@hubble-ventures/infisicml 1.2.1 → 2.1.0

package/dist/ci-skip.d.ts

@@ -1,26 +1,43 @@
-import { type SecretsManifest } from "./manifest.js";
+import type { SecretsManifest } from "./manifest.js";
 import type { SecretsProvider } from "./providers/types.js";
+import type { CompiledFolder } from "./tree.js";
 export type { SecretsProvider };
+/** A folder's declared keys paired with the values that folder actually held. */
+export type FolderSecrets = {
+    folder: CompiledFolder;
+    /** Declared keys present in this folder (canonical, pre-alias). */
+    selected: Record<string, string>;
+};
 export declare function mergeFolderSecrets(chunks: Record<string, string>[]): Record<string, string>;
-export declare function fetchSecretsForPaths(provider: SecretsProvider, envName: string, paths: string[]): Promise<Record<string, string>>;
 /**
- * `fetch: "keys"` counterpart to {@link fetchSecretsForPaths}: request only the
- * given canonical keys from each folder and merge. A key absent from one folder
- * is simply not returned by that folder; the merge (last folder wins, matching
- * the folder path) collects it from whichever folder holds it.
+ * Fetch each compiled folder and select *that folder's* declared keys from it,
+ * honoring the resolved `fetch` mode. `keys` mode requests only the declared
+ * keys per folder (the tree names the exact canonical vault keys, so no
+ * allowlist reverse-map is needed — the alias *source* is the real key);
+ * `folder` mode reads the whole folder and picks the declared keys locally.
+ *
+ * Returns one {@link FolderSecrets} per folder so downstream steps keep folder
+ * provenance: two folders declaring the same key name are distinct entries here,
+ * and only collapse (last-wins) at the final merge — see {@link materializeSecrets}.
  */
-export declare function fetchSecretsForKeys(provider: SecretsProvider, envName: string, paths: string[], keys: string[]): Promise<Record<string, string>>;
+export declare function fetchCompiledFolders(provider: SecretsProvider, envName: string, folders: CompiledFolder[], fetchMode: "folder" | "keys"): Promise<FolderSecrets[]>;
 /**
- * Fetch a manifest's secrets for the given folder set, honoring its resolved
- * `fetch` mode: `keys` requests only the canonical keys `include` resolves to
- * (least privilege at the wire), `folder` reads whole folders. `keys` requires
- * an `include` allowlist — the whole point is to name exactly what to fetch.
+ * Turn per-folder fetched secrets into the final emit map, preserving folder
+ * provenance:
+ *
+ * - **Missing keys are checked per folder/key pair, before merging.** A key
+ *   declared in `/a` but absent from `/a` is unknown even if a same-named key in
+ *   `/b` was produced — so a genuine miss can't be masked by another folder.
+ * - **Aliases expand from the folder-local value.** `/a`'s `TOKEN -> A_TOKEN`
+ *   uses `/a`'s `TOKEN`, and `/b`'s `TOKEN -> B_TOKEN` uses `/b`'s — the flat
+ *   merge (which keeps only one `TOKEN`) can no longer route one folder's secret
+ *   to another folder's alias.
  *
- * Callers pass an explicit `paths` subset (export-gha splits runtime vs
- * deploy-only) rather than re-deriving it, so the runtime/deploy provenance the
- * caller already computed is preserved.
+ * Folder-local aliased maps then merge in tree order (last-wins on a genuine
+ * cross-folder name collision). A declared key absent from its folder fails
+ * unless its name is in `optionalKeys` for the environment.
  */
-export declare function fetchManifestSecrets(provider: SecretsProvider, envName: string, paths: string[], manifest: SecretsManifest, profile?: string): Promise<Record<string, string>>;
+export declare function materializeSecrets(folderSecrets: FolderSecrets[], optionalKeys: string[]): Record<string, string>;
 export declare function isCi(): boolean;
 export declare function shouldSkipInfisicalPull(manifest: SecretsManifest, force: boolean): boolean;
 export declare function keysForCiStub(manifest: SecretsManifest): string[];

package/dist/ci-skip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-skip.d.ts","sourceRoot":"","sources":["../src/ci-skip.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAC/B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMxB;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAMjC;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAMjC;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAuBjC;AAED,wBAAgB,IAAI,IAAI,OAAO,CAG9B;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,OAAO,GACb,OAAO,CAgBT;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,EAAE,CAEjE"}
+{"version":3,"file":"ci-skip.d.ts","sourceRoot":"","sources":["../src/ci-skip.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,cAAc,CAAC;IACvB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAC/B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMxB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,cAAc,EAAE,EACzB,SAAS,EAAE,QAAQ,GAAG,MAAM,GAC3B,OAAO,CAAC,aAAa,EAAE,CAAC,CAe1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,EAAE,EAC9B,YAAY,EAAE,MAAM,EAAE,GACrB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxB;AAED,wBAAgB,IAAI,IAAI,OAAO,CAG9B;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,OAAO,GACb,OAAO,CAgBT;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,EAAE,CAEjE"}

package/dist/ci-skip.js

@@ -1,5 +1,5 @@
-import { resolveFetchKeys } from "./include.js";
-import { resolveFetchMode, resolveInclude, } from "./manifest.js";
+import { applyAliases } from "./aliases.js";
+import { enforceKnownKeys } from "./include.js";
 export function mergeFolderSecrets(chunks) {
     const merged = {};
     for (const chunk of chunks) {
@@ -7,52 +7,61 @@ export function mergeFolderSecrets(chunks) {
     }
     return merged;
 }
-export async function fetchSecretsForPaths(provider, envName, paths) {
-    const chunks = [];
-    for (const folder of paths) {
-        chunks.push(await provider.exportFolder(envName, folder));
-    }
-    return mergeFolderSecrets(chunks);
-}
 /**
- * `fetch: "keys"` counterpart to {@link fetchSecretsForPaths}: request only the
- * given canonical keys from each folder and merge. A key absent from one folder
- * is simply not returned by that folder; the merge (last folder wins, matching
- * the folder path) collects it from whichever folder holds it.
+ * Fetch each compiled folder and select *that folder's* declared keys from it,
+ * honoring the resolved `fetch` mode. `keys` mode requests only the declared
+ * keys per folder (the tree names the exact canonical vault keys, so no
+ * allowlist reverse-map is needed — the alias *source* is the real key);
+ * `folder` mode reads the whole folder and picks the declared keys locally.
+ *
+ * Returns one {@link FolderSecrets} per folder so downstream steps keep folder
+ * provenance: two folders declaring the same key name are distinct entries here,
+ * and only collapse (last-wins) at the final merge — see {@link materializeSecrets}.
  */
-export async function fetchSecretsForKeys(provider, envName, paths, keys) {
-    const chunks = [];
-    for (const folder of paths) {
-        chunks.push(await provider.exportKeys(envName, folder, keys));
+export async function fetchCompiledFolders(provider, envName, folders, fetchMode) {
+    const out = [];
+    for (const folder of folders) {
+        const declared = folder.keys.map((k) => k.key);
+        const raw = fetchMode === "keys"
+            ? await provider.exportKeys(envName, folder.path, declared)
+            : await provider.exportFolder(envName, folder.path);
+        const selected = {};
+        for (const key of declared) {
+            if (key in raw)
+                selected[key] = raw[key];
+        }
+        out.push({ folder, selected });
     }
-    return mergeFolderSecrets(chunks);
+    return out;
 }
 /**
- * Fetch a manifest's secrets for the given folder set, honoring its resolved
- * `fetch` mode: `keys` requests only the canonical keys `include` resolves to
- * (least privilege at the wire), `folder` reads whole folders. `keys` requires
- * an `include` allowlist — the whole point is to name exactly what to fetch.
+ * Turn per-folder fetched secrets into the final emit map, preserving folder
+ * provenance:
+ *
+ * - **Missing keys are checked per folder/key pair, before merging.** A key
+ *   declared in `/a` but absent from `/a` is unknown even if a same-named key in
+ *   `/b` was produced — so a genuine miss can't be masked by another folder.
+ * - **Aliases expand from the folder-local value.** `/a`'s `TOKEN -> A_TOKEN`
+ *   uses `/a`'s `TOKEN`, and `/b`'s `TOKEN -> B_TOKEN` uses `/b`'s — the flat
+ *   merge (which keeps only one `TOKEN`) can no longer route one folder's secret
+ *   to another folder's alias.
  *
- * Callers pass an explicit `paths` subset (export-gha splits runtime vs
- * deploy-only) rather than re-deriving it, so the runtime/deploy provenance the
- * caller already computed is preserved.
+ * Folder-local aliased maps then merge in tree order (last-wins on a genuine
+ * cross-folder name collision). A declared key absent from its folder fails
+ * unless its name is in `optionalKeys` for the environment.
  */
-export async function fetchManifestSecrets(provider, envName, paths, manifest, profile) {
-    if (resolveFetchMode(manifest, profile) === "keys") {
-        const include = resolveInclude(manifest, profile);
-        if (!include) {
-            // resolveInclude already checked the profile then the root, so name the
-            // exact place(s) that need an `include` rather than a vague "root or
-            // profile" — the user should add it to whichever they're running.
-            const where = profile
-                ? `neither profile "${profile}" nor the manifest root defines one`
-                : "the manifest root does not define one";
-            throw new Error(`fetch: "keys" requires an include allowlist, but ${where}. ` +
-                "Add `include: [...]` naming exactly which keys to request from the vault.");
+export function materializeSecrets(folderSecrets, optionalKeys) {
+    const unknown = [];
+    const chunks = [];
+    for (const { folder, selected } of folderSecrets) {
+        for (const key of folder.keys) {
+            if (!(key.key in selected))
+                unknown.push(key.key);
         }
-        return fetchSecretsForKeys(provider, envName, paths, resolveFetchKeys(include, manifest));
+        chunks.push(applyAliases(selected, [folder]));
     }
-    return fetchSecretsForPaths(provider, envName, paths);
+    enforceKnownKeys(unknown, optionalKeys);
+    return mergeFolderSecrets(chunks);
 }
 export function isCi() {
     const ci = process.env.CI;

package/dist/ci-skip.js.map

@@ -1 +1 @@
-{"version":3,"file":"ci-skip.js","sourceRoot":"","sources":["../src/ci-skip.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,cAAc,GAEf,MAAM,eAAe,CAAC;AAKvB,MAAM,UAAU,kBAAkB,CAChC,MAAgC;IAEhC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAyB,EACzB,OAAe,EACf,KAAe;IAEf,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAyB,EACzB,OAAe,EACf,KAAe,EACf,IAAc;IAEd,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAyB,EACzB,OAAe,EACf,KAAe,EACf,QAAyB,EACzB,OAAgB;IAEhB,IAAI,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,wEAAwE;YACxE,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,KAAK,GAAG,OAAO;gBACnB,CAAC,CAAC,oBAAoB,OAAO,qCAAqC;gBAClE,CAAC,CAAC,uCAAuC,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,oDAAoD,KAAK,IAAI;gBAC3D,2EAA2E,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,mBAAmB,CACxB,QAAQ,EACR,OAAO,EACP,KAAK,EACL,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,IAAI;IAClB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1B,OAAO,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,GAAG,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAyB,EACzB,KAAc;IAEd,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAEtB,IAAI,EAAE,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAyB;IACrD,OAAO,QAAQ,CAAC,EAAE,EAAE,WAAW,IAAI,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"ci-skip.js","sourceRoot":"","sources":["../src/ci-skip.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAchD,MAAM,UAAU,kBAAkB,CAChC,MAAgC;IAEhC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAyB,EACzB,OAAe,EACf,OAAyB,EACzB,SAA4B;IAE5B,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,GAAG,GACP,SAAS,KAAK,MAAM;YAClB,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC3D,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,GAAG,IAAI,GAAG;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAChC,aAA8B,EAC9B,YAAsB;IAEtB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,aAAa,EAAE,CAAC;QACjD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,QAAQ,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACxC,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,IAAI;IAClB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1B,OAAO,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,GAAG,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAyB,EACzB,KAAc;IAEd,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAEtB,IAAI,EAAE,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAyB;IACrD,OAAO,QAAQ,CAAC,EAAE,EAAE,WAAW,IAAI,EAAE,CAAC;AACxC,CAAC"}

package/dist/commands/export-gha.d.ts

@@ -1,3 +1,4 @@
+import type { CompiledFolder } from "../tree.js";
 export type ExportGhaOptions = {
     packageId: string;
     env: string;
@@ -7,5 +8,20 @@ export type ExportGhaOptions = {
     projectSlug?: string;
     identityId?: string;
 };
+/**
+ * Canonical (pre-alias) key names to advertise, split runtime vs all.
+ *
+ * Classification is by **(path, key)** against the base tree, not by folder path
+ * alone: a profile can reuse a base folder path and add deploy-only keys, so a
+ * key counts as runtime only if the base tree declares *that key* under *that
+ * path*. This keeps a deploy-only credential in a shared folder out of the
+ * runtime-scoped advertise set (and thus out of runtime deploy forwarding).
+ * Only keys actually in `emitted` are advertised, so an absent optional key is
+ * never named.
+ */
+export declare function computeAdvertiseKeys(allFolders: CompiledFolder[], baseFolders: CompiledFolder[], emitted: Record<string, string>): {
+    runtimeKeys: string[];
+    allKeys: string[];
+};
 export declare function runExportGha(options: ExportGhaOptions): Promise<void>;
 //# sourceMappingURL=export-gha.d.ts.map

package/dist/commands/export-gha.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"export-gha.d.ts","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoG3E"}
+{"version":3,"file":"export-gha.d.ts","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,cAAc,EAAE,EAC5B,WAAW,EAAE,cAAc,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B;IAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAiB9C;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyE3E"}

package/dist/commands/export-gha.js

@@ -1,14 +1,42 @@
-import { applyAliases } from "../aliases.js";
-import { fetchManifestSecrets } from "../ci-skip.js";
+import { fetchCompiledFolders, materializeSecrets } from "../ci-skip.js";
 import { loadConfig } from "../config.js";
 import { normalizeEnvSlug } from "../env-slug.js";
 import { appendSecretsToGithubEnv } from "../github-env.js";
 import { runAdvertiseKeysHooks } from "../hooks.js";
-import { selectEmittedSecrets } from "../include.js";
-import { normalizeFolderPath, resolveInclude, resolvePaths, } from "../manifest.js";
-import { logMissingOptionalKeys, resolveOptionalKeys, } from "../optional-keys.js";
+import { normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, } from "../manifest.js";
+import { resolveOptionalKeys } from "../optional-keys.js";
 import { RemoteProvider } from "../providers/remote.js";
-import { discoverManifests } from "../registry.js";
+import { discoverPackages, loadPackage } from "../registry.js";
+/**
+ * Canonical (pre-alias) key names to advertise, split runtime vs all.
+ *
+ * Classification is by **(path, key)** against the base tree, not by folder path
+ * alone: a profile can reuse a base folder path and add deploy-only keys, so a
+ * key counts as runtime only if the base tree declares *that key* under *that
+ * path*. This keeps a deploy-only credential in a shared folder out of the
+ * runtime-scoped advertise set (and thus out of runtime deploy forwarding).
+ * Only keys actually in `emitted` are advertised, so an absent optional key is
+ * never named.
+ */
+export function computeAdvertiseKeys(allFolders, baseFolders, emitted) {
+    const baseKeysByPath = new Map();
+    for (const f of baseFolders) {
+        baseKeysByPath.set(f.path, new Set(f.keys.map((k) => k.key)));
+    }
+    const runtimeKeys = new Set();
+    const allKeys = new Set();
+    for (const folder of allFolders) {
+        for (const key of folder.keys) {
+            if (emitted[key.key] === undefined)
+                continue;
+            allKeys.add(key.key);
+            if (baseKeysByPath.get(folder.path)?.has(key.key)) {
+                runtimeKeys.add(key.key);
+            }
+        }
+    }
+    return { runtimeKeys: [...runtimeKeys], allKeys: [...allKeys] };
+}
 export async function runExportGha(options) {
     const config = await loadConfig(options.cwd);
     const envName = normalizeEnvSlug(process.env.INFISICAL_ENV_SLUG ?? options.env);
@@ -20,18 +48,16 @@ export async function runExportGha(options) {
     if (!projectSlug) {
         throw new Error("INFISICAL_PROJECT_SLUG required");
     }
-    const manifests = discoverManifests(config);
-    const manifest = manifests.find((m) => m.id === options.packageId);
-    if (!manifest) {
+    const ref = discoverPackages(config).find((p) => p.id === options.packageId);
+    if (!ref) {
         throw new Error(`Unknown package id: ${options.packageId}`);
     }
-    // Base `paths` are the app's runtime secrets; a profile (e.g. `deploy`) may
-    // replace them with a superset that also carries deploy-time credentials.
-    // Split the two so we advertise only runtime keys for deploy forwarding.
-    const allPaths = resolvePaths(manifest.config, options.profile);
-    const basePaths = manifest.config.paths;
-    const runtimePaths = basePaths.filter((p) => allPaths.includes(p));
-    const deployOnlyPaths = allPaths.filter((p) => !runtimePaths.includes(p));
+    const manifest = loadPackage(ref);
+    // The base tree holds the app's runtime secrets; a profile (e.g. `deploy`)
+    // may replace it with a superset that also carries deploy-time credentials.
+    const allFolders = resolveCompiledFolders(manifest.config, options.profile);
+    const baseFolders = resolveCompiledFolders(manifest.config);
+    const fetchMode = resolveFetchMode(manifest.config, options.profile);
     const identityId = options.identityId ?? process.env.INFISICAL_IDENTITY_ID;
     if (!identityId) {
         throw new Error("INFISICAL_IDENTITY_ID required — infisicml CI auth is GitHub OIDC only (no client-id/secret fallback). Set `permissions: id-token: write` on the job.");
@@ -42,38 +68,21 @@ export async function runExportGha(options) {
         identityId,
         oidcAudience: process.env.INFISICAL_OIDC_AUDIENCE ?? config.auth?.oidcAudience,
     });
-    for (const folder of allPaths) {
-        console.log(`Loading Infisical path ${normalizeFolderPath(folder)} (${envName})`);
+    for (const folder of allFolders) {
+        console.log(`Loading Infisical path ${normalizeFolderPath(folder.path)} (${envName})`);
     }
-    // Two calls (runtime then deploy-only), reusing the cached access token, so we
-    // know which keys are runtime without per-folder provenance through the merge.
-    const runtimeSecrets = await fetchManifestSecrets(provider, envName, runtimePaths, manifest.config, options.profile);
-    const deployOnlySecrets = deployOnlyPaths.length
-        ? await fetchManifestSecrets(provider, envName, deployOnlyPaths, manifest.config, options.profile)
-        : {};
+    // One per-folder fetch (token cached across folders). Per-folder alias
+    // expansion + missing-key enforcement (before the merge) keeps provenance, so
+    // a key declared in two folders can't have one folder's miss masked by the
+    // other, nor one folder's value routed to the other's alias.
+    const folderSecrets = await fetchCompiledFolders(provider, envName, allFolders, fetchMode);
     const optionalKeys = resolveOptionalKeys(manifest.config, envName);
-    const aliased = applyAliases({ ...runtimeSecrets, ...deployOnlySecrets }, manifest.config);
-    // Default-deny key selection: emit only the allowlisted keys when `include`
-    // is set. Absent = emit all.
-    const include = resolveInclude(manifest.config, options.profile);
-    // Notice missing optional keys against the pre-include set — a key present in
-    // the folders but filtered out by `include` isn't "missing". Skip keys the
-    // allowlist governs: those get a single notice from selectEmittedSecrets'
-    // unknown-key check, so we don't emit two notices for the same absent key.
-    const includeSet = new Set(include ?? []);
-    logMissingOptionalKeys(aliased, optionalKeys.filter((k) => !includeSet.has(k)));
-    const merged = selectEmittedSecrets(aliased, include, optionalKeys);
+    const merged = materializeSecrets(folderSecrets, optionalKeys);
     appendSecretsToGithubEnv(githubEnvPath, merged);
     // Advertise CANONICAL (pre-alias) key names. Alias targets (e.g.
     // NEXT_PUBLIC_*) are build-tool copies, not the names a server runtime reads,
     // so they are intentionally not advertised — they still land in the job env
-    // via `merged` for build steps that need them. Drop any key `include`
-    // filtered out (a no-op when `include` is absent, since every fetched key is
-    // then in `merged`) so we never advertise a name not in the job env.
-    const emitted = (keys) => keys.filter((k) => merged[k] !== undefined);
-    runAdvertiseKeysHooks(githubEnvPath, config.hooks?.advertiseKeys, {
-        runtimeKeys: emitted(Object.keys(runtimeSecrets)),
-        allKeys: emitted(Object.keys({ ...runtimeSecrets, ...deployOnlySecrets })),
-    });
+    // via `merged` for build steps that need them.
+    runAdvertiseKeysHooks(githubEnvPath, config.hooks?.advertiseKeys, computeAdvertiseKeys(allFolders, baseFolders, merged));
 }
 //# sourceMappingURL=export-gha.js.map

package/dist/commands/export-gha.js.map

@@ -1 +1 @@
-{"version":3,"file":"export-gha.js","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAYnD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAyB;IAC1D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,gBAAgB,CAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAC9C,CAAC;IACF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAC5E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC9E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;IACxC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC;QAClC,MAAM,EAAE,MAAM,CAAC,eAAe;QAC9B,WAAW;QACX,UAAU;QACV,YAAY,EACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,MAAM,CAAC,IAAI,EAAE,YAAY;KACnE,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CACT,0BAA0B,mBAAmB,CAAC,MAAM,CAAC,KAAK,OAAO,GAAG,CACrE,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAC/C,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,QAAQ,CAAC,MAAM,EACf,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,MAAM,iBAAiB,GAAG,eAAe,CAAC,MAAM;QAC9C,CAAC,CAAC,MAAM,oBAAoB,CACxB,QAAQ,EACR,OAAO,EACP,eAAe,EACf,QAAQ,CAAC,MAAM,EACf,OAAO,CAAC,OAAO,CAChB;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,YAAY,CAC1B,EAAE,GAAG,cAAc,EAAE,GAAG,iBAAiB,EAAE,EAC3C,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,4EAA4E;IAC5E,6BAA6B;IAC7B,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC1C,sBAAsB,CACpB,OAAO,EACP,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;IACF,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACpE,wBAAwB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAEhD,iEAAiE;IACjE,8EAA8E;IAC9E,4EAA4E;IAC5E,sEAAsE;IACtE,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,OAAO,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAChF,qBAAqB,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE;QAChE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,cAAc,EAAE,GAAG,iBAAiB,EAAE,CAAC,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"export-gha.js","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAa/D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA4B,EAC5B,WAA6B,EAC7B,OAA+B;IAE/B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,SAAS;YAC7C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAyB;IAC1D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,gBAAgB,CAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAC9C,CAAC;IACF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAC5E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC9E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAClC,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAElC,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAErE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC;QAClC,MAAM,EAAE,MAAM,CAAC,eAAe;QAC9B,WAAW;QACX,UAAU;QACV,YAAY,EACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,MAAM,CAAC,IAAI,EAAE,YAAY;KACnE,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CACT,0BAA0B,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,OAAO,GAAG,CAC1E,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,8EAA8E;IAC9E,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,OAAO,EACP,UAAU,EACV,SAAS,CACV,CAAC;IACF,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC/D,wBAAwB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAEhD,iEAAiE;IACjE,8EAA8E;IAC9E,4EAA4E;IAC5E,+CAA+C;IAC/C,qBAAqB,CACnB,aAAa,EACb,MAAM,CAAC,KAAK,EAAE,aAAa,EAC3B,oBAAoB,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,CACtD,CAAC;AACJ,CAAC"}

package/dist/commands/list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAIA,wBAAsB,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BzD"}
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAoBA,wBAAsB,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBzD"}

package/dist/commands/list.js

@@ -1,34 +1,26 @@
 import { loadConfig } from "../config.js";
-import { normalizeFolderPath } from "../manifest.js";
+import { normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, } from "../manifest.js";
 import { discoverManifests } from "../registry.js";
+function printFolders(folders, indent) {
+    for (const folder of folders) {
+        console.log(`${indent}${normalizeFolderPath(folder.path)}`);
+        for (const key of folder.keys) {
+            const alias = key.aliases.length > 0 ? ` → ${key.aliases.join(", ")}` : "";
+            console.log(`${indent}  ${key.key}${alias}`);
+        }
+    }
+}
 export async function runList(cwd) {
     const config = await loadConfig(cwd);
     const manifests = discoverManifests(config);
     for (const { id, config: m } of manifests) {
-        const paths = m.paths.map((p) => normalizeFolderPath(p)).join(", ");
-        console.log(`  ${id}: ${paths}`);
-        if (m.include) {
-            console.log(`    include: ${m.include.join(", ")}`);
-        }
-        if (m.fetch) {
-            console.log(`    fetch: ${m.fetch}`);
-        }
-        if (m.profiles) {
-            for (const [name, profile] of Object.entries(m.profiles)) {
-                const profilePaths = profile.paths
-                    .map((p) => normalizeFolderPath(p))
-                    .join(", ");
-                console.log(`    [${name}]: ${profilePaths}`);
-                // A profile include/fetch replaces the root value; show whichever applies.
-                const effectiveInclude = profile.include ?? m.include;
-                if (effectiveInclude) {
-                    console.log(`      include: ${effectiveInclude.join(", ")}`);
-                }
-                const effectiveFetch = profile.fetch ?? m.fetch;
-                if (effectiveFetch) {
-                    console.log(`      fetch: ${effectiveFetch}`);
-                }
-            }
+        const fetch = resolveFetchMode(m);
+        console.log(`  ${id}${fetch === "keys" ? " (fetch: keys)" : ""}:`);
+        printFolders(resolveCompiledFolders(m), "    ");
+        for (const name of Object.keys(m.profiles ?? {})) {
+            const profileFetch = resolveFetchMode(m, name);
+            console.log(`    [${name}]${profileFetch === "keys" ? " (fetch: keys)" : ""}:`);
+            printFolders(resolveCompiledFolders(m, name), "      ");
         }
     }
 }

package/dist/commands/list.js.map

@@ -1 +1 @@
-{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE5C,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK;qBAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;qBAClC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,YAAY,EAAE,CAAC,CAAC;gBAC9C,2EAA2E;gBAC3E,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC;gBACtD,IAAI,gBAAgB,EAAE,CAAC;oBACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/D,CAAC;gBACD,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;gBAChD,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,GAAG,CAAC,gBAAgB,cAAc,EAAE,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGnD,SAAS,YAAY,CAAC,OAAyB,EAAE,MAAc;IAC7D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,KAAK,GACT,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE5C,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnE,YAAY,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CACT,QAAQ,IAAI,IAAI,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,CACnE,CAAC;YACF,YAAY,CAAC,sBAAsB,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/commands/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BnE"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCnE"}

package/dist/commands/paths.js

@@ -1,24 +1,25 @@
 import { loadConfig } from "../config.js";
-import { normalizeFolderPath, resolveFetchMode, resolveInclude, resolvePaths, } from "../manifest.js";
-import { discoverManifests } from "../registry.js";
+import { normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, } from "../manifest.js";
+import { discoverPackages, loadPackage } from "../registry.js";
 export async function runPaths(options) {
     const config = await loadConfig(options.cwd);
-    const manifests = discoverManifests(config);
-    const manifest = manifests.find((m) => m.id === options.packageId);
-    if (!manifest) {
+    const ref = discoverPackages(config).find((p) => p.id === options.packageId);
+    if (!ref) {
         throw new Error(`Unknown package id: ${options.packageId}`);
     }
-    const paths = resolvePaths(manifest.config, options.profile);
-    const normalized = paths.map((p) => normalizeFolderPath(p));
-    // `paths` feeds the infisical CLI, which fetches whole folders — key-level
-    // `include` filtering happens later, in pull/export-gha. Warn on stderr so the
-    // filtering isn't invisible to someone reading only this folder list.
-    const include = resolveInclude(manifest.config, options.profile);
-    if (include) {
-        console.error(`# note: ${options.packageId} filters emitted keys to: ${include.join(", ")}`);
+    const manifest = loadPackage(ref);
+    const folders = resolveCompiledFolders(manifest.config, options.profile);
+    const normalized = folders.map((f) => normalizeFolderPath(f.path));
+    // `paths` feeds the infisical CLI, which fetches whole folders — the tree's
+    // per-folder key selection happens later, in pull/export-gha. Note on stderr
+    // which keys each folder emits so the selection isn't invisible to someone
+    // reading only this folder list.
+    for (const folder of folders) {
+        const keys = folder.keys.map((k) => k.key).join(", ");
+        console.error(`# note: ${normalizeFolderPath(folder.path)} emits: ${keys}`);
     }
     if (resolveFetchMode(manifest.config, options.profile) === "keys") {
-        console.error(`# note: ${options.packageId} uses fetch: "keys" — only the include keys are emitted; in CI they are read per-key from the vault (wire-level least privilege).`);
+        console.error(`# note: ${options.packageId} uses fetch: "keys" — only the declared keys are read, per-key from the vault (wire-level least privilege).`);
     }
     if (options.comma) {
         console.log(normalized.map((p) => p.replace(/^\//, "")).join(","));

package/dist/commands/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AASnD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5D,2EAA2E;IAC3E,+EAA+E;IAC/E,sEAAsE;IACtE,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CACX,WAAW,OAAO,CAAC,SAAS,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QAClE,OAAO,CAAC,KAAK,CACX,WAAW,OAAO,CAAC,SAAS,mIAAmI,CAChK,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAS/D,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAClC,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEnE,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,iCAAiC;IACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,OAAO,CAAC,KAAK,CAAC,WAAW,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QAClE,OAAO,CAAC,KAAK,CACX,WAAW,OAAO,CAAC,SAAS,6GAA6G,CAC1I,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/commands/pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAyEjE"}
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA6EjE"}

package/dist/commands/pull.js

@@ -3,7 +3,7 @@ import { loadConfig } from "../config.js";
 import { shouldSkipInfisicalPull } from "../ci-skip.js";
 import { commandExists, LocalProvider } from "../providers/local.js";
 import { pullManifest } from "../pull.js";
-import { discoverManifests } from "../registry.js";
+import { discoverPackages, loadPackage } from "../registry.js";
 export async function runPull(options) {
     const config = await loadConfig(options.cwd);
     const repoRoot = config.repoRoot;
@@ -11,27 +11,30 @@ export async function runPull(options) {
     if (!config.projectId) {
         throw new Error("INFISICAL_PROJECT_ID not resolved — set config.projectId, projectIdEnvFile, or the INFISICAL_PROJECT_ID env var");
     }
-    let manifests = discoverManifests(config);
+    // Select target packages first, then load only those — so an unrelated
+    // package with an ambiguous or invalid manifest never blocks a scoped pull.
+    let targets = discoverPackages(config);
     if (options.here) {
         const cwd = process.cwd();
-        const match = manifests.find((m) => resolve(m.dir) === resolve(cwd));
+        const match = targets.find((p) => resolve(p.dir) === resolve(cwd));
         if (!match) {
-            throw new Error(`No secrets.json in ${cwd}`);
+            throw new Error(`No secrets manifest in ${cwd}`);
         }
-        manifests = [match];
+        targets = [match];
     }
     else if (options.ids.length > 0) {
         const allowed = new Set(options.ids);
-        manifests = manifests.filter((m) => allowed.has(m.id));
-        const missing = options.ids.filter((id) => !manifests.some((m) => m.id === id));
+        targets = targets.filter((p) => allowed.has(p.id));
+        const missing = options.ids.filter((id) => !targets.some((p) => p.id === id));
         if (missing.length > 0) {
             throw new Error(`Unknown package id(s): ${missing.join(", ")}`);
         }
     }
-    if (manifests.length === 0) {
-        console.log("No secrets.json manifests found.");
+    if (targets.length === 0) {
+        console.log("No secrets manifests found.");
         return;
     }
+    const manifests = targets.map(loadPackage);
     // The infisical CLI is only needed for manifests that will actually pull.
     // Mirror pullManifest's own skip decision exactly so CI stubs never demand a
     // tool they don't use.

package/dist/commands/pull.js.map

@@ -1 +1 @@
-{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAYnD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAoB;IAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC;IAEzD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE1C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAChC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAC5C,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,uBAAuB;IACvB,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CACzD,CAAC;IAEF,IAAI,cAAc,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,QAAQ;KACd,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,QAAQ;YACR,QAAQ;YACR,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,KAAK;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,CAAC,CAAC;;YAChC,OAAO,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,GAAG,CACT,WAAW,MAAM,YAAY,OAAO,aAAa,SAAS,CAAC,MAAM,eAAe,CACjF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAY/D,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAoB;IAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC;IAEzD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,4EAA4E;IAC5E,IAAI,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAChC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAC1C,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAE3C,0EAA0E;IAC1E,6EAA6E;IAC7E,uBAAuB;IACvB,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CACzD,CAAC;IAEF,IAAI,cAAc,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,QAAQ;KACd,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,QAAQ;YACR,QAAQ;YACR,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,KAAK;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,CAAC,CAAC;;YAChC,OAAO,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,GAAG,CACT,WAAW,MAAM,YAAY,OAAO,aAAa,SAAS,CAAC,MAAM,eAAe,CACjF,CAAC;AACJ,CAAC"}