@karmaniverous/get-dotenv 5.2.3 → 5.2.4

package/dist/cliHost.cjs

@@ -12,6 +12,13 @@ var dotenv = require('dotenv');
 var crypto = require('crypto');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
+/** src/cliHost/definePlugin.ts
+ * Plugin contracts for the GetDotenv CLI host.
+ *
+ * This module exposes a structural public interface for the host that plugins
+ * should use (GetDotenvCliPublic). Using a structural type at the seam avoids
+ * nominal class identity issues (private fields) in downstream consumers.
+ */
 /**
  * Define a GetDotenv CLI plugin with compositional helpers.
  *

package/dist/cliHost.d.cts

@@ -269,17 +269,41 @@ declare class GetDotenvCli<TOptions extends GetDotenvOptions = GetDotenvOptions>
     private _runAfterResolve;
 }
 
-/** Public plugin contract used by the GetDotenv CLI host. */ interface GetDotenvCliPlugin {
-    id?: string /**
-     * Setup phase: register commands and wiring on the provided CLI instance.   * Runs parent → children (pre-order).
-     */;
-    setup: (cli: GetDotenvCli) => void | Promise<void>;
+/** src/cliHost/definePlugin.ts
+ * Plugin contracts for the GetDotenv CLI host.
+ *
+ * This module exposes a structural public interface for the host that plugins
+ * should use (GetDotenvCliPublic). Using a structural type at the seam avoids
+ * nominal class identity issues (private fields) in downstream consumers.
+ */
+
+/**
+ * Structural public interface for the host exposed to plugins.
+ * - Extends Commander.Command so plugins can attach options/commands/hooks.
+ * - Adds host-specific helpers used by built-in plugins.
+ *
+ * Purpose: remove nominal class identity (private fields) from the plugin seam
+ * to avoid TS2379 under exactOptionalPropertyTypes in downstream consumers.
+ */
+type GetDotenvCliPublic<TOptions extends GetDotenvOptions = GetDotenvOptions> = Command & {
+    ns: (name: string) => Command;
+    getCtx: () => GetDotenvCliCtx<TOptions> | undefined;
+    resolveAndLoad: (customOptions?: Partial<TOptions>) => Promise<GetDotenvCliCtx<TOptions>>;
+};
+/** Public plugin contract used by the GetDotenv CLI host. */
+interface GetDotenvCliPlugin {
+    id?: string;
+    /**
+     * Setup phase: register commands and wiring on the provided CLI instance.
+     * Runs parent → children (pre-order).
+     */
+    setup: (cli: GetDotenvCliPublic) => void | Promise<void>;
     /**
      * After the dotenv context is resolved, initialize any clients/secrets
      * or attach per-plugin state under ctx.plugins (by convention).
      * Runs parent → children (pre-order).
      */
-    afterResolve?: (cli: GetDotenvCli, ctx: GetDotenvCliCtx) => void | Promise<void>;
+    afterResolve?: (cli: GetDotenvCliPublic, ctx: GetDotenvCliCtx) => void | Promise<void>;
     /**
      * Optional Zod schema for this plugin's config slice (from config.plugins[id]).
      * When provided, the host validates the merged config under the guarded loader path.
@@ -287,7 +311,8 @@ declare class GetDotenvCli<TOptions extends GetDotenvOptions = GetDotenvOptions>
     configSchema?: ZodType;
     /**
      * Compositional children. Installed after the parent per pre-order.
-     */ children: GetDotenvCliPlugin[];
+     */
+    children: GetDotenvCliPlugin[];
     /**
      * Compose a child plugin. Returns the parent to enable chaining.
      */
@@ -317,4 +342,4 @@ declare const definePlugin: (spec: DefineSpec) => GetDotenvCliPlugin;
 declare const readMergedOptions: (cmd: Command) => GetDotenvCliOptions | undefined;
 
 export { GetDotenvCli, definePlugin, readMergedOptions };
-export type { DefineSpec, GetDotenvCliCtx, GetDotenvCliOptions, GetDotenvCliPlugin, ScriptsTable };
+export type { DefineSpec, GetDotenvCliCtx, GetDotenvCliOptions, GetDotenvCliPlugin, GetDotenvCliPublic, ScriptsTable };

package/dist/cliHost.d.mts

@@ -269,17 +269,41 @@ declare class GetDotenvCli<TOptions extends GetDotenvOptions = GetDotenvOptions>
     private _runAfterResolve;
 }
 
-/** Public plugin contract used by the GetDotenv CLI host. */ interface GetDotenvCliPlugin {
-    id?: string /**
-     * Setup phase: register commands and wiring on the provided CLI instance.   * Runs parent → children (pre-order).
-     */;
-    setup: (cli: GetDotenvCli) => void | Promise<void>;
+/** src/cliHost/definePlugin.ts
+ * Plugin contracts for the GetDotenv CLI host.
+ *
+ * This module exposes a structural public interface for the host that plugins
+ * should use (GetDotenvCliPublic). Using a structural type at the seam avoids
+ * nominal class identity issues (private fields) in downstream consumers.
+ */
+
+/**
+ * Structural public interface for the host exposed to plugins.
+ * - Extends Commander.Command so plugins can attach options/commands/hooks.
+ * - Adds host-specific helpers used by built-in plugins.
+ *
+ * Purpose: remove nominal class identity (private fields) from the plugin seam
+ * to avoid TS2379 under exactOptionalPropertyTypes in downstream consumers.
+ */
+type GetDotenvCliPublic<TOptions extends GetDotenvOptions = GetDotenvOptions> = Command & {
+    ns: (name: string) => Command;
+    getCtx: () => GetDotenvCliCtx<TOptions> | undefined;
+    resolveAndLoad: (customOptions?: Partial<TOptions>) => Promise<GetDotenvCliCtx<TOptions>>;
+};
+/** Public plugin contract used by the GetDotenv CLI host. */
+interface GetDotenvCliPlugin {
+    id?: string;
+    /**
+     * Setup phase: register commands and wiring on the provided CLI instance.
+     * Runs parent → children (pre-order).
+     */
+    setup: (cli: GetDotenvCliPublic) => void | Promise<void>;
     /**
      * After the dotenv context is resolved, initialize any clients/secrets
      * or attach per-plugin state under ctx.plugins (by convention).
      * Runs parent → children (pre-order).
      */
-    afterResolve?: (cli: GetDotenvCli, ctx: GetDotenvCliCtx) => void | Promise<void>;
+    afterResolve?: (cli: GetDotenvCliPublic, ctx: GetDotenvCliCtx) => void | Promise<void>;
     /**
      * Optional Zod schema for this plugin's config slice (from config.plugins[id]).
      * When provided, the host validates the merged config under the guarded loader path.
@@ -287,7 +311,8 @@ declare class GetDotenvCli<TOptions extends GetDotenvOptions = GetDotenvOptions>
     configSchema?: ZodType;
     /**
      * Compositional children. Installed after the parent per pre-order.
-     */ children: GetDotenvCliPlugin[];
+     */
+    children: GetDotenvCliPlugin[];
     /**
      * Compose a child plugin. Returns the parent to enable chaining.
      */
@@ -317,4 +342,4 @@ declare const definePlugin: (spec: DefineSpec) => GetDotenvCliPlugin;
 declare const readMergedOptions: (cmd: Command) => GetDotenvCliOptions | undefined;
 
 export { GetDotenvCli, definePlugin, readMergedOptions };
-export type { DefineSpec, GetDotenvCliCtx, GetDotenvCliOptions, GetDotenvCliPlugin, ScriptsTable };
+export type { DefineSpec, GetDotenvCliCtx, GetDotenvCliOptions, GetDotenvCliPlugin, GetDotenvCliPublic, ScriptsTable };

package/dist/cliHost.d.ts

@@ -269,17 +269,41 @@ declare class GetDotenvCli<TOptions extends GetDotenvOptions = GetDotenvOptions>
     private _runAfterResolve;
 }
 
-/** Public plugin contract used by the GetDotenv CLI host. */ interface GetDotenvCliPlugin {
-    id?: string /**
-     * Setup phase: register commands and wiring on the provided CLI instance.   * Runs parent → children (pre-order).
-     */;
-    setup: (cli: GetDotenvCli) => void | Promise<void>;
+/** src/cliHost/definePlugin.ts
+ * Plugin contracts for the GetDotenv CLI host.
+ *
+ * This module exposes a structural public interface for the host that plugins
+ * should use (GetDotenvCliPublic). Using a structural type at the seam avoids
+ * nominal class identity issues (private fields) in downstream consumers.
+ */
+
+/**
+ * Structural public interface for the host exposed to plugins.
+ * - Extends Commander.Command so plugins can attach options/commands/hooks.
+ * - Adds host-specific helpers used by built-in plugins.
+ *
+ * Purpose: remove nominal class identity (private fields) from the plugin seam
+ * to avoid TS2379 under exactOptionalPropertyTypes in downstream consumers.
+ */
+type GetDotenvCliPublic<TOptions extends GetDotenvOptions = GetDotenvOptions> = Command & {
+    ns: (name: string) => Command;
+    getCtx: () => GetDotenvCliCtx<TOptions> | undefined;
+    resolveAndLoad: (customOptions?: Partial<TOptions>) => Promise<GetDotenvCliCtx<TOptions>>;
+};
+/** Public plugin contract used by the GetDotenv CLI host. */
+interface GetDotenvCliPlugin {
+    id?: string;
+    /**
+     * Setup phase: register commands and wiring on the provided CLI instance.
+     * Runs parent → children (pre-order).
+     */
+    setup: (cli: GetDotenvCliPublic) => void | Promise<void>;
     /**
      * After the dotenv context is resolved, initialize any clients/secrets
      * or attach per-plugin state under ctx.plugins (by convention).
      * Runs parent → children (pre-order).
      */
-    afterResolve?: (cli: GetDotenvCli, ctx: GetDotenvCliCtx) => void | Promise<void>;
+    afterResolve?: (cli: GetDotenvCliPublic, ctx: GetDotenvCliCtx) => void | Promise<void>;
     /**
      * Optional Zod schema for this plugin's config slice (from config.plugins[id]).
      * When provided, the host validates the merged config under the guarded loader path.
@@ -287,7 +311,8 @@ declare class GetDotenvCli<TOptions extends GetDotenvOptions = GetDotenvOptions>
     configSchema?: ZodType;
     /**
      * Compositional children. Installed after the parent per pre-order.
-     */ children: GetDotenvCliPlugin[];
+     */
+    children: GetDotenvCliPlugin[];
     /**
      * Compose a child plugin. Returns the parent to enable chaining.
      */
@@ -317,4 +342,4 @@ declare const definePlugin: (spec: DefineSpec) => GetDotenvCliPlugin;
 declare const readMergedOptions: (cmd: Command) => GetDotenvCliOptions | undefined;
 
 export { GetDotenvCli, definePlugin, readMergedOptions };
-export type { DefineSpec, GetDotenvCliCtx, GetDotenvCliOptions, GetDotenvCliPlugin, ScriptsTable };
+export type { DefineSpec, GetDotenvCliCtx, GetDotenvCliOptions, GetDotenvCliPlugin, GetDotenvCliPublic, ScriptsTable };

package/dist/cliHost.mjs

@@ -9,6 +9,13 @@ import { nanoid } from 'nanoid';
 import { parse } from 'dotenv';
 import { createHash } from 'crypto';
 
+/** src/cliHost/definePlugin.ts
+ * Plugin contracts for the GetDotenv CLI host.
+ *
+ * This module exposes a structural public interface for the host that plugins
+ * should use (GetDotenvCliPublic). Using a structural type at the seam avoids
+ * nominal class identity issues (private fields) in downstream consumers.
+ */
 /**
  * Define a GetDotenv CLI plugin with compositional helpers.
  *

package/dist/getdotenv.cli.mjs

@@ -2066,6 +2066,13 @@ const buildSpawnEnv = (base, overlay) => {
     return out;
 };
 
+/** src/cliHost/definePlugin.ts
+ * Plugin contracts for the GetDotenv CLI host.
+ *
+ * This module exposes a structural public interface for the host that plugins
+ * should use (GetDotenvCliPublic). Using a structural type at the seam avoids
+ * nominal class identity issues (private fields) in downstream consumers.
+ */
 /**
  * Define a GetDotenv CLI plugin with compositional helpers.
  *
@@ -3202,11 +3209,8 @@ const cmdPlugin = (options = {}) => definePlugin({
             const { logger: _omit, ...envBag } = merged;
             const capture = process.env.GETDOTENV_STDIO === 'pipe' ||
                 Boolean(merged.capture);
-            // Prefer explicit env injection: pass the resolved dotenv map to the child.
-            // This avoids leaking prior secrets from the parent process.env when
-            // exclusions (e.g., --exclude-private) are in effect.
-            const host = cli;
-            const ctx = host.getCtx();
+            // Prefer explicit env injection using the resolved dotenv map.
+            const ctx = cli.getCtx();
             const dotenv = (ctx?.dotenv ?? {});
             // Diagnostics: --trace [keys...] (space-delimited keys if provided; all keys when true)
             const traceOpt = merged.trace;

package/dist/index.cjs

@@ -2075,6 +2075,13 @@ const buildSpawnEnv = (base, overlay) => {
     return out;
 };
 
+/** src/cliHost/definePlugin.ts
+ * Plugin contracts for the GetDotenv CLI host.
+ *
+ * This module exposes a structural public interface for the host that plugins
+ * should use (GetDotenvCliPublic). Using a structural type at the seam avoids
+ * nominal class identity issues (private fields) in downstream consumers.
+ */
 /**
  * Define a GetDotenv CLI plugin with compositional helpers.
  *
@@ -3211,11 +3218,8 @@ const cmdPlugin = (options = {}) => definePlugin({
             const { logger: _omit, ...envBag } = merged;
             const capture = process.env.GETDOTENV_STDIO === 'pipe' ||
                 Boolean(merged.capture);
-            // Prefer explicit env injection: pass the resolved dotenv map to the child.
-            // This avoids leaking prior secrets from the parent process.env when
-            // exclusions (e.g., --exclude-private) are in effect.
-            const host = cli;
-            const ctx = host.getCtx();
+            // Prefer explicit env injection using the resolved dotenv map.
+            const ctx = cli.getCtx();
             const dotenv = (ctx?.dotenv ?? {});
             // Diagnostics: --trace [keys...] (space-delimited keys if provided; all keys when true)
             const traceOpt = merged.trace;
@@ -4108,6 +4112,7 @@ function createCli(opts = {}) {
     };
 }
 
+exports.buildSpawnEnv = buildSpawnEnv;
 exports.createCli = createCli;
 exports.defineDynamic = defineDynamic;
 exports.dotenvExpand = dotenvExpand;

package/dist/index.d.cts

@@ -70,6 +70,24 @@ declare module '../cliHost/GetDotenvCli' {
     }
 }
 
+/** src/cliCore/spawnEnv.ts
+ * Build a sanitized environment bag for child processes.
+ *
+ * Requirements addressed:
+ * - Provide a single helper (buildSpawnEnv) to normalize/dedupe child env.
+ * - Drop undefined values (exactOptional semantics).
+ * - On Windows, dedupe keys case-insensitively and prefer the last value,
+ *   preserving the latest key's casing. Ensure HOME fallback from USERPROFILE.
+ *   Normalize TMP/TEMP consistency when either is present.
+ * - On POSIX, keep keys as-is; when a temp dir key is present (TMPDIR/TMP/TEMP),
+ *   ensure TMPDIR exists for downstream consumers that expect it.
+ *
+ * Adapter responsibility: pure mapping; no business logic.
+ */
+type SpawnEnv = Readonly<Partial<Record<string, string>>>;
+/** Build a sanitized env for child processes from base + overlay. */
+declare const buildSpawnEnv: (base?: NodeJS.ProcessEnv, overlay?: Record<string, string | undefined>) => SpawnEnv;
+
 type RootOptionsShapeCompat = Omit<RootOptionsShape, 'vars' | 'paths'> & {
     vars?: string | Record<string, string | undefined>;
     paths?: string | string[];
@@ -456,5 +474,5 @@ declare function createCli(opts?: CreateCliOptions): {
     run: (argv: string[]) => Promise<void>;
 };
 
-export { createCli, defineDynamic, dotenvExpand, dotenvExpandAll, dotenvExpandFromProcessEnv, generateGetDotenvCli, getDotenv, getDotenvCliOptions2Options, interpolateDeep };
+export { buildSpawnEnv, createCli, defineDynamic, dotenvExpand, dotenvExpandAll, dotenvExpandFromProcessEnv, generateGetDotenvCli, getDotenv, getDotenvCliOptions2Options, interpolateDeep };
 export type { CreateCliOptions, GetDotenvDynamic, GetDotenvOptions, ProcessEnv };

package/dist/index.d.mts

@@ -70,6 +70,24 @@ declare module '../cliHost/GetDotenvCli' {
     }
 }
 
+/** src/cliCore/spawnEnv.ts
+ * Build a sanitized environment bag for child processes.
+ *
+ * Requirements addressed:
+ * - Provide a single helper (buildSpawnEnv) to normalize/dedupe child env.
+ * - Drop undefined values (exactOptional semantics).
+ * - On Windows, dedupe keys case-insensitively and prefer the last value,
+ *   preserving the latest key's casing. Ensure HOME fallback from USERPROFILE.
+ *   Normalize TMP/TEMP consistency when either is present.
+ * - On POSIX, keep keys as-is; when a temp dir key is present (TMPDIR/TMP/TEMP),
+ *   ensure TMPDIR exists for downstream consumers that expect it.
+ *
+ * Adapter responsibility: pure mapping; no business logic.
+ */
+type SpawnEnv = Readonly<Partial<Record<string, string>>>;
+/** Build a sanitized env for child processes from base + overlay. */
+declare const buildSpawnEnv: (base?: NodeJS.ProcessEnv, overlay?: Record<string, string | undefined>) => SpawnEnv;
+
 type RootOptionsShapeCompat = Omit<RootOptionsShape, 'vars' | 'paths'> & {
     vars?: string | Record<string, string | undefined>;
     paths?: string | string[];
@@ -456,5 +474,5 @@ declare function createCli(opts?: CreateCliOptions): {
     run: (argv: string[]) => Promise<void>;
 };
 
-export { createCli, defineDynamic, dotenvExpand, dotenvExpandAll, dotenvExpandFromProcessEnv, generateGetDotenvCli, getDotenv, getDotenvCliOptions2Options, interpolateDeep };
+export { buildSpawnEnv, createCli, defineDynamic, dotenvExpand, dotenvExpandAll, dotenvExpandFromProcessEnv, generateGetDotenvCli, getDotenv, getDotenvCliOptions2Options, interpolateDeep };
 export type { CreateCliOptions, GetDotenvDynamic, GetDotenvOptions, ProcessEnv };

package/dist/index.d.ts

@@ -70,6 +70,24 @@ declare module '../cliHost/GetDotenvCli' {
     }
 }
 
+/** src/cliCore/spawnEnv.ts
+ * Build a sanitized environment bag for child processes.
+ *
+ * Requirements addressed:
+ * - Provide a single helper (buildSpawnEnv) to normalize/dedupe child env.
+ * - Drop undefined values (exactOptional semantics).
+ * - On Windows, dedupe keys case-insensitively and prefer the last value,
+ *   preserving the latest key's casing. Ensure HOME fallback from USERPROFILE.
+ *   Normalize TMP/TEMP consistency when either is present.
+ * - On POSIX, keep keys as-is; when a temp dir key is present (TMPDIR/TMP/TEMP),
+ *   ensure TMPDIR exists for downstream consumers that expect it.
+ *
+ * Adapter responsibility: pure mapping; no business logic.
+ */
+type SpawnEnv = Readonly<Partial<Record<string, string>>>;
+/** Build a sanitized env for child processes from base + overlay. */
+declare const buildSpawnEnv: (base?: NodeJS.ProcessEnv, overlay?: Record<string, string | undefined>) => SpawnEnv;
+
 type RootOptionsShapeCompat = Omit<RootOptionsShape, 'vars' | 'paths'> & {
     vars?: string | Record<string, string | undefined>;
     paths?: string | string[];
@@ -456,5 +474,5 @@ declare function createCli(opts?: CreateCliOptions): {
     run: (argv: string[]) => Promise<void>;
 };
 
-export { createCli, defineDynamic, dotenvExpand, dotenvExpandAll, dotenvExpandFromProcessEnv, generateGetDotenvCli, getDotenv, getDotenvCliOptions2Options, interpolateDeep };
+export { buildSpawnEnv, createCli, defineDynamic, dotenvExpand, dotenvExpandAll, dotenvExpandFromProcessEnv, generateGetDotenvCli, getDotenv, getDotenvCliOptions2Options, interpolateDeep };
 export type { CreateCliOptions, GetDotenvDynamic, GetDotenvOptions, ProcessEnv };

package/dist/index.mjs

@@ -2072,6 +2072,13 @@ const buildSpawnEnv = (base, overlay) => {
     return out;
 };
 
+/** src/cliHost/definePlugin.ts
+ * Plugin contracts for the GetDotenv CLI host.
+ *
+ * This module exposes a structural public interface for the host that plugins
+ * should use (GetDotenvCliPublic). Using a structural type at the seam avoids
+ * nominal class identity issues (private fields) in downstream consumers.
+ */
 /**
  * Define a GetDotenv CLI plugin with compositional helpers.
  *
@@ -3208,11 +3215,8 @@ const cmdPlugin = (options = {}) => definePlugin({
             const { logger: _omit, ...envBag } = merged;
             const capture = process.env.GETDOTENV_STDIO === 'pipe' ||
                 Boolean(merged.capture);
-            // Prefer explicit env injection: pass the resolved dotenv map to the child.
-            // This avoids leaking prior secrets from the parent process.env when
-            // exclusions (e.g., --exclude-private) are in effect.
-            const host = cli;
-            const ctx = host.getCtx();
+            // Prefer explicit env injection using the resolved dotenv map.
+            const ctx = cli.getCtx();
             const dotenv = (ctx?.dotenv ?? {});
             // Diagnostics: --trace [keys...] (space-delimited keys if provided; all keys when true)
             const traceOpt = merged.trace;
@@ -4105,4 +4109,4 @@ function createCli(opts = {}) {
     };
 }
 
-export { createCli, defineDynamic, dotenvExpand, dotenvExpandAll, dotenvExpandFromProcessEnv, generateGetDotenvCli, getDotenv, getDotenvCliOptions2Options, interpolateDeep };
+export { buildSpawnEnv, createCli, defineDynamic, dotenvExpand, dotenvExpandAll, dotenvExpandFromProcessEnv, generateGetDotenvCli, getDotenv, getDotenvCliOptions2Options, interpolateDeep };

package/dist/plugins-aws.cjs

@@ -236,6 +236,13 @@ const buildSpawnEnv = (base, overlay) => {
     return out;
 };
 
+/** src/cliHost/definePlugin.ts
+ * Plugin contracts for the GetDotenv CLI host.
+ *
+ * This module exposes a structural public interface for the host that plugins
+ * should use (GetDotenvCliPublic). Using a structural type at the seam avoids
+ * nominal class identity issues (private fields) in downstream consumers.
+ */
 /**
  * Define a GetDotenv CLI plugin with compositional helpers.
  *

package/dist/plugins-aws.d.cts

@@ -1,5 +1,5 @@
-import { ZodType } from 'zod';
 import { Command } from 'commander';
+import { ZodType } from 'zod';
 
 /**
  * A minimal representation of an environment key/value mapping.
@@ -95,93 +95,6 @@ interface GetDotenvOptions {
     useConfigLoader?: boolean;
 }
 
-type Scripts = Record<string, string | {
-    cmd: string;
-    shell?: string | boolean;
-}>;
-/**
- * Options passed programmatically to `getDotenvCli`.
- */
-interface GetDotenvCliOptions extends Omit<GetDotenvOptions, 'paths' | 'vars'> {
-    /**
-     * Logs CLI internals when true.
-     */
-    debug?: boolean;
-    /**
-     * Strict mode: fail the run when env validation issues are detected
-     * (schema or requiredKeys). Warns by default when false or unset.
-     */
-    strict?: boolean;
-    /**
-     * Redaction (presentation): mask secret-like values in logs/trace.
-     */
-    redact?: boolean;
-    /**
-     * Entropy warnings (presentation): emit once-per-key warnings for high-entropy values.
-     */
-    warnEntropy?: boolean;
-    entropyThreshold?: number;
-    entropyMinLength?: number;
-    entropyWhitelist?: string[];
-    redactPatterns?: string[];
-    /**
-     * When true, capture child stdout/stderr and re-emit after completion.
-     * Useful for tests/CI. Default behavior is streaming via stdio: 'inherit'.
-     */
-    capture?: boolean;
-    /**
-     * A delimited string of paths to dotenv files.
-     */
-    paths?: string;
-    /**
-     * A delimiter string with which to split `paths`. Only used if
-     * `pathsDelimiterPattern` is not provided.
-     */
-    pathsDelimiter?: string;
-    /**
-     * A regular expression pattern with which to split `paths`. Supersedes
-     * `pathsDelimiter`.
-     */
-    pathsDelimiterPattern?: string;
-    /**
-     * Scripts that can be executed from the CLI, either individually or via the batch subcommand.
-     */
-    scripts?: Scripts;
-    /**
-     * Determines how commands and scripts are executed. If `false` or
-     * `undefined`, commands are executed as plain Javascript using the default
-     * execa parser. If `true`, commands are executed using the default OS shell
-     * parser. Otherwise the user may provide a specific shell string (e.g.
-     * `/bin/bash`)
-     */
-    shell?: string | boolean;
-    /**
-     * A delimited string of key-value pairs declaratively specifying variables &
-     * values to be loaded in addition to any dotenv files.
-     */
-    vars?: string;
-    /**
-     * A string with which to split keys from values in `vars`. Only used if
-     * `varsDelimiterPattern` is not provided.
-     */
-    varsAssignor?: string;
-    /**
-     * A regular expression pattern with which to split variable names from values
-     * in `vars`. Supersedes `varsAssignor`.
-     */
-    varsAssignorPattern?: string;
-    /**
-     * A string with which to split `vars` into key-value pairs. Only used if
-     * `varsDelimiterPattern` is not provided.
-     */
-    varsDelimiter?: string;
-    /**
-     * A regular expression pattern with which to split `vars` into key-value
-     * pairs. Supersedes `varsDelimiter`.
-     */
-    varsDelimiterPattern?: string;
-}
-
 /** * Per-invocation context shared with plugins and actions. */
 type GetDotenvCliCtx<TOptions extends GetDotenvOptions = GetDotenvOptions> = {
     optionsResolved: TOptions;
@@ -189,89 +102,42 @@ type GetDotenvCliCtx<TOptions extends GetDotenvOptions = GetDotenvOptions> = {
     plugins?: Record<string, unknown>;
     pluginConfigs?: Record<string, unknown>;
 };
-declare const HELP_HEADER_SYMBOL: unique symbol;
-/**
- * Plugin-first CLI host for get-dotenv. Extends Commander.Command.
+
+/** src/cliHost/definePlugin.ts
+ * Plugin contracts for the GetDotenv CLI host.
  *
- * Responsibilities:
- * - Resolve options strictly and compute dotenv context (resolveAndLoad).
- * - Expose a stable accessor for the current context (getCtx).
- * - Provide a namespacing helper (ns).
- * - Support composable plugins with parent → children install and afterResolve.
+ * This module exposes a structural public interface for the host that plugins
+ * should use (GetDotenvCliPublic). Using a structural type at the seam avoids
+ * nominal class identity issues (private fields) in downstream consumers.
+ */
+
+/**
+ * Structural public interface for the host exposed to plugins.
+ * - Extends Commander.Command so plugins can attach options/commands/hooks.
+ * - Adds host-specific helpers used by built-in plugins.
  *
- * NOTE: This host is additive and does not alter the legacy CLI.
+ * Purpose: remove nominal class identity (private fields) from the plugin seam
+ * to avoid TS2379 under exactOptionalPropertyTypes in downstream consumers.
  */
-declare class GetDotenvCli<TOptions extends GetDotenvOptions = GetDotenvOptions> extends Command {
-    #private;
-    /** Registered top-level plugins (composition happens via .use()) */
-    private _plugins;
-    /** One-time installation guard */
-    private _installed;
-    /** Optional header line to prepend in help output */
-    private [HELP_HEADER_SYMBOL];
-    constructor(alias?: string);
-    /**
-     * Resolve options (strict) and compute dotenv context.   * Stores the context on the instance under a symbol.
-     */
-    resolveAndLoad(customOptions?: Partial<TOptions>): Promise<GetDotenvCliCtx<TOptions>>;
-    /**
-     * Retrieve the current invocation context (if any).
-     */
-    getCtx(): GetDotenvCliCtx<TOptions> | undefined;
-    /**
-     * Retrieve the merged root CLI options bag (if set by passOptions()).
-     * Downstream-safe: no generics required.
-     */
-    getOptions(): GetDotenvCliOptions | undefined;
-    /** Internal: set the merged root options bag for this run. */
-    _setOptionsBag(bag: GetDotenvCliOptions): void;
-    /**   * Convenience helper to create a namespaced subcommand.
-     */
-    ns(name: string): Command;
-    /**
-     * Tag options added during the provided callback as 'app' for grouped help.
-     * Allows downstream apps to demarcate their root-level options.
-     */
-    tagAppOptions<T>(fn: (root: Command) => T): T;
-    /**
-     * Branding helper: set CLI name/description/version and optional help header.
-     * If version is omitted and importMetaUrl is provided, attempts to read the
-     * nearest package.json version (best-effort; non-fatal on failure).
-     */
-    brand(args: {
-        name?: string;
-        description?: string;
-        version?: string;
-        importMetaUrl?: string;
-        helpHeader?: string;
-    }): Promise<this>;
-    /**
-     * Register a plugin for installation (parent level).
-     * Installation occurs on first resolveAndLoad() (or explicit install()).
-     */
-    use(plugin: GetDotenvCliPlugin): this;
+type GetDotenvCliPublic<TOptions extends GetDotenvOptions = GetDotenvOptions> = Command & {
+    ns: (name: string) => Command;
+    getCtx: () => GetDotenvCliCtx<TOptions> | undefined;
+    resolveAndLoad: (customOptions?: Partial<TOptions>) => Promise<GetDotenvCliCtx<TOptions>>;
+};
+/** Public plugin contract used by the GetDotenv CLI host. */
+interface GetDotenvCliPlugin {
+    id?: string;
     /**
-     * Install all registered plugins in parent → children (pre-order).
-     * Runs only once per CLI instance.
+     * Setup phase: register commands and wiring on the provided CLI instance.
+     * Runs parent → children (pre-order).
      */
-    install(): Promise<void>;
-    /**
-     * Run afterResolve hooks for all plugins (parent → children).
-     */
-    private _runAfterResolve;
-}
-
-/** Public plugin contract used by the GetDotenv CLI host. */ interface GetDotenvCliPlugin {
-    id?: string /**
-     * Setup phase: register commands and wiring on the provided CLI instance.   * Runs parent → children (pre-order).
-     */;
-    setup: (cli: GetDotenvCli) => void | Promise<void>;
+    setup: (cli: GetDotenvCliPublic) => void | Promise<void>;
     /**
      * After the dotenv context is resolved, initialize any clients/secrets
      * or attach per-plugin state under ctx.plugins (by convention).
      * Runs parent → children (pre-order).
      */
-    afterResolve?: (cli: GetDotenvCli, ctx: GetDotenvCliCtx) => void | Promise<void>;
+    afterResolve?: (cli: GetDotenvCliPublic, ctx: GetDotenvCliCtx) => void | Promise<void>;
     /**
      * Optional Zod schema for this plugin's config slice (from config.plugins[id]).
      * When provided, the host validates the merged config under the guarded loader path.
@@ -279,7 +145,8 @@ declare class GetDotenvCli<TOptions extends GetDotenvOptions = GetDotenvOptions>
     configSchema?: ZodType;
     /**
      * Compositional children. Installed after the parent per pre-order.
-     */ children: GetDotenvCliPlugin[];
+     */
+    children: GetDotenvCliPlugin[];
     /**
      * Compose a child plugin. Returns the parent to enable chaining.
      */