@karmaniverous/get-dotenv 6.2.4 → 6.4.0

package/dist/cli.d.ts

@@ -1,6 +1,218 @@
 import { z, ZodObject } from 'zod';
 import { OptionValues, Command, InferCommandArguments, Option, CommandUnknownOpts } from '@commander-js/extra-typings';
 
+/**
+ * Dotenv provenance model (descriptor-only).
+ *
+ * Requirements addressed:
+ * - Host ctx carries a dotenv provenance mapping describing per-key origin and override history.
+ * - Provenance is descriptor-only (no value payloads).
+ * - Provenance is an ordered stack per key in ascending precedence; the last entry is effective.
+ * - Explicit unsets are represented as `op: 'unset'` without requiring deletion of keys from the env map.
+ */
+/**
+ * Provenance kind for an entry in {@link DotenvProvenance}.
+ *
+ * @public
+ */
+type DotenvProvenanceKind = 'file' | 'config' | 'vars' | 'dynamic';
+/**
+ * Operation represented by a provenance entry.
+ *
+ * @public
+ */
+type DotenvProvenanceOp = 'set' | 'unset';
+/**
+ * Base shape for all provenance entries.
+ *
+ * @public
+ */
+interface DotenvProvenanceEntryBase {
+    /**
+     * The kind of provenance entry.
+     */
+    kind: DotenvProvenanceKind;
+    /**
+     * The operation applied at this layer.
+     */
+    op: DotenvProvenanceOp;
+}
+/**
+ * Provenance entry representing a value sourced from a dotenv file in the cascade.
+ *
+ * @public
+ */
+interface DotenvFileProvenanceEntry extends DotenvProvenanceEntryBase {
+    /** Discriminator. */
+    kind: 'file';
+    /** Global vs env-scoped file. */
+    scope: 'global' | 'env';
+    /** Public vs private file. */
+    privacy: 'public' | 'private';
+    /** Environment name (required when scope is `env`). */
+    env?: string;
+    /**
+     * The corresponding `paths[]` entry as provided by the caller/CLI.
+     * This is not an absolute path by policy.
+     */
+    path: string;
+    /**
+     * The computed dotenv filename token (e.g., `.env`, `.env.dev`, `.env.local`, `.env.dev.local`).
+     */
+    file: string;
+}
+/**
+ * Provenance entry representing a value sourced from config overlays (`vars` / `envVars`).
+ *
+ * @public
+ */
+interface DotenvConfigProvenanceEntry extends DotenvProvenanceEntryBase {
+    /** Discriminator. */
+    kind: 'config';
+    /** Global vs env-scoped config slice. */
+    scope: 'global' | 'env';
+    /** Public vs private on the privacy axis (`local` config maps to `private`). */
+    privacy: 'public' | 'private';
+    /** Environment name (required when scope is `env`). */
+    env?: string;
+    /** Packaged vs project config origin. */
+    configScope: 'packaged' | 'project';
+    /** Public vs local config file. */
+    configPrivacy: 'public' | 'local';
+}
+/**
+ * Provenance entry representing explicit variables overrides.
+ *
+ * Notes:
+ * - This kind represents values injected via `vars` (CLI/programmatic), not dotenv files.
+ *
+ * @public
+ */
+interface DotenvVarsProvenanceEntry extends DotenvProvenanceEntryBase {
+    /** Discriminator. */
+    kind: 'vars';
+}
+/**
+ * Source tier for dynamic variables.
+ *
+ * @public
+ */
+type DotenvDynamicSource = 'config' | 'programmatic' | 'dynamicPath';
+/**
+ * Provenance entry representing dynamic variables.
+ *
+ * @public
+ */
+interface DotenvDynamicProvenanceEntry extends DotenvProvenanceEntryBase {
+    /** Discriminator. */
+    kind: 'dynamic';
+    /** Dynamic source tier. */
+    dynamicSource: DotenvDynamicSource;
+    /**
+     * The `dynamicPath` value as provided by the caller/CLI when `dynamicSource` is `dynamicPath`.
+     * This is not resolved to an absolute path by provenance policy.
+     */
+    dynamicPath?: string;
+}
+/**
+ * Union of all supported provenance entry shapes.
+ *
+ * @public
+ */
+type DotenvProvenanceEntry = DotenvFileProvenanceEntry | DotenvConfigProvenanceEntry | DotenvVarsProvenanceEntry | DotenvDynamicProvenanceEntry;
+/**
+ * Per-key provenance history.
+ *
+ * Each key maps to an array of entries ordered in ascending precedence (lower to higher).
+ *
+ * @public
+ */
+type DotenvProvenance = Record<string, DotenvProvenanceEntry[]>;
+
+/**
+ * Resolved CLI options schema.
+ * For the current step this mirrors the RAW schema; later stages may further
+ * narrow types post-resolution in the host pipeline.
+ */
+/**
+ * CLI options schema (resolved).
+ *
+ * Today this mirrors {@link getDotenvCliOptionsSchemaRaw}, but is kept as a distinct export
+ * so future resolution steps can narrow or materialize defaults without breaking the API.
+ *
+ * @public
+ */
+declare const getDotenvCliOptionsSchemaResolved: z.ZodObject<{
+    defaultEnv: z.ZodOptional<z.ZodString>;
+    dotenvToken: z.ZodOptional<z.ZodString>;
+    dynamicPath: z.ZodOptional<z.ZodString>;
+    dynamic: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    env: z.ZodOptional<z.ZodString>;
+    excludeDynamic: z.ZodOptional<z.ZodBoolean>;
+    excludeEnv: z.ZodOptional<z.ZodBoolean>;
+    excludeGlobal: z.ZodOptional<z.ZodBoolean>;
+    excludePrivate: z.ZodOptional<z.ZodBoolean>;
+    excludePublic: z.ZodOptional<z.ZodBoolean>;
+    loadProcess: z.ZodOptional<z.ZodBoolean>;
+    log: z.ZodOptional<z.ZodBoolean>;
+    logger: z.ZodDefault<z.ZodUnknown>;
+    outputPath: z.ZodOptional<z.ZodString>;
+    privateToken: z.ZodOptional<z.ZodString>;
+    debug: z.ZodOptional<z.ZodBoolean>;
+    strict: z.ZodOptional<z.ZodBoolean>;
+    capture: z.ZodOptional<z.ZodBoolean>;
+    trace: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+    redact: z.ZodOptional<z.ZodBoolean>;
+    warnEntropy: z.ZodOptional<z.ZodBoolean>;
+    entropyThreshold: z.ZodOptional<z.ZodNumber>;
+    entropyMinLength: z.ZodOptional<z.ZodNumber>;
+    entropyWhitelist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    redactPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    paths: z.ZodOptional<z.ZodString>;
+    pathsDelimiter: z.ZodOptional<z.ZodString>;
+    pathsDelimiterPattern: z.ZodOptional<z.ZodString>;
+    scripts: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    shell: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>;
+    vars: z.ZodOptional<z.ZodString>;
+    varsAssignor: z.ZodOptional<z.ZodString>;
+    varsAssignorPattern: z.ZodOptional<z.ZodString>;
+    varsDelimiter: z.ZodOptional<z.ZodString>;
+    varsDelimiterPattern: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+/**
+ * Resolved programmatic options schema (post-inheritance).
+ * For now, this mirrors the RAW schema; future stages may materialize defaults
+ * and narrow shapes as resolution is wired into the host.
+ */
+/**
+ * Programmatic options schema (resolved).
+ *
+ * Today this mirrors {@link getDotenvOptionsSchemaRaw}, but is kept as a distinct export
+ * so future resolution steps can narrow or materialize defaults without breaking the API.
+ *
+ * @public
+ */
+declare const getDotenvOptionsSchemaResolved: z.ZodObject<{
+    defaultEnv: z.ZodOptional<z.ZodString>;
+    dotenvToken: z.ZodOptional<z.ZodString>;
+    dynamicPath: z.ZodOptional<z.ZodString>;
+    dynamic: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    env: z.ZodOptional<z.ZodString>;
+    excludeDynamic: z.ZodOptional<z.ZodBoolean>;
+    excludeEnv: z.ZodOptional<z.ZodBoolean>;
+    excludeGlobal: z.ZodOptional<z.ZodBoolean>;
+    excludePrivate: z.ZodOptional<z.ZodBoolean>;
+    excludePublic: z.ZodOptional<z.ZodBoolean>;
+    loadProcess: z.ZodOptional<z.ZodBoolean>;
+    log: z.ZodOptional<z.ZodBoolean>;
+    logger: z.ZodDefault<z.ZodUnknown>;
+    outputPath: z.ZodOptional<z.ZodString>;
+    paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    privateToken: z.ZodOptional<z.ZodString>;
+    vars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
+}, z.core.$strip>;
+
 /**
  * Minimal root options shape shared by CLI and generator layers.
  * Keep keys optional to respect exactOptionalPropertyTypes semantics.
@@ -115,6 +327,12 @@ interface GetDotenvCliCtx<TOptions extends GetDotenvOptions = GetDotenvOptions>
      * Final composed dotenv environment for this invocation.
      */
     dotenv: ProcessEnv;
+    /**
+     * Dotenv provenance history for {@link GetDotenvCliCtx.dotenv}.
+     *
+     * Descriptor-only: does not include value payloads.
+     */
+    dotenvProvenance: DotenvProvenance;
     /**
      * Optional runtime plugin state bag. Plugins may publish non-sensitive metadata here.
      */
@@ -142,90 +360,6 @@ interface BrandOptions {
     helpHeader?: string;
 }
 
-/**
- * Resolved CLI options schema.
- * For the current step this mirrors the RAW schema; later stages may further
- * narrow types post-resolution in the host pipeline.
- */
-/**
- * CLI options schema (resolved).
- *
- * Today this mirrors {@link getDotenvCliOptionsSchemaRaw}, but is kept as a distinct export
- * so future resolution steps can narrow or materialize defaults without breaking the API.
- *
- * @public
- */
-declare const getDotenvCliOptionsSchemaResolved: z.ZodObject<{
-    defaultEnv: z.ZodOptional<z.ZodString>;
-    dotenvToken: z.ZodOptional<z.ZodString>;
-    dynamicPath: z.ZodOptional<z.ZodString>;
-    dynamic: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    env: z.ZodOptional<z.ZodString>;
-    excludeDynamic: z.ZodOptional<z.ZodBoolean>;
-    excludeEnv: z.ZodOptional<z.ZodBoolean>;
-    excludeGlobal: z.ZodOptional<z.ZodBoolean>;
-    excludePrivate: z.ZodOptional<z.ZodBoolean>;
-    excludePublic: z.ZodOptional<z.ZodBoolean>;
-    loadProcess: z.ZodOptional<z.ZodBoolean>;
-    log: z.ZodOptional<z.ZodBoolean>;
-    logger: z.ZodDefault<z.ZodUnknown>;
-    outputPath: z.ZodOptional<z.ZodString>;
-    privateToken: z.ZodOptional<z.ZodString>;
-    debug: z.ZodOptional<z.ZodBoolean>;
-    strict: z.ZodOptional<z.ZodBoolean>;
-    capture: z.ZodOptional<z.ZodBoolean>;
-    trace: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
-    redact: z.ZodOptional<z.ZodBoolean>;
-    warnEntropy: z.ZodOptional<z.ZodBoolean>;
-    entropyThreshold: z.ZodOptional<z.ZodNumber>;
-    entropyMinLength: z.ZodOptional<z.ZodNumber>;
-    entropyWhitelist: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    redactPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    paths: z.ZodOptional<z.ZodString>;
-    pathsDelimiter: z.ZodOptional<z.ZodString>;
-    pathsDelimiterPattern: z.ZodOptional<z.ZodString>;
-    scripts: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    shell: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>;
-    vars: z.ZodOptional<z.ZodString>;
-    varsAssignor: z.ZodOptional<z.ZodString>;
-    varsAssignorPattern: z.ZodOptional<z.ZodString>;
-    varsDelimiter: z.ZodOptional<z.ZodString>;
-    varsDelimiterPattern: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-
-/**
- * Resolved programmatic options schema (post-inheritance).
- * For now, this mirrors the RAW schema; future stages may materialize defaults
- * and narrow shapes as resolution is wired into the host.
- */
-/**
- * Programmatic options schema (resolved).
- *
- * Today this mirrors {@link getDotenvOptionsSchemaRaw}, but is kept as a distinct export
- * so future resolution steps can narrow or materialize defaults without breaking the API.
- *
- * @public
- */
-declare const getDotenvOptionsSchemaResolved: z.ZodObject<{
-    defaultEnv: z.ZodOptional<z.ZodString>;
-    dotenvToken: z.ZodOptional<z.ZodString>;
-    dynamicPath: z.ZodOptional<z.ZodString>;
-    dynamic: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    env: z.ZodOptional<z.ZodString>;
-    excludeDynamic: z.ZodOptional<z.ZodBoolean>;
-    excludeEnv: z.ZodOptional<z.ZodBoolean>;
-    excludeGlobal: z.ZodOptional<z.ZodBoolean>;
-    excludePrivate: z.ZodOptional<z.ZodBoolean>;
-    excludePublic: z.ZodOptional<z.ZodBoolean>;
-    loadProcess: z.ZodOptional<z.ZodBoolean>;
-    log: z.ZodOptional<z.ZodBoolean>;
-    logger: z.ZodDefault<z.ZodUnknown>;
-    outputPath: z.ZodOptional<z.ZodString>;
-    paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    privateToken: z.ZodOptional<z.ZodString>;
-    vars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
-}, z.core.$strip>;
-
 /**
  * Canonical programmatic options and helpers for get-dotenv.
  *

package/dist/cli.mjs

@@ -1,25 +1,26 @@
-export { c as createCli } from './chunks/createCli-BY6_cfZr.mjs';
+export { c as createCli } from './chunks/createCli-BnRdfRRL.mjs';
 import 'zod';
 import 'path';
-import './chunks/loader-DnhPeGfq.mjs';
+import './chunks/loader-CePOf74i.mjs';
 import 'fs-extra';
 import 'package-directory';
 import 'url';
 import 'yaml';
+import 'node:path';
 import './chunks/loadModuleDefault-Dj8B3Stt.mjs';
 import 'crypto';
-import './chunks/readMergedOptions-Nt0TR7dX.mjs';
-import '@commander-js/extra-typings';
-import './chunks/overlayEnv-Bs2kVayG.mjs';
 import 'nanoid';
+import './chunks/readMergedOptions-B7VdLROn.mjs';
+import '@commander-js/extra-typings';
+import './chunks/readDotenvCascade-DfFkWMjs.mjs';
 import 'dotenv';
 import 'execa';
 import './chunks/helpConfig-CGejgwWW.mjs';
-import './chunks/resolveCliOptions-TFRzhB2c.mjs';
+import './chunks/resolveCliOptions-pgUXHJtj.mjs';
 import './chunks/validate-CDl0rE6k.mjs';
 import './plugins-aws.mjs';
-import './chunks/spawnEnv-CN8a7cNR.mjs';
-import './chunks/index-CeCufHlm.mjs';
+import './chunks/spawnEnv-CQwFu7ZJ.mjs';
+import './chunks/index-70Dm0f1N.mjs';
 import 'buffer';
 import 'os';
 import 'node:fs/promises';
@@ -31,9 +32,8 @@ import 'node:fs';
 import './plugins-batch.mjs';
 import './chunks/invoke-DuRPU1oC.mjs';
 import 'globby';
-import './chunks/index-Bc3h0a95.mjs';
+import './chunks/index-r0Me7-sT.mjs';
 import './plugins-init.mjs';
 import 'node:process';
 import 'readline/promises';
-import 'node:path';
 import 'node:url';

package/dist/cliHost.d.ts

@@ -2,6 +2,218 @@ import { OptionValues, Command, InferCommandArguments, Option, CommandUnknownOpt
 import { z, ZodObject } from 'zod';
 export { z } from 'zod';
 
+/**
+ * Dotenv provenance model (descriptor-only).
+ *
+ * Requirements addressed:
+ * - Host ctx carries a dotenv provenance mapping describing per-key origin and override history.
+ * - Provenance is descriptor-only (no value payloads).
+ * - Provenance is an ordered stack per key in ascending precedence; the last entry is effective.
+ * - Explicit unsets are represented as `op: 'unset'` without requiring deletion of keys from the env map.
+ */
+/**
+ * Provenance kind for an entry in {@link DotenvProvenance}.
+ *
+ * @public
+ */
+type DotenvProvenanceKind = 'file' | 'config' | 'vars' | 'dynamic';
+/**
+ * Operation represented by a provenance entry.
+ *
+ * @public
+ */
+type DotenvProvenanceOp = 'set' | 'unset';
+/**
+ * Base shape for all provenance entries.
+ *
+ * @public
+ */
+interface DotenvProvenanceEntryBase {
+    /**
+     * The kind of provenance entry.
+     */
+    kind: DotenvProvenanceKind;
+    /**
+     * The operation applied at this layer.
+     */
+    op: DotenvProvenanceOp;
+}
+/**
+ * Provenance entry representing a value sourced from a dotenv file in the cascade.
+ *
+ * @public
+ */
+interface DotenvFileProvenanceEntry extends DotenvProvenanceEntryBase {
+    /** Discriminator. */
+    kind: 'file';
+    /** Global vs env-scoped file. */
+    scope: 'global' | 'env';
+    /** Public vs private file. */
+    privacy: 'public' | 'private';
+    /** Environment name (required when scope is `env`). */
+    env?: string;
+    /**
+     * The corresponding `paths[]` entry as provided by the caller/CLI.
+     * This is not an absolute path by policy.
+     */
+    path: string;
+    /**
+     * The computed dotenv filename token (e.g., `.env`, `.env.dev`, `.env.local`, `.env.dev.local`).
+     */
+    file: string;
+}
+/**
+ * Provenance entry representing a value sourced from config overlays (`vars` / `envVars`).
+ *
+ * @public
+ */
+interface DotenvConfigProvenanceEntry extends DotenvProvenanceEntryBase {
+    /** Discriminator. */
+    kind: 'config';
+    /** Global vs env-scoped config slice. */
+    scope: 'global' | 'env';
+    /** Public vs private on the privacy axis (`local` config maps to `private`). */
+    privacy: 'public' | 'private';
+    /** Environment name (required when scope is `env`). */
+    env?: string;
+    /** Packaged vs project config origin. */
+    configScope: 'packaged' | 'project';
+    /** Public vs local config file. */
+    configPrivacy: 'public' | 'local';
+}
+/**
+ * Provenance entry representing explicit variables overrides.
+ *
+ * Notes:
+ * - This kind represents values injected via `vars` (CLI/programmatic), not dotenv files.
+ *
+ * @public
+ */
+interface DotenvVarsProvenanceEntry extends DotenvProvenanceEntryBase {
+    /** Discriminator. */
+    kind: 'vars';
+}
+/**
+ * Source tier for dynamic variables.
+ *
+ * @public
+ */
+type DotenvDynamicSource = 'config' | 'programmatic' | 'dynamicPath';
+/**
+ * Provenance entry representing dynamic variables.
+ *
+ * @public
+ */
+interface DotenvDynamicProvenanceEntry extends DotenvProvenanceEntryBase {
+    /** Discriminator. */
+    kind: 'dynamic';
+    /** Dynamic source tier. */
+    dynamicSource: DotenvDynamicSource;
+    /**
+     * The `dynamicPath` value as provided by the caller/CLI when `dynamicSource` is `dynamicPath`.
+     * This is not resolved to an absolute path by provenance policy.
+     */
+    dynamicPath?: string;
+}
+/**
+ * Union of all supported provenance entry shapes.
+ *
+ * @public
+ */
+type DotenvProvenanceEntry = DotenvFileProvenanceEntry | DotenvConfigProvenanceEntry | DotenvVarsProvenanceEntry | DotenvDynamicProvenanceEntry;
+/**
+ * Per-key provenance history.
+ *
+ * Each key maps to an array of entries ordered in ascending precedence (lower to higher).
+ *
+ * @public
+ */
+type DotenvProvenance = Record<string, DotenvProvenanceEntry[]>;
+
+/**
+ * Resolved CLI options schema.
+ * For the current step this mirrors the RAW schema; later stages may further
+ * narrow types post-resolution in the host pipeline.
+ */
+/**
+ * CLI options schema (resolved).
+ *
+ * Today this mirrors {@link getDotenvCliOptionsSchemaRaw}, but is kept as a distinct export
+ * so future resolution steps can narrow or materialize defaults without breaking the API.
+ *
+ * @public
+ */
+declare const getDotenvCliOptionsSchemaResolved: z.ZodObject<{
+    defaultEnv: z.ZodOptional<z.ZodString>;
+    dotenvToken: z.ZodOptional<z.ZodString>;
+    dynamicPath: z.ZodOptional<z.ZodString>;
+    dynamic: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    env: z.ZodOptional<z.ZodString>;
+    excludeDynamic: z.ZodOptional<z.ZodBoolean>;
+    excludeEnv: z.ZodOptional<z.ZodBoolean>;
+    excludeGlobal: z.ZodOptional<z.ZodBoolean>;
+    excludePrivate: z.ZodOptional<z.ZodBoolean>;
+    excludePublic: z.ZodOptional<z.ZodBoolean>;
+    loadProcess: z.ZodOptional<z.ZodBoolean>;
+    log: z.ZodOptional<z.ZodBoolean>;
+    logger: z.ZodDefault<z.ZodUnknown>;
+    outputPath: z.ZodOptional<z.ZodString>;
+    privateToken: z.ZodOptional<z.ZodString>;
+    debug: z.ZodOptional<z.ZodBoolean>;
+    strict: z.ZodOptional<z.ZodBoolean>;
+    capture: z.ZodOptional<z.ZodBoolean>;
+    trace: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+    redact: z.ZodOptional<z.ZodBoolean>;
+    warnEntropy: z.ZodOptional<z.ZodBoolean>;
+    entropyThreshold: z.ZodOptional<z.ZodNumber>;
+    entropyMinLength: z.ZodOptional<z.ZodNumber>;
+    entropyWhitelist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    redactPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    paths: z.ZodOptional<z.ZodString>;
+    pathsDelimiter: z.ZodOptional<z.ZodString>;
+    pathsDelimiterPattern: z.ZodOptional<z.ZodString>;
+    scripts: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    shell: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>;
+    vars: z.ZodOptional<z.ZodString>;
+    varsAssignor: z.ZodOptional<z.ZodString>;
+    varsAssignorPattern: z.ZodOptional<z.ZodString>;
+    varsDelimiter: z.ZodOptional<z.ZodString>;
+    varsDelimiterPattern: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+/**
+ * Resolved programmatic options schema (post-inheritance).
+ * For now, this mirrors the RAW schema; future stages may materialize defaults
+ * and narrow shapes as resolution is wired into the host.
+ */
+/**
+ * Programmatic options schema (resolved).
+ *
+ * Today this mirrors {@link getDotenvOptionsSchemaRaw}, but is kept as a distinct export
+ * so future resolution steps can narrow or materialize defaults without breaking the API.
+ *
+ * @public
+ */
+declare const getDotenvOptionsSchemaResolved: z.ZodObject<{
+    defaultEnv: z.ZodOptional<z.ZodString>;
+    dotenvToken: z.ZodOptional<z.ZodString>;
+    dynamicPath: z.ZodOptional<z.ZodString>;
+    dynamic: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    env: z.ZodOptional<z.ZodString>;
+    excludeDynamic: z.ZodOptional<z.ZodBoolean>;
+    excludeEnv: z.ZodOptional<z.ZodBoolean>;
+    excludeGlobal: z.ZodOptional<z.ZodBoolean>;
+    excludePrivate: z.ZodOptional<z.ZodBoolean>;
+    excludePublic: z.ZodOptional<z.ZodBoolean>;
+    loadProcess: z.ZodOptional<z.ZodBoolean>;
+    log: z.ZodOptional<z.ZodBoolean>;
+    logger: z.ZodDefault<z.ZodUnknown>;
+    outputPath: z.ZodOptional<z.ZodString>;
+    paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    privateToken: z.ZodOptional<z.ZodString>;
+    vars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
+}, z.core.$strip>;
+
 /**
  * Minimal root options shape shared by CLI and generator layers.
  * Keep keys optional to respect exactOptionalPropertyTypes semantics.
@@ -121,6 +333,12 @@ interface GetDotenvCliCtx<TOptions extends GetDotenvOptions = GetDotenvOptions>
      * Final composed dotenv environment for this invocation.
      */
     dotenv: ProcessEnv;
+    /**
+     * Dotenv provenance history for {@link GetDotenvCliCtx.dotenv}.
+     *
+     * Descriptor-only: does not include value payloads.
+     */
+    dotenvProvenance: DotenvProvenance;
     /**
      * Optional runtime plugin state bag. Plugins may publish non-sensitive metadata here.
      */
@@ -148,90 +366,6 @@ interface BrandOptions {
     helpHeader?: string;
 }
 
-/**
- * Resolved CLI options schema.
- * For the current step this mirrors the RAW schema; later stages may further
- * narrow types post-resolution in the host pipeline.
- */
-/**
- * CLI options schema (resolved).
- *
- * Today this mirrors {@link getDotenvCliOptionsSchemaRaw}, but is kept as a distinct export
- * so future resolution steps can narrow or materialize defaults without breaking the API.
- *
- * @public
- */
-declare const getDotenvCliOptionsSchemaResolved: z.ZodObject<{
-    defaultEnv: z.ZodOptional<z.ZodString>;
-    dotenvToken: z.ZodOptional<z.ZodString>;
-    dynamicPath: z.ZodOptional<z.ZodString>;
-    dynamic: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    env: z.ZodOptional<z.ZodString>;
-    excludeDynamic: z.ZodOptional<z.ZodBoolean>;
-    excludeEnv: z.ZodOptional<z.ZodBoolean>;
-    excludeGlobal: z.ZodOptional<z.ZodBoolean>;
-    excludePrivate: z.ZodOptional<z.ZodBoolean>;
-    excludePublic: z.ZodOptional<z.ZodBoolean>;
-    loadProcess: z.ZodOptional<z.ZodBoolean>;
-    log: z.ZodOptional<z.ZodBoolean>;
-    logger: z.ZodDefault<z.ZodUnknown>;
-    outputPath: z.ZodOptional<z.ZodString>;
-    privateToken: z.ZodOptional<z.ZodString>;
-    debug: z.ZodOptional<z.ZodBoolean>;
-    strict: z.ZodOptional<z.ZodBoolean>;
-    capture: z.ZodOptional<z.ZodBoolean>;
-    trace: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
-    redact: z.ZodOptional<z.ZodBoolean>;
-    warnEntropy: z.ZodOptional<z.ZodBoolean>;
-    entropyThreshold: z.ZodOptional<z.ZodNumber>;
-    entropyMinLength: z.ZodOptional<z.ZodNumber>;
-    entropyWhitelist: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    redactPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    paths: z.ZodOptional<z.ZodString>;
-    pathsDelimiter: z.ZodOptional<z.ZodString>;
-    pathsDelimiterPattern: z.ZodOptional<z.ZodString>;
-    scripts: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    shell: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>;
-    vars: z.ZodOptional<z.ZodString>;
-    varsAssignor: z.ZodOptional<z.ZodString>;
-    varsAssignorPattern: z.ZodOptional<z.ZodString>;
-    varsDelimiter: z.ZodOptional<z.ZodString>;
-    varsDelimiterPattern: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-
-/**
- * Resolved programmatic options schema (post-inheritance).
- * For now, this mirrors the RAW schema; future stages may materialize defaults
- * and narrow shapes as resolution is wired into the host.
- */
-/**
- * Programmatic options schema (resolved).
- *
- * Today this mirrors {@link getDotenvOptionsSchemaRaw}, but is kept as a distinct export
- * so future resolution steps can narrow or materialize defaults without breaking the API.
- *
- * @public
- */
-declare const getDotenvOptionsSchemaResolved: z.ZodObject<{
-    defaultEnv: z.ZodOptional<z.ZodString>;
-    dotenvToken: z.ZodOptional<z.ZodString>;
-    dynamicPath: z.ZodOptional<z.ZodString>;
-    dynamic: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    env: z.ZodOptional<z.ZodString>;
-    excludeDynamic: z.ZodOptional<z.ZodBoolean>;
-    excludeEnv: z.ZodOptional<z.ZodBoolean>;
-    excludeGlobal: z.ZodOptional<z.ZodBoolean>;
-    excludePrivate: z.ZodOptional<z.ZodBoolean>;
-    excludePublic: z.ZodOptional<z.ZodBoolean>;
-    loadProcess: z.ZodOptional<z.ZodBoolean>;
-    log: z.ZodOptional<z.ZodBoolean>;
-    logger: z.ZodDefault<z.ZodUnknown>;
-    outputPath: z.ZodOptional<z.ZodString>;
-    paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    privateToken: z.ZodOptional<z.ZodString>;
-    vars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
-}, z.core.$strip>;
-
 /**
  * Canonical programmatic options and helpers for get-dotenv.
  *