@hubble-ventures/infisicml 1.2.1 → 2.0.0

package/dist/include.js

@@ -1,82 +1,26 @@
-import { resolveAliases } from "./aliases.js";
 /**
- * Resolve the canonical vault keys to request in `fetch: "keys"` mode.
- *
- * `include` names the *final* (post-{@link applyAliases}) keys, but the vault is
- * keyed by canonical names. For each `include` entry we request the name itself
- * (it may be a real vault key) plus any alias *source* whose target is that name
- * (so the source value exists to materialize the target). Phantom entries — an
- * alias target that isn't a real vault key — simply miss on fetch, which is
- * harmless: the post-fetch {@link selectEmittedSecrets} still validates the
- * emitted set against `include`, so a genuinely-missing key fails there exactly
- * as in folder mode.
+ * A declared key (a tree `raw` entry or `aliased` source) that no folder
+ * produced is treated like a missing required key: fail, unless it's listed in
+ * the environment's `optionalKeys`, in which case it's downgraded to a
+ * `::notice::`. Enforced identically in `pull` and `export-gha` so the two
+ * surfaces stay consistent.
  */
-export function resolveFetchKeys(include, manifest) {
-    const aliases = resolveAliases(manifest);
-    const keys = new Set();
-    for (const name of include) {
-        keys.add(name);
-        for (const { source, targets } of aliases) {
-            if (targets.includes(name))
-                keys.add(source);
-        }
-    }
-    return [...keys];
-}
-/**
- * Filter a materialized secret map down to the `include` allowlist.
- *
- * Runs *after* {@link applyAliases}, so it filters the final set of names: an
- * alias whose source isn't listed still emits its target, and a canonical key
- * not listed is dropped even when its alias target is kept.
- *
- * When `include` is `undefined` this is a pass-through (emit all keys) — the
- * backward-compatible default. Returns a new object; the input is not mutated.
- */
-export function applyInclude(merged, include) {
-    if (include === undefined) {
-        return { filtered: { ...merged }, unknown: [] };
-    }
-    const allow = new Set(include);
-    const filtered = {};
-    for (const [key, value] of Object.entries(merged)) {
-        if (allow.has(key))
-            filtered[key] = value;
-    }
-    const unknown = include.filter((name) => !(name in merged));
-    return { filtered, unknown };
-}
-/**
- * An `include` name that no folder produced is treated like a missing required
- * key: fail, unless it's listed in the environment's `optionalKeys`, in which
- * case it's downgraded to a `::notice::`. Enforced identically in `pull` and
- * `export-gha` so the two surfaces stay consistent.
- */
-export function enforceIncludeKnown(unknown, optionalKeys) {
+export function enforceKnownKeys(unknown, optionalKeys) {
     const optional = new Set(optionalKeys);
     const missing = [];
-    for (const name of unknown) {
+    // Dedupe: the same key name can be declared-and-absent in more than one
+    // folder, which would otherwise notice/report it twice.
+    for (const name of new Set(unknown)) {
         if (optional.has(name)) {
-            console.log(`::notice::include key ${name} not produced by any folder (optional for this environment)`);
+            console.log(`::notice::declared key ${name} not produced by its folder (optional for this environment)`);
         }
         else {
             missing.push(name);
         }
     }
     if (missing.length > 0) {
-        throw new Error(`include lists key(s) not produced by any pulled folder: ${missing.join(", ")}. ` +
+        throw new Error(`tree declares key(s) not produced by any pulled folder: ${missing.join(", ")}. ` +
             "Fix the name, add the folder, or list the key in environments.<slug>.optionalKeys to allow absence.");
     }
 }
-/**
- * Shared allowlist step for both emit surfaces: filter the aliased map to the
- * (already-resolved) `include` and enforce the unknown-key policy. Callers
- * resolve `include` once — with {@link resolveInclude} — so the value they use
- * for headers/logging is the same one that governs the filter.
- */
-export function selectEmittedSecrets(aliased, include, optionalKeys) {
-    const { filtered, unknown } = applyInclude(aliased, include);
-    enforceIncludeKnown(unknown, optionalKeys);
-    return filtered;
-}
 //# sourceMappingURL=include.js.map

package/dist/include.js.map

@@ -1 +1 @@
-{"version":3,"file":"include.js","sourceRoot":"","sources":["../src/include.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAiB,EACjB,QAAyB;IAEzB,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA8B,EAC9B,OAA6B;IAE7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC;IAC5D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAiB,EACjB,YAAsB;IAEtB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CACT,yBAAyB,IAAI,6DAA6D,CAC3F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,2DAA2D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC/E,qGAAqG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B,EAC/B,OAA6B,EAC7B,YAAsB;IAEtB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"include.js","sourceRoot":"","sources":["../src/include.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAiB,EACjB,YAAsB;IAEtB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,wEAAwE;IACxE,wDAAwD;IACxD,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CACT,0BAA0B,IAAI,6DAA6D,CAC5F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,2DAA2D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC/E,qGAAqG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,16 +1,17 @@
 export { applyAliases, type ResolvedAlias, resolveAliases, } from "./aliases.js";
-export { fetchSecretsForPaths, isCi, keysForCiStub, mergeFolderSecrets, shouldSkipInfisicalPull, } from "./ci-skip.js";
+export { fetchCompiledFolders, type FolderSecrets, isCi, keysForCiStub, materializeSecrets, mergeFolderSecrets, shouldSkipInfisicalPull, } from "./ci-skip.js";
 export { type AdvertiseKeysHook, defineConfig, type DiscoveryConfig, type InfisicmlConfig, loadConfig, type ResolvedConfig, } from "./config.js";
 export { parseDotenv, serializeDotenv } from "./dotenv.js";
 export { normalizeEnvSlug } from "./env-slug.js";
 export { appendPlainToGithubEnv, appendSecretsToGithubEnv, appendSecretToGithubEnv, } from "./github-env.js";
 export { type AdvertiseInput, keysForScope, runAdvertiseKeysHooks, } from "./hooks.js";
-export { applyInclude, enforceIncludeKnown, type IncludeResult, selectEmittedSecrets, } from "./include.js";
-export { loadManifestJson, normalizeFolderPath, resolveInclude, resolvePaths, resolveSecretsOutputPath, type SecretsManifest, secretsManifestSchema, } from "./manifest.js";
+export { enforceKnownKeys } from "./include.js";
+export { loadManifestJson, normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, resolveSecretsOutputPath, type SecretsManifest, secretsManifestSchema, } from "./manifest.js";
 export { logMissingOptionalKeys, resolveOptionalKeys, } from "./optional-keys.js";
 export { commandExists, LocalProvider } from "./providers/local.js";
 export { RemoteProvider } from "./providers/remote.js";
 export type { SecretsProvider } from "./providers/types.js";
 export { type PullResult, pullManifest, writeInjectedSecretsStub, } from "./pull.js";
 export { discoverManifests, type PackageManifest } from "./registry.js";
+export { type CompiledFolder, type CompiledKey, compileTree, type FolderArray, type FolderEntry, type SecretsTree, treeSchema, } from "./tree.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,aAAa,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,iBAAiB,EACtB,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,UAAU,EACV,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,cAAc,EACnB,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,KAAK,aAAa,EAClB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,wBAAwB,EACxB,KAAK,eAAe,EACpB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,KAAK,UAAU,EACf,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,aAAa,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EAClB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,iBAAiB,EACtB,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,UAAU,EACV,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,cAAc,EACnB,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,eAAe,EACpB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,KAAK,UAAU,EACf,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,UAAU,GACX,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -1,15 +1,16 @@
 export { applyAliases, resolveAliases, } from "./aliases.js";
-export { fetchSecretsForPaths, isCi, keysForCiStub, mergeFolderSecrets, shouldSkipInfisicalPull, } from "./ci-skip.js";
+export { fetchCompiledFolders, isCi, keysForCiStub, materializeSecrets, mergeFolderSecrets, shouldSkipInfisicalPull, } from "./ci-skip.js";
 export { defineConfig, loadConfig, } from "./config.js";
 export { parseDotenv, serializeDotenv } from "./dotenv.js";
 export { normalizeEnvSlug } from "./env-slug.js";
 export { appendPlainToGithubEnv, appendSecretsToGithubEnv, appendSecretToGithubEnv, } from "./github-env.js";
 export { keysForScope, runAdvertiseKeysHooks, } from "./hooks.js";
-export { applyInclude, enforceIncludeKnown, selectEmittedSecrets, } from "./include.js";
-export { loadManifestJson, normalizeFolderPath, resolveInclude, resolvePaths, resolveSecretsOutputPath, secretsManifestSchema, } from "./manifest.js";
+export { enforceKnownKeys } from "./include.js";
+export { loadManifestJson, normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, resolveSecretsOutputPath, secretsManifestSchema, } from "./manifest.js";
 export { logMissingOptionalKeys, resolveOptionalKeys, } from "./optional-keys.js";
 export { commandExists, LocalProvider } from "./providers/local.js";
 export { RemoteProvider } from "./providers/remote.js";
 export { pullManifest, writeInjectedSecretsStub, } from "./pull.js";
 export { discoverManifests } from "./registry.js";
+export { compileTree, treeSchema, } from "./tree.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAEZ,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,YAAY,EAGZ,UAAU,GAEX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,mBAAmB,EAEnB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,wBAAwB,EAExB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAEL,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAwB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAEZ,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EAEpB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,YAAY,EAGZ,UAAU,GAEX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EAExB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAEL,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAwB,MAAM,eAAe,CAAC;AACxE,OAAO,EAGL,WAAW,EAIX,UAAU,GACX,MAAM,WAAW,CAAC"}

package/dist/manifest.d.ts

@@ -1,18 +1,16 @@
 import { z } from "zod";
+import { type CompiledFolder } from "./tree.js";
 export declare const secretsManifestSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
-    paths: z.ZodArray<z.ZodString, "many">;
+    secrets: z.ZodType<import("./tree.js").SecretsTree, z.ZodTypeDef, import("./tree.js").SecretsTree>;
     profiles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        paths: z.ZodArray<z.ZodString, "many">;
-        include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        secrets: z.ZodType<import("./tree.js").SecretsTree, z.ZodTypeDef, import("./tree.js").SecretsTree>;
         fetch: z.ZodOptional<z.ZodEnum<["folder", "keys"]>>;
     }, "strip", z.ZodTypeAny, {
-        paths: string[];
-        include?: string[] | undefined;
+        secrets: import("./tree.js").SecretsTree;
         fetch?: "keys" | "folder" | undefined;
     }, {
-        paths: string[];
-        include?: string[] | undefined;
+        secrets: import("./tree.js").SecretsTree;
         fetch?: "keys" | "folder" | undefined;
     }>>>;
     ci: z.ZodOptional<z.ZodObject<{
@@ -26,8 +24,6 @@ export declare const secretsManifestSchema: z.ZodObject<{
         stubInCi?: boolean | undefined;
     }>>;
     output: z.ZodOptional<z.ZodString>;
-    aliases: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>>;
-    include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     fetch: z.ZodOptional<z.ZodEnum<["folder", "keys"]>>;
     environments: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         optionalKeys: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -37,13 +33,11 @@ export declare const secretsManifestSchema: z.ZodObject<{
         optionalKeys?: string[] | undefined;
     }>>>;
 }, "strip", z.ZodTypeAny, {
-    paths: string[];
+    secrets: import("./tree.js").SecretsTree;
     $schema?: string | undefined;
-    include?: string[] | undefined;
     fetch?: "keys" | "folder" | undefined;
     profiles?: Record<string, {
-        paths: string[];
-        include?: string[] | undefined;
+        secrets: import("./tree.js").SecretsTree;
         fetch?: "keys" | "folder" | undefined;
     }> | undefined;
     ci?: {
@@ -51,18 +45,15 @@ export declare const secretsManifestSchema: z.ZodObject<{
         stubInCi?: boolean | undefined;
     } | undefined;
     output?: string | undefined;
-    aliases?: Record<string, string | string[]> | undefined;
     environments?: Record<string, {
         optionalKeys?: string[] | undefined;
     }> | undefined;
 }, {
-    paths: string[];
+    secrets: import("./tree.js").SecretsTree;
     $schema?: string | undefined;
-    include?: string[] | undefined;
     fetch?: "keys" | "folder" | undefined;
     profiles?: Record<string, {
-        paths: string[];
-        include?: string[] | undefined;
+        secrets: import("./tree.js").SecretsTree;
         fetch?: "keys" | "folder" | undefined;
     }> | undefined;
     ci?: {
@@ -70,36 +61,24 @@ export declare const secretsManifestSchema: z.ZodObject<{
         stubInCi?: boolean | undefined;
     } | undefined;
     output?: string | undefined;
-    aliases?: Record<string, string | string[]> | undefined;
     environments?: Record<string, {
         optionalKeys?: string[] | undefined;
     }> | undefined;
 }>;
 export type SecretsManifest = z.infer<typeof secretsManifestSchema>;
 export declare function loadManifestJson(raw: unknown): SecretsManifest;
-/** Profile paths replace default paths when a profile is set. */
-export declare function resolvePaths(manifest: SecretsManifest, profile?: string): string[];
 /**
- * Resolve the effective key allowlist. A profile's `include` replaces the root
- * `include` when the profile defines it; otherwise the root `include` applies.
- * Returns `undefined` when no allowlist is in effect (emit all keys).
+ * Compile the effective folder tree into an ordered {@link CompiledFolder} list.
+ * A profile's `tree` replaces the root `tree` when a profile is set (same
+ * replace-not-merge as v1 `paths`). Throws on an unknown profile name.
  */
-export declare function resolveInclude(manifest: SecretsManifest, profile?: string): string[] | undefined;
+export declare function resolveCompiledFolders(manifest: SecretsManifest, profile?: string): CompiledFolder[];
 /**
  * Resolve the effective fetch mode. A profile's `fetch` replaces the root
  * `fetch` when the profile defines it; otherwise the root `fetch` applies.
- * Defaults to `"folder"` (whole-folder read + local filter) when unset.
+ * Defaults to `"folder"` (whole-folder read + local select) when unset.
  */
 export declare function resolveFetchMode(manifest: SecretsManifest, profile?: string): "folder" | "keys";
-/**
- * Cross-field rule: `fetch: "keys"` requires an `include` allowlist, because
- * key mode fetches exactly the keys `include` names. The check spans the root
- * and every profile (a profile's `fetch`/`include` each replace the root's), so
- * every runnable combination is covered. Returns human-readable issue strings
- * (empty when consistent) for `validate` to surface. Zod can't express this —
- * the requirement depends on the resolved profile.
- */
-export declare function checkFetchIncludeConsistency(manifest: SecretsManifest): string[];
 export declare function normalizeFolderPath(folder: string): string;
 export declare function resolveSecretsOutputPath(manifestDir: string, outputName: string): string;
 //# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA8BxB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwDhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAE9D;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,EAAE,CASV;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,EAAE,GAAG,SAAS,CAMtB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,QAAQ,GAAG,MAAM,CAMnB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,eAAe,GACxB,MAAM,EAAE,CAeV;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAiBR"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,KAAK,cAAc,EAGpB,MAAM,WAAW,CAAC;AASnB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyChC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,cAAc,EAAE,CASlB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,QAAQ,GAAG,MAAM,CAMnB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAiBR"}

package/dist/manifest.js

@@ -1,39 +1,25 @@
 import { resolve, sep } from "node:path";
 import { z } from "zod";
-const pathPattern = /^[a-z0-9_/-]+$/;
-const pathsSchema = z
-    .array(z.string().regex(pathPattern))
-    .min(1, "paths must be a non-empty array");
-const envVarNamePattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const aliasSourceSchema = z
-    .string()
-    .regex(envVarNamePattern, "alias source must be a valid env var name");
-const aliasTargetSchema = z
-    .string()
-    .regex(envVarNamePattern, "alias target must be a valid env var name");
-// Key-level allowlist. When present, only these env var names are emitted from
-// whatever the folders yielded (after aliases). `.min(1)` because an empty
-// allowlist is almost certainly a mistake — omit the field to emit every key.
-const includeSchema = z
-    .array(z.string().regex(envVarNamePattern, "include entry must be a valid env var name"))
-    .min(1, "include must be a non-empty array");
+import { compileTree, treeSchema, } from "./tree.js";
 // How secrets are read from the vault. `folder` (default) fetches whole folders
-// and filters locally. `keys` fetches only the exact keys `include` resolves to,
-// so the vault never transmits the rest — wire-level least privilege. `keys`
-// requires an `include` allowlist (enforced by resolveFetchKeys / validate,
-// since the requirement depends on the resolved profile).
+// and selects the declared keys locally. `keys` fetches only the exact keys the
+// tree declares, so the vault never transmits the rest — wire-level least
+// privilege. Because the tree always names every key, `keys` needs no separate
+// allowlist (unlike v1, where it required `include`).
 const fetchModeSchema = z.enum(["folder", "keys"]);
 export const secretsManifestSchema = z.object({
     $schema: z.string().optional(),
-    paths: pathsSchema,
+    // The folder tree: an array of `{ folder: [ ...contents ] }` objects naming
+    // which Infisical folders to pull and, per folder, exactly which keys to emit
+    // (bare strings) and how to alias them (`{ SOURCE: "TARGET" }`). Subfolders
+    // nest as `{ name: [ ... ] }`. See tree.ts for the entry grammar.
+    secrets: treeSchema,
     profiles: z
         .record(z.string(), z.object({
-        paths: pathsSchema,
-        // Replaces the root `include` for this profile when set; if omitted,
-        // the root `include` applies (same replace-not-merge as `paths`).
-        include: includeSchema.optional(),
-        // Overrides the root `fetch` for this profile when set (same
-        // replace-not-merge as `paths` / `include`).
+        // Replaces the root `secrets` for this profile when running with
+        // --profile (same replace-not-merge as v1 `paths`).
+        secrets: treeSchema,
+        // Overrides the root `fetch` for this profile when set.
         fetch: fetchModeSchema.optional(),
     }))
         .optional(),
@@ -47,23 +33,9 @@ export const secretsManifestSchema = z.object({
         .string()
         .regex(/^[^/\\]+$/)
         .optional(),
-    // Map a pulled secret to the extra env var name(s) a build/runtime expects.
-    // The vault names a secret once (e.g. /clerk exposes the publishable key as
-    // CLERK_PUBLISHABLE_KEY), but build tools inline it by a tool-specific,
-    // convention-prefixed name — Vite reads VITE_*, Next reads NEXT_PUBLIC_*.
-    // Declaring the mapping here means every consumer (CI export-gha, local pull)
-    // emits the right name instead of each workflow re-deriving it.
-    aliases: z
-        .record(aliasSourceSchema, z.union([aliasTargetSchema, z.array(aliasTargetSchema).min(1)]))
-        .optional(),
-    // Emit only these keys from whatever the folders yielded (default-deny key
-    // selection). Applied after `aliases`, to the final set of names — so a client
-    // can pull a shared vendor folder but emit only its public key. Absent = emit
-    // all (backward compatible). A per-profile `include` replaces this one.
-    include: includeSchema.optional(),
-    // Read strategy: `folder` (default) pulls whole folders and filters locally;
-    // `keys` pulls only the keys `include` resolves to (least privilege at the
-    // wire). A per-profile `fetch` replaces this one.
+    // Read strategy: `folder` (default) pulls whole folders and selects the
+    // declared keys locally; `keys` pulls only the declared keys (least privilege
+    // at the wire). A per-profile `fetch` replaces this one.
     fetch: fetchModeSchema.optional(),
     environments: z
         .record(z.string(), z.object({
@@ -74,34 +46,25 @@ export const secretsManifestSchema = z.object({
 export function loadManifestJson(raw) {
     return secretsManifestSchema.parse(raw);
 }
-/** Profile paths replace default paths when a profile is set. */
-export function resolvePaths(manifest, profile) {
+/**
+ * Compile the effective folder tree into an ordered {@link CompiledFolder} list.
+ * A profile's `tree` replaces the root `tree` when a profile is set (same
+ * replace-not-merge as v1 `paths`). Throws on an unknown profile name.
+ */
+export function resolveCompiledFolders(manifest, profile) {
     if (profile) {
         const profileConfig = manifest.profiles?.[profile];
         if (!profileConfig) {
             throw new Error(`Unknown profile '${profile}' in secrets.json`);
         }
-        return profileConfig.paths;
+        return compileTree(profileConfig.secrets);
     }
-    return manifest.paths;
-}
-/**
- * Resolve the effective key allowlist. A profile's `include` replaces the root
- * `include` when the profile defines it; otherwise the root `include` applies.
- * Returns `undefined` when no allowlist is in effect (emit all keys).
- */
-export function resolveInclude(manifest, profile) {
-    if (profile) {
-        const profileInclude = manifest.profiles?.[profile]?.include;
-        if (profileInclude !== undefined)
-            return profileInclude;
-    }
-    return manifest.include;
+    return compileTree(manifest.secrets);
 }
 /**
  * Resolve the effective fetch mode. A profile's `fetch` replaces the root
  * `fetch` when the profile defines it; otherwise the root `fetch` applies.
- * Defaults to `"folder"` (whole-folder read + local filter) when unset.
+ * Defaults to `"folder"` (whole-folder read + local select) when unset.
  */
 export function resolveFetchMode(manifest, profile) {
     if (profile) {
@@ -111,28 +74,6 @@ export function resolveFetchMode(manifest, profile) {
     }
     return manifest.fetch ?? "folder";
 }
-/**
- * Cross-field rule: `fetch: "keys"` requires an `include` allowlist, because
- * key mode fetches exactly the keys `include` names. The check spans the root
- * and every profile (a profile's `fetch`/`include` each replace the root's), so
- * every runnable combination is covered. Returns human-readable issue strings
- * (empty when consistent) for `validate` to surface. Zod can't express this —
- * the requirement depends on the resolved profile.
- */
-export function checkFetchIncludeConsistency(manifest) {
-    const issues = [];
-    const check = (profile, label) => {
-        if (resolveFetchMode(manifest, profile) === "keys" &&
-            resolveInclude(manifest, profile) === undefined) {
-            issues.push(`fetch: "keys" requires an include allowlist (${label})`);
-        }
-    };
-    check(undefined, "root");
-    for (const name of Object.keys(manifest.profiles ?? {})) {
-        check(name, `profile "${name}"`);
-    }
-    return issues;
-}
 export function normalizeFolderPath(folder) {
     return `/${folder.replace(/^\/+/, "")}`;
 }

package/dist/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,MAAM,WAAW,GAAG,CAAC;KAClB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;KACpC,GAAG,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC;AAE7C,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AACrD,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,KAAK,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;AACzE,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,KAAK,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;AAEzE,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,MAAM,aAAa,GAAG,CAAC;KACpB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;KACxF,GAAG,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC;AAE/C,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,CAAC;SACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,KAAK,EAAE,WAAW;QAClB,qEAAqE;QACrE,kEAAkE;QAClE,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;QACjC,6DAA6D;QAC7D,6CAA6C;QAC7C,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;KAClC,CAAC,CACH;SACA,QAAQ,EAAE;IACb,EAAE,EAAE,CAAC;SACF,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC3C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,CAAC;SAClB,QAAQ,EAAE;IACb,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,8EAA8E;IAC9E,gEAAgE;IAChE,OAAO,EAAE,CAAC;SACP,MAAM,CACL,iBAAiB,EACjB,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAChE;SACA,QAAQ,EAAE;IACb,2EAA2E;IAC3E,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,6EAA6E;IAC7E,2EAA2E;IAC3E,kDAAkD;IAClD,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,CAAC;SACZ,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAC1B,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,mBAAmB,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC;IAC7B,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,cAAc,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAC7D,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,cAAc,CAAC;IAC1D,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;QACzD,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC;IACtD,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAyB;IAEzB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,OAA2B,EAAE,KAAa,EAAE,EAAE;QAC3D,IACE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,MAAM;YAC9C,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,SAAS,EAC/C,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,gDAAgD,KAAK,GAAG,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,EAAE,YAAY,IAAI,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,UAAkB;IAElB,IACE,UAAU,KAAK,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;QAC1C,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,UAAU,CAAC,MAAM,KAAK,CAAC,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,IACE,WAAW,KAAK,WAAW;QAC3B,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,WAAW,EACX,UAAU,GACX,MAAM,WAAW,CAAC;AAEnB,gFAAgF;AAChF,gFAAgF;AAChF,0EAA0E;AAC1E,+EAA+E;AAC/E,sDAAsD;AACtD,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,kEAAkE;IAClE,OAAO,EAAE,UAAU;IACnB,QAAQ,EAAE,CAAC;SACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,oDAAoD;QACpD,OAAO,EAAE,UAAU;QACnB,wDAAwD;QACxD,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;KAClC,CAAC,CACH;SACA,QAAQ,EAAE;IACb,EAAE,EAAE,CAAC;SACF,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC3C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,CAAC;SAClB,QAAQ,EAAE;IACb,wEAAwE;IACxE,8EAA8E;IAC9E,yDAAyD;IACzD,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,CAAC;SACZ,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,mBAAmB,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;QACzD,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC;IACtD,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,UAAkB;IAElB,IACE,UAAU,KAAK,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;QAC1C,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,UAAU,CAAC,MAAM,KAAK,CAAC,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,IACE,WAAW,KAAK,WAAW;QAC3B,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../src/pull.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9C,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;CAC3B,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,EAAE,GACb,IAAI,CAgBN;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAkErB"}
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../src/pull.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9C,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;CAC3B,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,EAAE,GACb,IAAI,CAgBN;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAgErB"}

package/dist/pull.js

@@ -1,10 +1,8 @@
 import { existsSync, writeFileSync } from "node:fs";
 import { relative } from "node:path";
-import { applyAliases } from "./aliases.js";
-import { fetchManifestSecrets, keysForCiStub, shouldSkipInfisicalPull, } from "./ci-skip.js";
+import { fetchCompiledFolders, keysForCiStub, materializeSecrets, shouldSkipInfisicalPull, } from "./ci-skip.js";
 import { serializeDotenv } from "./dotenv.js";
-import { selectEmittedSecrets } from "./include.js";
-import { normalizeFolderPath, resolveFetchMode, resolveInclude, resolvePaths, resolveSecretsOutputPath, } from "./manifest.js";
+import { normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, resolveSecretsOutputPath, } from "./manifest.js";
 import { resolveOptionalKeys } from "./optional-keys.js";
 export function writeInjectedSecretsStub(outputPath, manifest, keys) {
     const fromEnv = {};
@@ -37,25 +35,22 @@ export async function pullManifest(options) {
         console.log(`⏭️  ${manifest.id}: skipped Infisical pull (injected env → ${rel})`);
         return "skipped";
     }
-    const paths = resolvePaths(manifest.config, profile);
+    const folders = resolveCompiledFolders(manifest.config, profile);
     const fetchMode = resolveFetchMode(manifest.config, profile);
-    const aliased = applyAliases(await fetchManifestSecrets(provider, envName, paths, manifest.config, profile), manifest.config);
-    // Default-deny key selection: emit only the allowlisted keys when `include`
-    // is set (after aliases). Absent = emit all.
-    const include = resolveInclude(manifest.config, profile);
-    const merged = selectEmittedSecrets(aliased, include, resolveOptionalKeys(manifest.config, envName));
-    // filter(Boolean) drops the optional Profile/Include lines when absent. It
-    // would also drop a trailing "" sentinel, so append the trailing newline
-    // explicitly — otherwise the first secret gets glued onto the "# Generated"
-    // line.
+    // Per-folder fetch → per-folder alias + missing-key enforcement → merge, so a
+    // key declared in two folders keeps each folder's value/provenance.
+    const folderSecrets = await fetchCompiledFolders(provider, envName, folders, fetchMode);
+    const merged = materializeSecrets(folderSecrets, resolveOptionalKeys(manifest.config, envName));
+    // filter(Boolean) drops the optional Profile line when absent. It would also
+    // drop a trailing "" sentinel, so append the trailing newline explicitly —
+    // otherwise the first secret gets glued onto the "# Generated" line.
     const header = `${[
         "# Pulled from Infisical — do not edit. Refresh: infisicml pull",
         `# Package: ${manifest.id}`,
         `# Environment: ${envName}`,
         profile ? `# Profile: ${profile}` : "",
-        `# Paths: ${paths.map((p) => normalizeFolderPath(p)).join(", ")}`,
+        `# Paths: ${folders.map((f) => normalizeFolderPath(f.path)).join(", ")}`,
         fetchMode === "keys" ? "# Fetch: keys (per-key least-privilege read)" : "",
-        include ? `# Include: ${include.join(", ")}` : "",
         `# Generated: ${new Date().toISOString()}`,
     ]
         .filter(Boolean)

package/dist/pull.js.map

@@ -1 +1 @@
-{"version":3,"file":"pull.js","sourceRoot":"","sources":["../src/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAgBzD,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,QAAyB,EACzB,IAAc;IAEd,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG;QACb,sEAAsE;QACtE,cAAc,QAAQ,CAAC,EAAE,EAAE;QAC3B,sDAAsD;QACtD,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;QAC1C,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA4B;IAE5B,MAAM,EACJ,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,OAAO,EACP,KAAK,GAAG,KAAK,EACb,SAAS,GAAG,KAAK,EACjB,QAAQ,GACT,GAAG,OAAO,CAAC;IAEZ,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;IAC5D,MAAM,UAAU,GAAG,wBAAwB,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE3C,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,CAAC,EAAE,KAAK,GAAG,kCAAkC,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5C,wBAAwB,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CACT,OAAO,QAAQ,CAAC,EAAE,4CAA4C,GAAG,GAAG,CACrE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,YAAY,CAC1B,MAAM,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9E,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,oBAAoB,CACjC,OAAO,EACP,OAAO,EACP,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAC9C,CAAC;IAEF,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,QAAQ;IACR,MAAM,MAAM,GAAG,GAAG;QAChB,gEAAgE;QAChE,cAAc,QAAQ,CAAC,EAAE,EAAE;QAC3B,kBAAkB,OAAO,EAAE;QAC3B,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;QACtC,YAAY,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACjE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,EAAE;QAC1E,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QACjD,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;KAC3C;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAElB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CACT,KAAK,QAAQ,CAAC,EAAE,WAAW,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,QAAQ,CACtE,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"pull.js","sourceRoot":"","sources":["../src/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAgBzD,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,QAAyB,EACzB,IAAc;IAEd,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG;QACb,sEAAsE;QACtE,cAAc,QAAQ,CAAC,EAAE,EAAE;QAC3B,sDAAsD;QACtD,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;QAC1C,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA4B;IAE5B,MAAM,EACJ,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,OAAO,EACP,KAAK,GAAG,KAAK,EACb,SAAS,GAAG,KAAK,EACjB,QAAQ,GACT,GAAG,OAAO,CAAC;IAEZ,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;IAC5D,MAAM,UAAU,GAAG,wBAAwB,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE3C,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,CAAC,EAAE,KAAK,GAAG,kCAAkC,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5C,wBAAwB,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CACT,OAAO,QAAQ,CAAC,EAAE,4CAA4C,GAAG,GAAG,CACrE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,OAAO,EACP,OAAO,EACP,SAAS,CACV,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAC/B,aAAa,EACb,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAC9C,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,MAAM,GAAG,GAAG;QAChB,gEAAgE;QAChE,cAAc,QAAQ,CAAC,EAAE,EAAE;QAC3B,kBAAkB,OAAO,EAAE;QAC3B,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;QACtC,YAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,EAAE;QAC1E,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;KAC3C;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAElB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CACT,KAAK,QAAQ,CAAC,EAAE,WAAW,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,QAAQ,CACtE,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/tree.d.ts

@@ -0,0 +1,49 @@
+import { z } from "zod";
+/**
+ * One entry in a folder's contents array. Either:
+ * - a **string** — a plain key emitted as-is, or
+ * - an **object** whose entries are, per key, discriminated by value type:
+ *   - `SOURCE: "TARGET"` (string value) — an alias (the canonical vault key
+ *     `SOURCE` is emitted and copied to `TARGET`). Multiple targets? Repeat the
+ *     entry, one target each.
+ *   - `name: [ ... ]` (array value) — a subfolder (its own contents array).
+ */
+export type FolderEntry = string | {
+    [key: string]: string | FolderArray;
+};
+/** A folder's contents: a non-empty array of {@link FolderEntry}. */
+export type FolderArray = FolderEntry[];
+/**
+ * The manifest's `secrets`: a non-empty array of single-folder objects
+ * (`{ folderName: contentsArray }`) — the top level of the tree.
+ */
+export type SecretsTree = Array<{
+    [folder: string]: FolderArray;
+}>;
+/** A single emitted key resolved from a folder (canonical name + aliases). */
+export type CompiledKey = {
+    key: string;
+    aliases: string[];
+};
+/** A folder path plus the exact keys to emit from it (provenance-aware). */
+export type CompiledFolder = {
+    path: string;
+    keys: CompiledKey[];
+};
+/**
+ * Schema for the manifest's `secrets`: a non-empty array of folder objects, each
+ * validated recursively. Cast to the precise {@link SecretsTree} type — the base
+ * `z.array` infers `unknown[]`, but every element is structurally a folder
+ * object once {@link validateFolderObject} passes.
+ */
+export declare const treeSchema: z.ZodType<SecretsTree>;
+/**
+ * Flatten a validated tree into an ordered list of {@link CompiledFolder}.
+ * String entries carry no aliases; each `SOURCE: "TARGET"` entry carries its
+ * single target (repeat the entry for several targets). A folder's own keys are
+ * emitted before recursing into its subfolders, so declaration order is
+ * preserved (last folder wins on a genuine cross-folder name collision at merge
+ * time).
+ */
+export declare function compileTree(secrets: SecretsTree): CompiledFolder[];
+//# sourceMappingURL=tree.d.ts.map

package/dist/tree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree.d.ts","sourceRoot":"","sources":["../src/tree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAA;CAAE,CAAC;AAE3E,qEAAqE;AACrE,MAAM,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;AAExC;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,KAAK,CAAC;IAAE,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAAA;CAAE,CAAC,CAAC;AAEnE,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE7D,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAkJnE;;;;;GAKG;AACH,eAAO,MAAM,UAAU,EAUJ,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1C;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,cAAc,EAAE,CAQlE"}