@hubble-ventures/infisicml 1.2.1

package/dist/cli.js

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+import { parseArgs } from "node:util";
+import { runExportGha } from "./commands/export-gha.js";
+import { runList } from "./commands/list.js";
+import { runPaths } from "./commands/paths.js";
+import { runPull } from "./commands/pull.js";
+import { runExec } from "./commands/run.js";
+import { runValidate } from "./commands/validate.js";
+const USAGE = `infisicml — Infisical Secret Orchestration for monorepos
+
+Usage:
+  infisicml pull [ids...] [--env ENV] [--profile NAME] [--force] [--here] [--turbo]
+  infisicml export-gha <id> [--env ENV] [--profile NAME]
+  infisicml list
+  infisicml validate
+  infisicml paths <id> [--profile NAME] [--comma]
+  infisicml run <id> [--profile NAME] [--env ENV] -- <command...>
+
+Config: infisicml.config.{ts,json} at the repo root. See https://github.com/hubble-ventures/infisicml
+`;
+async function main() {
+    const argv = process.argv.slice(2);
+    if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
+        console.log(USAGE);
+        process.exit(0);
+    }
+    const subcommand = argv[0];
+    const rest = argv.slice(1);
+    try {
+        switch (subcommand) {
+            case "pull":
+                await handlePull(rest);
+                break;
+            case "export-gha":
+                await handleExportGha(rest);
+                break;
+            case "list":
+                await runList();
+                break;
+            case "validate":
+                await runValidate();
+                break;
+            case "paths":
+                await handlePaths(rest);
+                break;
+            case "run":
+                await handleRun(rest);
+                break;
+            default:
+                console.error(`Unknown subcommand: ${subcommand}\n`);
+                console.log(USAGE);
+                process.exit(1);
+        }
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+async function handlePull(args) {
+    const { values, positionals } = parseArgs({
+        args,
+        allowPositionals: true,
+        options: {
+            env: { type: "string", default: "development" },
+            profile: { type: "string" },
+            force: { type: "boolean", short: "f", default: false },
+            here: { type: "boolean", default: false },
+            turbo: { type: "boolean", default: false },
+        },
+    });
+    await runPull({
+        ids: positionals,
+        env: values.env ?? "development",
+        profile: values.profile,
+        force: values.force ?? false,
+        here: values.here ?? false,
+        turbo: values.turbo ?? false,
+    });
+}
+async function handleExportGha(args) {
+    const { values, positionals } = parseArgs({
+        args,
+        allowPositionals: true,
+        options: {
+            env: { type: "string", default: "production" },
+            profile: { type: "string" },
+        },
+    });
+    const packageId = positionals[0];
+    if (!packageId) {
+        throw new Error("export-gha requires a package id");
+    }
+    await runExportGha({
+        packageId,
+        env: values.env ?? "production",
+        profile: values.profile,
+    });
+}
+async function handlePaths(args) {
+    const { values, positionals } = parseArgs({
+        args,
+        allowPositionals: true,
+        options: {
+            profile: { type: "string" },
+            comma: { type: "boolean", default: false },
+        },
+    });
+    const packageId = positionals[0];
+    if (!packageId) {
+        throw new Error("paths requires a package id");
+    }
+    await runPaths({
+        packageId,
+        profile: values.profile,
+        comma: values.comma ?? false,
+    });
+}
+async function handleRun(args) {
+    const sep = args.indexOf("--");
+    if (sep === -1) {
+        throw new Error("run requires -- before command");
+    }
+    const before = args.slice(0, sep);
+    const command = args.slice(sep + 1);
+    if (command.length === 0) {
+        throw new Error("run requires a command after --");
+    }
+    const { values, positionals } = parseArgs({
+        args: before,
+        allowPositionals: true,
+        options: {
+            env: { type: "string", default: "development" },
+            profile: { type: "string" },
+        },
+    });
+    const packageId = positionals[0];
+    if (!packageId) {
+        throw new Error("run requires a package id");
+    }
+    const code = await runExec({
+        packageId,
+        profile: values.profile,
+        env: values.env ?? "development",
+        command,
+    });
+    process.exit(code);
+}
+main();
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,MAAM,KAAK,GAAG;;;;;;;;;;;CAWb,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,CAAC;QACH,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,MAAM;gBACT,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;gBACvB,MAAM;YACR,KAAK,YAAY;gBACf,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,MAAM;gBACT,MAAM,OAAO,EAAE,CAAC;gBAChB,MAAM;YACR,KAAK,UAAU;gBACb,MAAM,WAAW,EAAE,CAAC;gBACpB,MAAM;YACR,KAAK,OAAO;gBACV,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;gBACxB,MAAM;YACR,KAAK,KAAK;gBACR,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtB,MAAM;YACR;gBACE,OAAO,CAAC,KAAK,CAAC,uBAAuB,UAAU,IAAI,CAAC,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAc;IACtC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE;YAC/C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;YACtD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YACzC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;SAC3C;KACF,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC;QACZ,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,aAAa;QAChC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;QAC5B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,KAAK;QAC1B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAc;IAC3C,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;YAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC5B;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,YAAY,CAAC;QACjB,SAAS;QACT,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,YAAY;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAc;IACvC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;SAC3C;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,QAAQ,CAAC;QACb,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAc;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,EAAE,MAAM;QACZ,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE;YAC/C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC5B;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC;QACzB,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,aAAa;QAChC,OAAO;KACR,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/commands/export-gha.d.ts

@@ -0,0 +1,11 @@
+export type ExportGhaOptions = {
+    packageId: string;
+    env: string;
+    profile?: string;
+    cwd?: string;
+    githubEnvPath?: string;
+    projectSlug?: string;
+    identityId?: string;
+};
+export declare function runExportGha(options: ExportGhaOptions): Promise<void>;
+//# sourceMappingURL=export-gha.d.ts.map

package/dist/commands/export-gha.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-gha.d.ts","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoG3E"}

package/dist/commands/export-gha.js

@@ -0,0 +1,79 @@
+import { applyAliases } from "../aliases.js";
+import { fetchManifestSecrets } from "../ci-skip.js";
+import { loadConfig } from "../config.js";
+import { normalizeEnvSlug } from "../env-slug.js";
+import { appendSecretsToGithubEnv } from "../github-env.js";
+import { runAdvertiseKeysHooks } from "../hooks.js";
+import { selectEmittedSecrets } from "../include.js";
+import { normalizeFolderPath, resolveInclude, resolvePaths, } from "../manifest.js";
+import { logMissingOptionalKeys, resolveOptionalKeys, } from "../optional-keys.js";
+import { RemoteProvider } from "../providers/remote.js";
+import { discoverManifests } from "../registry.js";
+export async function runExportGha(options) {
+    const config = await loadConfig(options.cwd);
+    const envName = normalizeEnvSlug(process.env.INFISICAL_ENV_SLUG ?? options.env);
+    const githubEnvPath = options.githubEnvPath ?? process.env.GITHUB_ENV ?? "";
+    if (!githubEnvPath) {
+        throw new Error("GITHUB_ENV is not set");
+    }
+    const projectSlug = options.projectSlug ?? process.env.INFISICAL_PROJECT_SLUG;
+    if (!projectSlug) {
+        throw new Error("INFISICAL_PROJECT_SLUG required");
+    }
+    const manifests = discoverManifests(config);
+    const manifest = manifests.find((m) => m.id === options.packageId);
+    if (!manifest) {
+        throw new Error(`Unknown package id: ${options.packageId}`);
+    }
+    // Base `paths` are the app's runtime secrets; a profile (e.g. `deploy`) may
+    // replace them with a superset that also carries deploy-time credentials.
+    // Split the two so we advertise only runtime keys for deploy forwarding.
+    const allPaths = resolvePaths(manifest.config, options.profile);
+    const basePaths = manifest.config.paths;
+    const runtimePaths = basePaths.filter((p) => allPaths.includes(p));
+    const deployOnlyPaths = allPaths.filter((p) => !runtimePaths.includes(p));
+    const identityId = options.identityId ?? process.env.INFISICAL_IDENTITY_ID;
+    if (!identityId) {
+        throw new Error("INFISICAL_IDENTITY_ID required — infisicml CI auth is GitHub OIDC only (no client-id/secret fallback). Set `permissions: id-token: write` on the job.");
+    }
+    const provider = new RemoteProvider({
+        domain: config.infisicalDomain,
+        projectSlug,
+        identityId,
+        oidcAudience: process.env.INFISICAL_OIDC_AUDIENCE ?? config.auth?.oidcAudience,
+    });
+    for (const folder of allPaths) {
+        console.log(`Loading Infisical path ${normalizeFolderPath(folder)} (${envName})`);
+    }
+    // Two calls (runtime then deploy-only), reusing the cached access token, so we
+    // know which keys are runtime without per-folder provenance through the merge.
+    const runtimeSecrets = await fetchManifestSecrets(provider, envName, runtimePaths, manifest.config, options.profile);
+    const deployOnlySecrets = deployOnlyPaths.length
+        ? await fetchManifestSecrets(provider, envName, deployOnlyPaths, manifest.config, options.profile)
+        : {};
+    const optionalKeys = resolveOptionalKeys(manifest.config, envName);
+    const aliased = applyAliases({ ...runtimeSecrets, ...deployOnlySecrets }, manifest.config);
+    // Default-deny key selection: emit only the allowlisted keys when `include`
+    // is set. Absent = emit all.
+    const include = resolveInclude(manifest.config, options.profile);
+    // Notice missing optional keys against the pre-include set — a key present in
+    // the folders but filtered out by `include` isn't "missing". Skip keys the
+    // allowlist governs: those get a single notice from selectEmittedSecrets'
+    // unknown-key check, so we don't emit two notices for the same absent key.
+    const includeSet = new Set(include ?? []);
+    logMissingOptionalKeys(aliased, optionalKeys.filter((k) => !includeSet.has(k)));
+    const merged = selectEmittedSecrets(aliased, include, optionalKeys);
+    appendSecretsToGithubEnv(githubEnvPath, merged);
+    // Advertise CANONICAL (pre-alias) key names. Alias targets (e.g.
+    // NEXT_PUBLIC_*) are build-tool copies, not the names a server runtime reads,
+    // so they are intentionally not advertised — they still land in the job env
+    // via `merged` for build steps that need them. Drop any key `include`
+    // filtered out (a no-op when `include` is absent, since every fetched key is
+    // then in `merged`) so we never advertise a name not in the job env.
+    const emitted = (keys) => keys.filter((k) => merged[k] !== undefined);
+    runAdvertiseKeysHooks(githubEnvPath, config.hooks?.advertiseKeys, {
+        runtimeKeys: emitted(Object.keys(runtimeSecrets)),
+        allKeys: emitted(Object.keys({ ...runtimeSecrets, ...deployOnlySecrets })),
+    });
+}
+//# sourceMappingURL=export-gha.js.map

package/dist/commands/export-gha.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-gha.js","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAYnD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAyB;IAC1D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,gBAAgB,CAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAC9C,CAAC;IACF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAC5E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC9E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;IACxC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC;QAClC,MAAM,EAAE,MAAM,CAAC,eAAe;QAC9B,WAAW;QACX,UAAU;QACV,YAAY,EACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,MAAM,CAAC,IAAI,EAAE,YAAY;KACnE,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CACT,0BAA0B,mBAAmB,CAAC,MAAM,CAAC,KAAK,OAAO,GAAG,CACrE,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAC/C,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,QAAQ,CAAC,MAAM,EACf,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,MAAM,iBAAiB,GAAG,eAAe,CAAC,MAAM;QAC9C,CAAC,CAAC,MAAM,oBAAoB,CACxB,QAAQ,EACR,OAAO,EACP,eAAe,EACf,QAAQ,CAAC,MAAM,EACf,OAAO,CAAC,OAAO,CAChB;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,YAAY,CAC1B,EAAE,GAAG,cAAc,EAAE,GAAG,iBAAiB,EAAE,EAC3C,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,4EAA4E;IAC5E,6BAA6B;IAC7B,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC1C,sBAAsB,CACpB,OAAO,EACP,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;IACF,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACpE,wBAAwB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAEhD,iEAAiE;IACjE,8EAA8E;IAC9E,4EAA4E;IAC5E,sEAAsE;IACtE,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,OAAO,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAChF,qBAAqB,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE;QAChE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,cAAc,EAAE,GAAG,iBAAiB,EAAE,CAAC,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/list.d.ts

@@ -0,0 +1,2 @@
+export declare function runList(cwd?: string): Promise<void>;
+//# sourceMappingURL=list.d.ts.map

package/dist/commands/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAIA,wBAAsB,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BzD"}

package/dist/commands/list.js

@@ -0,0 +1,35 @@
+import { loadConfig } from "../config.js";
+import { normalizeFolderPath } from "../manifest.js";
+import { discoverManifests } from "../registry.js";
+export async function runList(cwd) {
+    const config = await loadConfig(cwd);
+    const manifests = discoverManifests(config);
+    for (const { id, config: m } of manifests) {
+        const paths = m.paths.map((p) => normalizeFolderPath(p)).join(", ");
+        console.log(`  ${id}: ${paths}`);
+        if (m.include) {
+            console.log(`    include: ${m.include.join(", ")}`);
+        }
+        if (m.fetch) {
+            console.log(`    fetch: ${m.fetch}`);
+        }
+        if (m.profiles) {
+            for (const [name, profile] of Object.entries(m.profiles)) {
+                const profilePaths = profile.paths
+                    .map((p) => normalizeFolderPath(p))
+                    .join(", ");
+                console.log(`    [${name}]: ${profilePaths}`);
+                // A profile include/fetch replaces the root value; show whichever applies.
+                const effectiveInclude = profile.include ?? m.include;
+                if (effectiveInclude) {
+                    console.log(`      include: ${effectiveInclude.join(", ")}`);
+                }
+                const effectiveFetch = profile.fetch ?? m.fetch;
+                if (effectiveFetch) {
+                    console.log(`      fetch: ${effectiveFetch}`);
+                }
+            }
+        }
+    }
+}
+//# sourceMappingURL=list.js.map

package/dist/commands/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE5C,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK;qBAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;qBAClC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,YAAY,EAAE,CAAC,CAAC;gBAC9C,2EAA2E;gBAC3E,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC;gBACtD,IAAI,gBAAgB,EAAE,CAAC;oBACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/D,CAAC;gBACD,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;gBAChD,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,GAAG,CAAC,gBAAgB,cAAc,EAAE,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/commands/paths.d.ts

@@ -0,0 +1,8 @@
+export type PathsOptions = {
+    packageId: string;
+    profile?: string;
+    comma: boolean;
+    cwd?: string;
+};
+export declare function runPaths(options: PathsOptions): Promise<void>;
+//# sourceMappingURL=paths.d.ts.map

package/dist/commands/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BnE"}

package/dist/commands/paths.js

@@ -0,0 +1,30 @@
+import { loadConfig } from "../config.js";
+import { normalizeFolderPath, resolveFetchMode, resolveInclude, resolvePaths, } from "../manifest.js";
+import { discoverManifests } from "../registry.js";
+export async function runPaths(options) {
+    const config = await loadConfig(options.cwd);
+    const manifests = discoverManifests(config);
+    const manifest = manifests.find((m) => m.id === options.packageId);
+    if (!manifest) {
+        throw new Error(`Unknown package id: ${options.packageId}`);
+    }
+    const paths = resolvePaths(manifest.config, options.profile);
+    const normalized = paths.map((p) => normalizeFolderPath(p));
+    // `paths` feeds the infisical CLI, which fetches whole folders — key-level
+    // `include` filtering happens later, in pull/export-gha. Warn on stderr so the
+    // filtering isn't invisible to someone reading only this folder list.
+    const include = resolveInclude(manifest.config, options.profile);
+    if (include) {
+        console.error(`# note: ${options.packageId} filters emitted keys to: ${include.join(", ")}`);
+    }
+    if (resolveFetchMode(manifest.config, options.profile) === "keys") {
+        console.error(`# note: ${options.packageId} uses fetch: "keys" — only the include keys are emitted; in CI they are read per-key from the vault (wire-level least privilege).`);
+    }
+    if (options.comma) {
+        console.log(normalized.map((p) => p.replace(/^\//, "")).join(","));
+    }
+    else {
+        console.log(normalized.map((p) => `--path=${p}`).join(" "));
+    }
+}
+//# sourceMappingURL=paths.js.map

package/dist/commands/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AASnD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5D,2EAA2E;IAC3E,+EAA+E;IAC/E,sEAAsE;IACtE,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CACX,WAAW,OAAO,CAAC,SAAS,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QAClE,OAAO,CAAC,KAAK,CACX,WAAW,OAAO,CAAC,SAAS,mIAAmI,CAChK,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/commands/pull.d.ts

@@ -0,0 +1,11 @@
+export type PullOptions = {
+    ids: string[];
+    env: string;
+    profile?: string;
+    force: boolean;
+    here: boolean;
+    turbo: boolean;
+    cwd?: string;
+};
+export declare function runPull(options: PullOptions): Promise<void>;
+//# sourceMappingURL=pull.d.ts.map

package/dist/commands/pull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAyEjE"}

package/dist/commands/pull.js

@@ -0,0 +1,65 @@
+import { resolve } from "node:path";
+import { loadConfig } from "../config.js";
+import { shouldSkipInfisicalPull } from "../ci-skip.js";
+import { commandExists, LocalProvider } from "../providers/local.js";
+import { pullManifest } from "../pull.js";
+import { discoverManifests } from "../registry.js";
+export async function runPull(options) {
+    const config = await loadConfig(options.cwd);
+    const repoRoot = config.repoRoot;
+    const envName = process.env.INFISICAL_ENV ?? options.env;
+    if (!config.projectId) {
+        throw new Error("INFISICAL_PROJECT_ID not resolved — set config.projectId, projectIdEnvFile, or the INFISICAL_PROJECT_ID env var");
+    }
+    let manifests = discoverManifests(config);
+    if (options.here) {
+        const cwd = process.cwd();
+        const match = manifests.find((m) => resolve(m.dir) === resolve(cwd));
+        if (!match) {
+            throw new Error(`No secrets.json in ${cwd}`);
+        }
+        manifests = [match];
+    }
+    else if (options.ids.length > 0) {
+        const allowed = new Set(options.ids);
+        manifests = manifests.filter((m) => allowed.has(m.id));
+        const missing = options.ids.filter((id) => !manifests.some((m) => m.id === id));
+        if (missing.length > 0) {
+            throw new Error(`Unknown package id(s): ${missing.join(", ")}`);
+        }
+    }
+    if (manifests.length === 0) {
+        console.log("No secrets.json manifests found.");
+        return;
+    }
+    // The infisical CLI is only needed for manifests that will actually pull.
+    // Mirror pullManifest's own skip decision exactly so CI stubs never demand a
+    // tool they don't use.
+    const needsInfisical = manifests.some((m) => !shouldSkipInfisicalPull(m.config, options.force));
+    if (needsInfisical && !commandExists("infisical")) {
+        throw new Error("infisical CLI not found — install and run: infisical login");
+    }
+    const provider = new LocalProvider({
+        projectId: config.projectId,
+        cwd: repoRoot,
+    });
+    let pulled = 0;
+    let skipped = 0;
+    for (const manifest of manifests) {
+        const result = await pullManifest({
+            manifest,
+            repoRoot,
+            envName,
+            profile: options.profile,
+            force: options.force,
+            turboMode: options.turbo,
+            provider,
+        });
+        if (result === "pulled")
+            pulled += 1;
+        else
+            skipped += 1;
+    }
+    console.log(`\nDone: ${pulled} pulled, ${skipped} skipped (${manifests.length} package(s)).`);
+}
+//# sourceMappingURL=pull.js.map

package/dist/commands/pull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAYnD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAoB;IAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC;IAEzD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE1C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAChC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAC5C,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,uBAAuB;IACvB,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CACzD,CAAC;IAEF,IAAI,cAAc,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,QAAQ;KACd,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,QAAQ;YACR,QAAQ;YACR,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,KAAK;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,CAAC,CAAC;;YAChC,OAAO,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,GAAG,CACT,WAAW,MAAM,YAAY,OAAO,aAAa,SAAS,CAAC,MAAM,eAAe,CACjF,CAAC;AACJ,CAAC"}

package/dist/commands/run.d.ts

@@ -0,0 +1,9 @@
+export type RunOptions = {
+    packageId: string;
+    profile?: string;
+    env: string;
+    command: string[];
+    cwd?: string;
+};
+export declare function runExec(options: RunOptions): Promise<number>;
+//# sourceMappingURL=run.d.ts.map

package/dist/commands/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,OAAO,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAgClE"}

package/dist/commands/run.js

@@ -0,0 +1,30 @@
+import { spawnSync } from "node:child_process";
+import { loadConfig } from "../config.js";
+import { normalizeEnvSlug } from "../env-slug.js";
+import { normalizeFolderPath, resolvePaths } from "../manifest.js";
+import { discoverManifests } from "../registry.js";
+export async function runExec(options) {
+    const config = await loadConfig(options.cwd);
+    const repoRoot = config.repoRoot;
+    const envName = normalizeEnvSlug(process.env.INFISICAL_ENV ?? options.env);
+    const manifests = discoverManifests(config);
+    const manifest = manifests.find((m) => m.id === options.packageId);
+    if (!manifest) {
+        throw new Error(`Unknown package id: ${options.packageId}`);
+    }
+    if (process.env.INFISICAL_DISABLE === "1") {
+        const result = spawnSync(options.command[0], options.command.slice(1), {
+            stdio: "inherit",
+            cwd: repoRoot,
+        });
+        return result.status ?? 1;
+    }
+    const paths = resolvePaths(manifest.config, options.profile);
+    const pathFlags = paths.flatMap((p) => ["--path", normalizeFolderPath(p)]);
+    const result = spawnSync("infisical", ["run", `--env=${envName}`, ...pathFlags, "--", ...options.command], { stdio: "inherit", cwd: repoRoot });
+    if (result.error) {
+        throw result.error;
+    }
+    return result.status ?? 1;
+}
+//# sourceMappingURL=run.js.map

package/dist/commands/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAUnD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAmB;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACrE,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,SAAS,CACtB,WAAW,EACX,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EACnE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CACpC,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/commands/validate.d.ts

@@ -0,0 +1,2 @@
+export declare function runValidate(cwd?: string): Promise<void>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/commands/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAOA,wBAAsB,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B7D"}

package/dist/commands/validate.js

@@ -0,0 +1,33 @@
+import { loadConfig } from "../config.js";
+import { checkFetchIncludeConsistency, secretsManifestSchema, } from "../manifest.js";
+import { discoverManifests } from "../registry.js";
+export async function runValidate(cwd) {
+    const config = await loadConfig(cwd);
+    const manifests = discoverManifests(config);
+    let errors = 0;
+    for (const { id, dir, config: m } of manifests) {
+        const result = secretsManifestSchema.safeParse(m);
+        if (!result.success) {
+            console.error(`❌ ${id} (${dir}/secrets.json):`);
+            for (const issue of result.error.issues) {
+                console.error(`   ${issue.path.join(".")}: ${issue.message}`);
+            }
+            errors += 1;
+            continue;
+        }
+        // Cross-field checks the schema can't express (depend on resolved profile).
+        const semanticIssues = checkFetchIncludeConsistency(result.data);
+        if (semanticIssues.length > 0) {
+            console.error(`❌ ${id} (${dir}/secrets.json):`);
+            for (const issue of semanticIssues) {
+                console.error(`   ${issue}`);
+            }
+            errors += 1;
+        }
+    }
+    if (errors > 0) {
+        throw new Error(`validate failed: ${errors} invalid manifest(s)`);
+    }
+    console.log(`✅ ${manifests.length} manifest(s) valid`);
+}
+//# sourceMappingURL=validate.js.map

package/dist/commands/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,IAAI,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QACD,4EAA4E;QAC5E,MAAM,cAAc,GAAG,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,sBAAsB,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,oBAAoB,CAAC,CAAC;AACzD,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,58 @@
+/**
+ * How Infisicml discovers per-package `secrets.json` manifests. Discovery is
+ * driven entirely by config, so no repo layout is baked into the tool.
+ */
+export type DiscoveryConfig = {
+    /**
+     * Parent directories scanned one level deep. Any immediate child directory
+     * containing a `secrets.json` becomes a package whose id is the child dir
+     * name (e.g. `roots: ["nextjs-apps", "vite-apps"]`).
+     */
+    roots?: string[];
+    /** Explicit packages with custom ids (e.g. `{ id: "postgres", dir: "infra/postgres" }`). */
+    packages?: {
+        id: string;
+        dir: string;
+    }[];
+};
+/**
+ * Advertise a subset of a package's secret KEY NAMES (never values) to
+ * GITHUB_ENV as a plain, comma-separated var. A deploy step reads it and
+ * forwards exactly those keys (e.g. `flyctl secrets import`, `gcloud`,
+ * `wrangler secret`), so `secrets.json` stays the source of truth for what a
+ * deploy forwards — no hand-maintained allowlist in the workflow.
+ */
+export type AdvertiseKeysHook = {
+    /** Env var name to write the comma-separated key list to. */
+    envVar: string;
+    /**
+     * `runtime` (default): only keys from the manifest's base `paths` — the app's
+     *   runtime secrets, excluding profile-only deploy credentials.
+     * `all`: every canonical key across the resolved (profile) paths.
+     */
+    scope?: "runtime" | "all";
+};
+export type InfisicmlConfig = {
+    /** Infisical project id for the local CLI provider. */
+    projectId?: string;
+    /** dotenv file (relative to repo root) providing INFISICAL_PROJECT_ID. */
+    projectIdEnvFile?: string;
+    /** Infisical API domain (self-hosted). Defaults to https://app.infisical.com. */
+    infisicalDomain?: string;
+    discovery: DiscoveryConfig;
+    auth?: {
+        /** OIDC audience bound to the machine identity (CI). */
+        oidcAudience?: string;
+    };
+    hooks?: {
+        advertiseKeys?: AdvertiseKeysHook[];
+    };
+};
+export type ResolvedConfig = InfisicmlConfig & {
+    repoRoot: string;
+    projectId: string;
+};
+/** Identity helper for type-safe `infisicml.config.ts` files. */
+export declare function defineConfig(config: InfisicmlConfig): InfisicmlConfig;
+export declare function loadConfig(cwd?: string): Promise<ResolvedConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,eAAe,CAAC;IAC3B,IAAI,CAAC,EAAE;QACL,wDAAwD;QACxD,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,KAAK,CAAC,EAAE;QACN,aAAa,CAAC,EAAE,iBAAiB,EAAE,CAAC;KACrC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAErE;AAqDD,wBAAsB,UAAU,CAAC,GAAG,SAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAY7E"}