@hubble-ventures/infisicml 1.2.1

package/dist/config.js

@@ -0,0 +1,68 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseDotenv } from "./dotenv.js";
+/** Identity helper for type-safe `infisicml.config.ts` files. */
+export function defineConfig(config) {
+    return config;
+}
+const CONFIG_FILENAMES = [
+    "infisicml.config.json",
+    "infisicml.config.mjs",
+    "infisicml.config.js",
+];
+function findConfigFile(startDir) {
+    let dir = resolve(startDir);
+    while (true) {
+        for (const name of CONFIG_FILENAMES) {
+            const candidate = join(dir, name);
+            if (existsSync(candidate))
+                return { dir, file: candidate };
+        }
+        const parent = resolve(dir, "..");
+        if (parent === dir) {
+            throw new Error(`Could not find ${CONFIG_FILENAMES[0]} in any parent of ${startDir}`);
+        }
+        dir = parent;
+    }
+}
+async function readConfigFile(file) {
+    if (file.endsWith(".json")) {
+        return JSON.parse(readFileSync(file, "utf8"));
+    }
+    const mod = (await import(pathToFileURL(file).href));
+    if (!mod.default) {
+        throw new Error(`${file} must export a default InfisicmlConfig`);
+    }
+    return mod.default;
+}
+function resolveProjectId(repoRoot, config) {
+    if (config.projectId)
+        return config.projectId;
+    if (process.env.INFISICAL_PROJECT_ID)
+        return process.env.INFISICAL_PROJECT_ID;
+    if (config.projectIdEnvFile) {
+        const envPath = join(repoRoot, config.projectIdEnvFile);
+        if (existsSync(envPath)) {
+            const parsed = parseDotenv(readFileSync(envPath, "utf8"));
+            if (parsed.INFISICAL_PROJECT_ID)
+                return parsed.INFISICAL_PROJECT_ID;
+        }
+    }
+    throw new Error("INFISICAL_PROJECT_ID not resolved — set config.projectId, projectIdEnvFile, or the INFISICAL_PROJECT_ID env var");
+}
+export async function loadConfig(cwd = process.cwd()) {
+    const { dir, file } = findConfigFile(cwd);
+    const config = await readConfigFile(file);
+    // Project id is only needed by the local (CLI) provider; resolve lazily-ish
+    // but tolerate its absence in remote/CI flows that pass a project slug.
+    let projectId = "";
+    try {
+        projectId = resolveProjectId(dir, config);
+    }
+    catch {
+        projectId = "";
+    }
+    return { ...config, repoRoot: dir, projectId };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAyD1C,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB,uBAAuB;IACvB,sBAAsB;IACtB,qBAAqB;CACtB,CAAC;AAEF,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,IAAI,EAAE,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,kBAAkB,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,QAAQ,EAAE,CACrE,CAAC;QACJ,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAoB,CAAC;IACnE,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAElD,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAuB;IACjE,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC;IAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC9E,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,oBAAoB;gBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAClD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1C,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AACjD,CAAC"}

package/dist/dotenv.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Parse and serialize dotenv-format secret files.
+ */
+export declare function parseDotenv(text: string): Record<string, string>;
+export declare function serializeDotenv(vars: Record<string, string>): string;
+//# sourceMappingURL=dotenv.d.ts.map

package/dist/dotenv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotenv.d.ts","sourceRoot":"","sources":["../src/dotenv.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkBhE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CASpE"}

package/dist/dotenv.js

@@ -0,0 +1,31 @@
+/**
+ * Parse and serialize dotenv-format secret files.
+ */
+export function parseDotenv(text) {
+    const out = {};
+    for (const line of text.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        const eq = trimmed.indexOf("=");
+        if (eq === -1)
+            continue;
+        const key = trimmed.slice(0, eq).trim();
+        let value = trimmed.slice(eq + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        out[key] = value;
+    }
+    return out;
+}
+export function serializeDotenv(vars) {
+    const lines = [];
+    for (const [key, value] of Object.entries(vars).sort(([a], [b]) => a.localeCompare(b))) {
+        const needsQuotes = /[\s"'$`#\\]/.test(value);
+        lines.push(`${key}=${needsQuotes ? JSON.stringify(value) : value}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=dotenv.js.map

package/dist/dotenv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotenv.js","sourceRoot":"","sources":["../src/dotenv.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAChE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CACnB,EAAE,CAAC;QACF,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/env-slug.d.ts

@@ -0,0 +1,3 @@
+/** Normalize Infisical environment slugs. */
+export declare function normalizeEnvSlug(env: string): string;
+//# sourceMappingURL=env-slug.d.ts.map

package/dist/env-slug.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-slug.d.ts","sourceRoot":"","sources":["../src/env-slug.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGpD"}

package/dist/env-slug.js

@@ -0,0 +1,7 @@
+/** Normalize Infisical environment slugs. */
+export function normalizeEnvSlug(env) {
+    if (env === "prod")
+        return "production";
+    return env;
+}
+//# sourceMappingURL=env-slug.js.map

package/dist/env-slug.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-slug.js","sourceRoot":"","sources":["../src/env-slug.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/github-env.d.ts

@@ -0,0 +1,10 @@
+export declare function appendSecretToGithubEnv(githubEnvPath: string, key: string, value: string): void;
+export declare function appendSecretsToGithubEnv(githubEnvPath: string, secrets: Record<string, string>): void;
+/**
+ * Append a NON-secret env var (no `::add-mask::`) to GITHUB_ENV. Use for
+ * metadata like a comma-separated list of secret key names — the names are not
+ * sensitive, and masking them would garble unrelated log output. The value must
+ * be a single line (secret key names always are).
+ */
+export declare function appendPlainToGithubEnv(githubEnvPath: string, key: string, value: string): void;
+//# sourceMappingURL=github-env.d.ts.map

package/dist/github-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-env.d.ts","sourceRoot":"","sources":["../src/github-env.ts"],"names":[],"mappings":"AAEA,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,IAAI,CAgBN;AAED,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,IAAI,CAIN;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,IAAI,CAMN"}

package/dist/github-env.js

@@ -0,0 +1,37 @@
+import { appendFileSync } from "node:fs";
+export function appendSecretToGithubEnv(githubEnvPath, key, value) {
+    if (!key)
+        return;
+    // Workflow commands must go to stdout — not GITHUB_ENV (see actions/toolkit#1338).
+    for (const line of value.split("\n")) {
+        if (!line)
+            continue;
+        const masked = line.replaceAll("%", "%25");
+        process.stdout.write(`::add-mask::${masked}\n`);
+    }
+    let delim = `INFISCML_${key}_${Date.now()}${process.hrtime.bigint()}`;
+    while (value.includes(delim)) {
+        delim = `${delim}_`;
+    }
+    appendFileSync(githubEnvPath, `${key}<<${delim}\n${value}\n${delim}\n`);
+}
+export function appendSecretsToGithubEnv(githubEnvPath, secrets) {
+    for (const [key, value] of Object.entries(secrets)) {
+        appendSecretToGithubEnv(githubEnvPath, key, value);
+    }
+}
+/**
+ * Append a NON-secret env var (no `::add-mask::`) to GITHUB_ENV. Use for
+ * metadata like a comma-separated list of secret key names — the names are not
+ * sensitive, and masking them would garble unrelated log output. The value must
+ * be a single line (secret key names always are).
+ */
+export function appendPlainToGithubEnv(githubEnvPath, key, value) {
+    if (!key)
+        return;
+    if (value.includes("\n")) {
+        throw new Error(`Plain GITHUB_ENV value for ${key} must be single-line`);
+    }
+    appendFileSync(githubEnvPath, `${key}=${value}\n`);
+}
+//# sourceMappingURL=github-env.js.map

package/dist/github-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-env.js","sourceRoot":"","sources":["../src/github-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,GAAW,EACX,KAAa;IAEb,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,mFAAmF;IACnF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,KAAK,GAAG,YAAY,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IACtE,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,GAAG,GAAG,KAAK,GAAG,CAAC;IACtB,CAAC;IAED,cAAc,CAAC,aAAa,EAAE,GAAG,GAAG,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,aAAqB,EACrB,OAA+B;IAE/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,uBAAuB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,GAAW,EACX,KAAa;IAEb,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,sBAAsB,CAAC,CAAC;IAC3E,CAAC;IACD,cAAc,CAAC,aAAa,EAAE,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC;AACrD,CAAC"}

package/dist/hooks.d.ts

@@ -0,0 +1,17 @@
+import type { AdvertiseKeysHook } from "./config.js";
+export type AdvertiseInput = {
+    /** Canonical key names from the manifest's base (runtime) paths. */
+    runtimeKeys: string[];
+    /** Canonical key names across all resolved (profile) paths. */
+    allKeys: string[];
+};
+export declare function keysForScope(hook: AdvertiseKeysHook, input: AdvertiseInput): string[];
+/**
+ * Write each configured `advertiseKeys` hook's key list to GITHUB_ENV as a
+ * plain (unmasked, non-secret) comma-separated var. Key NAMES only — values are
+ * never advertised. A deploy step forwards exactly these keys by value from the
+ * job env, so `secrets.json` stays the single source of truth for what lands on
+ * the app (no hand-maintained allowlist in the workflow).
+ */
+export declare function runAdvertiseKeysHooks(githubEnvPath: string, hooks: AdvertiseKeysHook[] | undefined, input: AdvertiseInput): void;
+//# sourceMappingURL=hooks.d.ts.map

package/dist/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGrD,MAAM,MAAM,cAAc,GAAG;IAC3B,oEAAoE;IACpE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,cAAc,GACpB,MAAM,EAAE,CAGV;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,iBAAiB,EAAE,GAAG,SAAS,EACtC,KAAK,EAAE,cAAc,GACpB,IAAI,CAKN"}

package/dist/hooks.js

@@ -0,0 +1,19 @@
+import { appendPlainToGithubEnv } from "./github-env.js";
+export function keysForScope(hook, input) {
+    const keys = hook.scope === "all" ? input.allKeys : input.runtimeKeys;
+    return [...keys].sort();
+}
+/**
+ * Write each configured `advertiseKeys` hook's key list to GITHUB_ENV as a
+ * plain (unmasked, non-secret) comma-separated var. Key NAMES only — values are
+ * never advertised. A deploy step forwards exactly these keys by value from the
+ * job env, so `secrets.json` stays the single source of truth for what lands on
+ * the app (no hand-maintained allowlist in the workflow).
+ */
+export function runAdvertiseKeysHooks(githubEnvPath, hooks, input) {
+    for (const hook of hooks ?? []) {
+        const keys = keysForScope(hook, input);
+        appendPlainToGithubEnv(githubEnvPath, hook.envVar, keys.join(","));
+    }
+}
+//# sourceMappingURL=hooks.js.map

package/dist/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AASzD,MAAM,UAAU,YAAY,CAC1B,IAAuB,EACvB,KAAqB;IAErB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IACtE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAqB,EACrB,KAAsC,EACtC,KAAqB;IAErB,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,sBAAsB,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}

package/dist/include.d.ts

@@ -0,0 +1,46 @@
+import type { SecretsManifest } from "./manifest.js";
+/**
+ * Resolve the canonical vault keys to request in `fetch: "keys"` mode.
+ *
+ * `include` names the *final* (post-{@link applyAliases}) keys, but the vault is
+ * keyed by canonical names. For each `include` entry we request the name itself
+ * (it may be a real vault key) plus any alias *source* whose target is that name
+ * (so the source value exists to materialize the target). Phantom entries — an
+ * alias target that isn't a real vault key — simply miss on fetch, which is
+ * harmless: the post-fetch {@link selectEmittedSecrets} still validates the
+ * emitted set against `include`, so a genuinely-missing key fails there exactly
+ * as in folder mode.
+ */
+export declare function resolveFetchKeys(include: string[], manifest: SecretsManifest): string[];
+export type IncludeResult = {
+    /** The emitted map after allowlist filtering. */
+    filtered: Record<string, string>;
+    /** `include` names that no folder produced (absent from the input map). */
+    unknown: string[];
+};
+/**
+ * Filter a materialized secret map down to the `include` allowlist.
+ *
+ * Runs *after* {@link applyAliases}, so it filters the final set of names: an
+ * alias whose source isn't listed still emits its target, and a canonical key
+ * not listed is dropped even when its alias target is kept.
+ *
+ * When `include` is `undefined` this is a pass-through (emit all keys) — the
+ * backward-compatible default. Returns a new object; the input is not mutated.
+ */
+export declare function applyInclude(merged: Record<string, string>, include: string[] | undefined): IncludeResult;
+/**
+ * An `include` name that no folder produced is treated like a missing required
+ * key: fail, unless it's listed in the environment's `optionalKeys`, in which
+ * case it's downgraded to a `::notice::`. Enforced identically in `pull` and
+ * `export-gha` so the two surfaces stay consistent.
+ */
+export declare function enforceIncludeKnown(unknown: string[], optionalKeys: string[]): void;
+/**
+ * Shared allowlist step for both emit surfaces: filter the aliased map to the
+ * (already-resolved) `include` and enforce the unknown-key policy. Callers
+ * resolve `include` once — with {@link resolveInclude} — so the value they use
+ * for headers/logging is the same one that governs the filter.
+ */
+export declare function selectEmittedSecrets(aliased: Record<string, string>, include: string[] | undefined, optionalKeys: string[]): Record<string, string>;
+//# sourceMappingURL=include.d.ts.map

package/dist/include.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"include.d.ts","sourceRoot":"","sources":["../src/include.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EAAE,EACjB,QAAQ,EAAE,eAAe,GACxB,MAAM,EAAE,CAUV;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAC5B,aAAa,CAWf;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EAAE,EACjB,YAAY,EAAE,MAAM,EAAE,GACrB,IAAI,CAkBN;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,EAC7B,YAAY,EAAE,MAAM,EAAE,GACrB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB"}

package/dist/include.js

@@ -0,0 +1,82 @@
+import { resolveAliases } from "./aliases.js";
+/**
+ * Resolve the canonical vault keys to request in `fetch: "keys"` mode.
+ *
+ * `include` names the *final* (post-{@link applyAliases}) keys, but the vault is
+ * keyed by canonical names. For each `include` entry we request the name itself
+ * (it may be a real vault key) plus any alias *source* whose target is that name
+ * (so the source value exists to materialize the target). Phantom entries — an
+ * alias target that isn't a real vault key — simply miss on fetch, which is
+ * harmless: the post-fetch {@link selectEmittedSecrets} still validates the
+ * emitted set against `include`, so a genuinely-missing key fails there exactly
+ * as in folder mode.
+ */
+export function resolveFetchKeys(include, manifest) {
+    const aliases = resolveAliases(manifest);
+    const keys = new Set();
+    for (const name of include) {
+        keys.add(name);
+        for (const { source, targets } of aliases) {
+            if (targets.includes(name))
+                keys.add(source);
+        }
+    }
+    return [...keys];
+}
+/**
+ * Filter a materialized secret map down to the `include` allowlist.
+ *
+ * Runs *after* {@link applyAliases}, so it filters the final set of names: an
+ * alias whose source isn't listed still emits its target, and a canonical key
+ * not listed is dropped even when its alias target is kept.
+ *
+ * When `include` is `undefined` this is a pass-through (emit all keys) — the
+ * backward-compatible default. Returns a new object; the input is not mutated.
+ */
+export function applyInclude(merged, include) {
+    if (include === undefined) {
+        return { filtered: { ...merged }, unknown: [] };
+    }
+    const allow = new Set(include);
+    const filtered = {};
+    for (const [key, value] of Object.entries(merged)) {
+        if (allow.has(key))
+            filtered[key] = value;
+    }
+    const unknown = include.filter((name) => !(name in merged));
+    return { filtered, unknown };
+}
+/**
+ * An `include` name that no folder produced is treated like a missing required
+ * key: fail, unless it's listed in the environment's `optionalKeys`, in which
+ * case it's downgraded to a `::notice::`. Enforced identically in `pull` and
+ * `export-gha` so the two surfaces stay consistent.
+ */
+export function enforceIncludeKnown(unknown, optionalKeys) {
+    const optional = new Set(optionalKeys);
+    const missing = [];
+    for (const name of unknown) {
+        if (optional.has(name)) {
+            console.log(`::notice::include key ${name} not produced by any folder (optional for this environment)`);
+        }
+        else {
+            missing.push(name);
+        }
+    }
+    if (missing.length > 0) {
+        throw new Error(`include lists key(s) not produced by any pulled folder: ${missing.join(", ")}. ` +
+            "Fix the name, add the folder, or list the key in environments.<slug>.optionalKeys to allow absence.");
+    }
+}
+/**
+ * Shared allowlist step for both emit surfaces: filter the aliased map to the
+ * (already-resolved) `include` and enforce the unknown-key policy. Callers
+ * resolve `include` once — with {@link resolveInclude} — so the value they use
+ * for headers/logging is the same one that governs the filter.
+ */
+export function selectEmittedSecrets(aliased, include, optionalKeys) {
+    const { filtered, unknown } = applyInclude(aliased, include);
+    enforceIncludeKnown(unknown, optionalKeys);
+    return filtered;
+}
+//# sourceMappingURL=include.js.map

package/dist/include.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"include.js","sourceRoot":"","sources":["../src/include.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAiB,EACjB,QAAyB;IAEzB,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA8B,EAC9B,OAA6B;IAE7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC;IAC5D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAiB,EACjB,YAAsB;IAEtB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CACT,yBAAyB,IAAI,6DAA6D,CAC3F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,2DAA2D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC/E,qGAAqG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B,EAC/B,OAA6B,EAC7B,YAAsB;IAEtB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+export { applyAliases, type ResolvedAlias, resolveAliases, } from "./aliases.js";
+export { fetchSecretsForPaths, isCi, keysForCiStub, mergeFolderSecrets, shouldSkipInfisicalPull, } from "./ci-skip.js";
+export { type AdvertiseKeysHook, defineConfig, type DiscoveryConfig, type InfisicmlConfig, loadConfig, type ResolvedConfig, } from "./config.js";
+export { parseDotenv, serializeDotenv } from "./dotenv.js";
+export { normalizeEnvSlug } from "./env-slug.js";
+export { appendPlainToGithubEnv, appendSecretsToGithubEnv, appendSecretToGithubEnv, } from "./github-env.js";
+export { type AdvertiseInput, keysForScope, runAdvertiseKeysHooks, } from "./hooks.js";
+export { applyInclude, enforceIncludeKnown, type IncludeResult, selectEmittedSecrets, } from "./include.js";
+export { loadManifestJson, normalizeFolderPath, resolveInclude, resolvePaths, resolveSecretsOutputPath, type SecretsManifest, secretsManifestSchema, } from "./manifest.js";
+export { logMissingOptionalKeys, resolveOptionalKeys, } from "./optional-keys.js";
+export { commandExists, LocalProvider } from "./providers/local.js";
+export { RemoteProvider } from "./providers/remote.js";
+export type { SecretsProvider } from "./providers/types.js";
+export { type PullResult, pullManifest, writeInjectedSecretsStub, } from "./pull.js";
+export { discoverManifests, type PackageManifest } from "./registry.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,aAAa,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,iBAAiB,EACtB,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,UAAU,EACV,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,cAAc,EACnB,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,KAAK,aAAa,EAClB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,wBAAwB,EACxB,KAAK,eAAe,EACpB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,KAAK,UAAU,EACf,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,15 @@
+export { applyAliases, resolveAliases, } from "./aliases.js";
+export { fetchSecretsForPaths, isCi, keysForCiStub, mergeFolderSecrets, shouldSkipInfisicalPull, } from "./ci-skip.js";
+export { defineConfig, loadConfig, } from "./config.js";
+export { parseDotenv, serializeDotenv } from "./dotenv.js";
+export { normalizeEnvSlug } from "./env-slug.js";
+export { appendPlainToGithubEnv, appendSecretsToGithubEnv, appendSecretToGithubEnv, } from "./github-env.js";
+export { keysForScope, runAdvertiseKeysHooks, } from "./hooks.js";
+export { applyInclude, enforceIncludeKnown, selectEmittedSecrets, } from "./include.js";
+export { loadManifestJson, normalizeFolderPath, resolveInclude, resolvePaths, resolveSecretsOutputPath, secretsManifestSchema, } from "./manifest.js";
+export { logMissingOptionalKeys, resolveOptionalKeys, } from "./optional-keys.js";
+export { commandExists, LocalProvider } from "./providers/local.js";
+export { RemoteProvider } from "./providers/remote.js";
+export { pullManifest, writeInjectedSecretsStub, } from "./pull.js";
+export { discoverManifests } from "./registry.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAEZ,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,YAAY,EAGZ,UAAU,GAEX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,mBAAmB,EAEnB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,wBAAwB,EAExB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAEL,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAwB,MAAM,eAAe,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,105 @@
+import { z } from "zod";
+export declare const secretsManifestSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    paths: z.ZodArray<z.ZodString, "many">;
+    profiles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        paths: z.ZodArray<z.ZodString, "many">;
+        include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        fetch: z.ZodOptional<z.ZodEnum<["folder", "keys"]>>;
+    }, "strip", z.ZodTypeAny, {
+        paths: string[];
+        include?: string[] | undefined;
+        fetch?: "keys" | "folder" | undefined;
+    }, {
+        paths: string[];
+        include?: string[] | undefined;
+        fetch?: "keys" | "folder" | undefined;
+    }>>>;
+    ci: z.ZodOptional<z.ZodObject<{
+        skipWhenEnv: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        stubInCi: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        skipWhenEnv?: string[] | undefined;
+        stubInCi?: boolean | undefined;
+    }, {
+        skipWhenEnv?: string[] | undefined;
+        stubInCi?: boolean | undefined;
+    }>>;
+    output: z.ZodOptional<z.ZodString>;
+    aliases: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>>;
+    include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    fetch: z.ZodOptional<z.ZodEnum<["folder", "keys"]>>;
+    environments: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        optionalKeys: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        optionalKeys?: string[] | undefined;
+    }, {
+        optionalKeys?: string[] | undefined;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    paths: string[];
+    $schema?: string | undefined;
+    include?: string[] | undefined;
+    fetch?: "keys" | "folder" | undefined;
+    profiles?: Record<string, {
+        paths: string[];
+        include?: string[] | undefined;
+        fetch?: "keys" | "folder" | undefined;
+    }> | undefined;
+    ci?: {
+        skipWhenEnv?: string[] | undefined;
+        stubInCi?: boolean | undefined;
+    } | undefined;
+    output?: string | undefined;
+    aliases?: Record<string, string | string[]> | undefined;
+    environments?: Record<string, {
+        optionalKeys?: string[] | undefined;
+    }> | undefined;
+}, {
+    paths: string[];
+    $schema?: string | undefined;
+    include?: string[] | undefined;
+    fetch?: "keys" | "folder" | undefined;
+    profiles?: Record<string, {
+        paths: string[];
+        include?: string[] | undefined;
+        fetch?: "keys" | "folder" | undefined;
+    }> | undefined;
+    ci?: {
+        skipWhenEnv?: string[] | undefined;
+        stubInCi?: boolean | undefined;
+    } | undefined;
+    output?: string | undefined;
+    aliases?: Record<string, string | string[]> | undefined;
+    environments?: Record<string, {
+        optionalKeys?: string[] | undefined;
+    }> | undefined;
+}>;
+export type SecretsManifest = z.infer<typeof secretsManifestSchema>;
+export declare function loadManifestJson(raw: unknown): SecretsManifest;
+/** Profile paths replace default paths when a profile is set. */
+export declare function resolvePaths(manifest: SecretsManifest, profile?: string): string[];
+/**
+ * Resolve the effective key allowlist. A profile's `include` replaces the root
+ * `include` when the profile defines it; otherwise the root `include` applies.
+ * Returns `undefined` when no allowlist is in effect (emit all keys).
+ */
+export declare function resolveInclude(manifest: SecretsManifest, profile?: string): string[] | undefined;
+/**
+ * Resolve the effective fetch mode. A profile's `fetch` replaces the root
+ * `fetch` when the profile defines it; otherwise the root `fetch` applies.
+ * Defaults to `"folder"` (whole-folder read + local filter) when unset.
+ */
+export declare function resolveFetchMode(manifest: SecretsManifest, profile?: string): "folder" | "keys";
+/**
+ * Cross-field rule: `fetch: "keys"` requires an `include` allowlist, because
+ * key mode fetches exactly the keys `include` names. The check spans the root
+ * and every profile (a profile's `fetch`/`include` each replace the root's), so
+ * every runnable combination is covered. Returns human-readable issue strings
+ * (empty when consistent) for `validate` to surface. Zod can't express this —
+ * the requirement depends on the resolved profile.
+ */
+export declare function checkFetchIncludeConsistency(manifest: SecretsManifest): string[];
+export declare function normalizeFolderPath(folder: string): string;
+export declare function resolveSecretsOutputPath(manifestDir: string, outputName: string): string;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA8BxB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwDhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAE9D;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,EAAE,CASV;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,EAAE,GAAG,SAAS,CAMtB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,QAAQ,GAAG,MAAM,CAMnB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,eAAe,GACxB,MAAM,EAAE,CAeV;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAiBR"}