@hubble-ventures/infisicml 1.2.1 → 2.0.0

package/dist/ci-skip.js

@@ -1,5 +1,5 @@
-import { resolveFetchKeys } from "./include.js";
-import { resolveFetchMode, resolveInclude, } from "./manifest.js";
+import { applyAliases } from "./aliases.js";
+import { enforceKnownKeys } from "./include.js";
 export function mergeFolderSecrets(chunks) {
     const merged = {};
     for (const chunk of chunks) {
@@ -7,52 +7,61 @@ export function mergeFolderSecrets(chunks) {
     }
     return merged;
 }
-export async function fetchSecretsForPaths(provider, envName, paths) {
-    const chunks = [];
-    for (const folder of paths) {
-        chunks.push(await provider.exportFolder(envName, folder));
-    }
-    return mergeFolderSecrets(chunks);
-}
 /**
- * `fetch: "keys"` counterpart to {@link fetchSecretsForPaths}: request only the
- * given canonical keys from each folder and merge. A key absent from one folder
- * is simply not returned by that folder; the merge (last folder wins, matching
- * the folder path) collects it from whichever folder holds it.
+ * Fetch each compiled folder and select *that folder's* declared keys from it,
+ * honoring the resolved `fetch` mode. `keys` mode requests only the declared
+ * keys per folder (the tree names the exact canonical vault keys, so no
+ * allowlist reverse-map is needed — the alias *source* is the real key);
+ * `folder` mode reads the whole folder and picks the declared keys locally.
+ *
+ * Returns one {@link FolderSecrets} per folder so downstream steps keep folder
+ * provenance: two folders declaring the same key name are distinct entries here,
+ * and only collapse (last-wins) at the final merge — see {@link materializeSecrets}.
  */
-export async function fetchSecretsForKeys(provider, envName, paths, keys) {
-    const chunks = [];
-    for (const folder of paths) {
-        chunks.push(await provider.exportKeys(envName, folder, keys));
+export async function fetchCompiledFolders(provider, envName, folders, fetchMode) {
+    const out = [];
+    for (const folder of folders) {
+        const declared = folder.keys.map((k) => k.key);
+        const raw = fetchMode === "keys"
+            ? await provider.exportKeys(envName, folder.path, declared)
+            : await provider.exportFolder(envName, folder.path);
+        const selected = {};
+        for (const key of declared) {
+            if (key in raw)
+                selected[key] = raw[key];
+        }
+        out.push({ folder, selected });
     }
-    return mergeFolderSecrets(chunks);
+    return out;
 }
 /**
- * Fetch a manifest's secrets for the given folder set, honoring its resolved
- * `fetch` mode: `keys` requests only the canonical keys `include` resolves to
- * (least privilege at the wire), `folder` reads whole folders. `keys` requires
- * an `include` allowlist — the whole point is to name exactly what to fetch.
+ * Turn per-folder fetched secrets into the final emit map, preserving folder
+ * provenance:
+ *
+ * - **Missing keys are checked per folder/key pair, before merging.** A key
+ *   declared in `/a` but absent from `/a` is unknown even if a same-named key in
+ *   `/b` was produced — so a genuine miss can't be masked by another folder.
+ * - **Aliases expand from the folder-local value.** `/a`'s `TOKEN -> A_TOKEN`
+ *   uses `/a`'s `TOKEN`, and `/b`'s `TOKEN -> B_TOKEN` uses `/b`'s — the flat
+ *   merge (which keeps only one `TOKEN`) can no longer route one folder's secret
+ *   to another folder's alias.
  *
- * Callers pass an explicit `paths` subset (export-gha splits runtime vs
- * deploy-only) rather than re-deriving it, so the runtime/deploy provenance the
- * caller already computed is preserved.
+ * Folder-local aliased maps then merge in tree order (last-wins on a genuine
+ * cross-folder name collision). A declared key absent from its folder fails
+ * unless its name is in `optionalKeys` for the environment.
  */
-export async function fetchManifestSecrets(provider, envName, paths, manifest, profile) {
-    if (resolveFetchMode(manifest, profile) === "keys") {
-        const include = resolveInclude(manifest, profile);
-        if (!include) {
-            // resolveInclude already checked the profile then the root, so name the
-            // exact place(s) that need an `include` rather than a vague "root or
-            // profile" — the user should add it to whichever they're running.
-            const where = profile
-                ? `neither profile "${profile}" nor the manifest root defines one`
-                : "the manifest root does not define one";
-            throw new Error(`fetch: "keys" requires an include allowlist, but ${where}. ` +
-                "Add `include: [...]` naming exactly which keys to request from the vault.");
+export function materializeSecrets(folderSecrets, optionalKeys) {
+    const unknown = [];
+    const chunks = [];
+    for (const { folder, selected } of folderSecrets) {
+        for (const key of folder.keys) {
+            if (!(key.key in selected))
+                unknown.push(key.key);
         }
-        return fetchSecretsForKeys(provider, envName, paths, resolveFetchKeys(include, manifest));
+        chunks.push(applyAliases(selected, [folder]));
     }
-    return fetchSecretsForPaths(provider, envName, paths);
+    enforceKnownKeys(unknown, optionalKeys);
+    return mergeFolderSecrets(chunks);
 }
 export function isCi() {
     const ci = process.env.CI;

package/dist/ci-skip.js.map

@@ -1 +1 @@
-{"version":3,"file":"ci-skip.js","sourceRoot":"","sources":["../src/ci-skip.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,cAAc,GAEf,MAAM,eAAe,CAAC;AAKvB,MAAM,UAAU,kBAAkB,CAChC,MAAgC;IAEhC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAyB,EACzB,OAAe,EACf,KAAe;IAEf,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAyB,EACzB,OAAe,EACf,KAAe,EACf,IAAc;IAEd,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAyB,EACzB,OAAe,EACf,KAAe,EACf,QAAyB,EACzB,OAAgB;IAEhB,IAAI,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,wEAAwE;YACxE,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,KAAK,GAAG,OAAO;gBACnB,CAAC,CAAC,oBAAoB,OAAO,qCAAqC;gBAClE,CAAC,CAAC,uCAAuC,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,oDAAoD,KAAK,IAAI;gBAC3D,2EAA2E,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,mBAAmB,CACxB,QAAQ,EACR,OAAO,EACP,KAAK,EACL,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,IAAI;IAClB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1B,OAAO,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,GAAG,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAyB,EACzB,KAAc;IAEd,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAEtB,IAAI,EAAE,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAyB;IACrD,OAAO,QAAQ,CAAC,EAAE,EAAE,WAAW,IAAI,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"ci-skip.js","sourceRoot":"","sources":["../src/ci-skip.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAchD,MAAM,UAAU,kBAAkB,CAChC,MAAgC;IAEhC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAyB,EACzB,OAAe,EACf,OAAyB,EACzB,SAA4B;IAE5B,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,GAAG,GACP,SAAS,KAAK,MAAM;YAClB,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC3D,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,GAAG,IAAI,GAAG;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAChC,aAA8B,EAC9B,YAAsB;IAEtB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,aAAa,EAAE,CAAC;QACjD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,QAAQ,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACxC,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,IAAI;IAClB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1B,OAAO,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,GAAG,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAyB,EACzB,KAAc;IAEd,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAEtB,IAAI,EAAE,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAyB;IACrD,OAAO,QAAQ,CAAC,EAAE,EAAE,WAAW,IAAI,EAAE,CAAC;AACxC,CAAC"}

package/dist/commands/export-gha.d.ts

@@ -1,3 +1,4 @@
+import type { CompiledFolder } from "../tree.js";
 export type ExportGhaOptions = {
     packageId: string;
     env: string;
@@ -7,5 +8,20 @@ export type ExportGhaOptions = {
     projectSlug?: string;
     identityId?: string;
 };
+/**
+ * Canonical (pre-alias) key names to advertise, split runtime vs all.
+ *
+ * Classification is by **(path, key)** against the base tree, not by folder path
+ * alone: a profile can reuse a base folder path and add deploy-only keys, so a
+ * key counts as runtime only if the base tree declares *that key* under *that
+ * path*. This keeps a deploy-only credential in a shared folder out of the
+ * runtime-scoped advertise set (and thus out of runtime deploy forwarding).
+ * Only keys actually in `emitted` are advertised, so an absent optional key is
+ * never named.
+ */
+export declare function computeAdvertiseKeys(allFolders: CompiledFolder[], baseFolders: CompiledFolder[], emitted: Record<string, string>): {
+    runtimeKeys: string[];
+    allKeys: string[];
+};
 export declare function runExportGha(options: ExportGhaOptions): Promise<void>;
 //# sourceMappingURL=export-gha.d.ts.map

package/dist/commands/export-gha.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"export-gha.d.ts","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoG3E"}
+{"version":3,"file":"export-gha.d.ts","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,cAAc,EAAE,EAC5B,WAAW,EAAE,cAAc,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B;IAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAiB9C;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuE3E"}

package/dist/commands/export-gha.js

@@ -1,14 +1,42 @@
-import { applyAliases } from "../aliases.js";
-import { fetchManifestSecrets } from "../ci-skip.js";
+import { fetchCompiledFolders, materializeSecrets } from "../ci-skip.js";
 import { loadConfig } from "../config.js";
 import { normalizeEnvSlug } from "../env-slug.js";
 import { appendSecretsToGithubEnv } from "../github-env.js";
 import { runAdvertiseKeysHooks } from "../hooks.js";
-import { selectEmittedSecrets } from "../include.js";
-import { normalizeFolderPath, resolveInclude, resolvePaths, } from "../manifest.js";
-import { logMissingOptionalKeys, resolveOptionalKeys, } from "../optional-keys.js";
+import { normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, } from "../manifest.js";
+import { resolveOptionalKeys } from "../optional-keys.js";
 import { RemoteProvider } from "../providers/remote.js";
 import { discoverManifests } from "../registry.js";
+/**
+ * Canonical (pre-alias) key names to advertise, split runtime vs all.
+ *
+ * Classification is by **(path, key)** against the base tree, not by folder path
+ * alone: a profile can reuse a base folder path and add deploy-only keys, so a
+ * key counts as runtime only if the base tree declares *that key* under *that
+ * path*. This keeps a deploy-only credential in a shared folder out of the
+ * runtime-scoped advertise set (and thus out of runtime deploy forwarding).
+ * Only keys actually in `emitted` are advertised, so an absent optional key is
+ * never named.
+ */
+export function computeAdvertiseKeys(allFolders, baseFolders, emitted) {
+    const baseKeysByPath = new Map();
+    for (const f of baseFolders) {
+        baseKeysByPath.set(f.path, new Set(f.keys.map((k) => k.key)));
+    }
+    const runtimeKeys = new Set();
+    const allKeys = new Set();
+    for (const folder of allFolders) {
+        for (const key of folder.keys) {
+            if (emitted[key.key] === undefined)
+                continue;
+            allKeys.add(key.key);
+            if (baseKeysByPath.get(folder.path)?.has(key.key)) {
+                runtimeKeys.add(key.key);
+            }
+        }
+    }
+    return { runtimeKeys: [...runtimeKeys], allKeys: [...allKeys] };
+}
 export async function runExportGha(options) {
     const config = await loadConfig(options.cwd);
     const envName = normalizeEnvSlug(process.env.INFISICAL_ENV_SLUG ?? options.env);
@@ -25,13 +53,11 @@ export async function runExportGha(options) {
     if (!manifest) {
         throw new Error(`Unknown package id: ${options.packageId}`);
     }
-    // Base `paths` are the app's runtime secrets; a profile (e.g. `deploy`) may
-    // replace them with a superset that also carries deploy-time credentials.
-    // Split the two so we advertise only runtime keys for deploy forwarding.
-    const allPaths = resolvePaths(manifest.config, options.profile);
-    const basePaths = manifest.config.paths;
-    const runtimePaths = basePaths.filter((p) => allPaths.includes(p));
-    const deployOnlyPaths = allPaths.filter((p) => !runtimePaths.includes(p));
+    // The base tree holds the app's runtime secrets; a profile (e.g. `deploy`)
+    // may replace it with a superset that also carries deploy-time credentials.
+    const allFolders = resolveCompiledFolders(manifest.config, options.profile);
+    const baseFolders = resolveCompiledFolders(manifest.config);
+    const fetchMode = resolveFetchMode(manifest.config, options.profile);
     const identityId = options.identityId ?? process.env.INFISICAL_IDENTITY_ID;
     if (!identityId) {
         throw new Error("INFISICAL_IDENTITY_ID required — infisicml CI auth is GitHub OIDC only (no client-id/secret fallback). Set `permissions: id-token: write` on the job.");
@@ -42,38 +68,21 @@ export async function runExportGha(options) {
         identityId,
         oidcAudience: process.env.INFISICAL_OIDC_AUDIENCE ?? config.auth?.oidcAudience,
     });
-    for (const folder of allPaths) {
-        console.log(`Loading Infisical path ${normalizeFolderPath(folder)} (${envName})`);
+    for (const folder of allFolders) {
+        console.log(`Loading Infisical path ${normalizeFolderPath(folder.path)} (${envName})`);
     }
-    // Two calls (runtime then deploy-only), reusing the cached access token, so we
-    // know which keys are runtime without per-folder provenance through the merge.
-    const runtimeSecrets = await fetchManifestSecrets(provider, envName, runtimePaths, manifest.config, options.profile);
-    const deployOnlySecrets = deployOnlyPaths.length
-        ? await fetchManifestSecrets(provider, envName, deployOnlyPaths, manifest.config, options.profile)
-        : {};
+    // One per-folder fetch (token cached across folders). Per-folder alias
+    // expansion + missing-key enforcement (before the merge) keeps provenance, so
+    // a key declared in two folders can't have one folder's miss masked by the
+    // other, nor one folder's value routed to the other's alias.
+    const folderSecrets = await fetchCompiledFolders(provider, envName, allFolders, fetchMode);
     const optionalKeys = resolveOptionalKeys(manifest.config, envName);
-    const aliased = applyAliases({ ...runtimeSecrets, ...deployOnlySecrets }, manifest.config);
-    // Default-deny key selection: emit only the allowlisted keys when `include`
-    // is set. Absent = emit all.
-    const include = resolveInclude(manifest.config, options.profile);
-    // Notice missing optional keys against the pre-include set — a key present in
-    // the folders but filtered out by `include` isn't "missing". Skip keys the
-    // allowlist governs: those get a single notice from selectEmittedSecrets'
-    // unknown-key check, so we don't emit two notices for the same absent key.
-    const includeSet = new Set(include ?? []);
-    logMissingOptionalKeys(aliased, optionalKeys.filter((k) => !includeSet.has(k)));
-    const merged = selectEmittedSecrets(aliased, include, optionalKeys);
+    const merged = materializeSecrets(folderSecrets, optionalKeys);
     appendSecretsToGithubEnv(githubEnvPath, merged);
     // Advertise CANONICAL (pre-alias) key names. Alias targets (e.g.
     // NEXT_PUBLIC_*) are build-tool copies, not the names a server runtime reads,
     // so they are intentionally not advertised — they still land in the job env
-    // via `merged` for build steps that need them. Drop any key `include`
-    // filtered out (a no-op when `include` is absent, since every fetched key is
-    // then in `merged`) so we never advertise a name not in the job env.
-    const emitted = (keys) => keys.filter((k) => merged[k] !== undefined);
-    runAdvertiseKeysHooks(githubEnvPath, config.hooks?.advertiseKeys, {
-        runtimeKeys: emitted(Object.keys(runtimeSecrets)),
-        allKeys: emitted(Object.keys({ ...runtimeSecrets, ...deployOnlySecrets })),
-    });
+    // via `merged` for build steps that need them.
+    runAdvertiseKeysHooks(githubEnvPath, config.hooks?.advertiseKeys, computeAdvertiseKeys(allFolders, baseFolders, merged));
 }
 //# sourceMappingURL=export-gha.js.map

package/dist/commands/export-gha.js.map

@@ -1 +1 @@
-{"version":3,"file":"export-gha.js","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAYnD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAyB;IAC1D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,gBAAgB,CAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAC9C,CAAC;IACF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAC5E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC9E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;IACxC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC;QAClC,MAAM,EAAE,MAAM,CAAC,eAAe;QAC9B,WAAW;QACX,UAAU;QACV,YAAY,EACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,MAAM,CAAC,IAAI,EAAE,YAAY;KACnE,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CACT,0BAA0B,mBAAmB,CAAC,MAAM,CAAC,KAAK,OAAO,GAAG,CACrE,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAC/C,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,QAAQ,CAAC,MAAM,EACf,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,MAAM,iBAAiB,GAAG,eAAe,CAAC,MAAM;QAC9C,CAAC,CAAC,MAAM,oBAAoB,CACxB,QAAQ,EACR,OAAO,EACP,eAAe,EACf,QAAQ,CAAC,MAAM,EACf,OAAO,CAAC,OAAO,CAChB;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,YAAY,CAC1B,EAAE,GAAG,cAAc,EAAE,GAAG,iBAAiB,EAAE,EAC3C,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,4EAA4E;IAC5E,6BAA6B;IAC7B,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC1C,sBAAsB,CACpB,OAAO,EACP,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;IACF,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACpE,wBAAwB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAEhD,iEAAiE;IACjE,8EAA8E;IAC9E,4EAA4E;IAC5E,sEAAsE;IACtE,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,OAAO,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAChF,qBAAqB,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE;QAChE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,cAAc,EAAE,GAAG,iBAAiB,EAAE,CAAC,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"export-gha.js","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAanD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA4B,EAC5B,WAA6B,EAC7B,OAA+B;IAE/B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,SAAS;YAC7C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAyB;IAC1D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,gBAAgB,CAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAC9C,CAAC;IACF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAC5E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC9E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAErE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC;QAClC,MAAM,EAAE,MAAM,CAAC,eAAe;QAC9B,WAAW;QACX,UAAU;QACV,YAAY,EACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,MAAM,CAAC,IAAI,EAAE,YAAY;KACnE,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CACT,0BAA0B,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,OAAO,GAAG,CAC1E,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,8EAA8E;IAC9E,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,OAAO,EACP,UAAU,EACV,SAAS,CACV,CAAC;IACF,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC/D,wBAAwB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAEhD,iEAAiE;IACjE,8EAA8E;IAC9E,4EAA4E;IAC5E,+CAA+C;IAC/C,qBAAqB,CACnB,aAAa,EACb,MAAM,CAAC,KAAK,EAAE,aAAa,EAC3B,oBAAoB,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,CACtD,CAAC;AACJ,CAAC"}

package/dist/commands/list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAIA,wBAAsB,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BzD"}
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAoBA,wBAAsB,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBzD"}

package/dist/commands/list.js

@@ -1,34 +1,26 @@
 import { loadConfig } from "../config.js";
-import { normalizeFolderPath } from "../manifest.js";
+import { normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, } from "../manifest.js";
 import { discoverManifests } from "../registry.js";
+function printFolders(folders, indent) {
+    for (const folder of folders) {
+        console.log(`${indent}${normalizeFolderPath(folder.path)}`);
+        for (const key of folder.keys) {
+            const alias = key.aliases.length > 0 ? ` → ${key.aliases.join(", ")}` : "";
+            console.log(`${indent}  ${key.key}${alias}`);
+        }
+    }
+}
 export async function runList(cwd) {
     const config = await loadConfig(cwd);
     const manifests = discoverManifests(config);
     for (const { id, config: m } of manifests) {
-        const paths = m.paths.map((p) => normalizeFolderPath(p)).join(", ");
-        console.log(`  ${id}: ${paths}`);
-        if (m.include) {
-            console.log(`    include: ${m.include.join(", ")}`);
-        }
-        if (m.fetch) {
-            console.log(`    fetch: ${m.fetch}`);
-        }
-        if (m.profiles) {
-            for (const [name, profile] of Object.entries(m.profiles)) {
-                const profilePaths = profile.paths
-                    .map((p) => normalizeFolderPath(p))
-                    .join(", ");
-                console.log(`    [${name}]: ${profilePaths}`);
-                // A profile include/fetch replaces the root value; show whichever applies.
-                const effectiveInclude = profile.include ?? m.include;
-                if (effectiveInclude) {
-                    console.log(`      include: ${effectiveInclude.join(", ")}`);
-                }
-                const effectiveFetch = profile.fetch ?? m.fetch;
-                if (effectiveFetch) {
-                    console.log(`      fetch: ${effectiveFetch}`);
-                }
-            }
+        const fetch = resolveFetchMode(m);
+        console.log(`  ${id}${fetch === "keys" ? " (fetch: keys)" : ""}:`);
+        printFolders(resolveCompiledFolders(m), "    ");
+        for (const name of Object.keys(m.profiles ?? {})) {
+            const profileFetch = resolveFetchMode(m, name);
+            console.log(`    [${name}]${profileFetch === "keys" ? " (fetch: keys)" : ""}:`);
+            printFolders(resolveCompiledFolders(m, name), "      ");
         }
     }
 }

package/dist/commands/list.js.map

@@ -1 +1 @@
-{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE5C,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK;qBAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;qBAClC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,YAAY,EAAE,CAAC,CAAC;gBAC9C,2EAA2E;gBAC3E,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC;gBACtD,IAAI,gBAAgB,EAAE,CAAC;oBACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/D,CAAC;gBACD,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;gBAChD,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,GAAG,CAAC,gBAAgB,cAAc,EAAE,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGnD,SAAS,YAAY,CAAC,OAAyB,EAAE,MAAc;IAC7D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,KAAK,GACT,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE5C,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnE,YAAY,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CACT,QAAQ,IAAI,IAAI,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,CACnE,CAAC;YACF,YAAY,CAAC,sBAAsB,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/commands/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BnE"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BnE"}

package/dist/commands/paths.js

@@ -1,5 +1,5 @@
 import { loadConfig } from "../config.js";
-import { normalizeFolderPath, resolveFetchMode, resolveInclude, resolvePaths, } from "../manifest.js";
+import { normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, } from "../manifest.js";
 import { discoverManifests } from "../registry.js";
 export async function runPaths(options) {
     const config = await loadConfig(options.cwd);
@@ -8,17 +8,18 @@ export async function runPaths(options) {
     if (!manifest) {
         throw new Error(`Unknown package id: ${options.packageId}`);
     }
-    const paths = resolvePaths(manifest.config, options.profile);
-    const normalized = paths.map((p) => normalizeFolderPath(p));
-    // `paths` feeds the infisical CLI, which fetches whole folders — key-level
-    // `include` filtering happens later, in pull/export-gha. Warn on stderr so the
-    // filtering isn't invisible to someone reading only this folder list.
-    const include = resolveInclude(manifest.config, options.profile);
-    if (include) {
-        console.error(`# note: ${options.packageId} filters emitted keys to: ${include.join(", ")}`);
+    const folders = resolveCompiledFolders(manifest.config, options.profile);
+    const normalized = folders.map((f) => normalizeFolderPath(f.path));
+    // `paths` feeds the infisical CLI, which fetches whole folders — the tree's
+    // per-folder key selection happens later, in pull/export-gha. Note on stderr
+    // which keys each folder emits so the selection isn't invisible to someone
+    // reading only this folder list.
+    for (const folder of folders) {
+        const keys = folder.keys.map((k) => k.key).join(", ");
+        console.error(`# note: ${normalizeFolderPath(folder.path)} emits: ${keys}`);
     }
     if (resolveFetchMode(manifest.config, options.profile) === "keys") {
-        console.error(`# note: ${options.packageId} uses fetch: "keys" — only the include keys are emitted; in CI they are read per-key from the vault (wire-level least privilege).`);
+        console.error(`# note: ${options.packageId} uses fetch: "keys" — only the declared keys are read, per-key from the vault (wire-level least privilege).`);
     }
     if (options.comma) {
         console.log(normalized.map((p) => p.replace(/^\//, "")).join(","));

package/dist/commands/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AASnD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5D,2EAA2E;IAC3E,+EAA+E;IAC/E,sEAAsE;IACtE,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CACX,WAAW,OAAO,CAAC,SAAS,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QAClE,OAAO,CAAC,KAAK,CACX,WAAW,OAAO,CAAC,SAAS,mIAAmI,CAChK,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AASnD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEnE,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,iCAAiC;IACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,OAAO,CAAC,KAAK,CAAC,WAAW,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QAClE,OAAO,CAAC,KAAK,CACX,WAAW,OAAO,CAAC,SAAS,6GAA6G,CAC1I,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/commands/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,OAAO,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAgClE"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,OAAO,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAmClE"}

package/dist/commands/run.js

@@ -1,7 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { loadConfig } from "../config.js";
 import { normalizeEnvSlug } from "../env-slug.js";
-import { normalizeFolderPath, resolvePaths } from "../manifest.js";
+import { normalizeFolderPath, resolveCompiledFolders } from "../manifest.js";
 import { discoverManifests } from "../registry.js";
 export async function runExec(options) {
     const config = await loadConfig(options.cwd);
@@ -19,8 +19,11 @@ export async function runExec(options) {
         });
         return result.status ?? 1;
     }
-    const paths = resolvePaths(manifest.config, options.profile);
-    const pathFlags = paths.flatMap((p) => ["--path", normalizeFolderPath(p)]);
+    const folders = resolveCompiledFolders(manifest.config, options.profile);
+    const pathFlags = folders.flatMap((f) => [
+        "--path",
+        normalizeFolderPath(f.path),
+    ]);
     const result = spawnSync("infisical", ["run", `--env=${envName}`, ...pathFlags, "--", ...options.command], { stdio: "inherit", cwd: repoRoot });
     if (result.error) {
         throw result.error;

package/dist/commands/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAUnD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAmB;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACrE,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,SAAS,CACtB,WAAW,EACX,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EACnE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CACpC,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAUnD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAmB;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACrE,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACvC,QAAQ;QACR,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,SAAS,CACtB,WAAW,EACX,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EACnE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CACpC,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/commands/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAOA,wBAAsB,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B7D"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAIA,wBAAsB,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB7D"}

package/dist/commands/validate.js

@@ -1,5 +1,5 @@
 import { loadConfig } from "../config.js";
-import { checkFetchIncludeConsistency, secretsManifestSchema, } from "../manifest.js";
+import { secretsManifestSchema } from "../manifest.js";
 import { discoverManifests } from "../registry.js";
 export async function runValidate(cwd) {
     const config = await loadConfig(cwd);
@@ -13,16 +13,6 @@ export async function runValidate(cwd) {
                 console.error(`   ${issue.path.join(".")}: ${issue.message}`);
             }
             errors += 1;
-            continue;
-        }
-        // Cross-field checks the schema can't express (depend on resolved profile).
-        const semanticIssues = checkFetchIncludeConsistency(result.data);
-        if (semanticIssues.length > 0) {
-            console.error(`❌ ${id} (${dir}/secrets.json):`);
-            for (const issue of semanticIssues) {
-                console.error(`   ${issue}`);
-            }
-            errors += 1;
         }
     }
     if (errors > 0) {

package/dist/commands/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,IAAI,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QACD,4EAA4E;QAC5E,MAAM,cAAc,GAAG,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,sBAAsB,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,oBAAoB,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,sBAAsB,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,oBAAoB,CAAC,CAAC;AACzD,CAAC"}

package/dist/github-env.js

@@ -9,7 +9,7 @@ export function appendSecretToGithubEnv(githubEnvPath, key, value) {
         const masked = line.replaceAll("%", "%25");
         process.stdout.write(`::add-mask::${masked}\n`);
     }
-    let delim = `INFISCML_${key}_${Date.now()}${process.hrtime.bigint()}`;
+    let delim = `INFISICML_${key}_${Date.now()}${process.hrtime.bigint()}`;
     while (value.includes(delim)) {
         delim = `${delim}_`;
     }

package/dist/github-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-env.js","sourceRoot":"","sources":["../src/github-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,GAAW,EACX,KAAa;IAEb,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,mFAAmF;IACnF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,KAAK,GAAG,YAAY,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IACtE,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,GAAG,GAAG,KAAK,GAAG,CAAC;IACtB,CAAC;IAED,cAAc,CAAC,aAAa,EAAE,GAAG,GAAG,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,aAAqB,EACrB,OAA+B;IAE/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,uBAAuB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,GAAW,EACX,KAAa;IAEb,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,sBAAsB,CAAC,CAAC;IAC3E,CAAC;IACD,cAAc,CAAC,aAAa,EAAE,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"github-env.js","sourceRoot":"","sources":["../src/github-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,GAAW,EACX,KAAa;IAEb,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,mFAAmF;IACnF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,KAAK,GAAG,aAAa,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IACvE,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,GAAG,GAAG,KAAK,GAAG,CAAC;IACtB,CAAC;IAED,cAAc,CAAC,aAAa,EAAE,GAAG,GAAG,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,aAAqB,EACrB,OAA+B;IAE/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,uBAAuB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,GAAW,EACX,KAAa;IAEb,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,sBAAsB,CAAC,CAAC;IAC3E,CAAC;IACD,cAAc,CAAC,aAAa,EAAE,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC;AACrD,CAAC"}

package/dist/include.d.ts

@@ -1,46 +1,9 @@
-import type { SecretsManifest } from "./manifest.js";
 /**
- * Resolve the canonical vault keys to request in `fetch: "keys"` mode.
- *
- * `include` names the *final* (post-{@link applyAliases}) keys, but the vault is
- * keyed by canonical names. For each `include` entry we request the name itself
- * (it may be a real vault key) plus any alias *source* whose target is that name
- * (so the source value exists to materialize the target). Phantom entries — an
- * alias target that isn't a real vault key — simply miss on fetch, which is
- * harmless: the post-fetch {@link selectEmittedSecrets} still validates the
- * emitted set against `include`, so a genuinely-missing key fails there exactly
- * as in folder mode.
+ * A declared key (a tree `raw` entry or `aliased` source) that no folder
+ * produced is treated like a missing required key: fail, unless it's listed in
+ * the environment's `optionalKeys`, in which case it's downgraded to a
+ * `::notice::`. Enforced identically in `pull` and `export-gha` so the two
+ * surfaces stay consistent.
  */
-export declare function resolveFetchKeys(include: string[], manifest: SecretsManifest): string[];
-export type IncludeResult = {
-    /** The emitted map after allowlist filtering. */
-    filtered: Record<string, string>;
-    /** `include` names that no folder produced (absent from the input map). */
-    unknown: string[];
-};
-/**
- * Filter a materialized secret map down to the `include` allowlist.
- *
- * Runs *after* {@link applyAliases}, so it filters the final set of names: an
- * alias whose source isn't listed still emits its target, and a canonical key
- * not listed is dropped even when its alias target is kept.
- *
- * When `include` is `undefined` this is a pass-through (emit all keys) — the
- * backward-compatible default. Returns a new object; the input is not mutated.
- */
-export declare function applyInclude(merged: Record<string, string>, include: string[] | undefined): IncludeResult;
-/**
- * An `include` name that no folder produced is treated like a missing required
- * key: fail, unless it's listed in the environment's `optionalKeys`, in which
- * case it's downgraded to a `::notice::`. Enforced identically in `pull` and
- * `export-gha` so the two surfaces stay consistent.
- */
-export declare function enforceIncludeKnown(unknown: string[], optionalKeys: string[]): void;
-/**
- * Shared allowlist step for both emit surfaces: filter the aliased map to the
- * (already-resolved) `include` and enforce the unknown-key policy. Callers
- * resolve `include` once — with {@link resolveInclude} — so the value they use
- * for headers/logging is the same one that governs the filter.
- */
-export declare function selectEmittedSecrets(aliased: Record<string, string>, include: string[] | undefined, optionalKeys: string[]): Record<string, string>;
+export declare function enforceKnownKeys(unknown: string[], optionalKeys: string[]): void;
 //# sourceMappingURL=include.d.ts.map

package/dist/include.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"include.d.ts","sourceRoot":"","sources":["../src/include.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EAAE,EACjB,QAAQ,EAAE,eAAe,GACxB,MAAM,EAAE,CAUV;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAC5B,aAAa,CAWf;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EAAE,EACjB,YAAY,EAAE,MAAM,EAAE,GACrB,IAAI,CAkBN;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,EAC7B,YAAY,EAAE,MAAM,EAAE,GACrB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB"}
+{"version":3,"file":"include.d.ts","sourceRoot":"","sources":["../src/include.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EAAE,EACjB,YAAY,EAAE,MAAM,EAAE,GACrB,IAAI,CAoBN"}