@kolatts/pncli 5.3.0 → 6.0.0

package/dist/chunk-WDWAPTVC.js

@@ -0,0 +1,1001 @@
+#!/usr/bin/env node
+import {
+  PncliError
+} from "./chunk-HRNOAQDN.js";
+
+// src/lib/config.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { execSync } from "child_process";
+
+// src/types/jira.ts
+var CUSTOM_FIELD_TYPES = [
+  "string",
+  "number",
+  "date",
+  "datetime",
+  "select",
+  "multi-select",
+  "option-id",
+  "cascading-select",
+  "user",
+  "labels",
+  "url",
+  "textarea"
+];
+
+// src/lib/validate-custom-fields.ts
+var EXAMPLE = '[{"id":"customfield_10032","name":"Epic Link","type":"select"}]';
+function assertValidCustomFields(fields, opts = {}) {
+  const where = opts.source ? `in ${opts.source}` : "config";
+  const fix = (value) => `Fix with: pncli config set jira.customFields '${value}'${opts.repo ? " --repo" : ""}`;
+  if (!Array.isArray(fields)) {
+    throw new PncliError(
+      `Invalid jira.customFields ${where}: expected an array, got ${JSON.stringify(fields)}. ${fix("[]")}`,
+      1
+    );
+  }
+  for (const f of fields) {
+    const entry = f;
+    if (typeof entry !== "object" || entry === null || typeof entry.id !== "string" || typeof entry.name !== "string") {
+      throw new PncliError(
+        `Invalid jira.customFields ${where}: each entry must be an object with string "id" and "name" fields. Got: ${JSON.stringify(f)}. ${fix(EXAMPLE)}`,
+        1
+      );
+    }
+    if (entry.type !== void 0 && (typeof entry.type !== "string" || !CUSTOM_FIELD_TYPES.includes(entry.type))) {
+      throw new PncliError(
+        `Invalid jira.customFields ${where}: entry "${entry.name}" has unknown "type" ${JSON.stringify(entry.type)}; expected one of ${CUSTOM_FIELD_TYPES.join(", ")}. ${fix(EXAMPLE)}`,
+        1
+      );
+    }
+  }
+}
+
+// src/lib/keychain.ts
+import { spawnSync } from "child_process";
+var KEYCHAIN_PREFIX = "keychain:";
+var KEYCHAIN_SERVICE = "pncli";
+var ACCOUNT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var defaultRunner = (command, args, input) => {
+  const r = spawnSync(command, args, { input, encoding: "utf8", windowsHide: true, timeout: 3e4 });
+  return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "", error: r.error };
+};
+var KeychainError = class extends Error {
+};
+var KeychainBatchError = class extends KeychainError {
+  constructor(partial, errors) {
+    super(Object.entries(errors).map(([a, e]) => `${a}: ${e}`).join("; "));
+    this.partial = partial;
+    this.errors = errors;
+  }
+  partial;
+  errors;
+};
+function lookupEach(accounts, lookup) {
+  const out = {};
+  const errors = {};
+  for (const account of accounts) {
+    try {
+      out[account] = lookup(account);
+    } catch (err) {
+      errors[account] = err instanceof Error ? err.message : String(err);
+    }
+  }
+  if (Object.keys(errors).length > 0) throw new KeychainBatchError(out, errors);
+  return out;
+}
+function isKeychainRef(value) {
+  return typeof value === "string" && value.startsWith(KEYCHAIN_PREFIX);
+}
+function keychainRef(account) {
+  assertValidAccount(account);
+  return `${KEYCHAIN_PREFIX}${account}`;
+}
+function accountFromRef(ref) {
+  const account = ref.slice(KEYCHAIN_PREFIX.length);
+  assertValidAccount(account);
+  return account;
+}
+function assertValidAccount(account) {
+  if (!ACCOUNT_PATTERN.test(account)) {
+    throw new KeychainError(`Invalid keychain account name "${account}" \u2014 use letters, digits, '.', '_' or '-' (max 128 chars).`);
+  }
+}
+function assertStorableSecret(secret) {
+  if (!secret) throw new KeychainError("Refusing to store an empty secret.");
+  if (/[\r\n]/.test(secret)) throw new KeychainError("Secrets containing newlines cannot be stored in the keychain.");
+}
+function failure(backend, action, r) {
+  const detail = r.error?.message ?? (r.stderr.trim() || `exit code ${r.status}`);
+  return new KeychainError(`${backend}: could not ${action}: ${detail}`);
+}
+function macosBackend(run = defaultRunner) {
+  return {
+    name: "macos",
+    store: "macOS login Keychain",
+    available() {
+      const r = run("security", ["help"]);
+      return !r.error;
+    },
+    getMany(accounts) {
+      return lookupEach(accounts, (account) => {
+        assertValidAccount(account);
+        const r = run("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account, "-w"]);
+        if (r.status === 44) return null;
+        if (r.status !== 0) throw failure("macOS Keychain", `read "${account}"`, r);
+        return r.stdout.replace(/\r?\n$/, "");
+      });
+    },
+    set(account, secret) {
+      assertValidAccount(account);
+      assertStorableSecret(secret);
+      const hex = Buffer.from(secret, "utf8").toString("hex");
+      const r = run("security", ["-i"], `add-generic-password -U -s ${KEYCHAIN_SERVICE} -a ${account} -l "pncli ${account}" -X ${hex}
+`);
+      if (r.status !== 0 || /error/i.test(r.stderr)) throw failure("macOS Keychain", `store "${account}"`, r);
+    },
+    delete(account) {
+      assertValidAccount(account);
+      const r = run("security", ["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account]);
+      if (r.status === 44) return false;
+      if (r.status !== 0) throw failure("macOS Keychain", `delete "${account}"`, r);
+      return true;
+    }
+  };
+}
+var WINDOWS_CREDMAN_SCRIPT = String.raw`
+$ErrorActionPreference = 'Stop'
+# Redirected console streams default to the OEM code page; secrets are UTF-8 JSON both ways.
+[Console]::InputEncoding = New-Object System.Text.UTF8Encoding $false
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding $false
+Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+public static class PncliCredMan {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  private struct CREDENTIAL {
+    public int Flags; public int Type; public string TargetName; public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public int CredentialBlobSize; public IntPtr CredentialBlob; public int Persist;
+    public int AttributeCount; public IntPtr Attributes; public string TargetAlias; public string UserName;
+  }
+  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+  private static extern bool CredReadW(string target, int type, int flags, out IntPtr cred);
+  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+  private static extern bool CredWriteW(ref CREDENTIAL cred, int flags);
+  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+  private static extern bool CredDeleteW(string target, int type, int flags);
+  [DllImport("advapi32.dll")]
+  private static extern void CredFree(IntPtr cred);
+  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+  private static extern bool CredEnumerateW(string filter, int flags, out int count, out IntPtr creds);
+  private const int NotFound = 1168;
+  public static string Read(string target) {
+    IntPtr p;
+    if (!CredReadW(target, 1, 0, out p)) {
+      int err = Marshal.GetLastWin32Error();
+      if (err == NotFound) return null;
+      throw new System.ComponentModel.Win32Exception(err);
+    }
+    try {
+      CREDENTIAL c = (CREDENTIAL)Marshal.PtrToStructure(p, typeof(CREDENTIAL));
+      if (c.CredentialBlobSize == 0) return "";
+      byte[] bytes = new byte[c.CredentialBlobSize];
+      Marshal.Copy(c.CredentialBlob, bytes, 0, c.CredentialBlobSize);
+      return Encoding.UTF8.GetString(bytes);
+    } finally { CredFree(p); }
+  }
+  public static void Write(string target, string user, string secret) {
+    byte[] bytes = Encoding.UTF8.GetBytes(secret);
+    CREDENTIAL c = new CREDENTIAL();
+    c.Type = 1; c.TargetName = target; c.UserName = user; c.Persist = 2;
+    c.CredentialBlobSize = bytes.Length;
+    c.CredentialBlob = Marshal.AllocHGlobal(bytes.Length);
+    try {
+      Marshal.Copy(bytes, 0, c.CredentialBlob, bytes.Length);
+      if (!CredWriteW(ref c, 0)) throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
+    } finally { Marshal.FreeHGlobal(c.CredentialBlob); }
+  }
+  // Git Credential Manager writes UTF-16LE blobs; pncli and git-credential-wincred write UTF-8.
+  // Tokens are ASCII, so "every odd byte is zero" reliably identifies UTF-16.
+  private static string Decode(byte[] bytes) {
+    bool utf16 = bytes.Length % 2 == 0 && bytes.Length > 0;
+    for (int i = 1; utf16 && i < bytes.Length; i += 2) if (bytes[i] != 0) utf16 = false;
+    return utf16 ? Encoding.Unicode.GetString(bytes) : Encoding.UTF8.GetString(bytes);
+  }
+  // Flattened [target, user, secret] triples for every credential matching the filter (e.g. "git:*").
+  public static string[] List(string filter) {
+    int count; IntPtr list;
+    if (!CredEnumerateW(filter, 0, out count, out list)) {
+      int err = Marshal.GetLastWin32Error();
+      if (err == NotFound) return new string[0];
+      throw new System.ComponentModel.Win32Exception(err);
+    }
+    try {
+      string[] outp = new string[count * 3];
+      for (int i = 0; i < count; i++) {
+        IntPtr item = Marshal.ReadIntPtr(list, i * IntPtr.Size);
+        CREDENTIAL c = (CREDENTIAL)Marshal.PtrToStructure(item, typeof(CREDENTIAL));
+        string secret = "";
+        if (c.CredentialBlobSize > 0) {
+          byte[] bytes = new byte[c.CredentialBlobSize];
+          Marshal.Copy(c.CredentialBlob, bytes, 0, c.CredentialBlobSize);
+          secret = Decode(bytes);
+        }
+        outp[i * 3] = c.TargetName; outp[i * 3 + 1] = c.UserName; outp[i * 3 + 2] = secret;
+      }
+      return outp;
+    } finally { CredFree(list); }
+  }
+  public static bool Delete(string target) {
+    if (CredDeleteW(target, 1, 0)) return true;
+    int err = Marshal.GetLastWin32Error();
+    if (err == NotFound) return false;
+    throw new System.ComponentModel.Win32Exception(err);
+  }
+}
+'@
+$req = [Console]::In.ReadToEnd() | ConvertFrom-Json
+switch ($req.op) {
+  'get' {
+    $out = @{}
+    foreach ($t in $req.targets) { $out[$t] = [PncliCredMan]::Read($t) }
+    [Console]::Out.Write((ConvertTo-Json -InputObject $out -Compress))
+  }
+  'set' { [PncliCredMan]::Write($req.target, $req.user, $req.secret); [Console]::Out.Write('{"ok":true}') }
+  'delete' { $d = [PncliCredMan]::Delete($req.target); [Console]::Out.Write((ConvertTo-Json -InputObject @{ deleted = $d } -Compress)) }
+  'list' {
+    $flat = [PncliCredMan]::List($req.filter)
+    $items = @()
+    for ($i = 0; $i -lt $flat.Length; $i += 3) { $items += @{ target = $flat[$i]; user = $flat[$i + 1]; secret = $flat[$i + 2] } }
+    [Console]::Out.Write((ConvertTo-Json -InputObject @($items) -Compress -Depth 3))
+  }
+  'ping' { [Console]::Out.Write('{"ok":true}') }
+}
+`;
+function windowsListCredentials(filter, run = defaultRunner) {
+  const encoded = Buffer.from(WINDOWS_CREDMAN_SCRIPT, "utf16le").toString("base64");
+  const r = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded], JSON.stringify({ op: "list", filter }));
+  if (r.status !== 0) throw failure("Windows Credential Manager", "list credentials", r);
+  const parsed = JSON.parse(r.stdout.trim() || "[]");
+  const items = Array.isArray(parsed) ? parsed : [parsed];
+  return items.filter((x) => !!x && typeof x === "object").map((x) => ({ target: String(x.target ?? ""), user: String(x.user ?? ""), secret: String(x.secret ?? "") }));
+}
+function windowsTarget(account) {
+  return `${KEYCHAIN_SERVICE}:${account}`;
+}
+function windowsBackend(run = defaultRunner) {
+  const encoded = Buffer.from(WINDOWS_CREDMAN_SCRIPT, "utf16le").toString("base64");
+  const invoke = (payload, action) => {
+    const r = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded], JSON.stringify(payload));
+    if (r.status !== 0) throw failure("Windows Credential Manager", action, r);
+    try {
+      return JSON.parse(r.stdout.trim() || "{}");
+    } catch {
+      throw new KeychainError(`Windows Credential Manager: unexpected output while trying to ${action}.`);
+    }
+  };
+  return {
+    name: "windows",
+    store: "Windows Credential Manager",
+    available() {
+      try {
+        invoke({ op: "ping" }, "start PowerShell");
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    getMany(accounts) {
+      accounts.forEach(assertValidAccount);
+      if (accounts.length === 0) return {};
+      const raw = invoke({ op: "get", targets: accounts.map(windowsTarget) }, "read credentials");
+      return Object.fromEntries(accounts.map((a) => [a, raw[windowsTarget(a)] ?? null]));
+    },
+    set(account, secret) {
+      assertValidAccount(account);
+      assertStorableSecret(secret);
+      invoke({ op: "set", target: windowsTarget(account), user: account, secret }, `store "${account}"`);
+    },
+    delete(account) {
+      assertValidAccount(account);
+      const r = invoke({ op: "delete", target: windowsTarget(account) }, `delete "${account}"`);
+      return !!r.deleted;
+    }
+  };
+}
+function linuxBackend(run = defaultRunner) {
+  return {
+    name: "linux",
+    store: "Secret Service (secret-tool)",
+    available() {
+      const r = run("secret-tool", ["--version"]);
+      return !r.error;
+    },
+    getMany(accounts) {
+      return lookupEach(accounts, (account) => {
+        assertValidAccount(account);
+        const r = run("secret-tool", ["lookup", "service", KEYCHAIN_SERVICE, "account", account]);
+        if (r.error) throw failure("Secret Service", `read "${account}"`, r);
+        if (r.status !== 0) return null;
+        return r.stdout.replace(/\r?\n$/, "");
+      });
+    },
+    set(account, secret) {
+      assertValidAccount(account);
+      assertStorableSecret(secret);
+      const r = run("secret-tool", ["store", `--label=pncli ${account}`, "service", KEYCHAIN_SERVICE, "account", account], secret);
+      if (r.status !== 0) throw failure("Secret Service", `store "${account}"`, r);
+    },
+    delete(account) {
+      assertValidAccount(account);
+      const existing = this.getMany([account])[account];
+      if (existing === null) return false;
+      const r = run("secret-tool", ["clear", "service", KEYCHAIN_SERVICE, "account", account]);
+      if (r.status !== 0) throw failure("Secret Service", `delete "${account}"`, r);
+      return true;
+    }
+  };
+}
+function noneBackend() {
+  const unsupported = () => {
+    throw new KeychainError(`No OS keychain backend is available on ${process.platform}. Set PNCLI_KEYCHAIN_BACKEND to macos, windows, or linux if one should be.`);
+  };
+  return { name: "none", store: "none", available: () => false, getMany: unsupported, set: unsupported, delete: unsupported };
+}
+function getKeychainBackend(run = defaultRunner, platform = process.platform) {
+  const override = process.env.PNCLI_KEYCHAIN_BACKEND || void 0;
+  const name = override ?? (platform === "darwin" ? "macos" : platform === "win32" ? "windows" : platform === "linux" ? "linux" : "none");
+  switch (name) {
+    case "macos":
+      return macosBackend(run);
+    case "windows":
+      return windowsBackend(run);
+    case "linux":
+      return linuxBackend(run);
+    case "none":
+      return noneBackend();
+    default:
+      throw new KeychainError(`Unknown PNCLI_KEYCHAIN_BACKEND "${String(override)}" \u2014 use macos, windows, linux, or none.`);
+  }
+}
+var SECRET_FIELD_NAMES = /* @__PURE__ */ new Set([
+  "token",
+  "apiToken",
+  "pat",
+  "apiKey",
+  "clientSecret",
+  "serviceKey",
+  "passcode",
+  "refreshToken",
+  "adminApiKey",
+  "platformToken",
+  "password",
+  "connection",
+  "accessKey"
+]);
+function findConfigStrings(root, predicate, prefix = []) {
+  const found = [];
+  if (Array.isArray(root)) {
+    root.forEach((item, i) => found.push(...findConfigStrings(item, predicate, [...prefix, i])));
+  } else if (root && typeof root === "object") {
+    for (const [key, value] of Object.entries(root)) {
+      if (typeof value === "string") {
+        if (predicate(key, value)) found.push({ path: [...prefix, key], value });
+      } else {
+        found.push(...findConfigStrings(value, predicate, [...prefix, key]));
+      }
+    }
+  }
+  return found;
+}
+function purgeEntries(config, backend, accounts) {
+  const stillReferenced = new Set(findKeychainRefs(config).map((r) => r.value.slice(KEYCHAIN_PREFIX.length)));
+  const purged = [];
+  for (const account of new Set(accounts)) {
+    if (stillReferenced.has(account)) continue;
+    if (backend.delete(account)) purged.push(account);
+  }
+  return purged;
+}
+function findKeychainRefs(root) {
+  return findConfigStrings(root, (_k, v) => isKeychainRef(v));
+}
+function findPlaintextSecrets(root) {
+  return findConfigStrings(root, (k, v) => typeof k === "string" && SECRET_FIELD_NAMES.has(k) && v.length > 0 && !isKeychainRef(v));
+}
+function accountForPath(root, segments) {
+  const parts = [];
+  let node = root;
+  for (const seg of segments) {
+    if (typeof seg === "number") {
+      const entry = Array.isArray(node) ? node[seg] : void 0;
+      const name = entry && typeof entry === "object" ? entry.name : void 0;
+      parts.push(typeof name === "string" && /^[A-Za-z0-9._-]+$/.test(name) ? name : String(seg));
+    } else {
+      parts.push(seg);
+    }
+    node = node && typeof node === "object" ? node[seg] : void 0;
+  }
+  return parts.join(".");
+}
+function setAtPath(root, segments, value) {
+  let node = root;
+  for (const seg of segments.slice(0, -1)) node = node[seg];
+  node[segments[segments.length - 1]] = value;
+}
+var resolvedCache = /* @__PURE__ */ new Map();
+var lastUnresolved = [];
+var warnedUnresolved = false;
+function getUnresolvedKeychainRefs() {
+  return lastUnresolved;
+}
+function resetKeychainCache() {
+  resolvedCache.clear();
+  lastUnresolved = [];
+  warnedUnresolved = false;
+}
+function resolveKeychainRefs(config, backend, opts = {}) {
+  const all = findKeychainRefs(config);
+  if (all.length === 0) return config;
+  const copy = JSON.parse(JSON.stringify(config));
+  const refs = all.filter((r) => {
+    const key = r.path.join(".");
+    if (!opts.skipPaths?.has(key) && (!opts.onlyPaths || opts.onlyPaths.has(key))) return true;
+    setAtPath(copy, r.path, void 0);
+    return false;
+  });
+  if (refs.length === 0) return copy;
+  const unresolved = [];
+  const accounts = /* @__PURE__ */ new Map();
+  for (const ref of refs) {
+    try {
+      const account = accountFromRef(ref.value);
+      accounts.set(account, [...accounts.get(account) ?? [], ref.path]);
+    } catch (err) {
+      unresolved.push({ path: ref.path.join("."), account: ref.value.slice(KEYCHAIN_PREFIX.length), reason: err.message });
+      setAtPath(copy, ref.path, void 0);
+    }
+  }
+  const activeBackend = backend ?? getKeychainBackend();
+  if (activeBackend.name === "none") {
+    for (const [account, paths] of accounts) {
+      for (const p of paths) {
+        setAtPath(copy, p, void 0);
+        unresolved.push({ path: p.join("."), account, reason: "keychain disabled (PNCLI_KEYCHAIN_BACKEND=none or unsupported platform)" });
+      }
+    }
+    lastUnresolved = unresolved;
+    return copy;
+  }
+  const missing = [...accounts.keys()].filter((a) => !resolvedCache.has(a));
+  if (missing.length > 0) {
+    let failed = {};
+    try {
+      const found = activeBackend.getMany(missing);
+      for (const a of missing) resolvedCache.set(a, found[a] ?? null);
+    } catch (err) {
+      if (err instanceof KeychainBatchError) {
+        for (const a of missing) if (!(a in err.errors)) resolvedCache.set(a, err.partial[a] ?? null);
+        failed = err.errors;
+      } else {
+        failed = Object.fromEntries(missing.map((a) => [a, err.message]));
+      }
+    }
+    for (const [account, paths] of accounts) {
+      if (resolvedCache.has(account) || !(account in failed)) continue;
+      for (const p of paths) unresolved.push({ path: p.join("."), account, reason: failed[account] });
+    }
+  }
+  for (const [account, paths] of accounts) {
+    const secret = resolvedCache.get(account);
+    for (const p of paths) {
+      if (secret != null) {
+        setAtPath(copy, p, secret);
+      } else {
+        setAtPath(copy, p, void 0);
+        if (resolvedCache.has(account)) unresolved.push({ path: p.join("."), account, reason: "no entry in the keychain" });
+      }
+    }
+  }
+  lastUnresolved = unresolved;
+  if (unresolved.length > 0 && !warnedUnresolved) {
+    warnedUnresolved = true;
+    process.stderr.write(`Warning: ${unresolved.length} keychain reference(s) could not be resolved (${unresolved.map((u) => u.path).join(", ")}). Run: pncli doctor
+`);
+  }
+  return copy;
+}
+function storeVerified(backend, account, secret) {
+  backend.set(account, secret);
+  let readBack;
+  try {
+    readBack = backend.getMany([account])[account];
+  } catch (err) {
+    throw new KeychainError(`Stored "${account}" but could not read it back to verify: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (readBack !== secret) throw new KeychainError(`Stored "${account}" but reading it back did not return the same secret \u2014 config was not changed.`);
+}
+function resolveSecretValue(value, backend) {
+  if (!isKeychainRef(value)) return value;
+  const resolved = resolveKeychainRefs({ v: value }, backend);
+  return resolved.v;
+}
+
+// src/lib/config.ts
+var ENV_KEYS = {
+  EMAIL: "PNCLI_EMAIL",
+  USERID: "PNCLI_USERID",
+  JIRA_BASE_URL: "PNCLI_JIRA_BASE_URL",
+  JIRA_API_TOKEN: "PNCLI_JIRA_API_TOKEN",
+  BITBUCKET_BASE_URL: "PNCLI_BITBUCKET_BASE_URL",
+  BITBUCKET_PAT: "PNCLI_BITBUCKET_PAT",
+  GITHUB_BASE_URL: "PNCLI_GITHUB_BASE_URL",
+  GITHUB_TOKEN: "PNCLI_GITHUB_TOKEN",
+  // Well-known vars CI platforms provide without any pncli-specific setup.
+  GITHUB_TOKEN_FALLBACK: "GITHUB_TOKEN",
+  GITHUB_API_URL_FALLBACK: "GITHUB_API_URL",
+  CONFLUENCE_BASE_URL: "PNCLI_CONFLUENCE_BASE_URL",
+  CONFLUENCE_API_TOKEN: "PNCLI_CONFLUENCE_API_TOKEN",
+  ARTIFACTORY_BASE_URL: "PNCLI_ARTIFACTORY_BASE_URL",
+  ARTIFACTORY_TOKEN: "PNCLI_ARTIFACTORY_TOKEN",
+  ARTIFACTORY_REPO_NPM: "PNCLI_ARTIFACTORY_REPO_NPM",
+  ARTIFACTORY_REPO_NUGET: "PNCLI_ARTIFACTORY_REPO_NUGET",
+  ARTIFACTORY_REPO_MAVEN: "PNCLI_ARTIFACTORY_REPO_MAVEN",
+  SONAR_BASE_URL: "PNCLI_SONAR_BASE_URL",
+  SONAR_TOKEN: "PNCLI_SONAR_TOKEN",
+  // SonarSource's own scanner CLI standard var name — see the comment above GITHUB_TOKEN_FALLBACK.
+  SONAR_TOKEN_FALLBACK: "SONAR_TOKEN",
+  SDE_CONNECTION: "PNCLI_SDE_CONNECTION",
+  ADO_BASE_URL: "PNCLI_ADO_BASE_URL",
+  ADO_PAT: "PNCLI_ADO_PAT",
+  // Azure Pipelines' conventional name for $(System.AccessToken) — see the comment above GITHUB_TOKEN_FALLBACK.
+  ADO_PAT_FALLBACK: "SYSTEM_ACCESSTOKEN",
+  JENKINS_BASE_URL: "PNCLI_JENKINS_BASE_URL",
+  JENKINS_USERNAME: "PNCLI_JENKINS_USERNAME",
+  JENKINS_API_TOKEN: "PNCLI_JENKINS_API_TOKEN",
+  CHECKMARX_BASE_URL: "PNCLI_CHECKMARX_BASE_URL",
+  CHECKMARX_TENANT_NAME: "PNCLI_CHECKMARX_TENANT_NAME",
+  CHECKMARX_API_KEY: "PNCLI_CHECKMARX_API_KEY",
+  CHECKMARX_CLIENT_ID: "PNCLI_CHECKMARX_CLIENT_ID",
+  CHECKMARX_CLIENT_SECRET: "PNCLI_CHECKMARX_CLIENT_SECRET",
+  CONTRAST_BASE_URL: "PNCLI_CONTRAST_BASE_URL",
+  CONTRAST_ORG_UUID: "PNCLI_CONTRAST_ORG_UUID",
+  CONTRAST_API_KEY: "PNCLI_CONTRAST_API_KEY",
+  CONTRAST_SERVICE_KEY: "PNCLI_CONTRAST_SERVICE_KEY",
+  CONTRAST_USERNAME: "PNCLI_CONTRAST_USERNAME",
+  SONATYPEIQ_BASE_URL: "PNCLI_SONATYPEIQ_BASE_URL",
+  SONATYPEIQ_USER_CODE: "PNCLI_SONATYPEIQ_USER_CODE",
+  SONATYPEIQ_PASSCODE: "PNCLI_SONATYPEIQ_PASSCODE",
+  OPENSHIFT_BASE_URL: "PNCLI_OPENSHIFT_BASE_URL",
+  OPENSHIFT_TOKEN: "PNCLI_OPENSHIFT_TOKEN",
+  DYNATRACE_BASE_URL: "PNCLI_DYNATRACE_BASE_URL",
+  DYNATRACE_API_TOKEN: "PNCLI_DYNATRACE_API_TOKEN",
+  DYNATRACE_PLATFORM_URL: "PNCLI_DYNATRACE_PLATFORM_URL",
+  DYNATRACE_PLATFORM_TOKEN: "PNCLI_DYNATRACE_PLATFORM_TOKEN",
+  LOGSCALE_BASE_URL: "PNCLI_LOGSCALE_BASE_URL",
+  LOGSCALE_TOKEN: "PNCLI_LOGSCALE_TOKEN",
+  SPLITIO_BASE_URL: "PNCLI_SPLITIO_BASE_URL",
+  SPLITIO_ADMIN_API_KEY: "PNCLI_SPLITIO_ADMIN_API_KEY",
+  FIGMA_BASE_URL: "PNCLI_FIGMA_BASE_URL",
+  FIGMA_TOKEN: "PNCLI_FIGMA_TOKEN",
+  ALATION_BASE_URL: "PNCLI_ALATION_BASE_URL",
+  ALATION_REFRESH_TOKEN: "PNCLI_ALATION_REFRESH_TOKEN",
+  ALATION_USER_ID: "PNCLI_ALATION_USER_ID",
+  SAUCELABS_BASE_URL: "PNCLI_SAUCELABS_BASE_URL",
+  SAUCELABS_USERNAME: "PNCLI_SAUCELABS_USERNAME",
+  SAUCELABS_ACCESS_KEY: "PNCLI_SAUCELABS_ACCESS_KEY",
+  // The names saucectl, Sauce Connect and Sauce's own CI docs read — see the comment above GITHUB_TOKEN_FALLBACK.
+  SAUCELABS_USERNAME_FALLBACK: "SAUCE_USERNAME",
+  SAUCELABS_ACCESS_KEY_FALLBACK: "SAUCE_ACCESS_KEY",
+  CONFIG_PATH: "PNCLI_CONFIG_PATH"
+};
+function getGlobalConfigPath(overridePath) {
+  if (overridePath) return overridePath;
+  const envPath = process.env[ENV_KEYS.CONFIG_PATH];
+  if (envPath) return envPath;
+  return path.join(os.homedir(), ".pncli", "config.json");
+}
+function loadJsonFile(filePath) {
+  try {
+    const content = fs.readFileSync(filePath, "utf8");
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+function getRepoRoot() {
+  try {
+    return execSync("git rev-parse --show-toplevel", { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return null;
+  }
+}
+function parseSdeConnection(connection) {
+  const idx = connection.indexOf("@");
+  if (idx <= 0) return null;
+  const token = connection.slice(0, idx);
+  const host = connection.slice(idx + 1);
+  const baseUrl = /^https?:\/\//i.test(host) ? host : `https://${host}`;
+  return { token, baseUrl };
+}
+function mergeCustomFields(global, repo) {
+  const map = /* @__PURE__ */ new Map();
+  if (global != null) {
+    assertValidCustomFields(global, { source: "global config" });
+    for (const f of global) map.set(f.id, f);
+  }
+  if (repo != null) {
+    assertValidCustomFields(repo, { source: "repo config (.pncli.json)", repo: true });
+    for (const f of repo) map.set(f.id, f);
+  }
+  return Array.from(map.values());
+}
+function mergeDefaults(global, repo) {
+  return {
+    jira: { ...global?.jira, ...repo?.jira },
+    bitbucket: { ...global?.bitbucket, ...repo?.bitbucket },
+    github: { ...global?.github, ...repo?.github },
+    sonar: { ...global?.sonar, ...repo?.sonar },
+    sde: { ...global?.sde, ...repo?.sde },
+    ado: { ...global?.ado, ...repo?.ado },
+    jenkins: { ...global?.jenkins, ...repo?.jenkins }
+  };
+}
+var SECRET_ENV_OVERRIDES = [
+  ["jira.apiToken", [ENV_KEYS.JIRA_API_TOKEN]],
+  ["bitbucket.pat", [ENV_KEYS.BITBUCKET_PAT]],
+  ["github.token", [ENV_KEYS.GITHUB_TOKEN, ENV_KEYS.GITHUB_TOKEN_FALLBACK]],
+  ["confluence.apiToken", [ENV_KEYS.CONFLUENCE_API_TOKEN]],
+  ["artifactory.token", [ENV_KEYS.ARTIFACTORY_TOKEN]],
+  ["sonar.token", [ENV_KEYS.SONAR_TOKEN, ENV_KEYS.SONAR_TOKEN_FALLBACK]],
+  ["ado.pat", [ENV_KEYS.ADO_PAT, ENV_KEYS.ADO_PAT_FALLBACK]],
+  ["jenkins.apiToken", [ENV_KEYS.JENKINS_API_TOKEN]],
+  ["checkmarx.apiKey", [ENV_KEYS.CHECKMARX_API_KEY]],
+  ["checkmarx.clientSecret", [ENV_KEYS.CHECKMARX_CLIENT_SECRET]],
+  ["contrast.apiKey", [ENV_KEYS.CONTRAST_API_KEY]],
+  ["contrast.serviceKey", [ENV_KEYS.CONTRAST_SERVICE_KEY]],
+  ["sonatypeiq.passcode", [ENV_KEYS.SONATYPEIQ_PASSCODE]],
+  ["openshift.token", [ENV_KEYS.OPENSHIFT_TOKEN]],
+  ["dynatrace.apiToken", [ENV_KEYS.DYNATRACE_API_TOKEN]],
+  ["dynatrace.platformToken", [ENV_KEYS.DYNATRACE_PLATFORM_TOKEN]],
+  ["logscale.token", [ENV_KEYS.LOGSCALE_TOKEN]],
+  ["splitio.adminApiKey", [ENV_KEYS.SPLITIO_ADMIN_API_KEY]],
+  ["figma.token", [ENV_KEYS.FIGMA_TOKEN]],
+  ["alation.refreshToken", [ENV_KEYS.ALATION_REFRESH_TOKEN]],
+  ["saucelabs.accessKey", [ENV_KEYS.SAUCELABS_ACCESS_KEY, ENV_KEYS.SAUCELABS_ACCESS_KEY_FALLBACK]]
+];
+function envOverriddenSecretPaths(env = process.env) {
+  return new Set(SECRET_ENV_OVERRIDES.filter(([, keys]) => keys.some((k) => env[k] !== void 0)).map(([p]) => p));
+}
+function loadConfig(opts = {}) {
+  const globalConfigPath = getGlobalConfigPath(opts.configPath);
+  const globalConfig = resolveKeychainRefs(loadJsonFile(globalConfigPath) ?? {}, void 0, {
+    skipPaths: envOverriddenSecretPaths(),
+    ...opts.keychainPaths ? { onlyPaths: new Set(opts.keychainPaths) } : {}
+  });
+  const repoRoot = getRepoRoot();
+  let repoConfig = {};
+  if (repoRoot) {
+    repoConfig = loadJsonFile(path.join(repoRoot, ".pncli.json")) ?? {};
+  }
+  const mergedDefaults = mergeDefaults(globalConfig.defaults, repoConfig.defaults);
+  return {
+    user: {
+      email: process.env[ENV_KEYS.EMAIL] ?? globalConfig.user?.email,
+      userId: process.env[ENV_KEYS.USERID] ?? globalConfig.user?.userId
+    },
+    jira: {
+      baseUrl: process.env[ENV_KEYS.JIRA_BASE_URL] ?? globalConfig.jira?.baseUrl,
+      apiToken: process.env[ENV_KEYS.JIRA_API_TOKEN] ?? globalConfig.jira?.apiToken,
+      customFields: mergeCustomFields(globalConfig.jira?.customFields, repoConfig.jira?.customFields)
+    },
+    bitbucket: {
+      baseUrl: process.env[ENV_KEYS.BITBUCKET_BASE_URL] ?? globalConfig.bitbucket?.baseUrl,
+      pat: process.env[ENV_KEYS.BITBUCKET_PAT] ?? globalConfig.bitbucket?.pat
+    },
+    github: {
+      baseUrl: process.env[ENV_KEYS.GITHUB_BASE_URL] ?? process.env[ENV_KEYS.GITHUB_API_URL_FALLBACK] ?? globalConfig.github?.baseUrl,
+      token: process.env[ENV_KEYS.GITHUB_TOKEN] ?? process.env[ENV_KEYS.GITHUB_TOKEN_FALLBACK] ?? globalConfig.github?.token
+    },
+    confluence: {
+      baseUrl: process.env[ENV_KEYS.CONFLUENCE_BASE_URL] ?? globalConfig.confluence?.baseUrl,
+      apiToken: process.env[ENV_KEYS.CONFLUENCE_API_TOKEN] ?? globalConfig.confluence?.apiToken ?? process.env[ENV_KEYS.JIRA_API_TOKEN] ?? globalConfig.jira?.apiToken,
+      apiTokenExplicit: !!(process.env[ENV_KEYS.CONFLUENCE_API_TOKEN] ?? globalConfig.confluence?.apiToken)
+    },
+    artifactory: {
+      baseUrl: process.env[ENV_KEYS.ARTIFACTORY_BASE_URL] ?? globalConfig.artifactory?.baseUrl,
+      token: process.env[ENV_KEYS.ARTIFACTORY_TOKEN] ?? globalConfig.artifactory?.token,
+      npmRepo: process.env[ENV_KEYS.ARTIFACTORY_REPO_NPM] ?? globalConfig.artifactory?.npmRepo,
+      nugetRepo: process.env[ENV_KEYS.ARTIFACTORY_REPO_NUGET] ?? globalConfig.artifactory?.nugetRepo,
+      mavenRepo: process.env[ENV_KEYS.ARTIFACTORY_REPO_MAVEN] ?? globalConfig.artifactory?.mavenRepo
+    },
+    sonar: {
+      baseUrl: process.env[ENV_KEYS.SONAR_BASE_URL] ?? globalConfig.sonar?.baseUrl,
+      token: process.env[ENV_KEYS.SONAR_TOKEN] ?? process.env[ENV_KEYS.SONAR_TOKEN_FALLBACK] ?? globalConfig.sonar?.token
+    },
+    sde: (() => {
+      const raw = process.env[ENV_KEYS.SDE_CONNECTION] ?? globalConfig.sde?.connection;
+      const parsed = raw ? parseSdeConnection(raw) : null;
+      return { baseUrl: parsed?.baseUrl, token: parsed?.token };
+    })(),
+    ado: {
+      baseUrl: process.env[ENV_KEYS.ADO_BASE_URL] ?? globalConfig.ado?.baseUrl,
+      pat: process.env[ENV_KEYS.ADO_PAT] ?? process.env[ENV_KEYS.ADO_PAT_FALLBACK] ?? globalConfig.ado?.pat,
+      fieldAliases: globalConfig.ado?.fieldAliases ?? {},
+      discoveredFields: globalConfig.ado?.discoveredFields ?? [],
+      discoveredTypes: globalConfig.ado?.discoveredTypes ?? []
+    },
+    jenkins: {
+      baseUrl: repoConfig.defaults?.jenkins?.baseUrl ?? process.env[ENV_KEYS.JENKINS_BASE_URL] ?? globalConfig.jenkins?.baseUrl,
+      username: process.env[ENV_KEYS.JENKINS_USERNAME] ?? globalConfig.jenkins?.username,
+      apiToken: process.env[ENV_KEYS.JENKINS_API_TOKEN] ?? globalConfig.jenkins?.apiToken
+    },
+    jenkinsInstances: Array.isArray(globalConfig.jenkinsInstances) ? globalConfig.jenkinsInstances : [],
+    checkmarx: {
+      baseUrl: process.env[ENV_KEYS.CHECKMARX_BASE_URL] ?? globalConfig.checkmarx?.baseUrl,
+      tenantName: process.env[ENV_KEYS.CHECKMARX_TENANT_NAME] ?? globalConfig.checkmarx?.tenantName,
+      apiKey: process.env[ENV_KEYS.CHECKMARX_API_KEY] ?? globalConfig.checkmarx?.apiKey,
+      clientId: process.env[ENV_KEYS.CHECKMARX_CLIENT_ID] ?? globalConfig.checkmarx?.clientId,
+      clientSecret: process.env[ENV_KEYS.CHECKMARX_CLIENT_SECRET] ?? globalConfig.checkmarx?.clientSecret
+    },
+    contrast: {
+      baseUrl: process.env[ENV_KEYS.CONTRAST_BASE_URL] ?? globalConfig.contrast?.baseUrl,
+      orgUuid: process.env[ENV_KEYS.CONTRAST_ORG_UUID] ?? globalConfig.contrast?.orgUuid,
+      apiKey: process.env[ENV_KEYS.CONTRAST_API_KEY] ?? globalConfig.contrast?.apiKey,
+      serviceKey: process.env[ENV_KEYS.CONTRAST_SERVICE_KEY] ?? globalConfig.contrast?.serviceKey,
+      username: process.env[ENV_KEYS.CONTRAST_USERNAME] ?? globalConfig.contrast?.username
+    },
+    sonatypeiq: {
+      baseUrl: process.env[ENV_KEYS.SONATYPEIQ_BASE_URL] ?? globalConfig.sonatypeiq?.baseUrl,
+      userCode: process.env[ENV_KEYS.SONATYPEIQ_USER_CODE] ?? globalConfig.sonatypeiq?.userCode,
+      passcode: process.env[ENV_KEYS.SONATYPEIQ_PASSCODE] ?? globalConfig.sonatypeiq?.passcode
+    },
+    openshift: {
+      baseUrl: process.env[ENV_KEYS.OPENSHIFT_BASE_URL] ?? globalConfig.openshift?.baseUrl,
+      token: process.env[ENV_KEYS.OPENSHIFT_TOKEN] ?? globalConfig.openshift?.token,
+      defaultEnvironment: globalConfig.openshift?.defaultEnvironment,
+      defaultInstance: globalConfig.openshift?.defaultInstance,
+      environments: typeof globalConfig.openshift?.environments === "object" && globalConfig.openshift.environments !== null ? globalConfig.openshift.environments : {}
+    },
+    dynatrace: {
+      baseUrl: process.env[ENV_KEYS.DYNATRACE_BASE_URL] ?? globalConfig.dynatrace?.baseUrl,
+      apiToken: process.env[ENV_KEYS.DYNATRACE_API_TOKEN] ?? globalConfig.dynatrace?.apiToken,
+      platformUrl: process.env[ENV_KEYS.DYNATRACE_PLATFORM_URL] ?? globalConfig.dynatrace?.platformUrl,
+      platformToken: process.env[ENV_KEYS.DYNATRACE_PLATFORM_TOKEN] ?? globalConfig.dynatrace?.platformToken,
+      defaultEnvironment: globalConfig.dynatrace?.defaultEnvironment,
+      environments: typeof globalConfig.dynatrace?.environments === "object" && globalConfig.dynatrace.environments !== null ? globalConfig.dynatrace.environments : {}
+    },
+    logscale: {
+      baseUrl: process.env[ENV_KEYS.LOGSCALE_BASE_URL] ?? globalConfig.logscale?.baseUrl,
+      token: process.env[ENV_KEYS.LOGSCALE_TOKEN] ?? globalConfig.logscale?.token
+    },
+    splitio: {
+      baseUrl: process.env[ENV_KEYS.SPLITIO_BASE_URL] ?? globalConfig.splitio?.baseUrl,
+      adminApiKey: process.env[ENV_KEYS.SPLITIO_ADMIN_API_KEY] ?? globalConfig.splitio?.adminApiKey
+    },
+    figma: {
+      baseUrl: process.env[ENV_KEYS.FIGMA_BASE_URL] ?? globalConfig.figma?.baseUrl,
+      token: process.env[ENV_KEYS.FIGMA_TOKEN] ?? globalConfig.figma?.token
+    },
+    alation: {
+      baseUrl: process.env[ENV_KEYS.ALATION_BASE_URL] ?? globalConfig.alation?.baseUrl,
+      refreshToken: process.env[ENV_KEYS.ALATION_REFRESH_TOKEN] ?? globalConfig.alation?.refreshToken,
+      userId: process.env[ENV_KEYS.ALATION_USER_ID] ?? globalConfig.alation?.userId
+    },
+    saucelabs: {
+      baseUrl: process.env[ENV_KEYS.SAUCELABS_BASE_URL] ?? globalConfig.saucelabs?.baseUrl,
+      username: process.env[ENV_KEYS.SAUCELABS_USERNAME] ?? process.env[ENV_KEYS.SAUCELABS_USERNAME_FALLBACK] ?? globalConfig.saucelabs?.username,
+      accessKey: process.env[ENV_KEYS.SAUCELABS_ACCESS_KEY] ?? process.env[ENV_KEYS.SAUCELABS_ACCESS_KEY_FALLBACK] ?? globalConfig.saucelabs?.accessKey
+    },
+    defaults: mergedDefaults
+  };
+}
+function normalizeBaseUrl(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return trimmed;
+  return /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+}
+function writeGlobalConfig(config, configPath) {
+  const filePath = getGlobalConfigPath(configPath);
+  const dir = path.dirname(filePath);
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+  fs.writeFileSync(filePath, JSON.stringify(config, null, 2) + "\n", "utf8");
+}
+function writeRepoConfig(config) {
+  const repoRoot = getRepoRoot();
+  const targetDir = repoRoot ?? process.cwd();
+  fs.writeFileSync(path.join(targetDir, ".pncli.json"), JSON.stringify(config, null, 2) + "\n", "utf8");
+}
+function parseConfigValue(value) {
+  try {
+    const parsed = JSON.parse(value);
+    if (typeof parsed === "object" && parsed !== null) {
+      return parsed;
+    }
+  } catch {
+  }
+  return value;
+}
+function setConfigValue(key, value, configPath) {
+  const filePath = getGlobalConfigPath(configPath);
+  const existing = loadJsonFile(filePath) ?? {};
+  const parts = key.split(".");
+  let current = existing;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const part = parts[i];
+    if (typeof current[part] !== "object" || current[part] === null) {
+      current[part] = {};
+    }
+    current = current[part];
+  }
+  current[parts[parts.length - 1]] = parseConfigValue(value);
+  writeGlobalConfig(existing, configPath);
+}
+function setRepoConfigValue(key, value) {
+  const repoRoot = getRepoRoot();
+  const targetDir = repoRoot ?? process.cwd();
+  const filePath = path.join(targetDir, ".pncli.json");
+  const existing = loadJsonFile(filePath) ?? {};
+  const parts = key.split(".");
+  let current = existing;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const part = parts[i];
+    if (typeof current[part] !== "object" || current[part] === null) {
+      current[part] = {};
+    }
+    current = current[part];
+  }
+  current[parts[parts.length - 1]] = parseConfigValue(value);
+  writeRepoConfig(existing);
+}
+function maskConfig(config) {
+  return {
+    ...config,
+    jira: {
+      ...config.jira,
+      apiToken: config.jira.apiToken ? "***" : void 0,
+      customFields: config.jira.customFields
+    },
+    bitbucket: {
+      ...config.bitbucket,
+      pat: config.bitbucket.pat ? "***" : void 0
+    },
+    github: {
+      ...config.github,
+      token: config.github.token ? "***" : void 0
+    },
+    confluence: {
+      ...config.confluence,
+      apiToken: config.confluence.apiToken ? "***" : void 0
+    },
+    artifactory: {
+      ...config.artifactory,
+      token: config.artifactory.token ? "***" : void 0
+    },
+    sonar: {
+      ...config.sonar,
+      token: config.sonar.token ? "***" : void 0
+    },
+    sde: {
+      baseUrl: config.sde.baseUrl,
+      token: config.sde.token ? "***" : void 0
+    },
+    ado: {
+      ...config.ado,
+      pat: config.ado.pat ? "***" : void 0
+    },
+    jenkins: {
+      ...config.jenkins,
+      apiToken: config.jenkins.apiToken ? "***" : void 0
+    },
+    jenkinsInstances: config.jenkinsInstances.map((inst) => ({
+      ...inst,
+      apiToken: inst.apiToken ? "***" : void 0
+    })),
+    checkmarx: {
+      ...config.checkmarx,
+      apiKey: config.checkmarx.apiKey ? "***" : void 0,
+      clientSecret: config.checkmarx.clientSecret ? "***" : void 0
+    },
+    contrast: {
+      ...config.contrast,
+      apiKey: config.contrast.apiKey ? "***" : void 0,
+      serviceKey: config.contrast.serviceKey ? "***" : void 0
+    },
+    sonatypeiq: {
+      ...config.sonatypeiq,
+      passcode: config.sonatypeiq.passcode ? "***" : void 0
+    },
+    openshift: {
+      ...config.openshift,
+      token: config.openshift.token ? "***" : void 0,
+      environments: Object.fromEntries(
+        Object.entries(config.openshift.environments).map(([envName, envCfg]) => [
+          envName,
+          {
+            instances: Object.fromEntries(
+              Object.entries(envCfg.instances ?? {}).map(([instName, instCfg]) => [
+                instName,
+                { ...instCfg, token: instCfg.token ? "***" : void 0 }
+              ])
+            )
+          }
+        ])
+      )
+    },
+    dynatrace: {
+      ...config.dynatrace,
+      apiToken: config.dynatrace.apiToken ? "***" : void 0,
+      platformToken: config.dynatrace.platformToken ? "***" : void 0,
+      environments: Object.fromEntries(
+        Object.entries(config.dynatrace.environments).map(([name, env]) => [
+          name,
+          {
+            ...env,
+            apiToken: env.apiToken ? "***" : void 0,
+            platformToken: env.platformToken ? "***" : void 0
+          }
+        ])
+      )
+    },
+    logscale: {
+      ...config.logscale,
+      token: config.logscale.token ? "***" : void 0
+    },
+    splitio: {
+      ...config.splitio,
+      adminApiKey: config.splitio.adminApiKey ? "***" : void 0
+    },
+    figma: {
+      ...config.figma,
+      token: config.figma.token ? "***" : void 0
+    },
+    alation: {
+      ...config.alation,
+      refreshToken: config.alation.refreshToken ? "***" : void 0
+    },
+    saucelabs: {
+      ...config.saucelabs,
+      accessKey: config.saucelabs.accessKey ? "***" : void 0
+    }
+  };
+}
+
+export {
+  assertValidCustomFields,
+  defaultRunner,
+  KeychainError,
+  KeychainBatchError,
+  isKeychainRef,
+  keychainRef,
+  accountFromRef,
+  windowsListCredentials,
+  getKeychainBackend,
+  purgeEntries,
+  findKeychainRefs,
+  findPlaintextSecrets,
+  accountForPath,
+  setAtPath,
+  getUnresolvedKeychainRefs,
+  resetKeychainCache,
+  resolveKeychainRefs,
+  storeVerified,
+  resolveSecretValue,
+  getGlobalConfigPath,
+  loadJsonFile,
+  envOverriddenSecretPaths,
+  loadConfig,
+  normalizeBaseUrl,
+  writeGlobalConfig,
+  writeRepoConfig,
+  setConfigValue,
+  setRepoConfigValue,
+  maskConfig
+};
+//# sourceMappingURL=chunk-WDWAPTVC.js.map