@chriscode/hush 4.1.2 → 5.0.0

package/dist/cli.js

@@ -19,6 +19,7 @@ import { resolveCommand } from './commands/resolve.js';
 import { traceCommand } from './commands/trace.js';
 import { templateCommand } from './commands/template.js';
 import { expansionsCommand } from './commands/expansions.js';
+import { migrateCommand } from './commands/migrate.js';
 import { findConfigPath, loadConfig, checkSchemaVersion } from './config/loader.js';
 import { checkForUpdate } from './utils/version-check.js';
 const require = createRequire(import.meta.url);
@@ -32,7 +33,7 @@ ${pc.bold('Usage:')}
 
 ${pc.bold('Commands:')}
   init              Initialize hush.yaml config
-  encrypt           Encrypt source .env files
+  encrypt           Encrypt source .hush files
   run -- <cmd>      Run command with secrets in memory (AI-safe)
   set <KEY>         Set a single secret interactively (AI-safe)
   edit [file]       Edit all secrets in $EDITOR
@@ -40,10 +41,11 @@ ${pc.bold('Commands:')}
   inspect           List all variables (masked values, AI-safe)
   has <key>         Check if a secret exists (exit 0 if set, 1 if not)
   check             Verify secrets are encrypted (for pre-commit hooks)
-  push              Push secrets to Cloudflare Workers
+  push              Push secrets to Cloudflare (Workers and Pages)
   status            Show configuration and status
   skill             Install Claude Code / OpenCode skill
   keys <cmd>        Manage SOPS age keys (setup, generate, pull, push, list)
+  migrate           Migrate from v4 (.env.encrypted) to v5 (.hush.encrypted)
 
 ${pc.bold('Debugging Commands:')}
   resolve <target>  Show what variables a target receives (AI-safe)
@@ -57,7 +59,7 @@ ${pc.bold('Advanced Commands:')}
 ${pc.bold('Options:')}
   -e, --env <env>   Environment: development or production (default: development)
   -r, --root <dir>  Root directory (default: current directory)
-  -t, --target <t>  Target name from hush.yaml (run/resolve only)
+  -t, --target <t>  Target name from hush.yaml (run/resolve/push)
   -q, --quiet       Suppress output (has/check commands)
   --dry-run         Preview changes without applying (push only)
   --verbose         Show detailed output (push --dry-run only)
@@ -72,7 +74,7 @@ ${pc.bold('Options:')}
   -h, --help        Show this help message
   -v, --version     Show version number
 
-${pc.bold('Variable Expansion (v4+):')}
+${pc.bold('Variable Expansion (v5+):')}
   Subdirectory .env files can reference root secrets:
   
     \${VAR}           Pull VAR from root secrets
@@ -90,9 +92,20 @@ ${pc.bold('Variable Expansion (v4+):')}
   
   Subdirectory templates are safe to commit - they contain no secrets.
 
+${pc.bold('File Naming (v5+):')}
+  Hush uses .hush files instead of .env to avoid conflicts with other tools:
+  
+    .hush                  Shared secrets (source file)
+    .hush.development      Development secrets (source file)
+    .hush.encrypted        Encrypted shared secrets (committed)
+    .hush.development.encrypted  Encrypted dev secrets (committed)
+  
+  The .env files are reserved for other tools (Wrangler, Metro, etc.).
+
 ${pc.bold('Examples:')}
   hush init                     Initialize config + generate keys
-  hush encrypt                  Encrypt .env files
+  hush migrate                  Migrate v4 .env.encrypted to v5 .hush.encrypted
+  hush encrypt                  Encrypt .hush files
   hush run -- npm start         Run with secrets in memory (AI-safe!)
   hush run -e prod -- npm build Run with production secrets
   hush run -t api -- wrangler dev  Run filtered for 'api' target (root secrets only)
@@ -110,6 +123,7 @@ ${pc.bold('Examples:')}
   hush has API_KEY -q && echo "API_KEY is configured"
   hush check                    Verify secrets are encrypted
   hush push --dry-run           Preview push to Cloudflare
+  hush push -t app              Push only the 'app' target
   hush status                   Show current status
   hush skill                    Install Claude skill (interactive)
 `);
@@ -281,7 +295,7 @@ function parseArgs(args) {
     return { command, subcommand, env, envExplicit, root, dryRun, verbose, quiet, warn, json, onlyChanged, requireSource, allowPlaintext, global, local, force, gui, vault, file, key, target, cmdArgs };
 }
 function checkMigrationNeeded(root, command) {
-    const skipCommands = ['', 'help', 'version', 'init', 'skill'];
+    const skipCommands = ['', 'help', 'version', 'init', 'skill', 'migrate'];
     if (skipCommands.includes(command))
         return;
     const configPath = findConfigPath(root);
@@ -364,7 +378,7 @@ async function main() {
                 await checkCommand({ root, warn, json, quiet, onlyChanged, requireSource, allowPlaintext });
                 break;
             case 'push':
-                await pushCommand({ root, dryRun, verbose });
+                await pushCommand({ root, dryRun, verbose, target });
                 break;
             case 'status':
                 await statusCommand({ root });
@@ -402,6 +416,9 @@ async function main() {
             case 'expansions':
                 await expansionsCommand({ root, env });
                 break;
+            case 'migrate':
+                await migrateCommand({ root, dryRun });
+                break;
             default:
                 if (command) {
                     console.error(pc.red(`Unknown command: ${command}`));

package/dist/commands/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAmB,WAAW,EAAmC,MAAM,aAAa,CAAC;AAkF/G,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA+BvE;AAuMD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCvE"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAmB,WAAW,EAAmC,MAAM,aAAa,CAAC;AAmF/G,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA+BvE;AAuMD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCvE"}

package/dist/commands/check.js

@@ -44,6 +44,7 @@ function getGitChangedFiles(root) {
 }
 function findPlaintextEnvFiles(root) {
     const results = [];
+    // Only warn about .env files (legacy/output files), NOT .hush files (Hush's source files)
     const plaintextPatterns = ['.env', '.env.development', '.env.production', '.env.local', '.env.staging', '.env.test', '.dev.vars'];
     const skipDirs = new Set(['node_modules', '.git', 'dist', 'build', '.next', '.nuxt']);
     function scanDir(dir, relativePath = '') {
@@ -206,8 +207,8 @@ function formatTextOutput(result) {
         lines.push(pc.yellow('These files contain plaintext secrets that could be exposed to AI assistants.'));
         lines.push('');
         lines.push(pc.bold('To fix:'));
-        lines.push(pc.dim('  1. Run: hush encrypt'));
-        lines.push(pc.dim('  2. Delete the plaintext files (the .encrypted versions are your source of truth)'));
+        lines.push(pc.dim('  1. Run: hush migrate (if upgrading from v4)'));
+        lines.push(pc.dim('  2. Delete or gitignore these .env files'));
         lines.push(pc.dim('  3. Add to .gitignore: .env, .env.*, .dev.vars'));
         lines.push('');
         lines.push(pc.dim('To allow plaintext files (not recommended): --allow-plaintext'));

package/dist/commands/encrypt.js

@@ -34,7 +34,7 @@ export async function encryptCommand(options) {
     }
     if (encryptedFiles.length === 0) {
         console.error(pc.red('\nNo source files found to encrypt'));
-        console.error(pc.dim('Create at least .env with your secrets'));
+        console.error(pc.dim('Create at least .hush with your secrets'));
         process.exit(1);
     }
     console.log(pc.blue('\nVerifying encryption...'));

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAc,WAAW,EAAU,MAAM,aAAa,CAAC;AAyJnE,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsErE"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAc,WAAW,EAAU,MAAM,aAAa,CAAC;AAyKnE,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFrE"}

package/dist/commands/init.js

@@ -126,6 +126,7 @@ function detectTargets(root) {
     return targets;
 }
 function findExistingPlaintextEnvFiles(root) {
+    // Look for legacy .env files that may need migration
     const patterns = ['.env', '.env.development', '.env.production', '.env.local', '.env.staging', '.env.test', '.dev.vars'];
     const found = [];
     for (const pattern of patterns) {
@@ -136,6 +137,18 @@ function findExistingPlaintextEnvFiles(root) {
     }
     return found;
 }
+function findExistingEncryptedFiles(root) {
+    // Look for v4 encrypted files that need migration to v5 (.hush.encrypted)
+    const patterns = ['.env.encrypted', '.env.development.encrypted', '.env.production.encrypted', '.env.local.encrypted'];
+    const found = [];
+    for (const pattern of patterns) {
+        const filePath = join(root, pattern);
+        if (existsSync(filePath)) {
+            found.push(pattern);
+        }
+    }
+    return found;
+}
 export async function initCommand(options) {
     const { root } = options;
     const existingConfig = findConfigPath(root);
@@ -144,14 +157,24 @@ export async function initCommand(options) {
         process.exit(1);
     }
     console.log(pc.blue('Initializing hush...\n'));
+    const existingEncryptedFiles = findExistingEncryptedFiles(root);
+    if (existingEncryptedFiles.length > 0) {
+        console.log(pc.bgYellow(pc.black(' V4 ENCRYPTED FILES DETECTED ')));
+        console.log(pc.yellow('\nFound existing v4 encrypted files:'));
+        for (const file of existingEncryptedFiles) {
+            console.log(pc.yellow(`  ${file}`));
+        }
+        console.log(pc.dim('\nRun "npx hush migrate" to convert to v5 format (.hush.encrypted).\n'));
+    }
     const existingEnvFiles = findExistingPlaintextEnvFiles(root);
     if (existingEnvFiles.length > 0) {
-        console.log(pc.bgYellow(pc.black(' EXISTING SECRETS DETECTED ')));
+        console.log(pc.bgYellow(pc.black(' PLAINTEXT .ENV FILES DETECTED ')));
         console.log(pc.yellow('\nFound existing .env files:'));
         for (const file of existingEnvFiles) {
             console.log(pc.yellow(`  ${file}`));
         }
-        console.log(pc.dim('\nThese will be encrypted after setup. Run "npx hush encrypt" when ready.\n'));
+        console.log(pc.dim('\nRename these to .hush files, then run "npx hush encrypt".\n'));
+        console.log(pc.dim('Example: mv .env .hush && mv .env.development .hush.development\n'));
     }
     const project = getProjectFromPackageJson(root);
     if (!project) {
@@ -179,14 +202,19 @@ export async function initCommand(options) {
         console.log(`  ${pc.cyan(target.name)} ${pc.dim(target.path)} ${pc.magenta(target.format)}`);
     }
     console.log(pc.bold('\nNext steps:'));
-    if (existingEnvFiles.length > 0) {
-        console.log(pc.green('  1. npx hush encrypt') + pc.dim('     # Encrypt existing .env files (deletes plaintext)'));
-        console.log(pc.dim('  2. npx hush inspect') + pc.dim('      # Verify your secrets'));
-        console.log(pc.dim('  3. npx hush run -- <cmd>') + pc.dim(' # Run with secrets in memory'));
+    if (existingEncryptedFiles.length > 0) {
+        console.log(pc.green('  1. npx hush migrate') + pc.dim('      # Convert v4 .env.encrypted to v5 .hush.encrypted'));
+        console.log(pc.dim('  2. npx hush inspect') + pc.dim('       # Verify your secrets'));
+        console.log(pc.dim('  3. npx hush run -- <cmd>') + pc.dim('  # Run with secrets in memory'));
+    }
+    else if (existingEnvFiles.length > 0) {
+        console.log(pc.green('  1. Rename .env files to .hush') + pc.dim(' # mv .env .hush'));
+        console.log(pc.dim('  2. npx hush encrypt') + pc.dim('      # Encrypt .hush files'));
+        console.log(pc.dim('  3. npx hush run -- <cmd>') + pc.dim('  # Run with secrets in memory'));
     }
     else {
-        console.log(pc.dim('  1. npx hush set <KEY>') + pc.dim('    # Add secrets interactively'));
-        console.log(pc.dim('  2. npx hush run -- <cmd>') + pc.dim(' # Run with secrets in memory'));
+        console.log(pc.dim('  1. npx hush set <KEY>') + pc.dim('     # Add secrets interactively'));
+        console.log(pc.dim('  2. npx hush run -- <cmd>') + pc.dim('  # Run with secrets in memory'));
     }
     console.log(pc.dim('\nGit setup:'));
     console.log(pc.dim('  git add hush.yaml .sops.yaml'));

package/dist/commands/migrate.d.ts

@@ -0,0 +1,6 @@
+export interface MigrateOptions {
+    root: string;
+    dryRun: boolean;
+}
+export declare function migrateCommand(options: MigrateOptions): Promise<void>;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/commands/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AA8DD,wBAAsB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA0E3E"}

package/dist/commands/migrate.js

@@ -0,0 +1,116 @@
+import { existsSync, renameSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import pc from 'picocolors';
+import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
+import { findConfigPath } from '../config/loader.js';
+const FILE_MIGRATIONS = [
+    { from: '.env.encrypted', to: '.hush.encrypted' },
+    { from: '.env.development.encrypted', to: '.hush.development.encrypted' },
+    { from: '.env.production.encrypted', to: '.hush.production.encrypted' },
+    { from: '.env.local.encrypted', to: '.hush.local.encrypted' },
+];
+const SOURCE_MIGRATIONS = {
+    '.env': '.hush',
+    '.env.development': '.hush.development',
+    '.env.production': '.hush.production',
+    '.env.local': '.hush.local',
+};
+function getMigrationFiles(root) {
+    return FILE_MIGRATIONS.map(({ from, to }) => ({
+        from,
+        to,
+        exists: existsSync(join(root, from)),
+    }));
+}
+function migrateConfig(root, dryRun) {
+    const configPath = findConfigPath(root);
+    if (!configPath)
+        return false;
+    const content = readFileSync(configPath, 'utf-8');
+    const config = parseYaml(content);
+    let modified = false;
+    const sources = config.sources;
+    if (sources) {
+        for (const [oldValue, newValue] of Object.entries(SOURCE_MIGRATIONS)) {
+            for (const [key, value] of Object.entries(sources)) {
+                if (value === oldValue) {
+                    if (!dryRun) {
+                        sources[key] = newValue;
+                    }
+                    modified = true;
+                }
+            }
+        }
+    }
+    if (modified && !dryRun) {
+        const schemaComment = content.startsWith('#') ? content.split('\n')[0] + '\n' : '';
+        const newContent = schemaComment + stringifyYaml(config, { indent: 2 });
+        writeFileSync(configPath, newContent, 'utf-8');
+    }
+    return modified;
+}
+export async function migrateCommand(options) {
+    const { root, dryRun } = options;
+    console.log(pc.blue('Hush v4 → v5 Migration\n'));
+    if (dryRun) {
+        console.log(pc.yellow('DRY RUN - no changes will be made\n'));
+    }
+    const migrations = getMigrationFiles(root);
+    const filesToMigrate = migrations.filter(m => m.exists);
+    if (filesToMigrate.length === 0) {
+        console.log(pc.dim('No v4 encrypted files found (.env.encrypted, etc.)'));
+        console.log(pc.dim('Already on v5 or no encrypted files exist.\n'));
+        const configNeedsMigration = migrateConfig(root, true);
+        if (configNeedsMigration) {
+            console.log(pc.yellow('hush.yaml contains v4 source paths that need updating.\n'));
+            if (!dryRun) {
+                migrateConfig(root, false);
+                console.log(pc.green('Updated hush.yaml source paths to v5 format.\n'));
+            }
+        }
+        return;
+    }
+    console.log(pc.bold('Files to migrate:'));
+    for (const { from, to, exists } of migrations) {
+        if (exists) {
+            console.log(`  ${pc.yellow(from)} → ${pc.green(to)}`);
+        }
+        else {
+            console.log(pc.dim(`  ${from} (not found, skipping)`));
+        }
+    }
+    console.log('');
+    if (dryRun) {
+        console.log(pc.dim('Run without --dry-run to apply changes.'));
+        return;
+    }
+    let migratedCount = 0;
+    for (const { from, to, exists } of migrations) {
+        if (!exists)
+            continue;
+        const fromPath = join(root, from);
+        const toPath = join(root, to);
+        if (existsSync(toPath)) {
+            console.log(pc.yellow(`  Skipping ${from}: ${to} already exists`));
+            continue;
+        }
+        renameSync(fromPath, toPath);
+        console.log(pc.green(`  Migrated ${from} → ${to}`));
+        migratedCount++;
+    }
+    const configUpdated = migrateConfig(root, false);
+    if (configUpdated) {
+        console.log(pc.green('  Updated hush.yaml source paths'));
+    }
+    console.log('');
+    if (migratedCount > 0 || configUpdated) {
+        console.log(pc.green(pc.bold(`Migration complete.`)));
+        console.log(pc.dim('\nNext steps:'));
+        console.log(pc.dim('  1. git add .hush.encrypted .hush.*.encrypted hush.yaml'));
+        console.log(pc.dim('  2. git rm .env.encrypted .env.*.encrypted (if tracked)'));
+        console.log(pc.dim('  3. git commit -m "chore: migrate to Hush v5 format"'));
+    }
+    else {
+        console.log(pc.dim('No changes made.'));
+    }
+}

package/dist/commands/push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/commands/push.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAU,WAAW,EAAE,MAAM,aAAa,CAAC;AA0BvD,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwErE"}
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/commands/push.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAU,WAAW,EAAqC,MAAM,aAAa,CAAC;AAgH1F,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA6GrE"}

package/dist/commands/push.js

@@ -1,5 +1,5 @@
 import { execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, writeFileSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import pc from 'picocolors';
 import { loadConfig } from '../config/loader.js';
@@ -8,7 +8,8 @@ import { interpolateVars } from '../core/interpolate.js';
 import { mergeVars } from '../core/merge.js';
 import { parseEnvContent } from '../core/parse.js';
 import { decrypt as sopsDecrypt } from '../core/sops.js';
-function pushSecret(key, value, targetDir, dryRun, verbose) {
+import { loadLocalTemplates, resolveTemplateVars } from '../core/template.js';
+function pushWorkerSecret(key, value, targetDir, dryRun, verbose) {
     if (dryRun) {
         if (verbose) {
             console.log(pc.green(`    + ${key}`));
@@ -32,10 +33,80 @@ function pushSecret(key, value, targetDir, dryRun, verbose) {
         return false;
     }
 }
+function pushPagesSecrets(vars, projectName, targetDir, dryRun, verbose) {
+    if (dryRun) {
+        for (const { key } of vars) {
+            if (verbose) {
+                console.log(pc.green(`    + ${key}`));
+            }
+            else {
+                console.log(pc.dim(`    [dry-run] ${key}`));
+            }
+        }
+        return { success: vars.length, failed: 0 };
+    }
+    const secretsJson = {};
+    for (const { key, value } of vars) {
+        secretsJson[key] = value;
+    }
+    const tempFile = join(targetDir, '.hush-secrets-temp.json');
+    try {
+        writeFileSync(tempFile, JSON.stringify(secretsJson, null, 2));
+        execSync(`wrangler pages secret bulk "${tempFile}" --project-name "${projectName}"`, {
+            cwd: targetDir,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            shell: '/bin/bash',
+        });
+        for (const { key } of vars) {
+            console.log(pc.green(`    ${key}`));
+        }
+        return { success: vars.length, failed: 0 };
+    }
+    catch (error) {
+        const err = error;
+        const stderrStr = err.stderr instanceof Buffer ? err.stderr.toString() : (err.stderr || err.message || 'Unknown error');
+        console.error(pc.red(`    Failed to push secrets: ${stderrStr}`));
+        return { success: 0, failed: vars.length };
+    }
+    finally {
+        if (existsSync(tempFile)) {
+            unlinkSync(tempFile);
+        }
+    }
+}
+function getTargetsWithPush(config, targetFilter) {
+    const pushableTargets = config.targets.filter(t => {
+        const hasPushConfig = t.push_to !== undefined;
+        const isWranglerFormat = t.format === 'wrangler';
+        return hasPushConfig || isWranglerFormat;
+    });
+    if (targetFilter) {
+        const filtered = pushableTargets.filter(t => t.name === targetFilter);
+        if (filtered.length === 0) {
+            const availableTargets = pushableTargets.map(t => t.name).join(', ');
+            throw new Error(`Target "${targetFilter}" not found or has no push configuration.\n` +
+                `Available pushable targets: ${availableTargets || '(none)'}`);
+        }
+        return filtered;
+    }
+    return pushableTargets;
+}
+function getPushType(target) {
+    if (target.push_to) {
+        return target.push_to.type;
+    }
+    return 'cloudflare-workers';
+}
+function getPagesProject(target) {
+    if (target.push_to?.type === 'cloudflare-pages') {
+        return target.push_to.project;
+    }
+    throw new Error(`Target "${target.name}" is not configured for Cloudflare Pages`);
+}
 export async function pushCommand(options) {
-    const { root, dryRun, verbose } = options;
+    const { root, dryRun, verbose, target: targetFilter } = options;
     const config = loadConfig(root);
-    console.log(pc.blue('Pushing production secrets to Cloudflare Workers...'));
+    console.log(pc.blue('Pushing production secrets to Cloudflare...'));
     if (dryRun) {
         console.log(pc.yellow('(dry-run mode)'));
         if (verbose) {
@@ -59,30 +130,61 @@ export async function pushCommand(options) {
     }
     const merged = mergeVars(...varSources);
     const interpolated = interpolateVars(merged);
-    const wranglerTargets = config.targets.filter(t => t.format === 'wrangler');
-    if (wranglerTargets.length === 0) {
-        console.error(pc.red('No wrangler targets configured'));
+    const rootSecretsRecord = {};
+    for (const { key, value } of interpolated) {
+        rootSecretsRecord[key] = value;
+    }
+    let pushableTargets;
+    try {
+        pushableTargets = getTargetsWithPush(config, targetFilter);
+    }
+    catch (error) {
+        console.error(pc.red(error.message));
+        process.exit(1);
+    }
+    if (pushableTargets.length === 0) {
+        console.error(pc.red('No targets configured for push'));
+        console.error(pc.dim('Add format: wrangler or push_to: { type: cloudflare-pages, project: ... } to a target'));
         process.exit(1);
     }
-    for (const target of wranglerTargets) {
+    for (const target of pushableTargets) {
         const targetDir = join(root, target.path);
-        const filtered = filterVarsForTarget(interpolated, target);
+        const pushType = getPushType(target);
+        let filtered = filterVarsForTarget(interpolated, target);
+        const localTemplate = loadLocalTemplates(targetDir, 'production');
+        if (localTemplate.hasTemplate) {
+            const templateVars = resolveTemplateVars(localTemplate.vars, rootSecretsRecord, { processEnv: process.env });
+            filtered = mergeVars(filtered, templateVars);
+        }
+        if (filtered.length === 0) {
+            console.log(pc.dim(`\n${target.name} - no matching vars, skipped`));
+            continue;
+        }
+        const typeLabel = pushType === 'cloudflare-pages' ? 'Pages' : 'Workers';
         if (dryRun && verbose) {
-            console.log(pc.blue(`\n[DRY RUN] Would push to ${target.name} (${target.path}/):`));
+            console.log(pc.blue(`\n[DRY RUN] Would push to ${target.name} (${typeLabel}, ${target.path}/):`));
         }
         else {
-            console.log(pc.blue(`\n${target.name} (${target.path}/)`));
+            console.log(pc.blue(`\n${target.name} (${typeLabel}, ${target.path}/)`));
         }
         let success = 0;
         let failed = 0;
-        for (const { key, value } of filtered) {
-            if (pushSecret(key, value, targetDir, dryRun, verbose)) {
-                if (!dryRun)
-                    console.log(pc.green(`    ${key}`));
-                success++;
-            }
-            else {
-                failed++;
+        if (pushType === 'cloudflare-pages') {
+            const projectName = getPagesProject(target);
+            const result = pushPagesSecrets(filtered, projectName, targetDir, dryRun, verbose);
+            success = result.success;
+            failed = result.failed;
+        }
+        else {
+            for (const { key, value } of filtered) {
+                if (pushWorkerSecret(key, value, targetDir, dryRun, verbose)) {
+                    if (!dryRun)
+                        console.log(pc.green(`    ${key}`));
+                    success++;
+                }
+                else {
+                    failed++;
+                }
             }
         }
         console.log(pc.dim(`  ${success} pushed, ${failed} failed`));

package/dist/commands/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAy+ChD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvE"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAuiDhD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvE"}

package/dist/commands/skill.js

@@ -6,15 +6,15 @@ import pc from 'picocolors';
 const SKILL_FILES = {
     'SKILL.md': `---
 name: hush-secrets
-description: Manage secrets safely using Hush CLI. Use when working with .env files, environment variables, secrets, API keys, database URLs, credentials, or configuration. NEVER read .env files directly - always use hush commands instead to prevent exposing secrets to the LLM.
+description: Manage secrets safely using Hush CLI. Use when working with .hush files, environment variables, secrets, API keys, database URLs, credentials, or configuration. NEVER read .hush files directly - always use hush commands instead to prevent exposing secrets to the LLM.
 allowed-tools: Bash(hush:*), Bash(npx hush:*), Bash(brew:*), Bash(npm:*), Bash(pnpm:*), Bash(age-keygen:*), Read, Grep, Glob, Write, Bash(cat:*), Bash(grep:*)
 ---
 
 # Hush - AI-Native Secrets Management
 
-**CRITICAL: NEVER read root .env files directly.** Always use \`npx hush status\`, \`npx hush inspect\`, or \`npx hush has\` to check secrets.
+**CRITICAL: NEVER read .hush files directly.** Always use \`npx hush status\`, \`npx hush inspect\`, or \`npx hush has\` to check secrets.
 
-Hush keeps secrets **encrypted at rest** at the project root. Subdirectory \`.env\` files are **templates** (safe to commit and read) that reference root secrets via \`\${VAR}\` syntax.
+Hush keeps secrets **encrypted at rest** at the project root using \`.hush.encrypted\` files. Subdirectory \`.env\` files are **templates** (safe to commit and read) that reference root secrets via \`\${VAR}\` syntax.
 
 ## First Step: Investigate Current State
 
@@ -35,7 +35,7 @@ This tells you:
 
 | You See | What It Means | Action |
 |---------|---------------|--------|
-| \`SECURITY WARNING: Unencrypted .env files\` | Plaintext secrets at project root! | Run \`npx hush encrypt\` immediately |
+| \`SECURITY WARNING: Unencrypted .env files\` | Plaintext .env files found (legacy or output) | Run \`npx hush migrate\` or delete them |
 | \`No hush.yaml found\` | Hush not initialized | Run \`npx hush init\` |
 | \`SOPS not installed\` | Missing prerequisite | \`brew install sops\` |
 | \`age key not found\` | Missing encryption key | \`npx hush keys setup\` |
@@ -53,12 +53,12 @@ npx hush encrypt       # Encrypts any existing .env files, deletes plaintext
 npx hush inspect       # Verify setup
 \`\`\`
 
-### Scenario 2: Existing .env Files Found
+### Scenario 2: Existing .env Files Found (Migration from v4)
 
 \`\`\`bash
 npx hush status        # Check what's there
-npx hush encrypt       # Encrypt them (auto-deletes plaintext after verification)
-npx hush inspect       # Confirm everything is encrypted
+npx hush migrate       # Migrate .env.encrypted to .hush.encrypted
+npx hush inspect       # Confirm everything is migrated
 \`\`\`
 
 ### Scenario 3: Hush Already Set Up (Team Member Joining)
@@ -423,9 +423,9 @@ The generated config looks like:
 
 \`\`\`yaml
 sources:
-  shared: .env
-  development: .env.development
-  production: .env.production
+  shared: .hush
+  development: .hush.development
+  production: .hush.production
 
 targets:
   - name: root
@@ -461,29 +461,29 @@ Customize targets for your monorepo. Common patterns:
   format: yaml
 \`\`\`
 
-### Step 5: Create initial \`.env\` files
+### Step 5: Create initial \`.hush\` files
 
-Create \`.env\` with shared secrets:
+Create \`.hush\` with shared secrets:
 
 \`\`\`bash
-# .env
+# .hush
 DATABASE_URL=postgres://localhost/mydb
 API_KEY=your_api_key_here
 NEXT_PUBLIC_API_URL=http://localhost:3000
 \`\`\`
 
-Create \`.env.development\` for dev-specific values:
+Create \`.hush.development\` for dev-specific values:
 
 \`\`\`bash
-# .env.development  
+# .hush.development  
 DEBUG=true
 LOG_LEVEL=debug
 \`\`\`
 
-Create \`.env.production\` for production values:
+Create \`.hush.production\` for production values:
 
 \`\`\`bash
-# .env.production
+# .hush.production
 DEBUG=false
 LOG_LEVEL=error
 \`\`\`
@@ -495,9 +495,9 @@ npx hush encrypt
 \`\`\`
 
 This creates:
-- \`.env.encrypted\`
-- \`.env.development.encrypted\`
-- \`.env.production.encrypted\`
+- \`.hush.encrypted\`
+- \`.hush.development.encrypted\`
+- \`.hush.production.encrypted\`
 
 ### Step 7: Verify setup
 
@@ -511,22 +511,26 @@ npx hush inspect
 Add these lines to \`.gitignore\`:
 
 \`\`\`gitignore
-# Hush - plaintext env files (generated, not committed)
+# Hush - plaintext source files (encrypted versions are committed)
+.hush
+.hush.local
+.hush.development
+.hush.production
+
+# Output files (generated by hush decrypt, not committed)
 .env
-.env.local
-.env.development
-.env.production
+.env.*
 .dev.vars
 
 # Keep encrypted files (these ARE committed)
-!.env.encrypted
-!.env.*.encrypted
+!.hush.encrypted
+!.hush.*.encrypted
 \`\`\`
 
 ### Step 9: Commit encrypted files
 
 \`\`\`bash
-git add .sops.yaml hush.yaml .env*.encrypted .gitignore
+git add .sops.yaml hush.yaml .hush*.encrypted .gitignore
 git commit -m "chore: add Hush secrets management"
 \`\`\`
 
@@ -552,8 +556,8 @@ After setup, verify everything works:
 - [ ] \`npx hush status\` shows configuration
 - [ ] \`npx hush inspect\` shows masked variables
 - [ ] \`npx hush run -- env\` can decrypt and run (secrets stay in memory!)
-- [ ] \`.env.encrypted\` files are committed to git
-- [ ] Plaintext \`.env\` files are in \`.gitignore\`
+- [ ] \`.hush.encrypted\` files are committed to git
+- [ ] Plaintext \`.hush\` and \`.env\` files are in \`.gitignore\`
 
 ---
 
@@ -701,7 +705,7 @@ hush init
 
 ### hush encrypt
 
-Encrypt source \`.env\` files to \`.env.encrypted\` files.
+Encrypt source \`.hush\` files to \`.hush.encrypted\` files.
 
 \`\`\`bash
 hush encrypt
@@ -723,14 +727,25 @@ hush status
 
 ### hush push
 
-Push production secrets to Cloudflare Workers.
+Push production secrets to Cloudflare (Workers and Pages).
 
 \`\`\`bash
-hush push                          # Push secrets
+hush push                          # Push all targets
+hush push -t api                   # Push specific target
 hush push --dry-run                # Preview without pushing
 hush push --dry-run --verbose      # Detailed preview of what would be pushed
 \`\`\`
 
+**For Cloudflare Pages:** Add \`push_to\` configuration to your target:
+\`\`\`yaml
+targets:
+  - name: app
+    format: dotenv
+    push_to:
+      type: cloudflare-pages
+      project: my-pages-project
+\`\`\`
+
 ---
 
 ## Debugging Commands
@@ -895,10 +910,11 @@ hush has DB_URL -q && hush has API_KEY -q && echo "All set"
 
 ### hush push
 
-Push production secrets to Cloudflare Workers.
+Push production secrets to Cloudflare (Workers and Pages).
 
 \`\`\`bash
-hush push                       # Push secrets
+hush push                       # Push all targets
+hush push -t api                # Push specific target
 hush push --dry-run             # Preview without pushing
 \`\`\`
 
@@ -977,9 +993,9 @@ hush skill --local              # Install to ./.claude/skills/
 
 \`\`\`yaml
 sources:
-  shared: .env
-  development: .env.development
-  production: .env.production
+  shared: .hush
+  development: .hush.development
+  production: .hush.production
 
 targets:
   - name: root
@@ -1034,7 +1050,7 @@ targets:
 | Expo | \`EXPO_PUBLIC_*\` | \`include: [EXPO_PUBLIC_*]\` |
 | Gatsby | \`GATSBY_*\` | \`include: [GATSBY_*]\` |
 
-### Variable Interpolation (v4+)
+### Variable Interpolation (v5+)
 
 Reference other variables using \`\${VAR}\` syntax:
 
@@ -1100,8 +1116,13 @@ This will show:
 
 #### Path A: "SECURITY WARNING: Unencrypted .env files detected"
 \`\`\`bash
+# If migrating from v4 (has .env.encrypted files):
+npx hush migrate       # Converts to .hush.encrypted format
+
+# If new setup with plaintext .env files:
+mv .env .hush          # Rename to .hush
 npx hush init          # If no hush.yaml exists
-npx hush encrypt       # Encrypts files and DELETES plaintext automatically
+npx hush encrypt       # Encrypts .hush files
 npx hush status        # Verify the warning is gone
 \`\`\`
 
@@ -1232,14 +1253,35 @@ Look at the 🚫 EXCLUDED section to see which pattern is filtering out your var
 
 ### "Wrangler dev not seeing secrets"
 
-If you are using \`hush run -- wrangler dev\` and secrets are missing, Wrangler is likely being blocked by a local file.
+If you are using \`hush run -- wrangler dev\` and secrets are missing:
 
-**The Fix:**
-1. **Delete .dev.vars**: Run \`rm .dev.vars\` inside your worker directory.
-2. **Run normally**: \`hush run -- wrangler dev\`
+**Step 1: Check for blocking files**
+\`\`\`bash
+ls -la .dev.vars    # If this exists, it blocks Hush secrets
+\`\`\`
+
+**Step 2: Delete the blocking file**
+\`\`\`bash
+rm .dev.vars
+\`\`\`
 
-**Explanation:**
-Wrangler completely ignores environment variables if a \`.dev.vars\` file exists. Hush automatically handles the necessary environment configuration (\`CLOUDFLARE_INCLUDE_PROCESS_ENV=true\`) for you, but you MUST ensure the conflicting file is removed.
+**Step 3: Run normally**
+\`\`\`bash
+npx hush run -t api -- wrangler dev
+\`\`\`
+
+**Step 4: If still not working, update Wrangler**
+\`\`\`bash
+npm update wrangler
+\`\`\`
+
+**Why this happens:**
+- Wrangler has a strict rule: if \`.dev.vars\` exists (even empty!), it ignores ALL environment variables
+- Hush automatically sets \`CLOUDFLARE_INCLUDE_PROCESS_ENV=true\` for you
+- But Wrangler only respects this when no \`.dev.vars\` file exists
+- Older Wrangler versions may not support \`CLOUDFLARE_INCLUDE_PROCESS_ENV\` at all
+
+**Prevention tip:** Never use \`hush decrypt\` for Wrangler targets—always use \`hush run\`.
 
 ### "Variable appears in wrong places"
 
@@ -1292,6 +1334,26 @@ npx hush inspect   # See what's new
 \`\`\`bash
 npx hush push --dry-run   # Preview first
 npx hush push             # Actually push
+npx hush push -t api      # Push specific target
+\`\`\`
+
+### "Push to Cloudflare Pages"
+
+First, add \`push_to\` to your target in \`hush.yaml\`:
+\`\`\`yaml
+targets:
+  - name: app
+    path: ./app
+    format: dotenv
+    push_to:
+      type: cloudflare-pages
+      project: my-pages-project
+\`\`\`
+
+Then push:
+\`\`\`bash
+npx hush push -t app --dry-run   # Preview first
+npx hush push -t app             # Actually push
 \`\`\`
 
 ### "Build and deploy"
@@ -1442,11 +1504,11 @@ Key Status:
 \`\`\`
 
 **Reading this:**
-- There's a security issue - plaintext files exist
+- There are .env files present (legacy or output from decrypt)
 - The project is configured with key management
 - Keys are properly set up and backed up
 
-**To fix:** Run \`npx hush encrypt\`
+**To fix:** Run \`npx hush migrate\` (if v4) or delete/gitignore these .env files
 
 ### npx hush inspect output explained
 

package/dist/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAwCjD,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAmHzE"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAyCjD,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAmHzE"}

package/dist/commands/status.js

@@ -9,6 +9,7 @@ import { opInstalled } from '../lib/onepassword.js';
 import { FORMAT_OUTPUT_FILES } from '../types.js';
 function findRootPlaintextEnvFiles(root) {
     const results = [];
+    // Only warn about .env files (legacy/output), not .hush files (Hush's source files)
     const plaintextPatterns = ['.env', '.env.development', '.env.production', '.env.local', '.env.staging', '.env.test', '.dev.vars'];
     for (const pattern of plaintextPatterns) {
         const filePath = join(root, pattern);
@@ -58,8 +59,8 @@ export async function statusCommand(options) {
         console.log('');
         console.log(pc.yellow('These files may expose secrets to AI assistants and version control.'));
         console.log(pc.bold('\nTo fix:'));
-        console.log(pc.dim('  1. Run: npx hush encrypt'));
-        console.log(pc.dim('  2. The plaintext files will be automatically deleted after encryption'));
+        console.log(pc.dim('  1. Run: npx hush migrate (if upgrading from v4)'));
+        console.log(pc.dim('  2. Delete or gitignore these .env files'));
         console.log(pc.dim('  3. Add to .gitignore: .env, .env.*, .dev.vars\n'));
     }
     console.log(pc.bold('Config:'));
@@ -118,10 +119,10 @@ export async function statusCommand(options) {
             ? pc.green(`  ${label}`)
             : pc.dim(`  ${label} (not found)`));
     }
-    const localPath = join(root, '.env.local');
-    console.log(existsSync(localPath)
-        ? pc.green('  .env.local (overrides)')
-        : pc.dim('  .env.local (optional, not found)'));
+    const localEncryptedPath = join(root, config.sources.local + '.encrypted');
+    console.log(existsSync(localEncryptedPath)
+        ? pc.green(`  ${config.sources.local}.encrypted (overrides)`)
+        : pc.dim(`  ${config.sources.local}.encrypted (optional, not found)`));
     console.log(pc.bold('\nTargets:'));
     for (const target of config.targets) {
         const filter = describeFilter(target);

package/dist/config/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAK9C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ1D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAepG;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAoBnD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAO5G;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CA8B3D"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAK9C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ1D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAepG;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAoBnD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAO5G;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CA6C3D"}

package/dist/config/loader.js

@@ -55,6 +55,7 @@ export function checkSchemaVersion(config) {
 export function validateConfig(config) {
     const errors = [];
     const validFormats = ['dotenv', 'wrangler', 'json', 'shell', 'yaml'];
+    const validPushTypes = ['cloudflare-workers', 'cloudflare-pages'];
     if (!config.sources.shared) {
         errors.push('sources.shared is required');
     }
@@ -76,6 +77,21 @@ export function validateConfig(config) {
         else if (!validFormats.includes(target.format)) {
             errors.push(`${prefix}: invalid format "${target.format}" (must be one of: ${validFormats.join(', ')})`);
         }
+        // Validate push_to configuration
+        if (target.push_to) {
+            if (!target.push_to.type) {
+                errors.push(`${prefix}: push_to.type is required (one of: ${validPushTypes.join(', ')})`);
+            }
+            else if (!validPushTypes.includes(target.push_to.type)) {
+                errors.push(`${prefix}: invalid push_to.type "${target.push_to.type}" (must be one of: ${validPushTypes.join(', ')})`);
+            }
+            else if (target.push_to.type === 'cloudflare-pages') {
+                const pagesConfig = target.push_to;
+                if (!pagesConfig.project) {
+                    errors.push(`${prefix}: push_to.project is required for cloudflare-pages`);
+                }
+            }
+        }
     }
     return errors;
 }

package/dist/types.d.ts

@@ -1,11 +1,21 @@
 export type OutputFormat = 'dotenv' | 'wrangler' | 'json' | 'shell' | 'yaml';
 export type Environment = 'development' | 'production';
+export type PushDestinationType = 'cloudflare-workers' | 'cloudflare-pages';
+export interface CloudflareWorkersPushConfig {
+    type: 'cloudflare-workers';
+}
+export interface CloudflarePagesPushConfig {
+    type: 'cloudflare-pages';
+    project: string;
+}
+export type PushConfig = CloudflareWorkersPushConfig | CloudflarePagesPushConfig;
 export interface Target {
     name: string;
     path: string;
     format: OutputFormat;
     include?: string[];
     exclude?: string[];
+    push_to?: PushConfig;
 }
 export interface SourceFiles {
     shared: string;
@@ -52,6 +62,7 @@ export interface PushOptions {
     root: string;
     dryRun: boolean;
     verbose: boolean;
+    target?: string;
 }
 export interface StatusOptions {
     root: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AACvD,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;AAE5E,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,oBAAoB,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,UAAU,GAAG,2BAA2B,GAAG,yBAAyB,CAAC;AAEjF,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE9G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,eAAe,EAAE,WAK7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAqBjF,CAAC"}

package/dist/types.js

@@ -1,9 +1,9 @@
 export const CURRENT_SCHEMA_VERSION = 2;
 export const DEFAULT_SOURCES = {
-    shared: '.env',
-    development: '.env.development',
-    production: '.env.production',
-    local: '.env.local',
+    shared: '.hush',
+    development: '.hush.development',
+    production: '.hush.production',
+    local: '.hush.local',
 };
 export const FORMAT_OUTPUT_FILES = {
     dotenv: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chriscode/hush",
-  "version": "4.1.2",
+  "version": "5.0.0",
   "description": "SOPS-based secrets management for monorepos. Encrypt once, decrypt everywhere.",
   "type": "module",
   "bin": {