@hubble-ventures/infisicml 1.2.1 → 2.1.0

package/dist/commands/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,OAAO,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAgClE"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,OAAO,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAqClE"}

package/dist/commands/run.js

@@ -1,17 +1,17 @@
 import { spawnSync } from "node:child_process";
 import { loadConfig } from "../config.js";
 import { normalizeEnvSlug } from "../env-slug.js";
-import { normalizeFolderPath, resolvePaths } from "../manifest.js";
-import { discoverManifests } from "../registry.js";
+import { normalizeFolderPath, resolveCompiledFolders } from "../manifest.js";
+import { discoverPackages, loadPackage } from "../registry.js";
 export async function runExec(options) {
     const config = await loadConfig(options.cwd);
     const repoRoot = config.repoRoot;
     const envName = normalizeEnvSlug(process.env.INFISICAL_ENV ?? options.env);
-    const manifests = discoverManifests(config);
-    const manifest = manifests.find((m) => m.id === options.packageId);
-    if (!manifest) {
+    const ref = discoverPackages(config).find((p) => p.id === options.packageId);
+    if (!ref) {
         throw new Error(`Unknown package id: ${options.packageId}`);
     }
+    const manifest = loadPackage(ref);
     if (process.env.INFISICAL_DISABLE === "1") {
         const result = spawnSync(options.command[0], options.command.slice(1), {
             stdio: "inherit",
@@ -19,8 +19,11 @@ export async function runExec(options) {
         });
         return result.status ?? 1;
     }
-    const paths = resolvePaths(manifest.config, options.profile);
-    const pathFlags = paths.flatMap((p) => ["--path", normalizeFolderPath(p)]);
+    const folders = resolveCompiledFolders(manifest.config, options.profile);
+    const pathFlags = folders.flatMap((f) => [
+        "--path",
+        normalizeFolderPath(f.path),
+    ]);
     const result = spawnSync("infisical", ["run", `--env=${envName}`, ...pathFlags, "--", ...options.command], { stdio: "inherit", cwd: repoRoot });
     if (result.error) {
         throw result.error;

package/dist/commands/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAUnD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAmB;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACrE,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,SAAS,CACtB,WAAW,EACX,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EACnE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CACpC,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAU/D,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAmB;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3E,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAClC,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACrE,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACvC,QAAQ;QACR,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,SAAS,CACtB,WAAW,EACX,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EACnE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CACpC,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/commands/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAOA,wBAAsB,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B7D"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAIA,wBAAsB,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB7D"}

package/dist/commands/validate.js

@@ -1,28 +1,18 @@
 import { loadConfig } from "../config.js";
-import { checkFetchIncludeConsistency, secretsManifestSchema, } from "../manifest.js";
+import { secretsManifestSchema } from "../manifest.js";
 import { discoverManifests } from "../registry.js";
 export async function runValidate(cwd) {
     const config = await loadConfig(cwd);
     const manifests = discoverManifests(config);
     let errors = 0;
-    for (const { id, dir, config: m } of manifests) {
+    for (const { id, config: m, file } of manifests) {
         const result = secretsManifestSchema.safeParse(m);
         if (!result.success) {
-            console.error(`❌ ${id} (${dir}/secrets.json):`);
+            console.error(`❌ ${id} (${file.path}):`);
             for (const issue of result.error.issues) {
                 console.error(`   ${issue.path.join(".")}: ${issue.message}`);
             }
             errors += 1;
-            continue;
-        }
-        // Cross-field checks the schema can't express (depend on resolved profile).
-        const semanticIssues = checkFetchIncludeConsistency(result.data);
-        if (semanticIssues.length > 0) {
-            console.error(`❌ ${id} (${dir}/secrets.json):`);
-            for (const issue of semanticIssues) {
-                console.error(`   ${issue}`);
-            }
-            errors += 1;
         }
     }
     if (errors > 0) {

package/dist/commands/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,IAAI,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QACD,4EAA4E;QAC5E,MAAM,cAAc,GAAG,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,sBAAsB,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,oBAAoB,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,sBAAsB,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,oBAAoB,CAAC,CAAC;AACzD,CAAC"}

package/dist/config.d.ts

@@ -1,11 +1,12 @@
 /**
- * How Infisicml discovers per-package `secrets.json` manifests. Discovery is
- * driven entirely by config, so no repo layout is baked into the tool.
+ * How Infisicml discovers per-package secrets manifests (`secrets.yaml`, or
+ * `secrets.json`). Discovery is driven entirely by config, so no repo layout is
+ * baked into the tool.
  */
 export type DiscoveryConfig = {
     /**
      * Parent directories scanned one level deep. Any immediate child directory
-     * containing a `secrets.json` becomes a package whose id is the child dir
+     * containing a secrets manifest becomes a package whose id is the child dir
      * name (e.g. `roots: ["nextjs-apps", "vite-apps"]`).
      */
     roots?: string[];

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,eAAe,CAAC;IAC3B,IAAI,CAAC,EAAE;QACL,wDAAwD;QACxD,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,KAAK,CAAC,EAAE;QACN,aAAa,CAAC,EAAE,iBAAiB,EAAE,CAAC;KACrC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAErE;AAqDD,wBAAsB,UAAU,CAAC,GAAG,SAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAY7E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,eAAe,CAAC;IAC3B,IAAI,CAAC,EAAE;QACL,wDAAwD;QACxD,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,KAAK,CAAC,EAAE;QACN,aAAa,CAAC,EAAE,iBAAiB,EAAE,CAAC;KACrC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAErE;AAqDD,wBAAsB,UAAU,CAAC,GAAG,SAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAY7E"}

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAyD1C,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB,uBAAuB;IACvB,sBAAsB;IACtB,qBAAqB;CACtB,CAAC;AAEF,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,IAAI,EAAE,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,kBAAkB,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,QAAQ,EAAE,CACrE,CAAC;QACJ,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAoB,CAAC;IACnE,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAElD,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAuB;IACjE,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC;IAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC9E,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,oBAAoB;gBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAClD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1C,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AACjD,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA0D1C,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB,uBAAuB;IACvB,sBAAsB;IACtB,qBAAqB;CACtB,CAAC;AAEF,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,IAAI,EAAE,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,kBAAkB,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,QAAQ,EAAE,CACrE,CAAC;QACJ,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAoB,CAAC;IACnE,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAElD,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAuB;IACjE,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC;IAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC9E,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,oBAAoB;gBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAClD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1C,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AACjD,CAAC"}

package/dist/github-env.js

@@ -9,7 +9,7 @@ export function appendSecretToGithubEnv(githubEnvPath, key, value) {
         const masked = line.replaceAll("%", "%25");
         process.stdout.write(`::add-mask::${masked}\n`);
     }
-    let delim = `INFISCML_${key}_${Date.now()}${process.hrtime.bigint()}`;
+    let delim = `INFISICML_${key}_${Date.now()}${process.hrtime.bigint()}`;
     while (value.includes(delim)) {
         delim = `${delim}_`;
     }

package/dist/github-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-env.js","sourceRoot":"","sources":["../src/github-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,GAAW,EACX,KAAa;IAEb,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,mFAAmF;IACnF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,KAAK,GAAG,YAAY,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IACtE,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,GAAG,GAAG,KAAK,GAAG,CAAC;IACtB,CAAC;IAED,cAAc,CAAC,aAAa,EAAE,GAAG,GAAG,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,aAAqB,EACrB,OAA+B;IAE/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,uBAAuB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,GAAW,EACX,KAAa;IAEb,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,sBAAsB,CAAC,CAAC;IAC3E,CAAC;IACD,cAAc,CAAC,aAAa,EAAE,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"github-env.js","sourceRoot":"","sources":["../src/github-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,GAAW,EACX,KAAa;IAEb,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,mFAAmF;IACnF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,KAAK,GAAG,aAAa,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IACvE,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,GAAG,GAAG,KAAK,GAAG,CAAC;IACtB,CAAC;IAED,cAAc,CAAC,aAAa,EAAE,GAAG,GAAG,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,aAAqB,EACrB,OAA+B;IAE/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,uBAAuB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,GAAW,EACX,KAAa;IAEb,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,sBAAsB,CAAC,CAAC;IAC3E,CAAC;IACD,cAAc,CAAC,aAAa,EAAE,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC;AACrD,CAAC"}

package/dist/hooks.d.ts

@@ -10,8 +10,8 @@ export declare function keysForScope(hook: AdvertiseKeysHook, input: AdvertiseIn
  * Write each configured `advertiseKeys` hook's key list to GITHUB_ENV as a
  * plain (unmasked, non-secret) comma-separated var. Key NAMES only — values are
  * never advertised. A deploy step forwards exactly these keys by value from the
- * job env, so `secrets.json` stays the single source of truth for what lands on
- * the app (no hand-maintained allowlist in the workflow).
+ * job env, so the secrets manifest stays the single source of truth for what
+ * lands on the app (no hand-maintained allowlist in the workflow).
  */
 export declare function runAdvertiseKeysHooks(githubEnvPath: string, hooks: AdvertiseKeysHook[] | undefined, input: AdvertiseInput): void;
 //# sourceMappingURL=hooks.d.ts.map

package/dist/hooks.js

@@ -7,8 +7,8 @@ export function keysForScope(hook, input) {
  * Write each configured `advertiseKeys` hook's key list to GITHUB_ENV as a
  * plain (unmasked, non-secret) comma-separated var. Key NAMES only — values are
  * never advertised. A deploy step forwards exactly these keys by value from the
- * job env, so `secrets.json` stays the single source of truth for what lands on
- * the app (no hand-maintained allowlist in the workflow).
+ * job env, so the secrets manifest stays the single source of truth for what
+ * lands on the app (no hand-maintained allowlist in the workflow).
  */
 export function runAdvertiseKeysHooks(githubEnvPath, hooks, input) {
     for (const hook of hooks ?? []) {

package/dist/include.d.ts

@@ -1,46 +1,9 @@
-import type { SecretsManifest } from "./manifest.js";
 /**
- * Resolve the canonical vault keys to request in `fetch: "keys"` mode.
- *
- * `include` names the *final* (post-{@link applyAliases}) keys, but the vault is
- * keyed by canonical names. For each `include` entry we request the name itself
- * (it may be a real vault key) plus any alias *source* whose target is that name
- * (so the source value exists to materialize the target). Phantom entries — an
- * alias target that isn't a real vault key — simply miss on fetch, which is
- * harmless: the post-fetch {@link selectEmittedSecrets} still validates the
- * emitted set against `include`, so a genuinely-missing key fails there exactly
- * as in folder mode.
+ * A declared key (a tree `raw` entry or `aliased` source) that no folder
+ * produced is treated like a missing required key: fail, unless it's listed in
+ * the environment's `optionalKeys`, in which case it's downgraded to a
+ * `::notice::`. Enforced identically in `pull` and `export-gha` so the two
+ * surfaces stay consistent.
  */
-export declare function resolveFetchKeys(include: string[], manifest: SecretsManifest): string[];
-export type IncludeResult = {
-    /** The emitted map after allowlist filtering. */
-    filtered: Record<string, string>;
-    /** `include` names that no folder produced (absent from the input map). */
-    unknown: string[];
-};
-/**
- * Filter a materialized secret map down to the `include` allowlist.
- *
- * Runs *after* {@link applyAliases}, so it filters the final set of names: an
- * alias whose source isn't listed still emits its target, and a canonical key
- * not listed is dropped even when its alias target is kept.
- *
- * When `include` is `undefined` this is a pass-through (emit all keys) — the
- * backward-compatible default. Returns a new object; the input is not mutated.
- */
-export declare function applyInclude(merged: Record<string, string>, include: string[] | undefined): IncludeResult;
-/**
- * An `include` name that no folder produced is treated like a missing required
- * key: fail, unless it's listed in the environment's `optionalKeys`, in which
- * case it's downgraded to a `::notice::`. Enforced identically in `pull` and
- * `export-gha` so the two surfaces stay consistent.
- */
-export declare function enforceIncludeKnown(unknown: string[], optionalKeys: string[]): void;
-/**
- * Shared allowlist step for both emit surfaces: filter the aliased map to the
- * (already-resolved) `include` and enforce the unknown-key policy. Callers
- * resolve `include` once — with {@link resolveInclude} — so the value they use
- * for headers/logging is the same one that governs the filter.
- */
-export declare function selectEmittedSecrets(aliased: Record<string, string>, include: string[] | undefined, optionalKeys: string[]): Record<string, string>;
+export declare function enforceKnownKeys(unknown: string[], optionalKeys: string[]): void;
 //# sourceMappingURL=include.d.ts.map

package/dist/include.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"include.d.ts","sourceRoot":"","sources":["../src/include.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EAAE,EACjB,QAAQ,EAAE,eAAe,GACxB,MAAM,EAAE,CAUV;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAC5B,aAAa,CAWf;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EAAE,EACjB,YAAY,EAAE,MAAM,EAAE,GACrB,IAAI,CAkBN;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,EAC7B,YAAY,EAAE,MAAM,EAAE,GACrB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB"}
+{"version":3,"file":"include.d.ts","sourceRoot":"","sources":["../src/include.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EAAE,EACjB,YAAY,EAAE,MAAM,EAAE,GACrB,IAAI,CAoBN"}

package/dist/include.js

@@ -1,82 +1,26 @@
-import { resolveAliases } from "./aliases.js";
 /**
- * Resolve the canonical vault keys to request in `fetch: "keys"` mode.
- *
- * `include` names the *final* (post-{@link applyAliases}) keys, but the vault is
- * keyed by canonical names. For each `include` entry we request the name itself
- * (it may be a real vault key) plus any alias *source* whose target is that name
- * (so the source value exists to materialize the target). Phantom entries — an
- * alias target that isn't a real vault key — simply miss on fetch, which is
- * harmless: the post-fetch {@link selectEmittedSecrets} still validates the
- * emitted set against `include`, so a genuinely-missing key fails there exactly
- * as in folder mode.
+ * A declared key (a tree `raw` entry or `aliased` source) that no folder
+ * produced is treated like a missing required key: fail, unless it's listed in
+ * the environment's `optionalKeys`, in which case it's downgraded to a
+ * `::notice::`. Enforced identically in `pull` and `export-gha` so the two
+ * surfaces stay consistent.
  */
-export function resolveFetchKeys(include, manifest) {
-    const aliases = resolveAliases(manifest);
-    const keys = new Set();
-    for (const name of include) {
-        keys.add(name);
-        for (const { source, targets } of aliases) {
-            if (targets.includes(name))
-                keys.add(source);
-        }
-    }
-    return [...keys];
-}
-/**
- * Filter a materialized secret map down to the `include` allowlist.
- *
- * Runs *after* {@link applyAliases}, so it filters the final set of names: an
- * alias whose source isn't listed still emits its target, and a canonical key
- * not listed is dropped even when its alias target is kept.
- *
- * When `include` is `undefined` this is a pass-through (emit all keys) — the
- * backward-compatible default. Returns a new object; the input is not mutated.
- */
-export function applyInclude(merged, include) {
-    if (include === undefined) {
-        return { filtered: { ...merged }, unknown: [] };
-    }
-    const allow = new Set(include);
-    const filtered = {};
-    for (const [key, value] of Object.entries(merged)) {
-        if (allow.has(key))
-            filtered[key] = value;
-    }
-    const unknown = include.filter((name) => !(name in merged));
-    return { filtered, unknown };
-}
-/**
- * An `include` name that no folder produced is treated like a missing required
- * key: fail, unless it's listed in the environment's `optionalKeys`, in which
- * case it's downgraded to a `::notice::`. Enforced identically in `pull` and
- * `export-gha` so the two surfaces stay consistent.
- */
-export function enforceIncludeKnown(unknown, optionalKeys) {
+export function enforceKnownKeys(unknown, optionalKeys) {
     const optional = new Set(optionalKeys);
     const missing = [];
-    for (const name of unknown) {
+    // Dedupe: the same key name can be declared-and-absent in more than one
+    // folder, which would otherwise notice/report it twice.
+    for (const name of new Set(unknown)) {
         if (optional.has(name)) {
-            console.log(`::notice::include key ${name} not produced by any folder (optional for this environment)`);
+            console.log(`::notice::declared key ${name} not produced by its folder (optional for this environment)`);
         }
         else {
             missing.push(name);
         }
     }
     if (missing.length > 0) {
-        throw new Error(`include lists key(s) not produced by any pulled folder: ${missing.join(", ")}. ` +
+        throw new Error(`tree declares key(s) not produced by any pulled folder: ${missing.join(", ")}. ` +
             "Fix the name, add the folder, or list the key in environments.<slug>.optionalKeys to allow absence.");
     }
 }
-/**
- * Shared allowlist step for both emit surfaces: filter the aliased map to the
- * (already-resolved) `include` and enforce the unknown-key policy. Callers
- * resolve `include` once — with {@link resolveInclude} — so the value they use
- * for headers/logging is the same one that governs the filter.
- */
-export function selectEmittedSecrets(aliased, include, optionalKeys) {
-    const { filtered, unknown } = applyInclude(aliased, include);
-    enforceIncludeKnown(unknown, optionalKeys);
-    return filtered;
-}
 //# sourceMappingURL=include.js.map

package/dist/include.js.map

@@ -1 +1 @@
-{"version":3,"file":"include.js","sourceRoot":"","sources":["../src/include.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAiB,EACjB,QAAyB;IAEzB,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA8B,EAC9B,OAA6B;IAE7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC;IAC5D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAiB,EACjB,YAAsB;IAEtB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CACT,yBAAyB,IAAI,6DAA6D,CAC3F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,2DAA2D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC/E,qGAAqG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B,EAC/B,OAA6B,EAC7B,YAAsB;IAEtB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"include.js","sourceRoot":"","sources":["../src/include.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAiB,EACjB,YAAsB;IAEtB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,wEAAwE;IACxE,wDAAwD;IACxD,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CACT,0BAA0B,IAAI,6DAA6D,CAC5F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,2DAA2D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC/E,qGAAqG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,16 +1,17 @@
 export { applyAliases, type ResolvedAlias, resolveAliases, } from "./aliases.js";
-export { fetchSecretsForPaths, isCi, keysForCiStub, mergeFolderSecrets, shouldSkipInfisicalPull, } from "./ci-skip.js";
+export { fetchCompiledFolders, type FolderSecrets, isCi, keysForCiStub, materializeSecrets, mergeFolderSecrets, shouldSkipInfisicalPull, } from "./ci-skip.js";
 export { type AdvertiseKeysHook, defineConfig, type DiscoveryConfig, type InfisicmlConfig, loadConfig, type ResolvedConfig, } from "./config.js";
 export { parseDotenv, serializeDotenv } from "./dotenv.js";
 export { normalizeEnvSlug } from "./env-slug.js";
 export { appendPlainToGithubEnv, appendSecretsToGithubEnv, appendSecretToGithubEnv, } from "./github-env.js";
 export { type AdvertiseInput, keysForScope, runAdvertiseKeysHooks, } from "./hooks.js";
-export { applyInclude, enforceIncludeKnown, type IncludeResult, selectEmittedSecrets, } from "./include.js";
-export { loadManifestJson, normalizeFolderPath, resolveInclude, resolvePaths, resolveSecretsOutputPath, type SecretsManifest, secretsManifestSchema, } from "./manifest.js";
+export { enforceKnownKeys } from "./include.js";
+export { findManifestFile, hasManifestFile, loadManifestFromDir, loadManifestJson, MANIFEST_FILENAMES, MANIFEST_LABEL, type ManifestFile, type ManifestFormat, normalizeFolderPath, parseManifestFile, resolveCompiledFolders, resolveFetchMode, resolveSecretsOutputPath, type SecretsManifest, secretsManifestSchema, } from "./manifest.js";
 export { logMissingOptionalKeys, resolveOptionalKeys, } from "./optional-keys.js";
 export { commandExists, LocalProvider } from "./providers/local.js";
 export { RemoteProvider } from "./providers/remote.js";
 export type { SecretsProvider } from "./providers/types.js";
 export { type PullResult, pullManifest, writeInjectedSecretsStub, } from "./pull.js";
-export { discoverManifests, type PackageManifest } from "./registry.js";
+export { discoverManifests, discoverPackages, loadPackage, type PackageManifest, type PackageRef, } from "./registry.js";
+export { type CompiledFolder, type CompiledKey, compileTree, type FolderArray, type FolderEntry, type SecretsTree, treeSchema, } from "./tree.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,aAAa,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,iBAAiB,EACtB,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,UAAU,EACV,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,cAAc,EACnB,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,KAAK,aAAa,EAClB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,wBAAwB,EACxB,KAAK,eAAe,EACpB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,KAAK,UAAU,EACf,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,aAAa,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EAClB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,iBAAiB,EACtB,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,UAAU,EACV,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,cAAc,EACnB,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,eAAe,EACpB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,KAAK,UAAU,EACf,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,UAAU,GACX,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -1,15 +1,16 @@
 export { applyAliases, resolveAliases, } from "./aliases.js";
-export { fetchSecretsForPaths, isCi, keysForCiStub, mergeFolderSecrets, shouldSkipInfisicalPull, } from "./ci-skip.js";
+export { fetchCompiledFolders, isCi, keysForCiStub, materializeSecrets, mergeFolderSecrets, shouldSkipInfisicalPull, } from "./ci-skip.js";
 export { defineConfig, loadConfig, } from "./config.js";
 export { parseDotenv, serializeDotenv } from "./dotenv.js";
 export { normalizeEnvSlug } from "./env-slug.js";
 export { appendPlainToGithubEnv, appendSecretsToGithubEnv, appendSecretToGithubEnv, } from "./github-env.js";
 export { keysForScope, runAdvertiseKeysHooks, } from "./hooks.js";
-export { applyInclude, enforceIncludeKnown, selectEmittedSecrets, } from "./include.js";
-export { loadManifestJson, normalizeFolderPath, resolveInclude, resolvePaths, resolveSecretsOutputPath, secretsManifestSchema, } from "./manifest.js";
+export { enforceKnownKeys } from "./include.js";
+export { findManifestFile, hasManifestFile, loadManifestFromDir, loadManifestJson, MANIFEST_FILENAMES, MANIFEST_LABEL, normalizeFolderPath, parseManifestFile, resolveCompiledFolders, resolveFetchMode, resolveSecretsOutputPath, secretsManifestSchema, } from "./manifest.js";
 export { logMissingOptionalKeys, resolveOptionalKeys, } from "./optional-keys.js";
 export { commandExists, LocalProvider } from "./providers/local.js";
 export { RemoteProvider } from "./providers/remote.js";
 export { pullManifest, writeInjectedSecretsStub, } from "./pull.js";
-export { discoverManifests } from "./registry.js";
+export { discoverManifests, discoverPackages, loadPackage, } from "./registry.js";
+export { compileTree, treeSchema, } from "./tree.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAEZ,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,YAAY,EAGZ,UAAU,GAEX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,mBAAmB,EAEnB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,wBAAwB,EAExB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAEL,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAwB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAEZ,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EAEpB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,YAAY,EAGZ,UAAU,GAEX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EAGd,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EAExB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAEL,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GAGZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAGL,WAAW,EAIX,UAAU,GACX,MAAM,WAAW,CAAC"}

package/dist/manifest.d.ts

@@ -1,18 +1,16 @@
 import { z } from "zod";
+import { type CompiledFolder } from "./tree.js";
 export declare const secretsManifestSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
-    paths: z.ZodArray<z.ZodString, "many">;
+    secrets: z.ZodType<import("./tree.js").SecretsTree, z.ZodTypeDef, import("./tree.js").SecretsTree>;
     profiles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        paths: z.ZodArray<z.ZodString, "many">;
-        include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        secrets: z.ZodType<import("./tree.js").SecretsTree, z.ZodTypeDef, import("./tree.js").SecretsTree>;
         fetch: z.ZodOptional<z.ZodEnum<["folder", "keys"]>>;
     }, "strip", z.ZodTypeAny, {
-        paths: string[];
-        include?: string[] | undefined;
+        secrets: import("./tree.js").SecretsTree;
         fetch?: "keys" | "folder" | undefined;
     }, {
-        paths: string[];
-        include?: string[] | undefined;
+        secrets: import("./tree.js").SecretsTree;
         fetch?: "keys" | "folder" | undefined;
     }>>>;
     ci: z.ZodOptional<z.ZodObject<{
@@ -26,8 +24,6 @@ export declare const secretsManifestSchema: z.ZodObject<{
         stubInCi?: boolean | undefined;
     }>>;
     output: z.ZodOptional<z.ZodString>;
-    aliases: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>>;
-    include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     fetch: z.ZodOptional<z.ZodEnum<["folder", "keys"]>>;
     environments: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         optionalKeys: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -37,13 +33,11 @@ export declare const secretsManifestSchema: z.ZodObject<{
         optionalKeys?: string[] | undefined;
     }>>>;
 }, "strip", z.ZodTypeAny, {
-    paths: string[];
+    secrets: import("./tree.js").SecretsTree;
     $schema?: string | undefined;
-    include?: string[] | undefined;
     fetch?: "keys" | "folder" | undefined;
     profiles?: Record<string, {
-        paths: string[];
-        include?: string[] | undefined;
+        secrets: import("./tree.js").SecretsTree;
         fetch?: "keys" | "folder" | undefined;
     }> | undefined;
     ci?: {
@@ -51,18 +45,15 @@ export declare const secretsManifestSchema: z.ZodObject<{
         stubInCi?: boolean | undefined;
     } | undefined;
     output?: string | undefined;
-    aliases?: Record<string, string | string[]> | undefined;
     environments?: Record<string, {
         optionalKeys?: string[] | undefined;
     }> | undefined;
 }, {
-    paths: string[];
+    secrets: import("./tree.js").SecretsTree;
     $schema?: string | undefined;
-    include?: string[] | undefined;
     fetch?: "keys" | "folder" | undefined;
     profiles?: Record<string, {
-        paths: string[];
-        include?: string[] | undefined;
+        secrets: import("./tree.js").SecretsTree;
         fetch?: "keys" | "folder" | undefined;
     }> | undefined;
     ci?: {
@@ -70,36 +61,69 @@ export declare const secretsManifestSchema: z.ZodObject<{
         stubInCi?: boolean | undefined;
     } | undefined;
     output?: string | undefined;
-    aliases?: Record<string, string | string[]> | undefined;
     environments?: Record<string, {
         optionalKeys?: string[] | undefined;
     }> | undefined;
 }>;
 export type SecretsManifest = z.infer<typeof secretsManifestSchema>;
 export declare function loadManifestJson(raw: unknown): SecretsManifest;
-/** Profile paths replace default paths when a profile is set. */
-export declare function resolvePaths(manifest: SecretsManifest, profile?: string): string[];
+export declare const MANIFEST_FILENAMES: readonly ["secrets.yaml", "secrets.yml", "secrets.json"];
+/** A generic name for the manifest, for messages that shouldn't hardcode an extension. */
+export declare const MANIFEST_LABEL = "secrets manifest";
+export type ManifestFormat = "yaml" | "json";
+export type ManifestFile = {
+    /** Absolute (or as-passed) path to the manifest file. */
+    path: string;
+    /** Bare filename, e.g. `secrets.yaml`. */
+    filename: string;
+    format: ManifestFormat;
+};
 /**
- * Resolve the effective key allowlist. A profile's `include` replaces the root
- * `include` when the profile defines it; otherwise the root `include` applies.
- * Returns `undefined` when no allowlist is in effect (emit all keys).
+ * Locate the manifest file in `dir`, preferring YAML over JSON
+ * ({@link MANIFEST_FILENAMES}). Returns `null` when no manifest exists.
+ *
+ * A directory with more than one manifest file is a hard error: picking a winner
+ * by preference order would let a stale or experimental `secrets.yaml` left next
+ * to the intended `secrets.json` (or vice versa) silently change which secret
+ * tree is pulled — and non-interactive lanes (the GitHub Action's `export-gha`)
+ * would write it into `GITHUB_ENV` and still succeed. Refuse instead of guessing;
+ * the operator removes the extra file to resolve.
  */
-export declare function resolveInclude(manifest: SecretsManifest, profile?: string): string[] | undefined;
+/**
+ * Cheap presence check: does `dir` hold at least one manifest file? Used to
+ * enumerate package directories without parsing or resolving ambiguity, so
+ * discovery never throws on a manifest a command won't actually load.
+ */
+export declare function hasManifestFile(dir: string): boolean;
+export declare function findManifestFile(dir: string): ManifestFile | null;
+/**
+ * Parse a manifest file's contents into the raw object, dispatching on format.
+ * YAML is a superset of JSON, but we parse each with its own reader so error
+ * messages point at the right syntax. Does not validate against the schema —
+ * call {@link loadManifestJson} for that.
+ */
+export declare function parseManifestFile(file: ManifestFile): unknown;
+/**
+ * Find, read, parse, and schema-validate the manifest in `dir`. Returns the
+ * validated manifest plus the file it came from, or `null` when no manifest
+ * file exists.
+ */
+export declare function loadManifestFromDir(dir: string): {
+    manifest: SecretsManifest;
+    file: ManifestFile;
+} | null;
+/**
+ * Compile the effective folder tree into an ordered {@link CompiledFolder} list.
+ * A profile's `tree` replaces the root `tree` when a profile is set (same
+ * replace-not-merge as v1 `paths`). Throws on an unknown profile name.
+ */
+export declare function resolveCompiledFolders(manifest: SecretsManifest, profile?: string): CompiledFolder[];
 /**
  * Resolve the effective fetch mode. A profile's `fetch` replaces the root
  * `fetch` when the profile defines it; otherwise the root `fetch` applies.
- * Defaults to `"folder"` (whole-folder read + local filter) when unset.
+ * Defaults to `"folder"` (whole-folder read + local select) when unset.
  */
 export declare function resolveFetchMode(manifest: SecretsManifest, profile?: string): "folder" | "keys";
-/**
- * Cross-field rule: `fetch: "keys"` requires an `include` allowlist, because
- * key mode fetches exactly the keys `include` names. The check spans the root
- * and every profile (a profile's `fetch`/`include` each replace the root's), so
- * every runnable combination is covered. Returns human-readable issue strings
- * (empty when consistent) for `validate` to surface. Zod can't express this —
- * the requirement depends on the resolved profile.
- */
-export declare function checkFetchIncludeConsistency(manifest: SecretsManifest): string[];
 export declare function normalizeFolderPath(folder: string): string;
 export declare function resolveSecretsOutputPath(manifestDir: string, outputName: string): string;
 //# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA8BxB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwDhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAE9D;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,EAAE,CASV;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,EAAE,GAAG,SAAS,CAMtB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,QAAQ,GAAG,MAAM,CAMnB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,eAAe,GACxB,MAAM,EAAE,CAeV;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAiBR"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,KAAK,cAAc,EAGpB,MAAM,WAAW,CAAC;AASnB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyChC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAE9D;AAMD,eAAO,MAAM,kBAAkB,0DAIrB,CAAC;AAEX,0FAA0F;AAC1F,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,MAAM,CAAC;AAE7C,MAAM,MAAM,YAAY,GAAG;IACzB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;CACxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAkBjE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAG7D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,GACV;IAAE,QAAQ,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAAG,IAAI,CAI1D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,cAAc,EAAE,CASlB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,QAAQ,GAAG,MAAM,CAMnB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAiBR"}