@super-repo/envx 0.2.3-b.3 → 0.2.3-b.4

package/dist/index.js

@@ -1,8 +1,19 @@
-import { n as loadDotenvxConfig, u as loadEnv } from "./chunks/src-CwrtyfZE.js";
+import { C as serializeEnv, D as encryptValueAsymmetric, E as decryptValueAsymmetric, O as generateKeyPair, S as parseEnv, T as ENCRYPTED_PREFIX, _ as resolveEnvPaths, a as rotateFiles, b as expandRecord, c as defaultKeysPath, f as detectEnvironment, g as resolveCwdOrWorkspace, h as loadEnv, i as auditFiles, k as isEncrypted, l as readKeysFile, n as loadDotenvxConfig, o as decryptFiles, p as findWorkspaceRoot, r as BUILT_IN_PATTERNS, s as encryptFiles, u as writeKeysFile, w as toRecord, y as expandEnvSrc } from "./chunks/src-D0n2wHDg.js";
 //#region src/index.ts
 function envx(arg) {
-	const { config } = loadDotenvxConfig();
-	loadEnv(mergeOpts(config, arg === void 0 ? {} : typeof arg === "string" ? { cascade: arg } : arg));
+	const { config: baseConfig } = loadDotenvxConfig();
+	const userOpts = arg === void 0 ? {} : typeof arg === "string" ? { cascade: arg } : arg;
+	let cfg = baseConfig;
+	if (userOpts.profile) {
+		const profile = cfg.profiles?.[userOpts.profile];
+		if (!profile) throw new Error(`[ENVX_UNKNOWN_PROFILE] '${userOpts.profile}' not found (available: ${Object.keys(cfg.profiles ?? {}).join(", ") || "none"})`);
+		cfg = {
+			...cfg,
+			...profile
+		};
+	}
+	const { profile: _drop, ...rest } = userOpts;
+	loadEnv(mergeOpts(cfg, rest));
 	return process.env;
 }
 /**
@@ -37,9 +48,17 @@ function mergeOpts(config, user) {
 	else if (config.defaults !== void 0) out.defaults = config.defaults;
 	if (user.workspaceRoot !== void 0) out.workspaceRoot = user.workspaceRoot;
 	else if (config.workspaceRoot !== void 0) out.workspaceRoot = config.workspaceRoot;
+	if (user.schema !== void 0) out.schema = user.schema;
+	else if (config.schema !== void 0) out.schema = config.schema;
+	if (user.resolvers !== void 0) out.resolvers = user.resolvers;
+	else if (config.resolvers !== void 0) out.resolvers = config.resolvers;
+	if (user.publicPrefixes !== void 0) out.publicPrefixes = user.publicPrefixes;
+	else if (config.publicPrefixes !== void 0) out.publicPrefixes = config.publicPrefixes;
+	if (user.publicSource !== void 0) out.publicSource = user.publicSource;
+	else if (config.publicSource !== void 0) out.publicSource = config.publicSource;
 	return out;
 }
 //#endregion
-export { envx as default, envx };
+export { BUILT_IN_PATTERNS, ENCRYPTED_PREFIX, auditFiles, decryptFiles, decryptValueAsymmetric, envx as default, envx, defaultKeysPath, detectEnvironment, encryptFiles, encryptValueAsymmetric, expandEnvSrc, expandRecord, findWorkspaceRoot, generateKeyPair, isEncrypted, loadDotenvxConfig, parseEnv, readKeysFile, resolveCwdOrWorkspace, resolveEnvPaths, rotateFiles, serializeEnv, toRecord, writeKeysFile };
 
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["// #region -- Programmatic Entry Point ----------------------\n\nimport {\n  loadEnv,\n  loadDotenvxConfig,\n  type DotenvxConfig,\n  type LoadEnvOptions,\n} from \"@honeycluster/libs\";\n\n/**\n * Load env files into `process.env` and return it.\n *\n * Modeled after the `dotenv` API but with explicit scoping. Three call\n * shapes:\n *\n * ```ts\n * import envx from \"@honeycluster/envx\";\n *\n * envx();              // load `.env` (auto-detect from NODE_ENV / VERCEL_ENV / NETLIFY)\n * envx(\"prod\");        // load `.env` with cascade=prod (.env, .env.prod, .env.local, .env.prod.local)\n * envx({ envFiles: [\"vault/.env.prod\"], envPath: \"vault\", quiet: false }); // full options\n * ```\n *\n * In all cases `process.env` is mutated and returned for ergonomic\n * destructuring. Config file discovery (`envx.config.{ts,js,json}` /\n * `package.json` `envx.config`) runs automatically; programmatic\n * options layer on top of the discovered config, with caller-supplied\n * fields winning per-field.\n */\nfunction envx(): NodeJS.ProcessEnv;\nfunction envx(scope: string): NodeJS.ProcessEnv;\nfunction envx(opts: LoadEnvOptions): NodeJS.ProcessEnv;\nfunction envx(arg?: string | LoadEnvOptions): NodeJS.ProcessEnv {\n  const { config } = loadDotenvxConfig();\n  const userOpts: LoadEnvOptions =\n    arg === undefined\n      ? {}\n      : typeof arg === \"string\"\n        ? { cascade: arg }\n        : arg;\n  loadEnv(mergeOpts(config, userOpts));\n  return process.env;\n}\n\n/**\n * Per-field merge: caller-supplied option wins, falling through to the\n * matching config field, falling through to whatever default `loadEnv`\n * has built in. Fields the caller doesn't pass and the config doesn't\n * set are simply omitted from the merged options object.\n */\nfunction mergeOpts(\n  config: DotenvxConfig,\n  user: LoadEnvOptions,\n): LoadEnvOptions {\n  const out: { -readonly [K in keyof LoadEnvOptions]: LoadEnvOptions[K] } = {};\n\n  // env-file selection\n  if (user.envFiles !== undefined) out.envFiles = user.envFiles;\n  else if (config.envFiles !== undefined) out.envFiles = [...config.envFiles];\n\n  if (user.envPath !== undefined) out.envPath = user.envPath;\n  else if (config.envPath !== undefined) out.envPath = config.envPath;\n\n  if (user.cascade !== undefined) out.cascade = user.cascade;\n  else if (config.cascade !== undefined) out.cascade = config.cascade;\n\n  if (user.vault !== undefined) out.vault = user.vault;\n\n  if (user.variables !== undefined) out.variables = user.variables;\n\n  // load behavior\n  if (user.override !== undefined) out.override = user.override;\n  else if (config.override !== undefined) out.override = config.override;\n\n  if (user.quiet !== undefined) out.quiet = user.quiet;\n  else if (config.quiet !== undefined) out.quiet = config.quiet;\n\n  // auto-detection\n  if (user.autoDetect !== undefined) out.autoDetect = user.autoDetect;\n  else if (config.autoDetect !== undefined) out.autoDetect = config.autoDetect;\n\n  if (user.nodeEnvMap !== undefined) out.nodeEnvMap = user.nodeEnvMap;\n  else if (config.nodeEnvMap !== undefined) out.nodeEnvMap = config.nodeEnvMap;\n\n  // post-load behavior\n  if (user.required !== undefined) out.required = user.required;\n  else if (config.required !== undefined) out.required = config.required;\n\n  if (user.expand !== undefined) out.expand = user.expand;\n  else if (config.expand !== undefined) out.expand = config.expand;\n\n  if (user.defaults !== undefined) out.defaults = user.defaults;\n  else if (config.defaults !== undefined) out.defaults = config.defaults;\n\n  // advanced\n  if (user.workspaceRoot !== undefined) out.workspaceRoot = user.workspaceRoot;\n  else if (config.workspaceRoot !== undefined) out.workspaceRoot = config.workspaceRoot;\n\n  return out;\n}\n\nexport default envx;\nexport { envx };\n\n// Re-export the types callers will need to type their own wrappers.\nexport type { LoadEnvOptions };\n\n// #endregion -----------------------------------------------\n"],"mappings":";;AAgCA,SAAS,KAAK,KAAkD;CAC9D,MAAM,EAAE,WAAW,mBAAmB;CAOtC,QAAQ,UAAU,QALhB,QAAQ,KAAA,IACJ,EAAE,GACF,OAAO,QAAQ,WACb,EAAE,SAAS,KAAK,GAChB,IAC2B,CAAC;CACpC,OAAO,QAAQ;;;;;;;;AASjB,SAAS,UACP,QACA,MACgB;CAChB,MAAM,MAAoE,EAAE;CAG5E,IAAI,KAAK,aAAa,KAAA,GAAW,IAAI,WAAW,KAAK;MAChD,IAAI,OAAO,aAAa,KAAA,GAAW,IAAI,WAAW,CAAC,GAAG,OAAO,SAAS;CAE3E,IAAI,KAAK,YAAY,KAAA,GAAW,IAAI,UAAU,KAAK;MAC9C,IAAI,OAAO,YAAY,KAAA,GAAW,IAAI,UAAU,OAAO;CAE5D,IAAI,KAAK,YAAY,KAAA,GAAW,IAAI,UAAU,KAAK;MAC9C,IAAI,OAAO,YAAY,KAAA,GAAW,IAAI,UAAU,OAAO;CAE5D,IAAI,KAAK,UAAU,KAAA,GAAW,IAAI,QAAQ,KAAK;CAE/C,IAAI,KAAK,cAAc,KAAA,GAAW,IAAI,YAAY,KAAK;CAGvD,IAAI,KAAK,aAAa,KAAA,GAAW,IAAI,WAAW,KAAK;MAChD,IAAI,OAAO,aAAa,KAAA,GAAW,IAAI,WAAW,OAAO;CAE9D,IAAI,KAAK,UAAU,KAAA,GAAW,IAAI,QAAQ,KAAK;MAC1C,IAAI,OAAO,UAAU,KAAA,GAAW,IAAI,QAAQ,OAAO;CAGxD,IAAI,KAAK,eAAe,KAAA,GAAW,IAAI,aAAa,KAAK;MACpD,IAAI,OAAO,eAAe,KAAA,GAAW,IAAI,aAAa,OAAO;CAElE,IAAI,KAAK,eAAe,KAAA,GAAW,IAAI,aAAa,KAAK;MACpD,IAAI,OAAO,eAAe,KAAA,GAAW,IAAI,aAAa,OAAO;CAGlE,IAAI,KAAK,aAAa,KAAA,GAAW,IAAI,WAAW,KAAK;MAChD,IAAI,OAAO,aAAa,KAAA,GAAW,IAAI,WAAW,OAAO;CAE9D,IAAI,KAAK,WAAW,KAAA,GAAW,IAAI,SAAS,KAAK;MAC5C,IAAI,OAAO,WAAW,KAAA,GAAW,IAAI,SAAS,OAAO;CAE1D,IAAI,KAAK,aAAa,KAAA,GAAW,IAAI,WAAW,KAAK;MAChD,IAAI,OAAO,aAAa,KAAA,GAAW,IAAI,WAAW,OAAO;CAG9D,IAAI,KAAK,kBAAkB,KAAA,GAAW,IAAI,gBAAgB,KAAK;MAC1D,IAAI,OAAO,kBAAkB,KAAA,GAAW,IAAI,gBAAgB,OAAO;CAExE,OAAO"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["// #region -- Programmatic Entry Point ----------------------\n\nimport {\n  loadEnv,\n  loadDotenvxConfig,\n  type DotenvxConfig,\n  type LoadEnvOptions,\n} from \"@super-repo/envx-libs\";\n\n// Re-export the lib surface that consumers depend on (especially the\n// `auditFiles` API used by czar's `envxAuditPlugin`). Internal\n// packages `@super-repo/envx-libs` and `@super-repo/envx-common`\n// aren't on npm — `@super-repo/envx` is the only published entry, so\n// every public API has to be reachable from here.\nexport {\n  // Audit (plaintext-secret scanner)\n  auditFiles,\n  BUILT_IN_PATTERNS,\n  type AuditFinding,\n  type AuditOptions,\n  type SecretPattern,\n  // Crypto primitives\n  ENCRYPTED_PREFIX,\n  generateKeyPair,\n  encryptValueAsymmetric,\n  decryptValueAsymmetric,\n  isEncrypted,\n  // High-level operations\n  encryptFiles,\n  decryptFiles,\n  rotateFiles,\n  // Env-file parser\n  parseEnv,\n  serializeEnv,\n  toRecord,\n  // Variable expansion\n  expandRecord,\n  expandEnvSrc,\n  // Config + path resolution\n  loadDotenvxConfig,\n  findWorkspaceRoot,\n  resolveCwdOrWorkspace,\n  resolveEnvPaths,\n  detectEnvironment,\n  // Keys-file management\n  readKeysFile,\n  writeKeysFile,\n  defaultKeysPath,\n} from \"@super-repo/envx-libs\";\n\nexport type {\n  DotenvxConfig,\n  LoadEnvOptions,\n  ProcessedEnv,\n  ProcessingError,\n  ErrorCode,\n  RunOptions,\n  RunResult,\n  ExpandOptions,\n  ExpandResult,\n  EnvLine,\n  KvLine,\n  RawLine,\n} from \"@super-repo/envx-libs\";\n\n/**\n * Load env files into `process.env` and return it.\n *\n * Modeled after the `dotenv` API but with explicit scoping. Three call\n * shapes:\n *\n * ```ts\n * import envx from \"@super-repo/envx\";\n *\n * envx();              // load `.env` (auto-detect from NODE_ENV / VERCEL_ENV / NETLIFY)\n * envx(\"prod\");        // load `.env` with cascade=prod (.env, .env.prod, .env.local, .env.prod.local)\n * envx({ envFiles: [\"vault/.env.prod\"], envPath: \"vault\", quiet: false }); // full options\n * ```\n *\n * In all cases `process.env` is mutated and returned for ergonomic\n * destructuring. Config file discovery (`envx.config.{ts,js,json}` /\n * `package.json` `envx.config`) runs automatically; programmatic\n * options layer on top of the discovered config, with caller-supplied\n * fields winning per-field.\n */\n/**\n * Programmatic options accept everything `LoadEnvOptions` does plus an\n * optional `profile` name. When set, the matching `config.profiles[name]`\n * is merged onto the base config (per-field) before the user options\n * take over.\n */\nexport type EnvxProgrammaticOptions = LoadEnvOptions & { readonly profile?: string };\n\nfunction envx(): NodeJS.ProcessEnv;\nfunction envx(scope: string): NodeJS.ProcessEnv;\nfunction envx(opts: EnvxProgrammaticOptions): NodeJS.ProcessEnv;\nfunction envx(arg?: string | EnvxProgrammaticOptions): NodeJS.ProcessEnv {\n  const { config: baseConfig } = loadDotenvxConfig();\n  const userOpts: EnvxProgrammaticOptions =\n    arg === undefined\n      ? {}\n      : typeof arg === \"string\"\n        ? { cascade: arg }\n        : arg;\n  let cfg: DotenvxConfig = baseConfig;\n  if (userOpts.profile) {\n    const profile = cfg.profiles?.[userOpts.profile];\n    if (!profile) {\n      throw new Error(\n        `[ENVX_UNKNOWN_PROFILE] '${userOpts.profile}' not found (available: ${\n          Object.keys(cfg.profiles ?? {}).join(\", \") || \"none\"\n        })`,\n      );\n    }\n    cfg = { ...cfg, ...profile };\n  }\n  // Strip `profile` before passing to mergeOpts — it's not a LoadEnvOptions field.\n  const { profile: _drop, ...rest } = userOpts;\n  void _drop;\n  loadEnv(mergeOpts(cfg, rest));\n  return process.env;\n}\n\n/**\n * Per-field merge: caller-supplied option wins, falling through to the\n * matching config field, falling through to whatever default `loadEnv`\n * has built in. Fields the caller doesn't pass and the config doesn't\n * set are simply omitted from the merged options object.\n */\nfunction mergeOpts(\n  config: DotenvxConfig,\n  user: LoadEnvOptions,\n): LoadEnvOptions {\n  const out: { -readonly [K in keyof LoadEnvOptions]: LoadEnvOptions[K] } = {};\n\n  // env-file selection\n  if (user.envFiles !== undefined) out.envFiles = user.envFiles;\n  else if (config.envFiles !== undefined) out.envFiles = [...config.envFiles];\n\n  if (user.envPath !== undefined) out.envPath = user.envPath;\n  else if (config.envPath !== undefined) out.envPath = config.envPath;\n\n  if (user.cascade !== undefined) out.cascade = user.cascade;\n  else if (config.cascade !== undefined) out.cascade = config.cascade;\n\n  if (user.vault !== undefined) out.vault = user.vault;\n\n  if (user.variables !== undefined) out.variables = user.variables;\n\n  // load behavior\n  if (user.override !== undefined) out.override = user.override;\n  else if (config.override !== undefined) out.override = config.override;\n\n  if (user.quiet !== undefined) out.quiet = user.quiet;\n  else if (config.quiet !== undefined) out.quiet = config.quiet;\n\n  // auto-detection\n  if (user.autoDetect !== undefined) out.autoDetect = user.autoDetect;\n  else if (config.autoDetect !== undefined) out.autoDetect = config.autoDetect;\n\n  if (user.nodeEnvMap !== undefined) out.nodeEnvMap = user.nodeEnvMap;\n  else if (config.nodeEnvMap !== undefined) out.nodeEnvMap = config.nodeEnvMap;\n\n  // post-load behavior\n  if (user.required !== undefined) out.required = user.required;\n  else if (config.required !== undefined) out.required = config.required;\n\n  if (user.expand !== undefined) out.expand = user.expand;\n  else if (config.expand !== undefined) out.expand = config.expand;\n\n  if (user.defaults !== undefined) out.defaults = user.defaults;\n  else if (config.defaults !== undefined) out.defaults = config.defaults;\n\n  // advanced\n  if (user.workspaceRoot !== undefined) out.workspaceRoot = user.workspaceRoot;\n  else if (config.workspaceRoot !== undefined) out.workspaceRoot = config.workspaceRoot;\n\n  if (user.schema !== undefined) out.schema = user.schema;\n  else if (config.schema !== undefined) out.schema = config.schema;\n\n  if (user.resolvers !== undefined) out.resolvers = user.resolvers;\n  else if (config.resolvers !== undefined) out.resolvers = config.resolvers;\n\n  if (user.publicPrefixes !== undefined) out.publicPrefixes = user.publicPrefixes;\n  else if (config.publicPrefixes !== undefined) out.publicPrefixes = config.publicPrefixes;\n\n  if (user.publicSource !== undefined) out.publicSource = user.publicSource;\n  else if (config.publicSource !== undefined) out.publicSource = config.publicSource;\n\n  return out;\n}\n\nexport default envx;\nexport { envx };\n\n// Re-export the types callers will need to type their own wrappers.\nexport type { LoadEnvOptions };\n\n// #endregion -----------------------------------------------\n"],"mappings":";;AAgGA,SAAS,KAAK,KAA2D;CACvE,MAAM,EAAE,QAAQ,eAAe,mBAAmB;CAClD,MAAM,WACJ,QAAQ,KAAA,IACJ,EAAE,GACF,OAAO,QAAQ,WACb,EAAE,SAAS,KAAK,GAChB;CACR,IAAI,MAAqB;CACzB,IAAI,SAAS,SAAS;EACpB,MAAM,UAAU,IAAI,WAAW,SAAS;EACxC,IAAI,CAAC,SACH,MAAM,IAAI,MACR,2BAA2B,SAAS,QAAQ,0BAC1C,OAAO,KAAK,IAAI,YAAY,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,OAC/C,GACF;EAEH,MAAM;GAAE,GAAG;GAAK,GAAG;GAAS;;CAG9B,MAAM,EAAE,SAAS,OAAO,GAAG,SAAS;CAEpC,QAAQ,UAAU,KAAK,KAAK,CAAC;CAC7B,OAAO,QAAQ;;;;;;;;AASjB,SAAS,UACP,QACA,MACgB;CAChB,MAAM,MAAoE,EAAE;CAG5E,IAAI,KAAK,aAAa,KAAA,GAAW,IAAI,WAAW,KAAK;MAChD,IAAI,OAAO,aAAa,KAAA,GAAW,IAAI,WAAW,CAAC,GAAG,OAAO,SAAS;CAE3E,IAAI,KAAK,YAAY,KAAA,GAAW,IAAI,UAAU,KAAK;MAC9C,IAAI,OAAO,YAAY,KAAA,GAAW,IAAI,UAAU,OAAO;CAE5D,IAAI,KAAK,YAAY,KAAA,GAAW,IAAI,UAAU,KAAK;MAC9C,IAAI,OAAO,YAAY,KAAA,GAAW,IAAI,UAAU,OAAO;CAE5D,IAAI,KAAK,UAAU,KAAA,GAAW,IAAI,QAAQ,KAAK;CAE/C,IAAI,KAAK,cAAc,KAAA,GAAW,IAAI,YAAY,KAAK;CAGvD,IAAI,KAAK,aAAa,KAAA,GAAW,IAAI,WAAW,KAAK;MAChD,IAAI,OAAO,aAAa,KAAA,GAAW,IAAI,WAAW,OAAO;CAE9D,IAAI,KAAK,UAAU,KAAA,GAAW,IAAI,QAAQ,KAAK;MAC1C,IAAI,OAAO,UAAU,KAAA,GAAW,IAAI,QAAQ,OAAO;CAGxD,IAAI,KAAK,eAAe,KAAA,GAAW,IAAI,aAAa,KAAK;MACpD,IAAI,OAAO,eAAe,KAAA,GAAW,IAAI,aAAa,OAAO;CAElE,IAAI,KAAK,eAAe,KAAA,GAAW,IAAI,aAAa,KAAK;MACpD,IAAI,OAAO,eAAe,KAAA,GAAW,IAAI,aAAa,OAAO;CAGlE,IAAI,KAAK,aAAa,KAAA,GAAW,IAAI,WAAW,KAAK;MAChD,IAAI,OAAO,aAAa,KAAA,GAAW,IAAI,WAAW,OAAO;CAE9D,IAAI,KAAK,WAAW,KAAA,GAAW,IAAI,SAAS,KAAK;MAC5C,IAAI,OAAO,WAAW,KAAA,GAAW,IAAI,SAAS,OAAO;CAE1D,IAAI,KAAK,aAAa,KAAA,GAAW,IAAI,WAAW,KAAK;MAChD,IAAI,OAAO,aAAa,KAAA,GAAW,IAAI,WAAW,OAAO;CAG9D,IAAI,KAAK,kBAAkB,KAAA,GAAW,IAAI,gBAAgB,KAAK;MAC1D,IAAI,OAAO,kBAAkB,KAAA,GAAW,IAAI,gBAAgB,OAAO;CAExE,IAAI,KAAK,WAAW,KAAA,GAAW,IAAI,SAAS,KAAK;MAC5C,IAAI,OAAO,WAAW,KAAA,GAAW,IAAI,SAAS,OAAO;CAE1D,IAAI,KAAK,cAAc,KAAA,GAAW,IAAI,YAAY,KAAK;MAClD,IAAI,OAAO,cAAc,KAAA,GAAW,IAAI,YAAY,OAAO;CAEhE,IAAI,KAAK,mBAAmB,KAAA,GAAW,IAAI,iBAAiB,KAAK;MAC5D,IAAI,OAAO,mBAAmB,KAAA,GAAW,IAAI,iBAAiB,OAAO;CAE1E,IAAI,KAAK,iBAAiB,KAAA,GAAW,IAAI,eAAe,KAAK;MACxD,IAAI,OAAO,iBAAiB,KAAA,GAAW,IAAI,eAAe,OAAO;CAEtE,OAAO"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@super-repo/envx",
   "description": "A global executable to run applications with the ENV variables witin a monorepo loaded by dotenvx",
-  "version": "0.2.3-b.3",
+  "version": "0.2.3-b.4",
   "type": "module",
   "bin": {
     "envx": "./dist/cli.js",
@@ -60,8 +60,8 @@
     "vite": "^8.0.11",
     "vite-plugin-dts": "^5.0.0",
     "vitest": "^4.1.5",
-    "@super-repo/cli": "0.2.3-b.3",
-    "@super-repo/envx-common": "0.0.1",
-    "@super-repo/envx-libs": "0.0.1"
+    "@super-repo/envx-libs": "0.0.1",
+    "@super-repo/cli": "0.2.3-b.4",
+    "@super-repo/envx-common": "0.0.1"
   }
 }

package/dist/chunks/commands-DNf_gJRx.js

@@ -1,538 +0,0 @@
-import { _ as isEncrypted, a as encryptFiles, c as findWorkspaceRoot, d as resolveCwdOrWorkspace, f as resolveEnvPaths, g as parseEnv, h as log, i as decryptFiles, l as listEnvFiles, m as expandEnvSrc, n as loadDotenvxConfig, o as DEFAULT_NODE_ENV_MAP, p as validateCmdVariable, r as rotateFiles, s as detectEnvironment, t as writeProcessed, u as loadEnv } from "./src-CwrtyfZE.js";
-import * as fs from "fs";
-import * as path from "path";
-import yargs from "yargs";
-import { execSync } from "child_process";
-//#region src/commands/debug.ts
-var debugCommand = {
-	command: "debug",
-	describe: "Show which env files would be loaded and which variables would be applied, without loading them.",
-	handler: (argv) => {
-		const paths = resolveEnvPaths({
-			envFiles: argv["env"],
-			cascade: argv["cascade"]
-		});
-		const rawVars = argv["variables"];
-		const variables = rawVars ? Object.fromEntries(rawVars.map(validateCmdVariable)) : {};
-		log.info(`Paths: ${JSON.stringify(paths)}`);
-		log.info(`Variables: ${JSON.stringify(variables)}`);
-	}
-};
-//#endregion
-//#region src/commands/decrypt.ts
-/** Mirror of `dotenvx decrypt` from upstream — see also encrypt.ts. */
-var decryptCommand = {
-	command: "decrypt",
-	describe: "Decrypt the values in one or more .env files in place using the matching private key in .env.keys.",
-	builder: (yargs) => yargs.option("env-keys-file", {
-		alias: "fk",
-		type: "string",
-		describe: "Path to the .env.keys file (default: ./.env.keys at cwd, regardless of --dir / --env-path)."
-	}).option("key", {
-		alias: "k",
-		type: "array",
-		string: true,
-		describe: "Specific keys (or picomatch globs) to decrypt. Default: all keys."
-	}).option("exclude-key", {
-		alias: "ek",
-		type: "array",
-		string: true,
-		describe: "Keys (or picomatch globs) to leave encrypted."
-	}).option("stdout", {
-		type: "boolean",
-		default: false,
-		describe: "Write the decrypted env contents to stdout instead of saving in place."
-	}).help("h").alias("h", "help"),
-	handler: (argv) => {
-		const envFiles = argv["env"] ?? [".env"];
-		const keys = argv["key"];
-		const excludeKeys = argv["exclude-key"];
-		const envKeysFile = argv["env-keys-file"];
-		const stdout = argv["stdout"] ?? false;
-		const result = decryptFiles({
-			envFiles,
-			...keys ? { keys } : {},
-			...excludeKeys ? { excludeKeys } : {},
-			...envKeysFile ? { envKeysFile } : {}
-		});
-		let hadError = false;
-		for (const processed of result.processedEnvs) {
-			if (processed.error) {
-				hadError = true;
-				log.error(`${processed.envFilepath}: ${processed.error.message}`);
-				if (processed.error.help) log.dim(processed.error.help);
-				continue;
-			}
-			if (stdout) process.stdout.write(processed.envSrc);
-		}
-		if (!stdout) {
-			const { written } = writeProcessed(result.processedEnvs);
-			for (const w of written) log.success(`decrypted ${w}`);
-			if (written.length === 0 && result.unchangedFilepaths.length > 0 && !hadError) log.dim(`no changes (${result.unchangedFilepaths.join(", ")})`);
-		}
-		if (hadError) process.exitCode = 1;
-	}
-};
-//#endregion
-//#region src/commands/encrypt.ts
-/**
-* Mirrors the upstream `dotenvx encrypt` flags so existing muscle
-* memory carries over. The `--env` global doubles as the file list
-* (the upstream calls it `--env-file`); this CLI keeps a single
-* canonical name across subcommands.
-*/
-var encryptCommand = {
-	command: "encrypt",
-	describe: "Encrypt the values in one or more .env files. Generates a private key in .env.keys on first run.",
-	builder: (yargs) => yargs.option("env-keys-file", {
-		alias: "fk",
-		type: "string",
-		describe: "Path to the .env.keys file (default: ./.env.keys at cwd, regardless of --dir / --env-path)."
-	}).option("key", {
-		alias: "k",
-		type: "array",
-		string: true,
-		describe: "Specific keys (or picomatch globs) to encrypt. Default: all keys."
-	}).option("exclude-key", {
-		alias: "ek",
-		type: "array",
-		string: true,
-		describe: "Keys (or picomatch globs) to leave plaintext."
-	}).option("stdout", {
-		type: "boolean",
-		default: false,
-		describe: "Write the encrypted env contents to stdout instead of saving in place."
-	}).help("h").alias("h", "help"),
-	handler: (argv) => {
-		const envFiles = argv["env"] ?? [".env"];
-		const keys = argv["key"];
-		const excludeKeys = argv["exclude-key"];
-		const envKeysFile = argv["env-keys-file"];
-		const stdout = argv["stdout"] ?? false;
-		const result = encryptFiles({
-			envFiles,
-			...keys ? { keys } : {},
-			...excludeKeys ? { excludeKeys } : {},
-			...envKeysFile ? { envKeysFile } : {}
-		});
-		let hadError = false;
-		for (const processed of result.processedEnvs) {
-			if (processed.error) {
-				hadError = true;
-				log.error(`${processed.envFilepath}: ${processed.error.message}`);
-				if (processed.error.help) log.dim(processed.error.help);
-				continue;
-			}
-			if (stdout) {
-				process.stdout.write(processed.envSrc);
-				continue;
-			}
-			if (processed.privateKeyAdded) log.success(`key added to .env.keys (${processed.privateKeyName ?? "<unknown>"})`);
-		}
-		if (!stdout) {
-			const { written } = writeProcessed(result.processedEnvs);
-			for (const w of written) log.success(`encrypted ${w}`);
-			if (written.length === 0 && result.unchangedFilepaths.length > 0 && !hadError) log.dim(`no changes (${result.unchangedFilepaths.join(", ")})`);
-		}
-		if (hadError) process.exitCode = 1;
-	}
-};
-//#endregion
-//#region src/commands/expand.ts
-/**
-* Decrypts (when needed) and expands variable references in an env
-* file. Mirrors the workflow `decrypt-vault` action — but cycle-safe,
-* supports `${VAR:-default}` / `${VAR:?msg}`, and never silently
-* truncates after N passes.
-*/
-var expandCommand = {
-	command: "expand",
-	describe: "Decrypt (if needed) and expand ${VAR}/$VAR references in an env file. Outputs to stdout by default.",
-	builder: (yargs) => yargs.option("output", {
-		type: "string",
-		describe: "Write the expanded result to this file (default: stdout)."
-	}).option("env-keys-file", {
-		alias: "fk",
-		type: "string",
-		describe: "Path to .env.keys (default: ./.env.keys at cwd, regardless of --dir / --env-path)."
-	}).option("on-missing", {
-		type: "string",
-		choices: [
-			"leave",
-			"empty",
-			"throw"
-		],
-		default: "leave",
-		describe: "How to handle ${UNRESOLVED_VAR}: leave it literal, substitute empty, or fail."
-	}).help("h").alias("h", "help"),
-	handler: (argv) => {
-		const envFiles = argv["env"] ?? [".env"];
-		if (envFiles.length !== 1) {
-			log.error(`expand operates on a single env file at a time; got ${String(envFiles.length)}.`);
-			process.exit(1);
-		}
-		const envFile = envFiles[0];
-		const filepath = path.resolve(envFile);
-		if (!fs.existsSync(filepath)) {
-			log.error(`env file not found: ${envFile}`);
-			process.exit(1);
-		}
-		let envSrc = fs.readFileSync(filepath, "utf8");
-		if (parseEnv(envSrc).some((l) => l.type === "kv" && isEncrypted(l.value))) {
-			const envKeysFile = argv["env-keys-file"];
-			const processed = decryptFiles({
-				envFiles: [envFile],
-				...envKeysFile ? { envKeysFile } : {}
-			}).processedEnvs[0];
-			if (processed?.error) {
-				log.error(`${envFile}: ${processed.error.message}`);
-				if (processed.error.help) log.dim(processed.error.help);
-				process.exit(1);
-			}
-			envSrc = processed.envSrc;
-		}
-		const onMissing = argv["on-missing"];
-		const result = expandEnvSrc(envSrc, { onMissing });
-		for (const v of result.unresolved) log.warn(`unresolved variable: ${v}`);
-		for (const cycle of result.cycles) log.warn(`cycle: ${cycle.join(" → ")}`);
-		const output = argv["output"];
-		if (output) {
-			fs.writeFileSync(path.resolve(output), result.envSrc);
-			log.success(`expanded ${envFile} → ${output}`);
-		} else {
-			process.stdout.write(result.envSrc);
-			if (!result.envSrc.endsWith("\n")) process.stdout.write("\n");
-		}
-	}
-};
-//#endregion
-//#region src/commands/info.ts
-/**
-* Print everything envx knows about the current invocation: which
-* config file it found, the resolved settings, which platform signals
-* are present, what auto-detection produced, the NODE_ENV → suffix
-* map (built-in + user overrides), and the env file paths it would
-* load. Read-only — does not mutate process.env or write any files.
-*/
-var infoCommand = {
-	command: "info",
-	describe: "Show resolved configuration, auto-detection details, NODE_ENV mappings, and which env files would be loaded.",
-	builder: (yargs) => yargs.help("h").alias("h", "help"),
-	handler: (argv) => {
-		const cfg = argv["__envxConfig"] ?? {};
-		const cfgSource = argv["__envxConfigSource"];
-		const cfgOrigin = argv["__envxConfigOrigin"];
-		const workspaceRoot = findWorkspaceRoot();
-		const cwd = process.cwd();
-		log.info("envx info");
-		log.dim("─".repeat(60));
-		log.info("Workspace");
-		line("cwd", cwd);
-		line("workspace root", workspaceRoot === cwd ? `${workspaceRoot}  (none detected — using cwd)` : workspaceRoot);
-		blank();
-		log.info("Config");
-		line("source", cfgSource ?? "(none — built-in defaults)");
-		line("origin", cfgOrigin ?? "defaults");
-		blank();
-		log.info("Resolved settings");
-		line("envFiles", argv["env"] ?? cfg.envFiles ?? [".env"]);
-		line("envPath", argv["env-path"] ?? cfg.envPath ?? "(none)");
-		line("cascade", formatCascade(argv["cascade"] ?? cfg.cascade));
-		line("envKeysFile", formatPath(argv["env-keys-file"] ?? cfg.envKeysFile, cwd, workspaceRoot));
-		line("override", argv["override"] ?? cfg.override ?? false);
-		line("quiet", argv["quiet"] ?? cfg.quiet ?? true);
-		line("autoDetect", cfg.autoDetect ?? true);
-		line("expand", cfg.expand ?? false);
-		line("required", cfg.required && cfg.required.length > 0 ? cfg.required : "(none)");
-		line("defaults", cfg.defaults && Object.keys(cfg.defaults).length > 0 ? cfg.defaults : "(none)");
-		line("workspaceRoot (config)", cfg.workspaceRoot ?? "(auto-detect via findWorkspaceRoot)");
-		blank();
-		log.info("Platform signals (process.env)");
-		line("VERCEL", process.env["VERCEL"] ?? "(unset)");
-		line("VERCEL_ENV", process.env["VERCEL_ENV"] ?? "(unset)");
-		line("NETLIFY", process.env["NETLIFY"] ?? "(unset)");
-		line("CONTEXT", process.env["CONTEXT"] ?? "(unset)");
-		line("NODE_ENV", process.env.NODE_ENV ?? "(unset)");
-		blank();
-		log.info("Auto-detection");
-		const autoDetect = cfg.autoDetect ?? true;
-		if (!autoDetect) line("status", "disabled (autoDetect: false)");
-		else {
-			const detected = detectEnvironment({ ...cfg.nodeEnvMap !== void 0 ? { nodeEnvMap: cfg.nodeEnvMap } : {} });
-			line("source", pickDetectionSource());
-			line("detected", detected);
-			line("→ env file", detected === "root" ? ".env" : `.env.${detected}`);
-		}
-		blank();
-		log.info("NODE_ENV → suffix mapping");
-		log.dim("  (any NODE_ENV value not in this map passes through lowercased,");
-		log.dim("   so e.g. NODE_ENV=qa loads .env.qa)");
-		const userMap = cfg.nodeEnvMap ?? {};
-		const merged = {
-			...DEFAULT_NODE_ENV_MAP,
-			...userMap
-		};
-		const allKeys = Array.from(new Set([...Object.keys(merged)])).sort();
-		for (const k of allKeys) {
-			const v = merged[k] ?? "";
-			const suffix = v === "" ? "(no suffix → .env)" : `.env.${v}`;
-			const origin = userMap[k] === void 0 ? "default" : DEFAULT_NODE_ENV_MAP[k] === void 0 ? "config" : "config (override)";
-			line(`  ${k.padEnd(14)} → ${suffix}`, origin);
-		}
-		blank();
-		log.info("Resolved env file paths (would be loaded in this order)");
-		const paths = resolveEnvPaths({
-			...argv["env"] !== void 0 ? { envFiles: argv["env"] } : {},
-			...argv["cascade"] !== void 0 ? { cascade: argv["cascade"] } : {},
-			autoDetect,
-			...cfg.nodeEnvMap !== void 0 ? { nodeEnvMap: cfg.nodeEnvMap } : {}
-		});
-		if (paths.length === 0) line("(none)", "");
-		else {
-			const subdir = argv["env-path"] ?? (argv["vault"] ? "vault" : "");
-			for (const p of paths) {
-				if (path.isAbsolute(p)) {
-					log.dim(`  ${p}`);
-					continue;
-				}
-				const resolved = subdir ? resolveCwdOrWorkspace(path.join(subdir, p)) : resolveCwdOrWorkspace(p);
-				log.dim(`  ${p}  →  ${resolved}`);
-			}
-		}
-	}
-};
-function line(key, value, suffix) {
-	const v = value === void 0 || value === null ? "(unset)" : Array.isArray(value) ? value.length === 0 ? "[]" : JSON.stringify(value) : typeof value === "object" ? JSON.stringify(value) : String(value);
-	const tail = suffix ? `  ${dim(`(${suffix})`)}` : "";
-	log.dim(`  ${key.padEnd(14)} ${v}${tail}`);
-}
-function blank() {
-	console.log("");
-}
-function dim(s) {
-	return `\x1b[2m${s}\x1b[22m`;
-}
-function formatCascade(cascade) {
-	if (cascade === void 0 || cascade === false) return "(off)";
-	if (cascade === true) return "true (uses auto-detected env name)";
-	return String(cascade);
-}
-function pickDetectionSource() {
-	if (process.env["VERCEL"]) return "Vercel (VERCEL_ENV)";
-	if (process.env["NETLIFY"]) return "Netlify (CONTEXT)";
-	if (process.env.NODE_ENV) return "NODE_ENV";
-	return "(no signals — fallback to .env)";
-}
-function formatPath(raw, cwd, wsRoot) {
-	if (!raw) return `${resolveCwdOrWorkspace(".env.keys", cwd)}  (default: cwd-first, ws-root fallback)`;
-	if (path.isAbsolute(raw)) return `${raw}  (absolute)`;
-	return `${raw}  →  ${path.resolve(cwd, raw)}  (or ${path.resolve(wsRoot, raw)} if not at cwd)`;
-}
-//#endregion
-//#region src/commands/print.ts
-var printCommand = {
-	command: "print <variable>",
-	describe: "Load env files and print the value of a single variable.",
-	builder: (yargs) => yargs.positional("variable", {
-		describe: "Name of the variable to print",
-		type: "string",
-		demandOption: true
-	}),
-	handler: (argv) => {
-		loadEnv({
-			envFiles: argv["env"],
-			variables: argv["variables"],
-			cascade: argv["cascade"],
-			vault: argv["vault"],
-			envPath: argv["env-path"],
-			override: argv["override"],
-			quiet: argv["quiet"]
-		});
-		const name = argv["variable"];
-		const value = process.env[name];
-		process.stdout.write(value != null ? `${value}\n` : "\n");
-	}
-};
-//#endregion
-//#region src/commands/rotate.ts
-/**
-* Rotate the asymmetric keypair for one or more env files. Generates a
-* fresh secp256k1 keypair, decrypts existing values with the old
-* private key, re-encrypts with the new public key, and updates both
-* the `ENVX_PUBLIC_KEY*` header in the env file and the
-* `ENVX_PRIVATE_KEY*` entry in `.env.keys`.
-*
-* Files without a public-key header surface an error — run
-* `envx encrypt` against them first to set up the keypair.
-*/
-var rotateCommand = {
-	command: "rotate",
-	describe: "Rotate the asymmetric keypair for one or more env files.",
-	builder: (yargs) => yargs.option("env-keys-file", {
-		alias: "fk",
-		type: "string",
-		describe: "Path to the .env.keys file (default: ./.env.keys at cwd). Relative paths resolve against each env file's directory."
-	}).option("key", {
-		alias: "k",
-		type: "array",
-		string: true,
-		describe: "Specific keys (or picomatch globs) to rotate. Default: all encrypted keys."
-	}).option("exclude-key", {
-		alias: "ek",
-		type: "array",
-		string: true,
-		describe: "Keys (or picomatch globs) to leave with their existing ciphertext."
-	}).help("h").alias("h", "help"),
-	handler: (argv) => {
-		const envFiles = argv["env"] ?? [".env"];
-		const keys = argv["key"];
-		const excludeKeys = argv["exclude-key"];
-		const envKeysFile = argv["env-keys-file"];
-		const result = rotateFiles({
-			envFiles,
-			...keys ? { keys } : {},
-			...excludeKeys ? { excludeKeys } : {},
-			...envKeysFile ? { envKeysFile } : {}
-		});
-		let hadError = false;
-		for (const processed of result.processedEnvs) if (processed.error) {
-			hadError = true;
-			log.error(`${processed.envFilepath}: ${processed.error.message}`);
-			if (processed.error.help) log.dim(processed.error.help);
-		}
-		const { written } = writeProcessed(result.processedEnvs);
-		for (const w of written) log.success(`rotated ${w}`);
-		if (written.length === 0 && result.unchangedFilepaths.length > 0 && !hadError) log.dim(`no changes (${result.unchangedFilepaths.join(", ")})`);
-		if (hadError) process.exitCode = 1;
-	}
-};
-//#endregion
-//#region src/commands/run.ts
-var runCommand = {
-	command: "run [command..]",
-	aliases: ["$0"],
-	describe: "Load env files into process.env and execute a command. Default subcommand — `dotenvx-run [command]` is equivalent.",
-	builder: (yargs) => yargs.positional("command", {
-		describe: "Command to execute after loading env files",
-		type: "string",
-		array: true
-	}),
-	handler: (argv) => {
-		const command = (argv["command"] ?? []).join(" ");
-		const cfg = argv["__envxConfig"] ?? {};
-		loadEnv({
-			envFiles: argv["env"],
-			variables: argv["variables"],
-			cascade: argv["cascade"],
-			vault: argv["vault"],
-			envPath: argv["env-path"],
-			override: argv["override"],
-			quiet: argv["quiet"],
-			...cfg.autoDetect !== void 0 ? { autoDetect: cfg.autoDetect } : {},
-			...cfg.nodeEnvMap !== void 0 ? { nodeEnvMap: cfg.nodeEnvMap } : {},
-			...cfg.required !== void 0 ? { required: cfg.required } : {},
-			...cfg.expand !== void 0 ? { expand: cfg.expand } : {},
-			...cfg.defaults !== void 0 ? { defaults: cfg.defaults } : {},
-			...cfg.workspaceRoot !== void 0 ? { workspaceRoot: cfg.workspaceRoot } : {}
-		});
-		if (!command) return;
-		log.info(`Running: ${command}`);
-		try {
-			execSync(command, { stdio: "inherit" });
-			log.success(`Command completed: ${command}`);
-		} catch (error) {
-			const msg = error instanceof Error ? error.message : String(error);
-			log.error(`Command failed: ${msg}`);
-			process.exit(1);
-		}
-	}
-};
-//#endregion
-//#region src/commands/index.ts
-/**
-* Build the yargs CLI for `dotenvx-run`. Global options (env, variables,
-* cascade, vault, override, quiet) are registered on the root so every
-* subcommand inherits them.
-*/
-function createCli(argvInput) {
-	return yargs(argvInput).scriptName("envx").usage("$0 <command> [options]").option("config", {
-		alias: "c",
-		type: "string",
-		describe: "Path to an envx config file (default: discovered from package.json `envx.config` or envx.config.{ts,js,json})."
-	}).option("env", {
-		alias: "e",
-		type: "array",
-		describe: "Env files to load. Default: [\".env\"] (or `envFiles` from config; or every .env* under --env-path when set). Auto-detects environment when omitted."
-	}).option("env-path", {
-		alias: ["dir", "d"],
-		type: "string",
-		describe: "Subdirectory of the workspace root holding the env files (e.g. `vault`). When set and --env is omitted, every .env* file in that directory is included."
-	}).option("variables", {
-		alias: "v",
-		type: "array",
-		describe: "Inline variables in the form name=value (repeatable).",
-		default: []
-	}).option("cascade", {
-		type: "string",
-		describe: "Cascade load order: .env, .env.<cascade>, .env.local, .env.<cascade>.local"
-	}).option("vault", {
-		alias: "va",
-		type: "boolean",
-		describe: "Shortcut for `--env-path vault`."
-	}).option("override", {
-		alias: "o",
-		type: "boolean",
-		describe: "Override existing process.env values. Conflicts with --cascade."
-	}).option("quiet", {
-		alias: "q",
-		type: "boolean",
-		describe: "Suppress dotenv's own output."
-	}).middleware((argv) => {
-		const configPath = argv["config"];
-		let loaded;
-		try {
-			loaded = loadDotenvxConfig({ ...configPath ? { configPath } : {} });
-		} catch (e) {
-			log.error(`config error: ${e.message}`);
-			process.exit(1);
-		}
-		if (loaded.source) log.dim(`config: ${loaded.source} (${loaded.origin})`);
-		const cfg = loaded.config;
-		argv["__envxConfig"] = cfg;
-		argv["__envxConfigSource"] = loaded.source;
-		argv["__envxConfigOrigin"] = loaded.origin;
-		if (argv["cascade"] === void 0 && cfg.cascade !== void 0) argv["cascade"] = cfg.cascade;
-		if (argv["override"] === void 0) argv["override"] = cfg.override ?? false;
-		if (argv["quiet"] === void 0) argv["quiet"] = cfg.quiet ?? true;
-		if (argv["vault"] === void 0) argv["vault"] = false;
-		if (argv["env-keys-file"] === void 0 && cfg.envKeysFile !== void 0) argv["env-keys-file"] = cfg.envKeysFile;
-		if (argv["env-path"] === void 0) {
-			if (cfg.envPath !== void 0) argv["env-path"] = cfg.envPath;
-			else if (argv["vault"]) argv["env-path"] = "vault";
-		}
-		const userPassedEnv = Array.isArray(argv["env"]) && argv["env"].length > 0;
-		let files;
-		if (userPassedEnv) files = argv["env"];
-		else if (cfg.envFiles && cfg.envFiles.length > 0) files = [...cfg.envFiles];
-		else if (typeof argv["env-path"] === "string") {
-			const subdir = argv["env-path"];
-			const discovered = listEnvFiles(resolveCwdOrWorkspace(subdir));
-			if (discovered.length > 0) {
-				files = discovered;
-				log.dim(`env-path ${subdir}: discovered ${String(discovered.length)} file(s) — ${discovered.join(", ")}`);
-			} else {
-				files = [".env"];
-				log.warn(`env-path ${subdir}: no .env* files found; falling back to [".env"]`);
-			}
-		} else files = [".env"];
-		if (typeof argv["env-path"] === "string") {
-			const dir = resolveCwdOrWorkspace(argv["env-path"]);
-			files = files.map((f) => path.isAbsolute(f) ? f : path.join(dir, f));
-		}
-		argv["env"] = files;
-	}).command(runCommand).command(printCommand).command(debugCommand).command(encryptCommand).command(decryptCommand).command(expandCommand).command(rotateCommand).command(infoCommand).help("h").alias("h", "help").version().strictCommands().demandCommand(0).recommendCommands().epilog("Examples:\n  envx -- node app.js                # load .env (auto-detected) and run\n  envx --env dev -- pnpm start       # load .env.dev\n  envx print DATABASE_URL            # print one variable\n  envx debug --cascade prod          # show resolved paths\n  envx encrypt -e .env.prod          # encrypt values in .env.prod\n  envx decrypt -e .env.prod -k FOO   # decrypt only FOO\n  envx expand -e vault/.env.prod     # decrypt + expand to stdout\n  envx -c ./my.config.json run -- node app.js");
-}
-//#endregion
-export { createCli as t };
-
-//# sourceMappingURL=commands-DNf_gJRx.js.map