@chriscode/hush 4.1.1 → 4.2.0

package/dist/cli.js

@@ -40,7 +40,7 @@ ${pc.bold('Commands:')}
   inspect           List all variables (masked values, AI-safe)
   has <key>         Check if a secret exists (exit 0 if set, 1 if not)
   check             Verify secrets are encrypted (for pre-commit hooks)
-  push              Push secrets to Cloudflare Workers
+  push              Push secrets to Cloudflare (Workers and Pages)
   status            Show configuration and status
   skill             Install Claude Code / OpenCode skill
   keys <cmd>        Manage SOPS age keys (setup, generate, pull, push, list)
@@ -57,7 +57,7 @@ ${pc.bold('Advanced Commands:')}
 ${pc.bold('Options:')}
   -e, --env <env>   Environment: development or production (default: development)
   -r, --root <dir>  Root directory (default: current directory)
-  -t, --target <t>  Target name from hush.yaml (run/resolve only)
+  -t, --target <t>  Target name from hush.yaml (run/resolve/push)
   -q, --quiet       Suppress output (has/check commands)
   --dry-run         Preview changes without applying (push only)
   --verbose         Show detailed output (push --dry-run only)
@@ -79,6 +79,11 @@ ${pc.bold('Variable Expansion (v4+):')}
     \${VAR:-default}  Pull VAR, use default if missing
     \${env:VAR}       Read from system environment (CI, etc.)
   
+  Behavior:
+    - Template vars are merged with target filters (additive)
+    - Template vars take precedence over target filters
+    - Subdirectory templates are safe to commit
+  
   Example subdirectory template (apps/mobile/.env):
     EXPO_PUBLIC_API_URL=\${API_URL}
     PORT=\${PORT:-3000}
@@ -90,8 +95,8 @@ ${pc.bold('Examples:')}
   hush encrypt                  Encrypt .env files
   hush run -- npm start         Run with secrets in memory (AI-safe!)
   hush run -e prod -- npm build Run with production secrets
-  hush run -t api -- wrangler dev  Run filtered for 'api' target
-  cd apps/mobile && hush run -- expo start  Run from subdirectory with templates
+  hush run -t api -- wrangler dev  Run filtered for 'api' target (root secrets only)
+  cd apps/mobile && hush run -- expo start  Run from subdirectory (applies template + target filters)
   hush set DATABASE_URL         Set a secret interactively (AI-safe)
   hush set API_KEY --gui        Set secret via macOS dialog (for AI agents)
   hush set API_KEY -e prod      Set a production secret
@@ -105,6 +110,7 @@ ${pc.bold('Examples:')}
   hush has API_KEY -q && echo "API_KEY is configured"
   hush check                    Verify secrets are encrypted
   hush push --dry-run           Preview push to Cloudflare
+  hush push -t app              Push only the 'app' target
   hush status                   Show current status
   hush skill                    Install Claude skill (interactive)
 `);
@@ -359,7 +365,7 @@ async function main() {
                 await checkCommand({ root, warn, json, quiet, onlyChanged, requireSource, allowPlaintext });
                 break;
             case 'push':
-                await pushCommand({ root, dryRun, verbose });
+                await pushCommand({ root, dryRun, verbose, target });
                 break;
             case 'status':
                 await statusCommand({ root });

package/dist/commands/push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/commands/push.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAU,WAAW,EAAE,MAAM,aAAa,CAAC;AA0BvD,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwErE"}
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/commands/push.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAU,WAAW,EAAqC,MAAM,aAAa,CAAC;AAgH1F,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA6GrE"}

package/dist/commands/push.js

@@ -1,5 +1,5 @@
 import { execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, writeFileSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import pc from 'picocolors';
 import { loadConfig } from '../config/loader.js';
@@ -8,7 +8,8 @@ import { interpolateVars } from '../core/interpolate.js';
 import { mergeVars } from '../core/merge.js';
 import { parseEnvContent } from '../core/parse.js';
 import { decrypt as sopsDecrypt } from '../core/sops.js';
-function pushSecret(key, value, targetDir, dryRun, verbose) {
+import { loadLocalTemplates, resolveTemplateVars } from '../core/template.js';
+function pushWorkerSecret(key, value, targetDir, dryRun, verbose) {
     if (dryRun) {
         if (verbose) {
             console.log(pc.green(`    + ${key}`));
@@ -32,10 +33,80 @@ function pushSecret(key, value, targetDir, dryRun, verbose) {
         return false;
     }
 }
+function pushPagesSecrets(vars, projectName, targetDir, dryRun, verbose) {
+    if (dryRun) {
+        for (const { key } of vars) {
+            if (verbose) {
+                console.log(pc.green(`    + ${key}`));
+            }
+            else {
+                console.log(pc.dim(`    [dry-run] ${key}`));
+            }
+        }
+        return { success: vars.length, failed: 0 };
+    }
+    const secretsJson = {};
+    for (const { key, value } of vars) {
+        secretsJson[key] = value;
+    }
+    const tempFile = join(targetDir, '.hush-secrets-temp.json');
+    try {
+        writeFileSync(tempFile, JSON.stringify(secretsJson, null, 2));
+        execSync(`wrangler pages secret bulk "${tempFile}" --project-name "${projectName}"`, {
+            cwd: targetDir,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            shell: '/bin/bash',
+        });
+        for (const { key } of vars) {
+            console.log(pc.green(`    ${key}`));
+        }
+        return { success: vars.length, failed: 0 };
+    }
+    catch (error) {
+        const err = error;
+        const stderrStr = err.stderr instanceof Buffer ? err.stderr.toString() : (err.stderr || err.message || 'Unknown error');
+        console.error(pc.red(`    Failed to push secrets: ${stderrStr}`));
+        return { success: 0, failed: vars.length };
+    }
+    finally {
+        if (existsSync(tempFile)) {
+            unlinkSync(tempFile);
+        }
+    }
+}
+function getTargetsWithPush(config, targetFilter) {
+    const pushableTargets = config.targets.filter(t => {
+        const hasPushConfig = t.push_to !== undefined;
+        const isWranglerFormat = t.format === 'wrangler';
+        return hasPushConfig || isWranglerFormat;
+    });
+    if (targetFilter) {
+        const filtered = pushableTargets.filter(t => t.name === targetFilter);
+        if (filtered.length === 0) {
+            const availableTargets = pushableTargets.map(t => t.name).join(', ');
+            throw new Error(`Target "${targetFilter}" not found or has no push configuration.\n` +
+                `Available pushable targets: ${availableTargets || '(none)'}`);
+        }
+        return filtered;
+    }
+    return pushableTargets;
+}
+function getPushType(target) {
+    if (target.push_to) {
+        return target.push_to.type;
+    }
+    return 'cloudflare-workers';
+}
+function getPagesProject(target) {
+    if (target.push_to?.type === 'cloudflare-pages') {
+        return target.push_to.project;
+    }
+    throw new Error(`Target "${target.name}" is not configured for Cloudflare Pages`);
+}
 export async function pushCommand(options) {
-    const { root, dryRun, verbose } = options;
+    const { root, dryRun, verbose, target: targetFilter } = options;
     const config = loadConfig(root);
-    console.log(pc.blue('Pushing production secrets to Cloudflare Workers...'));
+    console.log(pc.blue('Pushing production secrets to Cloudflare...'));
     if (dryRun) {
         console.log(pc.yellow('(dry-run mode)'));
         if (verbose) {
@@ -59,30 +130,61 @@ export async function pushCommand(options) {
     }
     const merged = mergeVars(...varSources);
     const interpolated = interpolateVars(merged);
-    const wranglerTargets = config.targets.filter(t => t.format === 'wrangler');
-    if (wranglerTargets.length === 0) {
-        console.error(pc.red('No wrangler targets configured'));
+    const rootSecretsRecord = {};
+    for (const { key, value } of interpolated) {
+        rootSecretsRecord[key] = value;
+    }
+    let pushableTargets;
+    try {
+        pushableTargets = getTargetsWithPush(config, targetFilter);
+    }
+    catch (error) {
+        console.error(pc.red(error.message));
+        process.exit(1);
+    }
+    if (pushableTargets.length === 0) {
+        console.error(pc.red('No targets configured for push'));
+        console.error(pc.dim('Add format: wrangler or push_to: { type: cloudflare-pages, project: ... } to a target'));
         process.exit(1);
     }
-    for (const target of wranglerTargets) {
+    for (const target of pushableTargets) {
         const targetDir = join(root, target.path);
-        const filtered = filterVarsForTarget(interpolated, target);
+        const pushType = getPushType(target);
+        let filtered = filterVarsForTarget(interpolated, target);
+        const localTemplate = loadLocalTemplates(targetDir, 'production');
+        if (localTemplate.hasTemplate) {
+            const templateVars = resolveTemplateVars(localTemplate.vars, rootSecretsRecord, { processEnv: process.env });
+            filtered = mergeVars(filtered, templateVars);
+        }
+        if (filtered.length === 0) {
+            console.log(pc.dim(`\n${target.name} - no matching vars, skipped`));
+            continue;
+        }
+        const typeLabel = pushType === 'cloudflare-pages' ? 'Pages' : 'Workers';
         if (dryRun && verbose) {
-            console.log(pc.blue(`\n[DRY RUN] Would push to ${target.name} (${target.path}/):`));
+            console.log(pc.blue(`\n[DRY RUN] Would push to ${target.name} (${typeLabel}, ${target.path}/):`));
         }
         else {
-            console.log(pc.blue(`\n${target.name} (${target.path}/)`));
+            console.log(pc.blue(`\n${target.name} (${typeLabel}, ${target.path}/)`));
         }
         let success = 0;
         let failed = 0;
-        for (const { key, value } of filtered) {
-            if (pushSecret(key, value, targetDir, dryRun, verbose)) {
-                if (!dryRun)
-                    console.log(pc.green(`    ${key}`));
-                success++;
-            }
-            else {
-                failed++;
+        if (pushType === 'cloudflare-pages') {
+            const projectName = getPagesProject(target);
+            const result = pushPagesSecrets(filtered, projectName, targetDir, dryRun, verbose);
+            success = result.success;
+            failed = result.failed;
+        }
+        else {
+            for (const { key, value } of filtered) {
+                if (pushWorkerSecret(key, value, targetDir, dryRun, verbose)) {
+                    if (!dryRun)
+                        console.log(pc.green(`    ${key}`));
+                    success++;
+                }
+                else {
+                    failed++;
+                }
             }
         }
         console.log(pc.dim(`  ${success} pushed, ${failed} failed`));

package/dist/commands/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/commands/resolve.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAU,WAAW,EAAU,MAAM,aAAa,CAAC;AAG/D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AA6BD,wBAAsB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAmG3E"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/commands/resolve.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAU,WAAW,EAAU,MAAM,aAAa,CAAC;AAG/D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AA6BD,wBAAsB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAmI3E"}

package/dist/commands/resolve.js

@@ -6,6 +6,7 @@ import { interpolateVars } from '../core/interpolate.js';
 import { mergeVars } from '../core/merge.js';
 import { parseEnvContent } from '../core/parse.js';
 import { decrypt as sopsDecrypt } from '../core/sops.js';
+import { loadLocalTemplates } from '../core/template.js';
 import { FORMAT_OUTPUT_FILES } from '../types.js';
 function matchesPattern(key, pattern) {
     const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
@@ -87,7 +88,7 @@ export async function resolveCommand(options) {
     console.log(`Path: ${pc.dim(target.path + '/')}`);
     console.log(`Format: ${pc.dim(target.format)} ${pc.dim(`(${outputFile})`)}`);
     console.log(`Environment: ${pc.dim(env)}`);
-    console.log(pc.green(`\n✅ INCLUDED VARIABLES (${included.length}):`));
+    console.log(pc.green(`\n✅ ROOT SECRETS (Matched Filters) (${included.length}):`));
     if (included.length === 0) {
         console.log(pc.dim('  (none)'));
     }
@@ -107,5 +108,33 @@ export async function resolveCommand(options) {
             console.log(`  ${v.key.padEnd(maxKeyLen)}  ${pc.dim(`(matches: ${v.pattern})`)}`);
         }
     }
+    const targetAbsPath = join(root, target.path);
+    const localTemplate = loadLocalTemplates(targetAbsPath, env);
+    if (localTemplate.hasTemplate) {
+        console.log(pc.blue(`\n📄 TEMPLATE EXPANSIONS (${pc.dim(join(target.path, '.env'))}):`));
+        const maxKeyLen = Math.max(...localTemplate.vars.map(v => v.key.length));
+        for (const v of localTemplate.vars) {
+            console.log(`  ${v.key.padEnd(maxKeyLen)}  ${pc.dim(`← ${v.value}`)}`);
+        }
+        // Calculate final merged list for clarity
+        const finalKeys = new Set([
+            ...included.map(v => v.key),
+            ...localTemplate.vars.map(v => v.key)
+        ]);
+        console.log(pc.magenta(`\n📦 FINAL INJECTION (${finalKeys.size} total):`));
+        const sortedKeys = Array.from(finalKeys).sort();
+        for (const key of sortedKeys) {
+            const isTemplate = localTemplate.vars.some(v => v.key === key);
+            const isRoot = included.some(v => v.key === key);
+            let sourceInfo = '';
+            if (isTemplate && isRoot)
+                sourceInfo = pc.dim('(template overrides root)');
+            else if (isTemplate)
+                sourceInfo = pc.dim('(template)');
+            else if (isRoot)
+                sourceInfo = pc.dim('(root)');
+            console.log(`  ${key}  ${sourceInfo}`);
+        }
+    }
     console.log('');
 }

package/dist/commands/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAmC,MAAM,aAAa,CAAC;AAkD/E,wBAAsB,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAuFnE"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAmC,MAAM,aAAa,CAAC;AAkD/E,wBAAsB,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA8GnE"}

package/dist/commands/run.js

@@ -1,6 +1,6 @@
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import pc from 'picocolors';
 import { loadConfig, findProjectRoot } from '../config/loader.js';
 import { filterVarsForTarget } from '../core/filter.js';
@@ -67,20 +67,26 @@ export async function runCommand(options) {
     const rootSecrets = getDecryptedSecrets(projectRoot, env, config);
     const rootSecretsRecord = getRootSecretsAsRecord(rootSecrets);
     const localTemplate = loadLocalTemplates(contextDir, env);
-    let vars;
+    // 1. Resolve Template Vars
+    let templateVars = [];
     if (localTemplate.hasTemplate) {
-        vars = resolveTemplateVars(localTemplate.vars, rootSecretsRecord, { processEnv: process.env });
+        templateVars = resolveTemplateVars(localTemplate.vars, rootSecretsRecord, { processEnv: process.env });
     }
-    else if (target) {
-        const targetConfig = config.targets.find(t => t.name === target);
-        if (!targetConfig) {
-            console.error(pc.red(`Target "${target}" not found in hush.yaml`));
-            console.error(pc.dim(`Available targets: ${config.targets.map(t => t.name).join(', ')}`));
-            process.exit(1);
-        }
-        vars = filterVarsForTarget(rootSecrets, targetConfig);
+    // 2. Resolve Target Vars
+    let targetVars = [];
+    // Find target config: either explicit by name, or implicit by directory matching
+    const targetConfig = target
+        ? config.targets.find(t => t.name === target)
+        : config.targets.find(t => resolve(projectRoot, t.path) === resolve(contextDir));
+    if (target && !targetConfig) {
+        console.error(pc.red(`Target "${target}" not found in hush.yaml`));
+        console.error(pc.dim(`Available targets: ${config.targets.map(t => t.name).join(', ')}`));
+        process.exit(1);
+    }
+    if (targetConfig) {
+        targetVars = filterVarsForTarget(rootSecrets, targetConfig);
         if (targetConfig.format === 'wrangler') {
-            vars.push({ key: 'CLOUDFLARE_INCLUDE_PROCESS_ENV', value: 'true' });
+            targetVars.push({ key: 'CLOUDFLARE_INCLUDE_PROCESS_ENV', value: 'true' });
             const devVarsPath = join(targetConfig.path, '.dev.vars');
             const absDevVarsPath = join(projectRoot, devVarsPath);
             if (existsSync(absDevVarsPath)) {
@@ -91,8 +97,21 @@ export async function runCommand(options) {
             }
         }
     }
+    else if (!localTemplate.hasTemplate && !target) {
+        // If no template and no target matched (and not running explicit target), fallback to all secrets
+        // This maintains backward compatibility for running in root or non-target dirs without templates
+        targetVars = rootSecrets;
+    }
+    // 3. Merge (Template overrides Target)
+    let vars;
+    if (localTemplate.hasTemplate) {
+        // Merge target vars with template vars. 
+        // Template vars take precedence over target vars.
+        // This allows "additive" behavior: get target vars + template vars.
+        vars = mergeVars(targetVars, templateVars);
+    }
     else {
-        vars = rootSecrets;
+        vars = targetVars;
     }
     const unresolved = getUnresolvedVars(vars);
     if (unresolved.length > 0) {

package/dist/commands/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAu+ChD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvE"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA8hDhD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvE"}

package/dist/commands/skill.js

@@ -155,7 +155,9 @@ Hush automatically:
 2. Decrypts root secrets
 3. Loads the local \`.env\` template
 4. Resolves \`\${VAR}\` references against root secrets
-5. Injects the result into your command
+5. **Filters root secrets based on target config (include/exclude)**
+6. **Merges them (Template overrides Target)**
+7. Injects the result into your command
 
 ### Variable Expansion Syntax
 
@@ -721,14 +723,25 @@ hush status
 
 ### hush push
 
-Push production secrets to Cloudflare Workers.
+Push production secrets to Cloudflare (Workers and Pages).
 
 \`\`\`bash
-hush push                          # Push secrets
+hush push                          # Push all targets
+hush push -t api                   # Push specific target
 hush push --dry-run                # Preview without pushing
 hush push --dry-run --verbose      # Detailed preview of what would be pushed
 \`\`\`
 
+**For Cloudflare Pages:** Add \`push_to\` configuration to your target:
+\`\`\`yaml
+targets:
+  - name: app
+    format: dotenv
+    push_to:
+      type: cloudflare-pages
+      project: my-pages-project
+\`\`\`
+
 ---
 
 ## Debugging Commands
@@ -893,10 +906,11 @@ hush has DB_URL -q && hush has API_KEY -q && echo "All set"
 
 ### hush push
 
-Push production secrets to Cloudflare Workers.
+Push production secrets to Cloudflare (Workers and Pages).
 
 \`\`\`bash
-hush push                       # Push secrets
+hush push                       # Push all targets
+hush push -t api                # Push specific target
 hush push --dry-run             # Preview without pushing
 \`\`\`
 
@@ -1230,14 +1244,35 @@ Look at the 🚫 EXCLUDED section to see which pattern is filtering out your var
 
 ### "Wrangler dev not seeing secrets"
 
-If you are using \`hush run -- wrangler dev\` and secrets are missing, Wrangler is likely being blocked by a local file.
+If you are using \`hush run -- wrangler dev\` and secrets are missing:
 
-**The Fix:**
-1. **Delete .dev.vars**: Run \`rm .dev.vars\` inside your worker directory.
-2. **Run normally**: \`hush run -- wrangler dev\`
+**Step 1: Check for blocking files**
+\`\`\`bash
+ls -la .dev.vars    # If this exists, it blocks Hush secrets
+\`\`\`
 
-**Explanation:**
-Wrangler completely ignores environment variables if a \`.dev.vars\` file exists. Hush automatically handles the necessary environment configuration (\`CLOUDFLARE_INCLUDE_PROCESS_ENV=true\`) for you, but you MUST ensure the conflicting file is removed.
+**Step 2: Delete the blocking file**
+\`\`\`bash
+rm .dev.vars
+\`\`\`
+
+**Step 3: Run normally**
+\`\`\`bash
+npx hush run -t api -- wrangler dev
+\`\`\`
+
+**Step 4: If still not working, update Wrangler**
+\`\`\`bash
+npm update wrangler
+\`\`\`
+
+**Why this happens:**
+- Wrangler has a strict rule: if \`.dev.vars\` exists (even empty!), it ignores ALL environment variables
+- Hush automatically sets \`CLOUDFLARE_INCLUDE_PROCESS_ENV=true\` for you
+- But Wrangler only respects this when no \`.dev.vars\` file exists
+- Older Wrangler versions may not support \`CLOUDFLARE_INCLUDE_PROCESS_ENV\` at all
+
+**Prevention tip:** Never use \`hush decrypt\` for Wrangler targets—always use \`hush run\`.
 
 ### "Variable appears in wrong places"
 
@@ -1290,6 +1325,26 @@ npx hush inspect   # See what's new
 \`\`\`bash
 npx hush push --dry-run   # Preview first
 npx hush push             # Actually push
+npx hush push -t api      # Push specific target
+\`\`\`
+
+### "Push to Cloudflare Pages"
+
+First, add \`push_to\` to your target in \`hush.yaml\`:
+\`\`\`yaml
+targets:
+  - name: app
+    path: ./app
+    format: dotenv
+    push_to:
+      type: cloudflare-pages
+      project: my-pages-project
+\`\`\`
+
+Then push:
+\`\`\`bash
+npx hush push -t app --dry-run   # Preview first
+npx hush push -t app             # Actually push
 \`\`\`
 
 ### "Build and deploy"

package/dist/config/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAK9C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ1D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAepG;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAoBnD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAO5G;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CA8B3D"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAK9C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ1D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAepG;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAoBnD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAO5G;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CA6C3D"}

package/dist/config/loader.js

@@ -55,6 +55,7 @@ export function checkSchemaVersion(config) {
 export function validateConfig(config) {
     const errors = [];
     const validFormats = ['dotenv', 'wrangler', 'json', 'shell', 'yaml'];
+    const validPushTypes = ['cloudflare-workers', 'cloudflare-pages'];
     if (!config.sources.shared) {
         errors.push('sources.shared is required');
     }
@@ -76,6 +77,21 @@ export function validateConfig(config) {
         else if (!validFormats.includes(target.format)) {
             errors.push(`${prefix}: invalid format "${target.format}" (must be one of: ${validFormats.join(', ')})`);
         }
+        // Validate push_to configuration
+        if (target.push_to) {
+            if (!target.push_to.type) {
+                errors.push(`${prefix}: push_to.type is required (one of: ${validPushTypes.join(', ')})`);
+            }
+            else if (!validPushTypes.includes(target.push_to.type)) {
+                errors.push(`${prefix}: invalid push_to.type "${target.push_to.type}" (must be one of: ${validPushTypes.join(', ')})`);
+            }
+            else if (target.push_to.type === 'cloudflare-pages') {
+                const pagesConfig = target.push_to;
+                if (!pagesConfig.project) {
+                    errors.push(`${prefix}: push_to.project is required for cloudflare-pages`);
+                }
+            }
+        }
     }
     return errors;
 }

package/dist/types.d.ts

@@ -1,11 +1,21 @@
 export type OutputFormat = 'dotenv' | 'wrangler' | 'json' | 'shell' | 'yaml';
 export type Environment = 'development' | 'production';
+export type PushDestinationType = 'cloudflare-workers' | 'cloudflare-pages';
+export interface CloudflareWorkersPushConfig {
+    type: 'cloudflare-workers';
+}
+export interface CloudflarePagesPushConfig {
+    type: 'cloudflare-pages';
+    project: string;
+}
+export type PushConfig = CloudflareWorkersPushConfig | CloudflarePagesPushConfig;
 export interface Target {
     name: string;
     path: string;
     format: OutputFormat;
     include?: string[];
     exclude?: string[];
+    push_to?: PushConfig;
 }
 export interface SourceFiles {
     shared: string;
@@ -52,6 +62,7 @@ export interface PushOptions {
     root: string;
     dryRun: boolean;
     verbose: boolean;
+    target?: string;
 }
 export interface StatusOptions {
     root: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AACvD,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;AAE5E,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,oBAAoB,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,UAAU,GAAG,2BAA2B,GAAG,yBAAyB,CAAC;AAEjF,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chriscode/hush",
-  "version": "4.1.1",
+  "version": "4.2.0",
   "description": "SOPS-based secrets management for monorepos. Encrypt once, decrypt everywhere.",
   "type": "module",
   "bin": {