@hubble-ventures/infisicml 1.2.1 → 2.1.0

package/dist/manifest.js

@@ -1,39 +1,27 @@
-import { resolve, sep } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve, sep } from "node:path";
+import { parse as parseYaml } from "yaml";
 import { z } from "zod";
-const pathPattern = /^[a-z0-9_/-]+$/;
-const pathsSchema = z
-    .array(z.string().regex(pathPattern))
-    .min(1, "paths must be a non-empty array");
-const envVarNamePattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const aliasSourceSchema = z
-    .string()
-    .regex(envVarNamePattern, "alias source must be a valid env var name");
-const aliasTargetSchema = z
-    .string()
-    .regex(envVarNamePattern, "alias target must be a valid env var name");
-// Key-level allowlist. When present, only these env var names are emitted from
-// whatever the folders yielded (after aliases). `.min(1)` because an empty
-// allowlist is almost certainly a mistake — omit the field to emit every key.
-const includeSchema = z
-    .array(z.string().regex(envVarNamePattern, "include entry must be a valid env var name"))
-    .min(1, "include must be a non-empty array");
+import { compileTree, treeSchema, } from "./tree.js";
 // How secrets are read from the vault. `folder` (default) fetches whole folders
-// and filters locally. `keys` fetches only the exact keys `include` resolves to,
-// so the vault never transmits the rest — wire-level least privilege. `keys`
-// requires an `include` allowlist (enforced by resolveFetchKeys / validate,
-// since the requirement depends on the resolved profile).
+// and selects the declared keys locally. `keys` fetches only the exact keys the
+// tree declares, so the vault never transmits the rest — wire-level least
+// privilege. Because the tree always names every key, `keys` needs no separate
+// allowlist (unlike v1, where it required `include`).
 const fetchModeSchema = z.enum(["folder", "keys"]);
 export const secretsManifestSchema = z.object({
     $schema: z.string().optional(),
-    paths: pathsSchema,
+    // The folder tree: an array of `{ folder: [ ...contents ] }` objects naming
+    // which Infisical folders to pull and, per folder, exactly which keys to emit
+    // (bare strings) and how to alias them (`{ SOURCE: "TARGET" }`). Subfolders
+    // nest as `{ name: [ ... ] }`. See tree.ts for the entry grammar.
+    secrets: treeSchema,
     profiles: z
         .record(z.string(), z.object({
-        paths: pathsSchema,
-        // Replaces the root `include` for this profile when set; if omitted,
-        // the root `include` applies (same replace-not-merge as `paths`).
-        include: includeSchema.optional(),
-        // Overrides the root `fetch` for this profile when set (same
-        // replace-not-merge as `paths` / `include`).
+        // Replaces the root `secrets` for this profile when running with
+        // --profile (same replace-not-merge as v1 `paths`).
+        secrets: treeSchema,
+        // Overrides the root `fetch` for this profile when set.
         fetch: fetchModeSchema.optional(),
     }))
         .optional(),
@@ -47,23 +35,9 @@ export const secretsManifestSchema = z.object({
         .string()
         .regex(/^[^/\\]+$/)
         .optional(),
-    // Map a pulled secret to the extra env var name(s) a build/runtime expects.
-    // The vault names a secret once (e.g. /clerk exposes the publishable key as
-    // CLERK_PUBLISHABLE_KEY), but build tools inline it by a tool-specific,
-    // convention-prefixed name — Vite reads VITE_*, Next reads NEXT_PUBLIC_*.
-    // Declaring the mapping here means every consumer (CI export-gha, local pull)
-    // emits the right name instead of each workflow re-deriving it.
-    aliases: z
-        .record(aliasSourceSchema, z.union([aliasTargetSchema, z.array(aliasTargetSchema).min(1)]))
-        .optional(),
-    // Emit only these keys from whatever the folders yielded (default-deny key
-    // selection). Applied after `aliases`, to the final set of names — so a client
-    // can pull a shared vendor folder but emit only its public key. Absent = emit
-    // all (backward compatible). A per-profile `include` replaces this one.
-    include: includeSchema.optional(),
-    // Read strategy: `folder` (default) pulls whole folders and filters locally;
-    // `keys` pulls only the keys `include` resolves to (least privilege at the
-    // wire). A per-profile `fetch` replaces this one.
+    // Read strategy: `folder` (default) pulls whole folders and selects the
+    // declared keys locally; `keys` pulls only the declared keys (least privilege
+    // at the wire). A per-profile `fetch` replaces this one.
     fetch: fetchModeSchema.optional(),
     environments: z
         .record(z.string(), z.object({
@@ -74,34 +48,91 @@ export const secretsManifestSchema = z.object({
 export function loadManifestJson(raw) {
     return secretsManifestSchema.parse(raw);
 }
-/** Profile paths replace default paths when a profile is set. */
-export function resolvePaths(manifest, profile) {
-    if (profile) {
-        const profileConfig = manifest.profiles?.[profile];
-        if (!profileConfig) {
-            throw new Error(`Unknown profile '${profile}' in secrets.json`);
-        }
-        return profileConfig.paths;
+// Manifest filenames in preference order. YAML is the primary, recommended
+// format; JSON stays fully supported for anyone who prefers it (or generates
+// manifests programmatically). The first file that exists in a package
+// directory wins, so `secrets.yaml` shadows a stray `secrets.json`.
+export const MANIFEST_FILENAMES = [
+    "secrets.yaml",
+    "secrets.yml",
+    "secrets.json",
+];
+/** A generic name for the manifest, for messages that shouldn't hardcode an extension. */
+export const MANIFEST_LABEL = "secrets manifest";
+/**
+ * Locate the manifest file in `dir`, preferring YAML over JSON
+ * ({@link MANIFEST_FILENAMES}). Returns `null` when no manifest exists.
+ *
+ * A directory with more than one manifest file is a hard error: picking a winner
+ * by preference order would let a stale or experimental `secrets.yaml` left next
+ * to the intended `secrets.json` (or vice versa) silently change which secret
+ * tree is pulled — and non-interactive lanes (the GitHub Action's `export-gha`)
+ * would write it into `GITHUB_ENV` and still succeed. Refuse instead of guessing;
+ * the operator removes the extra file to resolve.
+ */
+/**
+ * Cheap presence check: does `dir` hold at least one manifest file? Used to
+ * enumerate package directories without parsing or resolving ambiguity, so
+ * discovery never throws on a manifest a command won't actually load.
+ */
+export function hasManifestFile(dir) {
+    return MANIFEST_FILENAMES.some((name) => existsSync(join(dir, name)));
+}
+export function findManifestFile(dir) {
+    const present = MANIFEST_FILENAMES.filter((name) => existsSync(join(dir, name)));
+    if (present.length === 0)
+        return null;
+    if (present.length > 1) {
+        throw new Error(`Ambiguous secrets manifest in ${dir}: found ${present.join(", ")}. ` +
+            `Keep exactly one — remove the extra file(s) so it's unambiguous which secret tree is used.`);
     }
-    return manifest.paths;
+    const [filename] = present;
+    return {
+        path: join(dir, filename),
+        filename,
+        format: filename.endsWith(".json") ? "json" : "yaml",
+    };
+}
+/**
+ * Parse a manifest file's contents into the raw object, dispatching on format.
+ * YAML is a superset of JSON, but we parse each with its own reader so error
+ * messages point at the right syntax. Does not validate against the schema —
+ * call {@link loadManifestJson} for that.
+ */
+export function parseManifestFile(file) {
+    const raw = readFileSync(file.path, "utf8");
+    return file.format === "yaml" ? parseYaml(raw) : JSON.parse(raw);
+}
+/**
+ * Find, read, parse, and schema-validate the manifest in `dir`. Returns the
+ * validated manifest plus the file it came from, or `null` when no manifest
+ * file exists.
+ */
+export function loadManifestFromDir(dir) {
+    const file = findManifestFile(dir);
+    if (!file)
+        return null;
+    return { manifest: loadManifestJson(parseManifestFile(file)), file };
 }
 /**
- * Resolve the effective key allowlist. A profile's `include` replaces the root
- * `include` when the profile defines it; otherwise the root `include` applies.
- * Returns `undefined` when no allowlist is in effect (emit all keys).
+ * Compile the effective folder tree into an ordered {@link CompiledFolder} list.
+ * A profile's `tree` replaces the root `tree` when a profile is set (same
+ * replace-not-merge as v1 `paths`). Throws on an unknown profile name.
  */
-export function resolveInclude(manifest, profile) {
+export function resolveCompiledFolders(manifest, profile) {
     if (profile) {
-        const profileInclude = manifest.profiles?.[profile]?.include;
-        if (profileInclude !== undefined)
-            return profileInclude;
+        const profileConfig = manifest.profiles?.[profile];
+        if (!profileConfig) {
+            throw new Error(`Unknown profile '${profile}' in ${MANIFEST_LABEL}`);
+        }
+        return compileTree(profileConfig.secrets);
     }
-    return manifest.include;
+    return compileTree(manifest.secrets);
 }
 /**
  * Resolve the effective fetch mode. A profile's `fetch` replaces the root
  * `fetch` when the profile defines it; otherwise the root `fetch` applies.
- * Defaults to `"folder"` (whole-folder read + local filter) when unset.
+ * Defaults to `"folder"` (whole-folder read + local select) when unset.
  */
 export function resolveFetchMode(manifest, profile) {
     if (profile) {
@@ -111,28 +142,6 @@ export function resolveFetchMode(manifest, profile) {
     }
     return manifest.fetch ?? "folder";
 }
-/**
- * Cross-field rule: `fetch: "keys"` requires an `include` allowlist, because
- * key mode fetches exactly the keys `include` names. The check spans the root
- * and every profile (a profile's `fetch`/`include` each replace the root's), so
- * every runnable combination is covered. Returns human-readable issue strings
- * (empty when consistent) for `validate` to surface. Zod can't express this —
- * the requirement depends on the resolved profile.
- */
-export function checkFetchIncludeConsistency(manifest) {
-    const issues = [];
-    const check = (profile, label) => {
-        if (resolveFetchMode(manifest, profile) === "keys" &&
-            resolveInclude(manifest, profile) === undefined) {
-            issues.push(`fetch: "keys" requires an include allowlist (${label})`);
-        }
-    };
-    check(undefined, "root");
-    for (const name of Object.keys(manifest.profiles ?? {})) {
-        check(name, `profile "${name}"`);
-    }
-    return issues;
-}
 export function normalizeFolderPath(folder) {
     return `/${folder.replace(/^\/+/, "")}`;
 }

package/dist/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,MAAM,WAAW,GAAG,CAAC;KAClB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;KACpC,GAAG,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC;AAE7C,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AACrD,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,KAAK,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;AACzE,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,KAAK,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;AAEzE,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,MAAM,aAAa,GAAG,CAAC;KACpB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;KACxF,GAAG,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC;AAE/C,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,CAAC;SACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,KAAK,EAAE,WAAW;QAClB,qEAAqE;QACrE,kEAAkE;QAClE,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;QACjC,6DAA6D;QAC7D,6CAA6C;QAC7C,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;KAClC,CAAC,CACH;SACA,QAAQ,EAAE;IACb,EAAE,EAAE,CAAC;SACF,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC3C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,CAAC;SAClB,QAAQ,EAAE;IACb,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,8EAA8E;IAC9E,gEAAgE;IAChE,OAAO,EAAE,CAAC;SACP,MAAM,CACL,iBAAiB,EACjB,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAChE;SACA,QAAQ,EAAE;IACb,2EAA2E;IAC3E,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,6EAA6E;IAC7E,2EAA2E;IAC3E,kDAAkD;IAClD,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,CAAC;SACZ,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAC1B,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,mBAAmB,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC;IAC7B,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,cAAc,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAC7D,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,cAAc,CAAC;IAC1D,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;QACzD,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC;IACtD,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAyB;IAEzB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,OAA2B,EAAE,KAAa,EAAE,EAAE;QAC3D,IACE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,MAAM;YAC9C,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,SAAS,EAC/C,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,gDAAgD,KAAK,GAAG,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,EAAE,YAAY,IAAI,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,UAAkB;IAElB,IACE,UAAU,KAAK,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;QAC1C,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,UAAU,CAAC,MAAM,KAAK,CAAC,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,IACE,WAAW,KAAK,WAAW;QAC3B,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,WAAW,EACX,UAAU,GACX,MAAM,WAAW,CAAC;AAEnB,gFAAgF;AAChF,gFAAgF;AAChF,0EAA0E;AAC1E,+EAA+E;AAC/E,sDAAsD;AACtD,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,kEAAkE;IAClE,OAAO,EAAE,UAAU;IACnB,QAAQ,EAAE,CAAC;SACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,oDAAoD;QACpD,OAAO,EAAE,UAAU;QACnB,wDAAwD;QACxD,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;KAClC,CAAC,CACH;SACA,QAAQ,EAAE;IACb,EAAE,EAAE,CAAC;SACF,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC3C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,CAAC;SAClB,QAAQ,EAAE;IACb,wEAAwE;IACxE,8EAA8E;IAC9E,yDAAyD;IACzD,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,CAAC;SACZ,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,uEAAuE;AACvE,oEAAoE;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,cAAc;IACd,aAAa;IACb,cAAc;CACN,CAAC;AAEX,0FAA0F;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAYjD;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACjD,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAC5B,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,iCAAiC,GAAG,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACnE,4FAA4F,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;IAC3B,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;KACrD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAW;IAEX,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,QAAQ,cAAc,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;QACzD,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC;IACtD,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,UAAkB;IAElB,IACE,UAAU,KAAK,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;QAC1C,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,UAAU,CAAC,MAAM,KAAK,CAAC,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,IACE,WAAW,KAAK,WAAW;QAC3B,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../src/pull.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9C,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;CAC3B,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,EAAE,GACb,IAAI,CAgBN;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAkErB"}
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../src/pull.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9C,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;CAC3B,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,EAAE,GACb,IAAI,CAgBN;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAgErB"}

package/dist/pull.js

@@ -1,10 +1,8 @@
 import { existsSync, writeFileSync } from "node:fs";
 import { relative } from "node:path";
-import { applyAliases } from "./aliases.js";
-import { fetchManifestSecrets, keysForCiStub, shouldSkipInfisicalPull, } from "./ci-skip.js";
+import { fetchCompiledFolders, keysForCiStub, materializeSecrets, shouldSkipInfisicalPull, } from "./ci-skip.js";
 import { serializeDotenv } from "./dotenv.js";
-import { selectEmittedSecrets } from "./include.js";
-import { normalizeFolderPath, resolveFetchMode, resolveInclude, resolvePaths, resolveSecretsOutputPath, } from "./manifest.js";
+import { normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, resolveSecretsOutputPath, } from "./manifest.js";
 import { resolveOptionalKeys } from "./optional-keys.js";
 export function writeInjectedSecretsStub(outputPath, manifest, keys) {
     const fromEnv = {};
@@ -37,25 +35,22 @@ export async function pullManifest(options) {
         console.log(`⏭️  ${manifest.id}: skipped Infisical pull (injected env → ${rel})`);
         return "skipped";
     }
-    const paths = resolvePaths(manifest.config, profile);
+    const folders = resolveCompiledFolders(manifest.config, profile);
     const fetchMode = resolveFetchMode(manifest.config, profile);
-    const aliased = applyAliases(await fetchManifestSecrets(provider, envName, paths, manifest.config, profile), manifest.config);
-    // Default-deny key selection: emit only the allowlisted keys when `include`
-    // is set (after aliases). Absent = emit all.
-    const include = resolveInclude(manifest.config, profile);
-    const merged = selectEmittedSecrets(aliased, include, resolveOptionalKeys(manifest.config, envName));
-    // filter(Boolean) drops the optional Profile/Include lines when absent. It
-    // would also drop a trailing "" sentinel, so append the trailing newline
-    // explicitly — otherwise the first secret gets glued onto the "# Generated"
-    // line.
+    // Per-folder fetch → per-folder alias + missing-key enforcement → merge, so a
+    // key declared in two folders keeps each folder's value/provenance.
+    const folderSecrets = await fetchCompiledFolders(provider, envName, folders, fetchMode);
+    const merged = materializeSecrets(folderSecrets, resolveOptionalKeys(manifest.config, envName));
+    // filter(Boolean) drops the optional Profile line when absent. It would also
+    // drop a trailing "" sentinel, so append the trailing newline explicitly —
+    // otherwise the first secret gets glued onto the "# Generated" line.
     const header = `${[
         "# Pulled from Infisical — do not edit. Refresh: infisicml pull",
         `# Package: ${manifest.id}`,
         `# Environment: ${envName}`,
         profile ? `# Profile: ${profile}` : "",
-        `# Paths: ${paths.map((p) => normalizeFolderPath(p)).join(", ")}`,
+        `# Paths: ${folders.map((f) => normalizeFolderPath(f.path)).join(", ")}`,
         fetchMode === "keys" ? "# Fetch: keys (per-key least-privilege read)" : "",
-        include ? `# Include: ${include.join(", ")}` : "",
         `# Generated: ${new Date().toISOString()}`,
     ]
         .filter(Boolean)

package/dist/pull.js.map

@@ -1 +1 @@
-{"version":3,"file":"pull.js","sourceRoot":"","sources":["../src/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAgBzD,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,QAAyB,EACzB,IAAc;IAEd,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG;QACb,sEAAsE;QACtE,cAAc,QAAQ,CAAC,EAAE,EAAE;QAC3B,sDAAsD;QACtD,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;QAC1C,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA4B;IAE5B,MAAM,EACJ,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,OAAO,EACP,KAAK,GAAG,KAAK,EACb,SAAS,GAAG,KAAK,EACjB,QAAQ,GACT,GAAG,OAAO,CAAC;IAEZ,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;IAC5D,MAAM,UAAU,GAAG,wBAAwB,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE3C,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,CAAC,EAAE,KAAK,GAAG,kCAAkC,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5C,wBAAwB,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CACT,OAAO,QAAQ,CAAC,EAAE,4CAA4C,GAAG,GAAG,CACrE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,YAAY,CAC1B,MAAM,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9E,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,oBAAoB,CACjC,OAAO,EACP,OAAO,EACP,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAC9C,CAAC;IAEF,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,QAAQ;IACR,MAAM,MAAM,GAAG,GAAG;QAChB,gEAAgE;QAChE,cAAc,QAAQ,CAAC,EAAE,EAAE;QAC3B,kBAAkB,OAAO,EAAE;QAC3B,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;QACtC,YAAY,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACjE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,EAAE;QAC1E,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QACjD,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;KAC3C;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAElB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CACT,KAAK,QAAQ,CAAC,EAAE,WAAW,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,QAAQ,CACtE,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"pull.js","sourceRoot":"","sources":["../src/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAgBzD,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,QAAyB,EACzB,IAAc;IAEd,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG;QACb,sEAAsE;QACtE,cAAc,QAAQ,CAAC,EAAE,EAAE;QAC3B,sDAAsD;QACtD,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;QAC1C,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA4B;IAE5B,MAAM,EACJ,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,OAAO,EACP,KAAK,GAAG,KAAK,EACb,SAAS,GAAG,KAAK,EACjB,QAAQ,GACT,GAAG,OAAO,CAAC;IAEZ,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;IAC5D,MAAM,UAAU,GAAG,wBAAwB,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE3C,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,CAAC,EAAE,KAAK,GAAG,kCAAkC,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5C,wBAAwB,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CACT,OAAO,QAAQ,CAAC,EAAE,4CAA4C,GAAG,GAAG,CACrE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,OAAO,EACP,OAAO,EACP,SAAS,CACV,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAC/B,aAAa,EACb,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAC9C,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,MAAM,GAAG,GAAG;QAChB,gEAAgE;QAChE,cAAc,QAAQ,CAAC,EAAE,EAAE;QAC3B,kBAAkB,OAAO,EAAE;QAC3B,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;QACtC,YAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,EAAE;QAC1E,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;KAC3C;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAElB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CACT,KAAK,QAAQ,CAAC,EAAE,WAAW,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,QAAQ,CACtE,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/registry.d.ts

@@ -1,14 +1,37 @@
 import type { ResolvedConfig } from "./config.js";
-import { type SecretsManifest } from "./manifest.js";
-export type PackageManifest = {
+import { type ManifestFile, type SecretsManifest } from "./manifest.js";
+/** A discovered package: its id and directory, before its manifest is loaded. */
+export type PackageRef = {
     id: string;
     dir: string;
+};
+export type PackageManifest = PackageRef & {
     config: SecretsManifest;
+    /** The manifest file this package was loaded from (YAML or JSON). */
+    file: ManifestFile;
 };
 /**
- * Discover every `secrets.json` in the repo, driven entirely by
- * `config.discovery` — no repo-specific directory constants. Explicit
- * `packages` win over `roots`-discovered entries at the same directory.
+ * Enumerate every package directory that holds a secrets manifest, driven
+ * entirely by `config.discovery` — no repo-specific directory constants.
+ * Explicit `packages` win over `roots`-discovered entries at the same directory.
+ *
+ * This is a cheap presence scan: it does NOT parse, validate, or resolve
+ * manifest ambiguity, so a stale or malformed manifest in one package never
+ * blocks discovery of the others. Resolution happens in {@link loadPackage},
+ * per package, only for the packages a command actually uses.
+ */
+export declare function discoverPackages(config: ResolvedConfig): PackageRef[];
+/**
+ * Resolve, parse, and schema-validate one package's manifest. Throws if the
+ * directory is ambiguous (more than one manifest file) or the manifest is
+ * invalid — scoped to this package, so an unrelated broken sibling never blocks
+ * a command that doesn't load it.
+ */
+export declare function loadPackage(ref: PackageRef): PackageManifest;
+/**
+ * Discover and load every package's manifest. Loads all — to load only a
+ * targeted subset (so an unrelated ambiguous/broken package can't abort the
+ * run), use {@link discoverPackages} + {@link loadPackage} instead.
  */
 export declare function discoverManifests(config: ResolvedConfig): PackageManifest[];
 //# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAEvE,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,eAAe,EAAE,CA4B3E"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,eAAe,CAAC;AAEvB,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG;IACzC,MAAM,EAAE,eAAe,CAAC;IACxB,qEAAqE;IACrE,IAAI,EAAE,YAAY,CAAC;CACpB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,UAAU,EAAE,CAwBrE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,eAAe,CAO5D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,eAAe,EAAE,CAE3E"}

package/dist/registry.js

@@ -1,20 +1,23 @@
-import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { existsSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { loadManifestJson } from "./manifest.js";
+import { hasManifestFile, loadManifestFromDir, } from "./manifest.js";
 /**
- * Discover every `secrets.json` in the repo, driven entirely by
- * `config.discovery` — no repo-specific directory constants. Explicit
- * `packages` win over `roots`-discovered entries at the same directory.
+ * Enumerate every package directory that holds a secrets manifest, driven
+ * entirely by `config.discovery` — no repo-specific directory constants.
+ * Explicit `packages` win over `roots`-discovered entries at the same directory.
+ *
+ * This is a cheap presence scan: it does NOT parse, validate, or resolve
+ * manifest ambiguity, so a stale or malformed manifest in one package never
+ * blocks discovery of the others. Resolution happens in {@link loadPackage},
+ * per package, only for the packages a command actually uses.
  */
-export function discoverManifests(config) {
+export function discoverPackages(config) {
     const { repoRoot } = config;
     const byDir = new Map();
-    const scanDir = (dir, id) => {
-        const manifestPath = join(dir, "secrets.json");
-        if (!existsSync(manifestPath))
+    const consider = (dir, id) => {
+        if (!hasManifestFile(dir))
             return;
-        const parsed = loadManifestJson(JSON.parse(readFileSync(manifestPath, "utf8")));
-        byDir.set(resolve(dir), { dir, id, config: parsed });
+        byDir.set(resolve(dir), { id, dir });
     };
     for (const root of config.discovery.roots ?? []) {
         const rootAbs = join(repoRoot, root);
@@ -23,13 +26,35 @@ export function discoverManifests(config) {
         for (const entry of readdirSync(rootAbs, { withFileTypes: true })) {
             if (!entry.isDirectory())
                 continue;
-            scanDir(join(rootAbs, entry.name), entry.name);
+            consider(join(rootAbs, entry.name), entry.name);
         }
     }
     // Explicit packages last so a custom id/dir overrides a roots-discovered one.
     for (const { id, dir } of config.discovery.packages ?? []) {
-        scanDir(join(repoRoot, dir), id);
+        consider(join(repoRoot, dir), id);
     }
     return [...byDir.values()].sort((a, b) => a.id.localeCompare(b.id));
 }
+/**
+ * Resolve, parse, and schema-validate one package's manifest. Throws if the
+ * directory is ambiguous (more than one manifest file) or the manifest is
+ * invalid — scoped to this package, so an unrelated broken sibling never blocks
+ * a command that doesn't load it.
+ */
+export function loadPackage(ref) {
+    const loaded = loadManifestFromDir(ref.dir);
+    if (!loaded) {
+        // hasManifestFile was true at discovery; the file vanished in between.
+        throw new Error(`No secrets manifest in ${ref.dir}`);
+    }
+    return { id: ref.id, dir: ref.dir, config: loaded.manifest, file: loaded.file };
+}
+/**
+ * Discover and load every package's manifest. Loads all — to load only a
+ * targeted subset (so an unrelated ambiguous/broken package can't abort the
+ * run), use {@link discoverPackages} + {@link loadPackage} instead.
+ */
+export function discoverManifests(config) {
+    return discoverPackages(config).map(loadPackage);
+}
 //# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAwB,MAAM,eAAe,CAAC;AAQvE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAsB;IACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEjD,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAU,EAAE,EAAE;QAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAC7B,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAC/C,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EACL,eAAe,EACf,mBAAmB,GAGpB,MAAM,eAAe,CAAC;AAcvB;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE5C,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAU,EAAE,EAAE;QAC3C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;YAAE,OAAO;QAClC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAe;IACzC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAsB;IACtD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC"}

package/dist/tree.d.ts

@@ -0,0 +1,49 @@
+import { z } from "zod";
+/**
+ * One entry in a folder's contents array. Either:
+ * - a **string** — a plain key emitted as-is, or
+ * - an **object** whose entries are, per key, discriminated by value type:
+ *   - `SOURCE: "TARGET"` (string value) — an alias (the canonical vault key
+ *     `SOURCE` is emitted and copied to `TARGET`). Multiple targets? Repeat the
+ *     entry, one target each.
+ *   - `name: [ ... ]` (array value) — a subfolder (its own contents array).
+ */
+export type FolderEntry = string | {
+    [key: string]: string | FolderArray;
+};
+/** A folder's contents: a non-empty array of {@link FolderEntry}. */
+export type FolderArray = FolderEntry[];
+/**
+ * The manifest's `secrets`: a non-empty array of single-folder objects
+ * (`{ folderName: contentsArray }`) — the top level of the tree.
+ */
+export type SecretsTree = Array<{
+    [folder: string]: FolderArray;
+}>;
+/** A single emitted key resolved from a folder (canonical name + aliases). */
+export type CompiledKey = {
+    key: string;
+    aliases: string[];
+};
+/** A folder path plus the exact keys to emit from it (provenance-aware). */
+export type CompiledFolder = {
+    path: string;
+    keys: CompiledKey[];
+};
+/**
+ * Schema for the manifest's `secrets`: a non-empty array of folder objects, each
+ * validated recursively. Cast to the precise {@link SecretsTree} type — the base
+ * `z.array` infers `unknown[]`, but every element is structurally a folder
+ * object once {@link validateFolderObject} passes.
+ */
+export declare const treeSchema: z.ZodType<SecretsTree>;
+/**
+ * Flatten a validated tree into an ordered list of {@link CompiledFolder}.
+ * String entries carry no aliases; each `SOURCE: "TARGET"` entry carries its
+ * single target (repeat the entry for several targets). A folder's own keys are
+ * emitted before recursing into its subfolders, so declaration order is
+ * preserved (last folder wins on a genuine cross-folder name collision at merge
+ * time).
+ */
+export declare function compileTree(secrets: SecretsTree): CompiledFolder[];
+//# sourceMappingURL=tree.d.ts.map

package/dist/tree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree.d.ts","sourceRoot":"","sources":["../src/tree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAA;CAAE,CAAC;AAE3E,qEAAqE;AACrE,MAAM,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;AAExC;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,KAAK,CAAC;IAAE,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAAA;CAAE,CAAC,CAAC;AAEnE,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE7D,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAkJnE;;;;;GAKG;AACH,eAAO,MAAM,UAAU,EAUJ,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1C;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,cAAc,EAAE,CAQlE"}