@hubble-ventures/infisicml 1.2.1

package/dist/manifest.js

@@ -0,0 +1,153 @@
+import { resolve, sep } from "node:path";
+import { z } from "zod";
+const pathPattern = /^[a-z0-9_/-]+$/;
+const pathsSchema = z
+    .array(z.string().regex(pathPattern))
+    .min(1, "paths must be a non-empty array");
+const envVarNamePattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const aliasSourceSchema = z
+    .string()
+    .regex(envVarNamePattern, "alias source must be a valid env var name");
+const aliasTargetSchema = z
+    .string()
+    .regex(envVarNamePattern, "alias target must be a valid env var name");
+// Key-level allowlist. When present, only these env var names are emitted from
+// whatever the folders yielded (after aliases). `.min(1)` because an empty
+// allowlist is almost certainly a mistake — omit the field to emit every key.
+const includeSchema = z
+    .array(z.string().regex(envVarNamePattern, "include entry must be a valid env var name"))
+    .min(1, "include must be a non-empty array");
+// How secrets are read from the vault. `folder` (default) fetches whole folders
+// and filters locally. `keys` fetches only the exact keys `include` resolves to,
+// so the vault never transmits the rest — wire-level least privilege. `keys`
+// requires an `include` allowlist (enforced by resolveFetchKeys / validate,
+// since the requirement depends on the resolved profile).
+const fetchModeSchema = z.enum(["folder", "keys"]);
+export const secretsManifestSchema = z.object({
+    $schema: z.string().optional(),
+    paths: pathsSchema,
+    profiles: z
+        .record(z.string(), z.object({
+        paths: pathsSchema,
+        // Replaces the root `include` for this profile when set; if omitted,
+        // the root `include` applies (same replace-not-merge as `paths`).
+        include: includeSchema.optional(),
+        // Overrides the root `fetch` for this profile when set (same
+        // replace-not-merge as `paths` / `include`).
+        fetch: fetchModeSchema.optional(),
+    }))
+        .optional(),
+    ci: z
+        .object({
+        skipWhenEnv: z.array(z.string()).optional(),
+        stubInCi: z.boolean().optional(),
+    })
+        .optional(),
+    output: z
+        .string()
+        .regex(/^[^/\\]+$/)
+        .optional(),
+    // Map a pulled secret to the extra env var name(s) a build/runtime expects.
+    // The vault names a secret once (e.g. /clerk exposes the publishable key as
+    // CLERK_PUBLISHABLE_KEY), but build tools inline it by a tool-specific,
+    // convention-prefixed name — Vite reads VITE_*, Next reads NEXT_PUBLIC_*.
+    // Declaring the mapping here means every consumer (CI export-gha, local pull)
+    // emits the right name instead of each workflow re-deriving it.
+    aliases: z
+        .record(aliasSourceSchema, z.union([aliasTargetSchema, z.array(aliasTargetSchema).min(1)]))
+        .optional(),
+    // Emit only these keys from whatever the folders yielded (default-deny key
+    // selection). Applied after `aliases`, to the final set of names — so a client
+    // can pull a shared vendor folder but emit only its public key. Absent = emit
+    // all (backward compatible). A per-profile `include` replaces this one.
+    include: includeSchema.optional(),
+    // Read strategy: `folder` (default) pulls whole folders and filters locally;
+    // `keys` pulls only the keys `include` resolves to (least privilege at the
+    // wire). A per-profile `fetch` replaces this one.
+    fetch: fetchModeSchema.optional(),
+    environments: z
+        .record(z.string(), z.object({
+        optionalKeys: z.array(z.string()).optional(),
+    }))
+        .optional(),
+});
+export function loadManifestJson(raw) {
+    return secretsManifestSchema.parse(raw);
+}
+/** Profile paths replace default paths when a profile is set. */
+export function resolvePaths(manifest, profile) {
+    if (profile) {
+        const profileConfig = manifest.profiles?.[profile];
+        if (!profileConfig) {
+            throw new Error(`Unknown profile '${profile}' in secrets.json`);
+        }
+        return profileConfig.paths;
+    }
+    return manifest.paths;
+}
+/**
+ * Resolve the effective key allowlist. A profile's `include` replaces the root
+ * `include` when the profile defines it; otherwise the root `include` applies.
+ * Returns `undefined` when no allowlist is in effect (emit all keys).
+ */
+export function resolveInclude(manifest, profile) {
+    if (profile) {
+        const profileInclude = manifest.profiles?.[profile]?.include;
+        if (profileInclude !== undefined)
+            return profileInclude;
+    }
+    return manifest.include;
+}
+/**
+ * Resolve the effective fetch mode. A profile's `fetch` replaces the root
+ * `fetch` when the profile defines it; otherwise the root `fetch` applies.
+ * Defaults to `"folder"` (whole-folder read + local filter) when unset.
+ */
+export function resolveFetchMode(manifest, profile) {
+    if (profile) {
+        const profileFetch = manifest.profiles?.[profile]?.fetch;
+        if (profileFetch !== undefined)
+            return profileFetch;
+    }
+    return manifest.fetch ?? "folder";
+}
+/**
+ * Cross-field rule: `fetch: "keys"` requires an `include` allowlist, because
+ * key mode fetches exactly the keys `include` names. The check spans the root
+ * and every profile (a profile's `fetch`/`include` each replace the root's), so
+ * every runnable combination is covered. Returns human-readable issue strings
+ * (empty when consistent) for `validate` to surface. Zod can't express this —
+ * the requirement depends on the resolved profile.
+ */
+export function checkFetchIncludeConsistency(manifest) {
+    const issues = [];
+    const check = (profile, label) => {
+        if (resolveFetchMode(manifest, profile) === "keys" &&
+            resolveInclude(manifest, profile) === undefined) {
+            issues.push(`fetch: "keys" requires an include allowlist (${label})`);
+        }
+    };
+    check(undefined, "root");
+    for (const name of Object.keys(manifest.profiles ?? {})) {
+        check(name, `profile "${name}"`);
+    }
+    return issues;
+}
+export function normalizeFolderPath(folder) {
+    return `/${folder.replace(/^\/+/, "")}`;
+}
+export function resolveSecretsOutputPath(manifestDir, outputName) {
+    if (outputName !== outputName.split("/").pop() ||
+        outputName.includes("..") ||
+        outputName.length === 0) {
+        throw new Error(`Invalid secrets output filename: ${outputName}`);
+    }
+    const resolvedDir = resolve(manifestDir);
+    const resolvedOut = resolve(manifestDir, outputName);
+    if (resolvedOut !== resolvedDir &&
+        !resolvedOut.startsWith(resolvedDir + sep)) {
+        throw new Error(`Secrets output escapes manifest directory: ${outputName}`);
+    }
+    return resolvedOut;
+}
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,MAAM,WAAW,GAAG,CAAC;KAClB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;KACpC,GAAG,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC;AAE7C,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AACrD,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,KAAK,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;AACzE,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,KAAK,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;AAEzE,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,MAAM,aAAa,GAAG,CAAC;KACpB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;KACxF,GAAG,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC;AAE/C,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,CAAC;SACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,KAAK,EAAE,WAAW;QAClB,qEAAqE;QACrE,kEAAkE;QAClE,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;QACjC,6DAA6D;QAC7D,6CAA6C;QAC7C,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;KAClC,CAAC,CACH;SACA,QAAQ,EAAE;IACb,EAAE,EAAE,CAAC;SACF,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC3C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,CAAC;SAClB,QAAQ,EAAE;IACb,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,8EAA8E;IAC9E,gEAAgE;IAChE,OAAO,EAAE,CAAC;SACP,MAAM,CACL,iBAAiB,EACjB,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAChE;SACA,QAAQ,EAAE;IACb,2EAA2E;IAC3E,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,6EAA6E;IAC7E,2EAA2E;IAC3E,kDAAkD;IAClD,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,CAAC;SACZ,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAC1B,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,mBAAmB,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC;IAC7B,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,cAAc,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAC7D,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,cAAc,CAAC;IAC1D,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;QACzD,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC;IACtD,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAyB;IAEzB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,OAA2B,EAAE,KAAa,EAAE,EAAE;QAC3D,IACE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,MAAM;YAC9C,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,SAAS,EAC/C,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,gDAAgD,KAAK,GAAG,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,EAAE,YAAY,IAAI,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,UAAkB;IAElB,IACE,UAAU,KAAK,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;QAC1C,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,UAAU,CAAC,MAAM,KAAK,CAAC,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,IACE,WAAW,KAAK,WAAW;QAC3B,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/optional-keys.d.ts

@@ -0,0 +1,4 @@
+import type { SecretsManifest } from "./manifest.js";
+export declare function resolveOptionalKeys(manifest: SecretsManifest, envName: string): string[];
+export declare function logMissingOptionalKeys(merged: Record<string, string>, optionalKeys: string[]): void;
+//# sourceMappingURL=optional-keys.d.ts.map

package/dist/optional-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"optional-keys.d.ts","sourceRoot":"","sources":["../src/optional-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,MAAM,GACd,MAAM,EAAE,CAEV;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,YAAY,EAAE,MAAM,EAAE,GACrB,IAAI,CAQN"}

package/dist/optional-keys.js

@@ -0,0 +1,11 @@
+export function resolveOptionalKeys(manifest, envName) {
+    return manifest.environments?.[envName]?.optionalKeys ?? [];
+}
+export function logMissingOptionalKeys(merged, optionalKeys) {
+    for (const key of optionalKeys) {
+        if (!merged[key]?.trim()) {
+            console.log(`::notice::Optional secret ${key} not set (allowed for this environment)`);
+        }
+    }
+}
+//# sourceMappingURL=optional-keys.js.map

package/dist/optional-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"optional-keys.js","sourceRoot":"","sources":["../src/optional-keys.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,mBAAmB,CACjC,QAAyB,EACzB,OAAe;IAEf,OAAO,QAAQ,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,EAAE,YAAY,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAA8B,EAC9B,YAAsB;IAEtB,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CACT,6BAA6B,GAAG,yCAAyC,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/providers/local.d.ts

@@ -0,0 +1,38 @@
+import { type SpawnSyncReturns } from "node:child_process";
+import type { SecretsProvider } from "./types.js";
+export type SpawnExportFn = (command: string, args: string[], cwd: string) => SpawnSyncReturns<string>;
+export type LocalProviderOptions = {
+    projectId: string;
+    cwd?: string;
+    maxAttempts?: number;
+    spawn?: SpawnExportFn;
+};
+/**
+ * Dev-time provider: shells out to the `infisical` CLI using the developer's
+ * `infisical login` session. No machine identity or tokens required locally.
+ */
+export declare class LocalProvider implements SecretsProvider {
+    private readonly projectId;
+    private readonly cwd;
+    private readonly maxAttempts;
+    private readonly spawnFn;
+    constructor(options: LocalProviderOptions);
+    exportFolder(envName: string, folder: string): Promise<Record<string, string>>;
+    /**
+     * Select only the named keys from a folder.
+     *
+     * The `infisical` CLI has no true single-secret *server* fetch — `secrets get`
+     * pulls the whole folder from the API and filters client-side (running it per
+     * key would transfer the folder once per key). So we fetch the folder once via
+     * {@link exportFolder} and select the requested keys locally. This means the
+     * **wire-level** least-privilege guarantee holds only for the CI/REST lane
+     * ({@link RemoteProvider}); the local lane narrows what's *written*, not what
+     * the vault transmits. Crucially, it also inherits `exportFolder`'s retry and
+     * its clear `"infisical export failed…"` error, so a transient CLI failure
+     * throws an infrastructure error rather than silently dropping keys into the
+     * generic "not produced by any folder" path.
+     */
+    exportKeys(envName: string, folder: string, keys: string[]): Promise<Record<string, string>>;
+}
+export declare function commandExists(cmd: string): boolean;
+//# sourceMappingURL=local.d.ts.map

package/dist/providers/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAAa,MAAM,oBAAoB,CAAC;AAGtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,KACR,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAE9B,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB,CAAC;AAUF;;;GAGG;AACH,qBAAa,aAAc,YAAW,eAAe;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;gBAE5B,OAAO,EAAE,oBAAoB;IAOnC,YAAY,CAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAkClC;;;;;;;;;;;;;OAaG;IACG,UAAU,CACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAQnC;AAMD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGlD"}

package/dist/providers/local.js

@@ -0,0 +1,76 @@
+import { spawnSync } from "node:child_process";
+import { parseDotenv } from "../dotenv.js";
+import { normalizeFolderPath } from "../manifest.js";
+function defaultSpawn(command, args, cwd) {
+    return spawnSync(command, args, { encoding: "utf8", cwd });
+}
+/**
+ * Dev-time provider: shells out to the `infisical` CLI using the developer's
+ * `infisical login` session. No machine identity or tokens required locally.
+ */
+export class LocalProvider {
+    projectId;
+    cwd;
+    maxAttempts;
+    spawnFn;
+    constructor(options) {
+        this.projectId = options.projectId;
+        this.cwd = options.cwd ?? process.cwd();
+        this.maxAttempts = options.maxAttempts ?? 4;
+        this.spawnFn = options.spawn ?? defaultSpawn;
+    }
+    async exportFolder(envName, folder) {
+        const pathArg = normalizeFolderPath(folder);
+        let lastMsg = "";
+        for (let attempt = 1; attempt <= this.maxAttempts; attempt++) {
+            const result = this.spawnFn("infisical", [
+                "export",
+                `--env=${envName}`,
+                `--projectId=${this.projectId}`,
+                `--path=${pathArg}`,
+                "--format=dotenv",
+                "--silent",
+            ], this.cwd);
+            if (result.status === 0) {
+                return parseDotenv(result.stdout ?? "");
+            }
+            lastMsg = (result.stderr || result.stdout || "").trim();
+            if (attempt < this.maxAttempts) {
+                const delay = 2 * attempt;
+                await sleepSeconds(delay);
+            }
+        }
+        throw new Error(`infisical export failed for ${pathArg} after ${this.maxAttempts} attempts: ${lastMsg || "unknown error"}`);
+    }
+    /**
+     * Select only the named keys from a folder.
+     *
+     * The `infisical` CLI has no true single-secret *server* fetch — `secrets get`
+     * pulls the whole folder from the API and filters client-side (running it per
+     * key would transfer the folder once per key). So we fetch the folder once via
+     * {@link exportFolder} and select the requested keys locally. This means the
+     * **wire-level** least-privilege guarantee holds only for the CI/REST lane
+     * ({@link RemoteProvider}); the local lane narrows what's *written*, not what
+     * the vault transmits. Crucially, it also inherits `exportFolder`'s retry and
+     * its clear `"infisical export failed…"` error, so a transient CLI failure
+     * throws an infrastructure error rather than silently dropping keys into the
+     * generic "not produced by any folder" path.
+     */
+    async exportKeys(envName, folder, keys) {
+        const all = await this.exportFolder(envName, folder);
+        const out = {};
+        for (const key of keys) {
+            if (key in all)
+                out[key] = all[key];
+        }
+        return out;
+    }
+}
+function sleepSeconds(seconds) {
+    return new Promise((resolve) => setTimeout(resolve, seconds * 1000));
+}
+export function commandExists(cmd) {
+    const result = spawnSync(cmd, ["--version"], { stdio: "ignore" });
+    return !result.error && result.status === 0;
+}
+//# sourceMappingURL=local.js.map

package/dist/providers/local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAgBrD,SAAS,YAAY,CACnB,OAAe,EACf,IAAc,EACd,GAAW;IAEX,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,aAAa;IACP,SAAS,CAAS;IAClB,GAAG,CAAS;IACZ,WAAW,CAAS;IACpB,OAAO,CAAgB;IAExC,YAAY,OAA6B;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,OAAe,EACf,MAAc;QAEd,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,GAAG,EAAE,CAAC;QAEjB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CACzB,WAAW,EACX;gBACE,QAAQ;gBACR,SAAS,OAAO,EAAE;gBAClB,eAAe,IAAI,CAAC,SAAS,EAAE;gBAC/B,UAAU,OAAO,EAAE;gBACnB,iBAAiB;gBACjB,UAAU;aACX,EACD,IAAI,CAAC,GAAG,CACT,CAAC;YAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;YAED,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACxD,IAAI,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC;gBAC1B,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CACb,+BAA+B,OAAO,UAAU,IAAI,CAAC,WAAW,cAAc,OAAO,IAAI,eAAe,EAAE,CAC3G,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,UAAU,CACd,OAAe,EACf,MAAc,EACd,IAAc;QAEd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,IAAI,GAAG;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC9C,CAAC"}

package/dist/providers/remote.d.ts

@@ -0,0 +1,52 @@
+import type { SecretsProvider } from "./types.js";
+export type RemoteProviderOptions = {
+    domain?: string;
+    projectSlug: string;
+    /**
+     * Infisical machine-identity id bound to a GitHub OIDC auth method. This is
+     * the only CI auth lane infisicml supports — there is no client-id/secret
+     * fallback.
+     */
+    identityId: string;
+    /**
+     * OIDC audience — must match one of the Infisical machine identity's bound
+     * audiences. There is no universal default, so it is only appended to the
+     * GitHub token request when set. Configure it per repo (see InfisicmlConfig.auth).
+     */
+    oidcAudience?: string;
+    fetchFn?: typeof fetch;
+    getOidcJwt?: () => Promise<string>;
+};
+/**
+ * CI-time provider: talks to the Infisical REST API directly using a machine
+ * identity via GitHub OIDC. No `infisical` CLI, and no long-lived client
+ * secret, in the runner — the runner's short-lived OIDC token is exchanged for
+ * an Infisical access token.
+ */
+export declare class RemoteProvider implements SecretsProvider {
+    private readonly domain;
+    private readonly projectSlug;
+    private readonly identityId;
+    private readonly oidcAudience?;
+    private readonly fetchFn;
+    private readonly getOidcJwt?;
+    private token?;
+    constructor(options: RemoteProviderOptions);
+    exportFolder(envName: string, folder: string): Promise<Record<string, string>>;
+    /**
+     * Fetch only the named keys from a folder via the single-secret raw endpoint
+     * (`GET /api/v3/secrets/raw/{name}`), so the vault transmits nothing beyond
+     * the requested keys — wire-level least privilege. `include_imports=true`
+     * matches {@link exportFolder}, so a key surfaced into this folder via an
+     * Infisical import is still resolved (the single-name endpoint returns only
+     * that one secret, so following imports doesn't widen the read). A 404 means
+     * the key isn't reachable from this folder and is skipped; the caller merges
+     * across folders and enforces genuine absence. The access token is fetched
+     * once and reused across keys.
+     */
+    exportKeys(envName: string, folder: string, keys: string[]): Promise<Record<string, string>>;
+    private getAccessToken;
+    private fetchOidcJwtFromEnv;
+    private fetchWithRetry;
+}
+//# sourceMappingURL=remote.d.ts.map

package/dist/providers/remote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../src/providers/remote.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACpC,CAAC;AAIF;;;;;GAKG;AACH,qBAAa,cAAe,YAAW,eAAe;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAwB;IACpD,OAAO,CAAC,KAAK,CAAC,CAAS;gBAEX,OAAO,EAAE,qBAAqB;IASpC,YAAY,CAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAyClC;;;;;;;;;;OAUG;IACG,UAAU,CACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAuCpB,cAAc;YA4Bd,mBAAmB;YAqBnB,cAAc;CAkC7B"}

package/dist/providers/remote.js

@@ -0,0 +1,166 @@
+import { normalizeEnvSlug } from "../env-slug.js";
+import { normalizeFolderPath } from "../manifest.js";
+/**
+ * CI-time provider: talks to the Infisical REST API directly using a machine
+ * identity via GitHub OIDC. No `infisical` CLI, and no long-lived client
+ * secret, in the runner — the runner's short-lived OIDC token is exchanged for
+ * an Infisical access token.
+ */
+export class RemoteProvider {
+    domain;
+    projectSlug;
+    identityId;
+    oidcAudience;
+    fetchFn;
+    getOidcJwt;
+    token;
+    constructor(options) {
+        this.domain = options.domain ?? "https://app.infisical.com";
+        this.projectSlug = options.projectSlug;
+        this.identityId = options.identityId;
+        this.oidcAudience = options.oidcAudience;
+        this.fetchFn = options.fetchFn ?? fetch;
+        this.getOidcJwt = options.getOidcJwt;
+    }
+    async exportFolder(envName, folder) {
+        const token = await this.getAccessToken();
+        const envSlug = normalizeEnvSlug(envName);
+        const secretPath = normalizeFolderPath(folder);
+        const url = new URL(`${this.domain}/api/v3/secrets/raw`);
+        url.searchParams.set("secretPath", secretPath);
+        url.searchParams.set("environment", envSlug);
+        url.searchParams.set("workspaceSlug", this.projectSlug);
+        url.searchParams.set("include_imports", "true");
+        url.searchParams.set("recursive", "false");
+        url.searchParams.set("expandSecretReferences", "true");
+        const resp = await this.fetchWithRetry(url.toString(), {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        const data = (await resp.json());
+        if (data.message) {
+            throw new Error(`Infisical error for path ${secretPath}: ${data.message}`);
+        }
+        const merged = {};
+        for (const imp of data.imports ?? []) {
+            for (const s of imp.secrets ?? []) {
+                if (s.secretKey)
+                    merged[s.secretKey] = s.secretValue ?? "";
+            }
+        }
+        for (const s of data.secrets ?? []) {
+            if (s.secretKey)
+                merged[s.secretKey] = s.secretValue ?? "";
+        }
+        return merged;
+    }
+    /**
+     * Fetch only the named keys from a folder via the single-secret raw endpoint
+     * (`GET /api/v3/secrets/raw/{name}`), so the vault transmits nothing beyond
+     * the requested keys — wire-level least privilege. `include_imports=true`
+     * matches {@link exportFolder}, so a key surfaced into this folder via an
+     * Infisical import is still resolved (the single-name endpoint returns only
+     * that one secret, so following imports doesn't widen the read). A 404 means
+     * the key isn't reachable from this folder and is skipped; the caller merges
+     * across folders and enforces genuine absence. The access token is fetched
+     * once and reused across keys.
+     */
+    async exportKeys(envName, folder, keys) {
+        const token = await this.getAccessToken();
+        const envSlug = normalizeEnvSlug(envName);
+        const secretPath = normalizeFolderPath(folder);
+        const out = {};
+        for (const key of keys) {
+            const url = new URL(`${this.domain}/api/v3/secrets/raw/${encodeURIComponent(key)}`);
+            url.searchParams.set("secretPath", secretPath);
+            url.searchParams.set("environment", envSlug);
+            url.searchParams.set("workspaceSlug", this.projectSlug);
+            url.searchParams.set("include_imports", "true");
+            url.searchParams.set("expandSecretReferences", "true");
+            const resp = await this.fetchWithRetry(url.toString(), { headers: { Authorization: `Bearer ${token}` } }, 5, true // allow404: a missing key is a non-fatal miss, not an error
+            );
+            if (resp.status === 404)
+                continue;
+            const data = (await resp.json());
+            if (data.message) {
+                throw new Error(`Infisical error for key ${key}: ${data.message}`);
+            }
+            if (data.secret?.secretKey) {
+                out[data.secret.secretKey] = data.secret.secretValue ?? "";
+            }
+        }
+        return out;
+    }
+    async getAccessToken() {
+        if (this.token)
+            return this.token;
+        if (!this.identityId) {
+            throw new Error("INFISICAL_IDENTITY_ID required for OIDC auth");
+        }
+        const jwt = this.getOidcJwt
+            ? await this.getOidcJwt()
+            : await this.fetchOidcJwtFromEnv();
+        const body = new URLSearchParams({ identityId: this.identityId, jwt });
+        const resp = await this.fetchWithRetry(`${this.domain}/api/v1/auth/oidc-auth/login`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body,
+        });
+        const data = (await resp.json());
+        this.token = data.accessToken ?? "";
+        if (!this.token) {
+            throw new Error("Infisical OIDC auth failed: empty access token");
+        }
+        return this.token;
+    }
+    async fetchOidcJwtFromEnv() {
+        const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
+        const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+        if (!requestUrl || !requestToken) {
+            throw new Error("OIDC auth requires ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN");
+        }
+        const url = this.oidcAudience
+            ? `${requestUrl}&audience=${encodeURIComponent(this.oidcAudience)}`
+            : requestUrl;
+        const resp = await this.fetchWithRetry(url, {
+            headers: { Authorization: `bearer ${requestToken}` },
+        });
+        const data = (await resp.json());
+        if (!data.value) {
+            throw new Error("OIDC JWT request returned empty value");
+        }
+        return data.value;
+    }
+    async fetchWithRetry(url, init, maxAttempts = 5, 
+    // When set, a 404 short-circuits: it's returned as-is (not retried, not
+    // thrown) so a per-key read can treat "key not in this folder" as a normal,
+    // non-fatal miss rather than an error.
+    allow404 = false) {
+        let lastError;
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+                const controller = new AbortController();
+                const timeout = setTimeout(() => controller.abort(), 120_000);
+                const resp = await this.fetchFn(url, {
+                    ...init,
+                    signal: controller.signal,
+                });
+                clearTimeout(timeout);
+                if (allow404 && resp.status === 404)
+                    return resp;
+                if (!resp.ok) {
+                    const text = await resp.text();
+                    throw new Error(`HTTP ${resp.status}: ${text}`);
+                }
+                return resp;
+            }
+            catch (err) {
+                lastError = err;
+                if (attempt < maxAttempts) {
+                    await new Promise((r) => setTimeout(r, attempt * 5000));
+                }
+            }
+        }
+        throw lastError;
+    }
+}
+//# sourceMappingURL=remote.js.map

package/dist/providers/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../src/providers/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAwBrD;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IACR,MAAM,CAAS;IACf,WAAW,CAAS;IACpB,UAAU,CAAS;IACnB,YAAY,CAAU;IACtB,OAAO,CAAe;IACtB,UAAU,CAAyB;IAC5C,KAAK,CAAU;IAEvB,YAAY,OAA8B;QACxC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,2BAA2B,CAAC;QAC5D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,OAAe,EACf,MAAc;QAEd,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAE/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,qBAAqB,CAAC,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;QAEvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACrD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAI9B,CAAC;QAEF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,4BAA4B,UAAU,KAAK,IAAI,CAAC,OAAO,EAAE,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC,CAAC,SAAS;oBAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,SAAS;gBAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,UAAU,CACd,OAAe,EACf,MAAc,EACd,IAAc;QAEd,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,GAAG,GAA2B,EAAE,CAAC;QAEvC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,GAAG,IAAI,CAAC,MAAM,uBAAuB,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAC/D,CAAC;YACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CACpC,GAAG,CAAC,QAAQ,EAAE,EACd,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EACjD,CAAC,EACD,IAAI,CAAC,4DAA4D;aAClE,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;gBAAE,SAAS;YAElC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAG9B,CAAC;YACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAElC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU;YACzB,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE;YACzB,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CACpC,GAAG,IAAI,CAAC,MAAM,8BAA8B,EAC5C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,CACF,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA6B,CAAC;QAC7D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QAEpC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;QAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAChE,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY;YAC3B,CAAC,CAAC,GAAG,UAAU,aAAa,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE;YACnE,CAAC,CAAC,UAAU,CAAC;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE;YAC1C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE;SACrD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAuB,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,GAAW,EACX,IAAkB,EAClB,WAAW,GAAG,CAAC;IACf,wEAAwE;IACxE,4EAA4E;IAC5E,uCAAuC;IACvC,QAAQ,GAAG,KAAK;QAEhB,IAAI,SAAkB,CAAC;QACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;gBACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;oBACnC,GAAG,IAAI;oBACP,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBACH,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;gBAClD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,CAAC;gBAChB,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;oBAC1B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,SAAS,CAAC;IAClB,CAAC;CACF"}

package/dist/providers/types.d.ts

@@ -0,0 +1,14 @@
+export interface SecretsProvider {
+    /**
+     * Read every secret in a folder (whole-folder read — `fetch: "folder"`).
+     */
+    exportFolder(envName: string, folder: string): Promise<Record<string, string>>;
+    /**
+     * Read only the named keys from a folder (`fetch: "keys"` — wire-level least
+     * privilege). Keys absent from this folder are omitted from the result, not
+     * an error: a key may live in a different folder, or not exist at all (the
+     * caller's `include` enforcement decides whether absence is fatal).
+     */
+    exportKeys(envName: string, folder: string, keys: string[]): Promise<Record<string, string>>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/providers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/providers/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,YAAY,CACV,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEnC;;;;;OAKG;IACH,UAAU,CACR,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpC"}

package/dist/providers/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/providers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/providers/types.ts"],"names":[],"mappings":""}

package/dist/pull.d.ts

@@ -0,0 +1,15 @@
+import type { SecretsProvider } from "./providers/types.js";
+import type { PackageManifest } from "./registry.js";
+export type PullResult = "pulled" | "skipped";
+export type PullManifestOptions = {
+    manifest: PackageManifest;
+    repoRoot: string;
+    envName: string;
+    profile?: string;
+    force?: boolean;
+    turboMode?: boolean;
+    provider: SecretsProvider;
+};
+export declare function writeInjectedSecretsStub(outputPath: string, manifest: PackageManifest, keys: string[]): void;
+export declare function pullManifest(options: PullManifestOptions): Promise<PullResult>;
+//# sourceMappingURL=pull.d.ts.map

package/dist/pull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../src/pull.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9C,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;CAC3B,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,EAAE,GACb,IAAI,CAgBN;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAkErB"}