error(`Input file not found: ${inputPath}`);
     }
     if (!isSopsInstalled()) {
-        throw new Error('SOPS is not installed. Install with: brew install sops');
+        throw new Error('SOPS is not installed. Install with: brew install sops (Mac) or scoop install sops (Windows)');
     }
     try {
         execSync(`sops --input-type dotenv --output-type dotenv --encrypt "${inputPath}" > "${outputPath}"`, {
             encoding: 'utf-8',
-            shell: '/bin/bash',
             stdio: ['pipe', 'pipe', 'pipe'],
             env: getSopsEnv(),
         });
@@ -85,6 +87,7 @@ export function edit(filePath) {
     const result = spawnSync('sops', ['--input-type', 'dotenv', '--output-type', 'dotenv', filePath], {
         stdio: 'inherit',
         env: getSopsEnv(),
+        shell: true // Required to find executable on Windows
     });
     if (result.status !== 0) {
         throw new Error(`SOPS edit failed with exit code ${result.status}`);
@@ -99,13 +102,10 @@ export function setKey(filePath, key, value) {
         throw new Error('SOPS is not installed. Install with: brew install sops');
     }
     let content = '';
-    // If file exists, decrypt it first
     if (existsSync(filePath)) {
         content = decrypt(filePath);
     }
-    // Parse existing content into lines
     const lines = content.split('\n').filter(line => line.trim() !== '');
-    // Find and update or add the key
     let found = false;
     const updatedLines = lines.map(line => {
         const match = line.match(/^([^=]+)=/);
@@ -122,16 +122,13 @@ export function setKey(filePath, key, value) {
     const tempFile = join(tmpdir(), `hush-temp-${Date.now()}.env`);
     try {
         writeFileSync(tempFile, newContent, 'utf-8');
-        // Encrypt temp file to the target
         execSync(`sops --input-type dotenv --output-type dotenv --encrypt "${tempFile}" > "${filePath}"`, {
             encoding: 'utf-8',
-            shell: '/bin/bash',
             stdio: ['pipe', 'pipe', 'pipe'],
             env: getSopsEnv(),
         });
     }
     finally {
-        // Always clean up temp file
         if (existsSync(tempFile)) {
             unlinkSync(tempFile);
         }

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export type { OutputFormat, Environment, Target, SourceFiles, HushConfig, EnvVar, EncryptOptions, EditOptions, PushOptions, StatusOptions, InitOptions, ListOptions, } from './types.js';
+export type { OutputFormat, Environment, Target, SourceFiles, HushConfig, EnvVar, DecryptOptions, EncryptOptions, EditOptions, PushOptions, StatusOptions, InitOptions, ListOptions, } from './types.js';
 export { DEFAULT_SOURCES, FORMAT_OUTPUT_FILES } from './types.js';
 export { loadConfig, findConfigPath, validateConfig } from './config/loader.js';
 export { parseEnvContent, parseEnvFile, varsToRecord, recordToVars } from './core/parse.js';
@@ -9,6 +9,7 @@ export { decrypt, encrypt, edit, isSopsInstalled, isAgeKeyConfigured } from './c
 export { maskValue, maskVars, formatMaskedVar } from './core/mask.js';
 export type { MaskedVar } from './core/mask.js';
 export { formatVars, formatDotenv, formatWrangler, formatJson, formatShell } from './formats/index.js';
+export { decryptCommand } from './commands/decrypt.js';
 export { encryptCommand } from './commands/encrypt.js';
 export { editCommand } from './commands/edit.js';
 export { statusCommand } from './commands/status.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,YAAY,EACZ,WAAW,EACX,MAAM,EACN,WAAW,EACX,UAAU,EACV,MAAM,EACN,cAAc,EACd,WAAW,EACX,WAAW,EACX,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAElE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAChH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEvG,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,YAAY,EACZ,WAAW,EACX,MAAM,EACN,WAAW,EACX,UAAU,EACV,MAAM,EACN,cAAc,EACd,cAAc,EACd,WAAW,EACX,WAAW,EACX,aAAa,EACb,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAElE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAChH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEvG,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -7,6 +7,7 @@ export { mergeVars } from './core/merge.js';
 export { decrypt, encrypt, edit, isSopsInstalled, isAgeKeyConfigured } from './core/sops.js';
 export { maskValue, maskVars, formatMaskedVar } from './core/mask.js';
 export { formatVars, formatDotenv, formatWrangler, formatJson, formatShell } from './formats/index.js';
+export { decryptCommand } from './commands/decrypt.js';
 export { encryptCommand } from './commands/encrypt.js';
 export { editCommand } from './commands/edit.js';
 export { statusCommand } from './commands/status.js';

package/dist/types.d.ts

@@ -27,6 +27,11 @@ export interface EnvVar {
 export interface EncryptOptions {
     root: string;
 }
+export interface DecryptOptions {
+    root: string;
+    env: Environment;
+    force: boolean;
+}
 export interface EditOptions {
     root: string;
     file?: 'shared' | 'development' | 'production' | 'local';

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chriscode/hush",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "SOPS-based secrets management for monorepos. Encrypt once, decrypt everywhere.",
   "type": "module",
   "bin": {