@varlock/nextjs-integration 1.0.0 → 1.0.1

package/dist/plugin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/plugin.ts"],"names":["patchGlobalConsole","fs","scanForLeaks","varlockSettings","patchGlobalServerResponse","redactSensitiveConfig","path"],"mappings":";;;;;;;;;;;;;;AAgBA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe;AAC9B,EAAA,OAAA,CAAQ,KAAA,CAAM;AAAA,IACZ,0DAAA;AAAA,IACA,EAAA;AAAA,IACA,gFAAA;AAAA,IACA,kEAAA;AAAA,IACA;AAAA,GACF,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AACZ,EAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AACtE;AAEAA,+BAAA,EAAmB;AAEnB,IAAM,SAAA,GAAY,CAAC,CAAC,OAAA,CAAQ,GAAA,CAAI,mBAAA;AAChC,SAAS,SAAS,IAAA,EAAkB;AAClC,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,8BAAA,EAAgC;AACjD,EAAA,OAAA,CAAQ,GAAA;AAAA,IACN,QAAA;AAAA,IACA,YAAY,WAAA,GAAc,UAAA;AAAA,IAC1B,IAAA;AAAA,IACA,GAAG;AAAA,GACL;AACF;AACA,KAAA,CAAM,wDAAmD,CAAA;AAEzD,IAAM,mBAAA,GAAsB,0BAAA;AAM5B,IAAI,kBAAA,GAAqB,KAAA;AACzB,eAAe,gBAAgB,WAAA,EAAqB;AAClD,EAAA,kBAAA,GAAqB,IAAA;AACrB,EAAA,WAAA,MAAiB,QAAQC,mBAAA,CAAG,QAAA,CAAS,KAAK,CAAA,EAAG,WAAW,YAAY,CAAA,EAAG;AACrE,IAAA,MAAM,eAAe,MAAMA,mBAAA,CAAG,QAAA,CAAS,QAAA,CAAS,MAAM,MAAM,CAAA;AAC5D,IAAAC,gBAAA,CAAa,YAAA,EAAc,EAAE,MAAA,EAAQ,+BAAA,EAAiC,MAAM,CAAA;AAAA,EAC9E;AACF;AAMA,SAAS,oBAAA,GAAuB;AAE9B,EAAA,MAAM,eAAA,GAAkBD,oBAAG,QAAA,CAAS,SAAA;AACpC,EAAAA,mBAAA,CAAG,QAAA,CAAS,SAAA,GAAY,eAAe,oBAAA,CAAA,GAAwB,IAAA,EAAM;AACnE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,CAAC,CAAA,CAAE,QAAA,EAAS;AAIlC,IAAA,IAAI,QAAA,CAAS,QAAA,CAAS,gCAAgC,CAAA,IAAK,CAAC,kBAAA,EAAoB;AAC9E,MAAA,MAAM,cAAc,QAAA,CAAS,SAAA,CAAU,GAAG,QAAA,CAAS,WAAA,CAAY,GAAG,CAAC,CAAA;AACnE,MAAA,MAAM,gBAAgB,WAAW,CAAA;AAAA,IACnC;AAaA,IAAA,OAAO,eAAA,CAAgB,IAAA,CAAK,IAAA,EAAM,GAAG,IAAI,CAAA;AAAA,EAC3C,CAAA;AACF;AAQA,IAAI,sBAAA;AACJ,IAAM,uBAAA,GAA0B,IAAI,KAAA,CAAM,EAAC,EAA6B;AAAA,EACtE,QAAQ,OAAA,EAAS;AACf,IAAA,sBAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,iBAAiB,IAAI,CAAA;AACrE,IAAA,MAAM,cAAc,EAAC;AACrB,IAAA,KAAA,MAAW,OAAA,IAAW,uBAAuB,MAAA,EAAQ;AACnD,MAAA,MAAM,IAAA,GAAO,sBAAA,CAAuB,MAAA,CAAO,OAAO,CAAA;AAClD,MAAA,IAAI,CAAC,IAAA,CAAK,WAAA,cAAyB,IAAA,CAAK,CAAA,IAAA,EAAO,OAAO,CAAA,CAAE,CAAA;AAAA,IAC1D;AACA,IAAA,KAAA,CAAM,qCAAqC,WAAW,CAAA;AACtD,IAAA,OAAO,WAAA;AAAA,EACT,CAAA;AAAA,EACA,wBAAA,CAAyB,SAAS,IAAA,EAAM;AACtC,IAAA,MAAM,UAAU,IAAA,CAAK,QAAA,GAAW,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC5C,IAAA,MAAM,IAAA,GAAO,sBAAA,EAAwB,MAAA,CAAO,OAAO,CAAA;AACnD,IAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,WAAA,EAAa;AAC/B,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,EAAA;AAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,UAAA,EAAY,IAAA;AAAA,MACZ,YAAA,EAAc;AAAA,KAChB;AAAA,EACF,CAAA;AAAA,EACA,GAAA,CAAI,SAAS,IAAA,EAAM;AACjB,IAAA,MAAM,UAAU,IAAA,CAAK,QAAA,GAAW,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC5C,IAAA,MAAM,IAAA,GAAO,sBAAA,EAAwB,MAAA,CAAO,OAAO,CAAA;AACnD,IAAA,IAAI,IAAA,IAAQ,CAAC,IAAA,CAAK,WAAA,SAAoB,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,EACjE;AACF,CAAC,CAAA;AAYM,SAAS,wBAAwB,cAAA,EAAuC;AAG7E,EAAA,OAAO,CAAC,UAAA,KAA0E;AAChF,IAAA,KAAA,CAAM,iCAAiC,CAAA;AAEvC,IAAA,OAAO,OAAO,OAAe,QAAA,KAA4C;AACvE,MAAA,IAAI,kBAAA;AACJ,MAAA,IAAI,OAAO,eAAe,UAAA,EAAY;AACpC,QAAA,MAAM,kBAAA,GAAqB,UAAA,CAAW,KAAA,EAAO,QAAQ,CAAA;AACrD,QAAA,kBAAA,GAAqB,MAAM,kBAAA;AAAA,MAC7B,CAAA,MAAO;AACL,QAAA,kBAAA,GAAqB,UAAA;AAAA,MACvB;AAEA,MAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,SAAA,IAAa,OAAA,CAAQ,IAAI,oBAAA,EAAsB;AAC7D,QAAA,OAAA,CAAQ,KAAA,CAAM;AAAA,UACZ,6GAAA;AAAA,UACA,EAAA;AAAA,UACA,kDAAA;AAAA,UACA,8EAAA;AAAA,UACA,6FAAA;AAAA,UACA;AAAA,SACF,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AACZ,QAAA,MAAM,IAAI,MAAM,yDAAyD,CAAA;AAAA,MAC3E;AAEA,MAAA,OAAO;AAAA,QACL,GAAG,kBAAA;AAAA,QACH,OAAA,CAAQ,eAAe,OAAA,EAAS;AAC9B,UAAA,KAAA,CAAM,iDAAiD,CAAA;AAEvD,UAAA,MAAM,EAAE,KAAI,GAAI,OAAA;AAEhB,UAAA,IAAIE,oBAAgB,YAAA,EAAc;AAGhC,YAAA,oBAAA,EAAqB;AAGrB,YAAAC,6CAAA,CAA0B;AAAA;AAAA,cAExB,iBAAA,EAAmB,CAAC,4BAA4B,CAAA;AAAA;AAAA,cAEhD,oBAAA,EAAsB;AAAA,aACvB,CAAA;AAAA,UACH;AAGA,UAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AAGxB,UAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,YAAA,aAAA,GAAgB,kBAAA,CAAmB,OAAA,CAAQ,aAAA,EAAe,OAAO,CAAA;AAAA,UACnE;AAEA,UAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,eAAe,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAIpG,UAAA,KAAA,CAAM,iDAAiD,CAAA;AACvD,UAAA,aAAA,CAAc,QAAQ,IAAA,CAAK,IAAI,OAAA,CAAQ,YAAA,CAAa,uBAAuB,CAAC,CAAA;AAE5E,UAAA,IAAID,oBAAgB,YAAA,EAAc;AAChC,YAAA,aAAA,CAAc,QAAQ,IAAA,CAAK;AAAA,cACzB,MAAM,QAAA,EAAe;AACnB,gBAAA,QAAA,CAAS,MAAM,YAAA,CAAa,GAAA,CAAI,mBAAA,EAAqB,CAAC,MAAW,YAAA,KAAsB;AACrF,kBAAA,MAAM,EAAE,OAAA,EAAS,UAAA,EAAW,GAAI,YAAA;AAGhC,kBAAA,IACE,UAAA,CAAW,QAAA,CAAS,uBAAuB,CAAA,IAExC,WAAW,QAAA,CAAS,OAAO,CAAA,IAC3B,UAAA,CAAW,SAAS,OAAO,CAAA,IAC3B,UAAA,CAAW,QAAA,CAAS,MAAM,CAAA,EAC7B;AAGA,oBAAA,IAAI;AACF,sBAAAD,gBAAA,CAAa,OAAA,EAAS;AAAA,wBACpB,MAAA,EAAQ,wDAAA;AAAA,wBACR,IAAA,EAAM;AAAA,uBACP,CAAA;AAAA,oBACH,SAAS,GAAA,EAAK;AACZ,sBAAA,IAAI,GAAA,EAAK;AAEP,wBAAAD,mBAAA,CAAG,cAAc,UAAA,EAAYI,yBAAA,CAAsB,OAAA,CAAQ,QAAA,EAAU,CAAC,CAAA;AAAA,sBACxE,CAAA,MAAO;AACL,wBAAA,MAAM,GAAA;AAAA,sBACR;AAAA,oBACF;AAAA,kBACF;AAAA,gBACF,CAAC,CAAA;AAAA,cACH;AAAA,aACD,CAAA;AAAA,UACH;AAWA,UAAA,SAAS,mCAAA,CAAoC,eAAe,KAAA,EAAO;AACjE,YAAA,OAAO,SAAS,cAAc,UAAA,EAAiB;AAC7C,cAAA,MAAM,aAAA,GAAgB,WAAW,MAAA,EAAO;AAIxC,cAAA,MAAM,YAAA,GAAeC,qBAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,yBAAyB,CAAA;AACtE,cAAA,MAAM,WAAA,GAAcL,mBAAA,CAAG,YAAA,CAAa,YAAA,EAAc,MAAM,CAAA;AAGxD,cAAA,MAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA,gBAMvB,WAAA;AAAA,gBACA;AAAA,eACF,CAAE,KAAK,IAAI,CAAA;AAEX,cAAA,OAAO,IAAI,OAAA,CAAQ,OAAA,CAAQ,SAAA,CAAU,gBAAgB,CAAA;AAAA,YACvD,CAAA;AAAA,UACF;AAEA,UAAA,aAAA,CAAc,QAAQ,IAAA,CAAK;AAAA,YACzB,MAAM,QAAA,EAAe;AACnB,cAAA,QAAA,CAAS,KAAA,CAAM,eAAA,CAAgB,GAAA,CAAI,mBAAA,EAAqB,CAAC,WAAA,KAAqB;AAC5E,gBAAA,WAAA,CAAY,MAAM,aAAA,CAAc,GAAA;AAAA,kBAC9B;AAAA,oBACE,IAAA,EAAM,mBAAA;AAAA,oBACN,KAAA,EAAO,QAAQ,WAAA,CAAY;AAAA,mBAC7B;AAAA,kBACA,MAAM;AAEJ,oBAAA,IAAI,WAAA,CAAY,QAAA,CAAS,oBAAoB,CAAA,EAAG;AAC9C,sBAAA,WAAA,CAAY,WAAA,CAAY,oBAAA,EAAsB,mCAAA,EAAqC,CAAA;AAAA,oBACrF;AACA,oBAAA,IAAI,WAAA,CAAY,QAAA,CAAS,uBAAuB,CAAA,EAAG;AACjD,sBAAA,WAAA,CAAY,WAAA,CAAY,uBAAA,EAAyB,mCAAA,EAAqC,CAAA;AAAA,oBACxF;AACA,oBAAA,IAAI,WAAA,CAAY,QAAA,CAAS,wBAAwB,CAAA,EAAG;AAClD,sBAAA,WAAA,CAAY,WAAA,CAAY,wBAAA,EAA0B,mCAAA,EAAqC,CAAA;AAAA,oBACzF;AACA,oBAAA,IAAI,WAAA,CAAY,QAAA,CAAS,2BAA2B,CAAA,EAAG;AACrD,sBAAA,WAAA,CAAY,WAAA,CAAY,2BAAA,EAA6B,mCAAA,EAAqC,CAAA;AAAA,oBAC5F;AAEA,oBAAA,IAAI,WAAA,CAAY,QAAA,CAAS,yBAAyB,CAAA,EAAG;AACnD,sBAAA,WAAA,CAAY,WAAA,CAAY,yBAAA,EAA2B,mCAAA,CAAoC,IAAI,CAAC,CAAA;AAAA,oBAC9F;AAAA,kBACF;AAAA,iBACF;AAAA,cACF,CAAC,CAAA;AAAA,YACH;AAAA,WAED,CAAA;AAED,UAAA,OAAO,aAAA;AAAA,QACT;AAAA,OACF;AAAA,IACF,CAAA;AAAA,EACF,CAAA;AACF","file":"plugin.js","sourcesContent":["/* eslint-disable no-console */\n\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { NextConfig } from 'next';\n\nimport {\n  redactSensitiveConfig, scanForLeaks, varlockSettings,\n} from 'varlock/env';\nimport { patchGlobalServerResponse } from 'varlock/patch-server-response';\nimport { patchGlobalConsole } from 'varlock/patch-console';\n\nimport { type SerializedEnvGraph } from 'varlock';\n\n// make sure varlock has acutally loaded the env files\n// NOTE - we dont need to call `initVarlockEnv` becuase the next-env-compat has already been loaded and called it\nif (!process.env.__VARLOCK_ENV) {\n  console.error([\n    '🚨 process.env.__VARLOCK_ENV is not set 🚨',\n    '',\n    'To use this plugin, you must override @next/env with @varlock/next-integration',\n    'See https://varlock.dev/integrations/nextjs for more information',\n    '',\n  ].join('\\n'));\n  throw new Error('VarlockNextWebpackPlugin: __VARLOCK_ENV is not set');\n}\n\npatchGlobalConsole();\n\nconst IS_WORKER = !!process.env.NEXT_PRIVATE_WORKER;\nfunction debug(...args: Array<any>) {\n  if (!process.env.DEBUG_VARLOCK_NEXT_INTEGRATION) return;\n  console.log(\n    'plugin',\n    IS_WORKER ? '[worker] ' : '[server]',\n    '--',\n    ...args,\n  );\n}\ndebug('✨ LOADED @varlock/next-integration/plugin module!');\n\nconst WEBPACK_PLUGIN_NAME = 'VarlockNextWebpackPlugin';\n\ntype VarlockPluginOptions = {\n  // injectResolvedConfigAtBuildTime: boolean,\n};\n\nlet scannedStaticFiles = false;\nasync function scanStaticFiles(nextDirPath: string) {\n  scannedStaticFiles = true;\n  for await (const file of fs.promises.glob(`${nextDirPath}/**/*.html`)) {\n    const fileContents = await fs.promises.readFile(file, 'utf8');\n    scanForLeaks(fileContents, { method: 'nextjs scan static html files', file });\n  }\n}\n\n// not all file writes go through this, at least in Next 15\n// (likely because webpack and prerendering are happening in workers)\n// but we can use this to monitor writing of certain files and give ourselves a \"hook\"\n// which we can then scan existing files\nfunction patchGlobalFsMethods() {\n  // patch fs.promises.writeFile\n  const origWriteFileFn = fs.promises.writeFile;\n  fs.promises.writeFile = async function dmnoPatchedWriteFile(...args) {\n    const filePath = args[0].toString();\n    // const fileContents = args[1].toString();\n    // console.log('⚡️ patched fs.promises.writeFile', filePath);\n\n    if (filePath.endsWith('/.next/next-server.js.nft.json') && !scannedStaticFiles) {\n      const nextDirPath = filePath.substring(0, filePath.lastIndexOf('/'));\n      await scanStaticFiles(nextDirPath);\n    }\n\n    // // naively enable/disable detection based on file extension... probably not the best logic but it might be enough?\n    // if (\n    //   filePath.endsWith('.html')\n    //   || filePath.endsWith('.rsc')\n    //   || filePath.endsWith('.body')\n    //   // we also need to scan .js files, but they are already built by webpack so we can't catch it here\n    // ) {\n    //   // TODO: better error details to help user _find_ the problem\n    //   scanForLeaks(fileContents, { method: 'nextjs fs.writeFile', file: filePath });\n    // }\n\n    return origWriteFileFn.call(this, ...args);\n  };\n}\n\n\n// We use a proxy object for the static replacements that we pass to webpack.DefinePlugin\n// because this plugin/webpack code is not invoked again when env files change\n// instead next is direcly messing with the existing plugins for their own changes\n// so instead we use a proxy object, and grab the values off of process.env.__VARLOCK_ENV\n// which will have been updated by our next-env-compat code\nlet latestLoadedVarlockEnv: SerializedEnvGraph | undefined;\nconst StaticReplacementsProxy = new Proxy({} as Record<string, string>, {\n  ownKeys(_target) {\n    latestLoadedVarlockEnv = JSON.parse(process.env.__VARLOCK_ENV || '{}') as SerializedEnvGraph;\n    const replaceKeys = [] as Array<string>;\n    for (const itemKey in latestLoadedVarlockEnv.config) {\n      const item = latestLoadedVarlockEnv.config[itemKey];\n      if (!item.isSensitive) replaceKeys.push(`ENV.${itemKey}`);\n    }\n    debug('reloaded static replacements keys', replaceKeys);\n    return replaceKeys;\n  },\n  getOwnPropertyDescriptor(_target, prop) {\n    const itemKey = prop.toString().split('.')[1];\n    const item = latestLoadedVarlockEnv?.config[itemKey];\n    if (!item || item.isSensitive) return;\n    return {\n      value: '', // this value is not used, the get handler will return the value\n      writable: false,\n      enumerable: true,\n      configurable: true,\n    };\n  },\n  get(_target, prop) {\n    const itemKey = prop.toString().split('.')[1];\n    const item = latestLoadedVarlockEnv?.config[itemKey];\n    if (item && !item.isSensitive) return JSON.stringify(item.value);\n  },\n});\n\n\n\n\nexport type NextConfigFunction = (\n  phase: string,\n  defaults: { defaultConfig: NextConfig },\n) => NextConfig | PromiseLike<NextConfig>;\n\n\n// we make this a plugin a function because we'll likely end up adding some options\nexport function varlockNextConfigPlugin(_pluginOptions?: VarlockPluginOptions) {\n  // nextjs doesnt have a proper plugin system :(\n  // so we use a function which takes in a config object and returns an augmented one\n  return (nextConfig: any | NextConfig | NextConfigFunction): NextConfigFunction => {\n    debug('varlockNextConfigPlugin init fn');\n\n    return async (phase: string, defaults: { defaultConfig: NextConfig }) => {\n      let resolvedNextConfig: NextConfig;\n      if (typeof nextConfig === 'function') {\n        const nextConfigFnResult = nextConfig(phase, defaults);\n        resolvedNextConfig = await nextConfigFnResult;\n      } else {\n        resolvedNextConfig = nextConfig;\n      }\n\n      if (process.env.TURBOPACK || process.env.npm_config_turbopack) {\n        console.error([\n          '🚨 @varlock/nextjs-integration: Turbopack is not yet supported for varlockNextConfigPlugin 🚨',\n          '',\n          'You can either stop using the `--turbopack` flag',\n          'or remove this plugin from your config, and only use the @next/env override.',\n          \"However if you don't use the plugin, you will not get all the benefits of this integration.\",\n          '',\n        ].join('\\n'));\n        throw new Error('varlockNextConfigPlugin: Turbopack is not yet supported');\n      }\n\n      return {\n        ...resolvedNextConfig,\n        webpack(webpackConfig, options) {\n          debug('varlockNextConfigPlugin webpack config patching');\n\n          const { dev } = options; // also available - isServer, nextRuntime\n\n          if (varlockSettings.preventLeaks) {\n            // we patch fs methods - ideally we would just path them to scan while files are written\n            // but instead we use it to detect what phase the build is in, and then run our own scan on already built files\n            patchGlobalFsMethods();\n\n            // have to wait to run this until here when we know if this is dev mode or not\n            patchGlobalServerResponse({\n              // ignore sourcemaps - although we may in future want to scrub them?\n              ignoreUrlPatterns: [/^\\/__nextjs_source-map\\?.*/],\n              // in dev mode, we redact the secrets rather than throwing, because otherwise the dev server crashes\n              redactInsteadOfThrow: dev,\n            });\n          }\n\n          // webpack itself is passed in so we dont have to import it (or make it a dependency)\n          const webpack = options.webpack;\n\n          // apply existing user customizations if there are any\n          if (resolvedNextConfig.webpack) {\n            webpackConfig = resolvedNextConfig.webpack(webpackConfig, options);\n          }\n\n          if (!process.env.__VARLOCK_ENV) throw new Error('VarlockNextWebpackPlugin: __VARLOCK_ENV is not set');\n\n          // Set up build-time replacements / rewrites - using webpack.DefinePlugin and a proxy\n          // TODO: use shared helpers from core library?\n          debug('adding ENV.xxx static replacements proxy object');\n          webpackConfig.plugins.push(new webpack.DefinePlugin(StaticReplacementsProxy));\n\n          if (varlockSettings.preventLeaks) {\n            webpackConfig.plugins.push({\n              apply(compiler: any) {\n                compiler.hooks.assetEmitted.tap(WEBPACK_PLUGIN_NAME, (file: any, assetDetails: any) => {\n                  const { content, targetPath } = assetDetails;\n                  // debug('emit file: ', targetPath);\n\n                  if (\n                    targetPath.includes('/.next/static/chunks/')\n                    // Dont think these actually ever happen?\n                    || targetPath.endsWith('.html')\n                    || targetPath.endsWith('.body')\n                    || targetPath.endsWith('.rsc')\n                  ) {\n                    // NOTE - in dev mode the request hangs on the error, but the console error should help\n                    // and during a build, it will actually fail the build\n                    try {\n                      scanForLeaks(content, {\n                        method: '@varlock/nextjs-integration/plugin - assetEmitted hook',\n                        file: targetPath,\n                      });\n                    } catch (err) {\n                      if (dev) {\n                        // overwrite file with redacted version\n                        fs.writeFileSync(targetPath, redactSensitiveConfig(content.toString()));\n                      } else {\n                        throw err;\n                      }\n                    }\n                  }\n                });\n              },\n            });\n          }\n\n\n\n\n          // we need to inject the dmno globals injector and call it\n          // and in vercel/netlify etc where we can't run via `dmno run` we need to inject the resolved config into the build\n          // not sure if this is the best way, but injecting into the `webpack-runtime.js` file seems to run everywhere\n\n          // updates the webpack source to inject dmno global logic and call it\n          // we run this on the runtimes for serverless and edge\n          function injectVarlockInitIntoWebpackRuntime(_edgeRuntime = false) {\n            return function assetUpdateFn(origSource: any) {\n              const origSourceStr = origSource.source();\n\n              // we will inline the injector code, but need a different version if we are running in the edge runtime\n              // const injectorSrc = getCjsModuleSource(`dmno/injector-standalone${edgeRuntime ? '/edge' : ''}`);\n              const injectorPath = path.resolve(__dirname, './patch-next-runtime.js');\n              const injectorSrc = fs.readFileSync(injectorPath, 'utf8');\n\n\n              const updatedSourceStr = [\n                // TODO: reimplement dynamic/static functionality, which triggers a call to next/headers (or similar)\n                // when accessing a dynamic env item. This will force the page into dynamic rendering mode\n                // see DMNO integration for more details\n\n                // inline the dmno injector code\n                injectorSrc,\n                origSourceStr,\n              ].join('\\n');\n\n              return new webpack.sources.RawSource(updatedSourceStr);\n            };\n          }\n\n          webpackConfig.plugins.push({\n            apply(compiler: any) {\n              compiler.hooks.thisCompilation.tap(WEBPACK_PLUGIN_NAME, (compilation: any) => {\n                compilation.hooks.processAssets.tap(\n                  {\n                    name: WEBPACK_PLUGIN_NAME,\n                    stage: webpack.Compilation.PROCESS_ASSETS_STAGE_ADDITIONS,\n                  },\n                  () => {\n                    // not sure why, but these paths are different in build vs dev\n                    if (compilation.getAsset('webpack-runtime.js')) {\n                      compilation.updateAsset('webpack-runtime.js', injectVarlockInitIntoWebpackRuntime());\n                    }\n                    if (compilation.getAsset('../webpack-runtime.js')) {\n                      compilation.updateAsset('../webpack-runtime.js', injectVarlockInitIntoWebpackRuntime());\n                    }\n                    if (compilation.getAsset('webpack-api-runtime.js')) {\n                      compilation.updateAsset('webpack-api-runtime.js', injectVarlockInitIntoWebpackRuntime());\n                    }\n                    if (compilation.getAsset('../webpack-api-runtime.js')) {\n                      compilation.updateAsset('../webpack-api-runtime.js', injectVarlockInitIntoWebpackRuntime());\n                    }\n\n                    if (compilation.getAsset('edge-runtime-webpack.js')) {\n                      compilation.updateAsset('edge-runtime-webpack.js', injectVarlockInitIntoWebpackRuntime(true));\n                    }\n                  },\n                );\n              });\n            },\n\n          });\n\n          return webpackConfig; // must return the modified config\n        },\n      };\n    };\n  };\n}\n"]}
+{"version":3,"sources":["../src/webpack-plugin.ts","../src/turbopack-runtime-inject.ts","../src/plugin.ts"],"names":["debug","patchGlobalFsMethods","varlockSettings","patchGlobalServerResponse","scanForLeaks","fs","redactSensitiveConfig","path","patchGlobalConsole","initVarlockEnv","getRedactionMapInfo"],"mappings":";;;;;;;;;;;;;;;;;;;;AAUA,IAAM,mBAAA,GAAsB,0BAAA;AAO5B,IAAI,sBAAA;AACJ,SAAS,8BAA8BA,MAAAA,EAAsC;AAC3E,EAAA,OAAO,IAAI,KAAA,CAAM,EAAC,EAA6B;AAAA,IAC7C,QAAQ,OAAA,EAAS;AACf,MAAA,sBAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,iBAAiB,IAAI,CAAA;AACrE,MAAA,MAAM,cAAc,EAAC;AACrB,MAAA,KAAA,MAAW,OAAA,IAAW,uBAAuB,MAAA,EAAQ;AACnD,QAAA,MAAM,IAAA,GAAO,sBAAA,CAAuB,MAAA,CAAO,OAAO,CAAA;AAClD,QAAA,IAAI,CAAC,IAAA,CAAK,WAAA,cAAyB,IAAA,CAAK,CAAA,IAAA,EAAO,OAAO,CAAA,CAAE,CAAA;AAAA,MAC1D;AACA,MAAAA,MAAAA,CAAM,qCAAqC,WAAW,CAAA;AACtD,MAAA,OAAO,WAAA;AAAA,IACT,CAAA;AAAA,IACA,wBAAA,CAAyB,SAAS,IAAA,EAAM;AACtC,MAAA,MAAM,UAAU,IAAA,CAAK,QAAA,GAAW,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC5C,MAAA,MAAM,IAAA,GAAO,sBAAA,EAAwB,MAAA,CAAO,OAAO,CAAA;AACnD,MAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,WAAA,EAAa;AAC/B,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,EAAA;AAAA;AAAA,QACP,QAAA,EAAU,KAAA;AAAA,QACV,UAAA,EAAY,IAAA;AAAA,QACZ,YAAA,EAAc;AAAA,OAChB;AAAA,IACF,CAAA;AAAA,IACA,GAAA,CAAI,SAAS,IAAA,EAAM;AACjB,MAAA,MAAM,UAAU,IAAA,CAAK,QAAA,GAAW,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC5C,MAAA,MAAM,IAAA,GAAO,sBAAA,EAAwB,MAAA,CAAO,OAAO,CAAA;AACnD,MAAA,IAAI,IAAA,IAAQ,CAAC,IAAA,CAAK,WAAA,SAAoB,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,IACjE;AAAA,GACD,CAAA;AACH;AAEO,SAAS,qBAAA,CACd,kBAAA,EACAC,qBAAAA,EACAD,MAAAA,EACA,OAAA,EACA;AACA,EAAA,MAAM,uBAAA,GAA0B,8BAA8BA,MAAK,CAAA;AAEnE,EAAA,OAAO,SAAS,eAAA,CAAgB,aAAA,EAAoB,OAAA,EAAc;AAChE,IAAAA,OAAM,iDAAiD,CAAA;AAEvD,IAAA,MAAM,EAAE,KAAI,GAAI,OAAA;AAIhB,IAAA,IAAI,OAAA,EAASC,qBAAAA,EAAqB;AAElC,IAAA,IAAIC,oBAAgB,YAAA,EAAc;AAEhC,MAAAC,6CAAA,CAA0B;AAAA,QACxB,iBAAA,EAAmB;AAAA,UACjB,4BAAA;AAAA;AAAA,UACA;AAAA;AAAA,SACF;AAAA;AAAA,QAEA,oBAAA,EAAsB;AAAA,OACvB,CAAA;AAAA,IACH;AAGA,IAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AAGxB,IAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,MAAA,aAAA,GAAgB,kBAAA,CAAmB,OAAA,CAAQ,aAAA,EAAe,OAAO,CAAA;AAAA,IACnE;AAEA,IAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,eAAe,MAAM,IAAI,MAAM,oDAAoD,CAAA;AASpG,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,WAAA,KAAgB,MAAA,EAAQ;AACtD,MAAA,aAAA,CAAc,MAAA,CAAO,MAAM,IAAA,CAAK;AAAA,QAC9B,IAAA,EAAM,4BAAA;AAAA,QACN,OAAA,EAAS,cAAA;AAAA,QACT,GAAA,EAAK;AAAA,UACH;AAAA,YACE,MAAA,EAAQ,SAAA,CAAQ,OAAA,CAAQ,UAAU,CAAA;AAAA,YAClC,OAAA,EAAS,EAAE,OAAA,EAAS,SAAA;AAAU;AAChC;AACF,OACD,CAAA;AAAA,IACH;AAIA,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,WAAA,KAAgB,MAAA,EAAQ;AACtD,MAAA,aAAA,CAAc,MAAA,CAAO,MAAM,IAAA,CAAK;AAAA,QAC9B,IAAA,EAAM,4BAAA;AAAA,QACN,OAAA,EAAS,cAAA;AAAA,QACT,GAAA,EAAK;AAAA,UACH;AAAA,YACE,MAAA,EAAQ,SAAA,CAAQ,OAAA,CAAQ,UAAU,CAAA;AAAA,YAClC,OAAA,EAAS,EAAE,OAAA,EAAS,SAAA,EAAW,QAAQ,IAAA;AAAK;AAC9C;AACF,OACD,CAAA;AAAA,IACH;AAIA,IAAAH,OAAM,iDAAiD,CAAA;AACvD,IAAA,aAAA,CAAc,QAAQ,IAAA,CAAK,IAAI,OAAA,CAAQ,YAAA,CAAa,uBAAuB,CAAC,CAAA;AAE5E,IAAA,IAAIE,oBAAgB,YAAA,EAAc;AAChC,MAAA,aAAA,CAAc,QAAQ,IAAA,CAAK;AAAA,QACzB,MAAM,QAAA,EAAe;AACnB,UAAA,QAAA,CAAS,MAAM,YAAA,CAAa,GAAA,CAAI,mBAAA,EAAqB,CAAC,OAAY,YAAA,KAAsB;AACtF,YAAA,MAAM,EAAE,OAAA,EAAS,UAAA,EAAW,GAAI,YAAA;AAEhC,YAAA,IACE,WAAW,QAAA,CAAS,uBAAuB,KACxC,UAAA,CAAW,QAAA,CAAS,OAAO,CAAA,EAE9B;AAGA,cAAA,IAAI;AACF,gBAAAE,gBAAA,CAAa,OAAA,EAAS;AAAA,kBACpB,MAAA,EAAQ,wDAAA;AAAA,kBACR,IAAA,EAAM;AAAA,iBACP,CAAA;AAAA,cACH,SAAS,GAAA,EAAK;AACZ,gBAAA,IAAI,GAAA,EAAK;AAEP,kBAAAC,oBAAA,CAAG,cAAc,UAAA,EAAYC,yBAAA,CAAsB,OAAA,CAAQ,QAAA,EAAU,CAAC,CAAA;AAAA,gBACxE,CAAA,MAAO;AACL,kBAAA,MAAM,GAAA;AAAA,gBACR;AAAA,cACF;AAAA,YACF;AAAA,UACF,CAAC,CAAA;AAAA,QACH;AAAA,OACD,CAAA;AAAA,IACH;AAMA,IAAA,SAAS,mCAAA,CAAoC,cAAc,KAAA,EAAO;AAChE,MAAA,OAAO,SAAS,cAAc,UAAA,EAAiB;AAC7C,QAAA,MAAM,aAAA,GAAgB,WAAW,MAAA,EAAO;AAExC,QAAA,MAAM,cAAA,GAAiB,cAAc,WAAA,GAAc,aAAA;AACnD,QAAA,MAAM,YAAA,GAAe,SAAA,CAAQ,OAAA,CAAQ,CAAA,QAAA,EAAW,cAAc,CAAA,CAAE,CAAA;AAChE,QAAA,MAAM,WAAA,GAAcD,oBAAA,CAAG,YAAA,CAAa,YAAA,EAAc,MAAM,CAAA;AAIxD,QAAA,MAAM,MAAA,GAAS,QAAQ,GAAA,CAAI,aAAA;AAC3B,QAAA,MAAM,YAAY,MAAA,GACd,CAAA,yDAAA,EAA4D,KAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAA,CAAA,GAClF,EAAA;AAEJ,QAAA,MAAM,gBAAA,GAAmB;AAAA,UACvB,SAAA;AAAA;AAAA;AAAA,UAGA,6BAA6B,WAAW,CAAA,oBAAA,CAAA;AAAA,UACxC;AAAA,SACF,CAAE,KAAK,IAAI,CAAA;AAEX,QAAA,OAAO,IAAI,OAAA,CAAQ,OAAA,CAAQ,SAAA,CAAU,gBAAgB,CAAA;AAAA,MACvD,CAAA;AAAA,IACF;AAEA,IAAA,MAAM,aAAA,GAAgB,QAAQ,WAAA,KAAgB,MAAA;AAC9C,IAAA,aAAA,CAAc,QAAQ,IAAA,CAAK;AAAA,MACzB,MAAM,QAAA,EAAe;AACnB,QAAA,QAAA,CAAS,KAAA,CAAM,eAAA,CAAgB,GAAA,CAAI,mBAAA,EAAqB,CAAC,WAAA,KAAqB;AAC5E,UAAA,WAAA,CAAY,MAAM,aAAA,CAAc,GAAA;AAAA,YAC9B;AAAA,cACE,IAAA,EAAM,mBAAA;AAAA,cACN,KAAA,EAAO,QAAQ,WAAA,CAAY;AAAA,aAC7B;AAAA,YACA,MAAM;AACJ,cAAA,IAAI,aAAA,EAAe;AAEjB,gBAAA,IAAI,WAAA,CAAY,QAAA,CAAS,yBAAyB,CAAA,EAAG;AACnD,kBAAA,WAAA,CAAY,WAAA,CAAY,yBAAA,EAA2B,mCAAA,CAAoC,IAAI,CAAC,CAAA;AAAA,gBAC9F;AAEA,gBAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,oBAAA,EAAsB,uBAAuB,CAAA,EAAG;AAClE,kBAAA,IAAI,WAAA,CAAY,QAAA,CAAS,IAAI,CAAA,EAAG;AAC9B,oBAAA,WAAA,CAAY,WAAA,CAAY,IAAA,EAAM,mCAAA,CAAoC,IAAI,CAAC,CAAA;AAAA,kBACzE;AAAA,gBACF;AAAA,cACF,CAAA,MAAA,IAAW,QAAQ,QAAA,EAAU;AAE3B,gBAAA,KAAA,MAAW,QAAQ,CAAC,oBAAA,EAAsB,uBAAA,EAAyB,wBAAA,EAA0B,2BAA2B,CAAA,EAAG;AACzH,kBAAA,IAAI,WAAA,CAAY,QAAA,CAAS,IAAI,CAAA,EAAG;AAC9B,oBAAA,WAAA,CAAY,WAAA,CAAY,IAAA,EAAM,mCAAA,EAAqC,CAAA;AAAA,kBACrE;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,WACF;AAAA,QACF,CAAC,CAAA;AAAA,MACH;AAAA,KACD,CAAA;AAED,IAAA,OAAO,aAAA;AAAA,EACT,CAAA;AACF;ACjOA,SAAS,SAAS,IAAA,EAAkB;AAClC,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,8BAAA,EAAgC;AAEjD,EAAA,OAAA,CAAQ,GAAA,CAAI,WAAA,EAAa,GAAG,IAAI,CAAA;AAClC;AAWA,IAAI,wBAAA,GAA2B,KAAA;AACxB,SAAS,sCAAsC,WAAA,EAAqB;AACzE,EAAA,IAAI,wBAAA,EAA0B;AAE9B,EAAA,MAAM,MAAA,GAAS,QAAQ,GAAA,CAAI,aAAA;AAC3B,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA;AAAA,EACF;AAKA,EAAA,MAAM,qBAAoC,EAAC;AAC3C,EAAA,MAAM,mBAAkC,EAAC;AACzC,EAAA,MAAM,OAAA,GAAU,CAAC,GAAA,KAAgB;AAC/B,IAAA,IAAI,CAACA,oBAAAA,CAAG,UAAA,CAAW,GAAG,CAAA,EAAG;AACzB,IAAA,KAAA,MAAW,KAAA,IAASA,qBAAG,WAAA,CAAY,GAAA,EAAK,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAChE,MAAA,IAAI,KAAA,CAAM,aAAY,EAAG;AACvB,QAAA,OAAA,CAAQE,sBAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,CAAM,IAAI,CAAC,CAAA;AAAA,MACpC,CAAA,MAAA,IAAW,KAAA,CAAM,IAAA,KAAS,wBAAA,EAA0B;AAClD,QAAA,kBAAA,CAAmB,KAAKA,sBAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,CAAM,IAAI,CAAC,CAAA;AAAA,MACpD,CAAA,MAAA,IAAW,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,cAAc,KAAK,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,EAAG;AAC5E,QAAA,gBAAA,CAAiB,KAAKA,sBAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,CAAM,IAAI,CAAC,CAAA;AAAA,MAClD;AAAA,IACF;AAAA,EACF,CAAA;AACA,EAAA,OAAA,CAAQ,WAAW,CAAA;AAEnB,EAAA,KAAA,CAAM,sCAAsC,kBAAA,CAAmB,MAAM,CAAA,uBAAA,EAA0B,gBAAA,CAAiB,MAAM,CAAA,mBAAA,CAAqB,CAAA;AAE3I,EAAA,IAAI,CAAC,mBAAmB,MAAA,EAAQ;AAG9B,IAAA;AAAA,EACF;AAGA,EAAA,wBAAA,GAA2B,IAAA;AAG3B,EAAA,MAAM,gBAAgBF,oBAAAA,CAAG,YAAA,CAAa,UAAQ,OAAA,CAAQ,qBAAqB,GAAG,MAAM,CAAA;AACpF,EAAA,MAAM,cAAcA,oBAAAA,CAAG,YAAA,CAAa,UAAQ,OAAA,CAAQ,mBAAmB,GAAG,MAAM,CAAA;AAChF,EAAA,MAAM,SAAA,GAAY,CAAA,yDAAA,EAA4D,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAA,CAAA;AAIpG,EAAA,MAAM,QAAA,GAAW,CAAC,GAAA,KAAgB,CAAA,0BAAA,EAA6B,GAAG,CAAA,oBAAA,CAAA;AAGlE,EAAA,KAAA,MAAW,eAAe,kBAAA,EAAoB;AAC5C,IAAA,MAAM,UAAA,GAAaA,oBAAAA,CAAG,YAAA,CAAa,WAAA,EAAa,MAAM,CAAA;AACtD,IAAA,MAAM,aAAA,GAAgB;AAAA,MACpB,SAAA;AAAA,MACA,SAAS,aAAa,CAAA;AAAA,MACtB;AAAA,KACF,CAAE,KAAK,IAAI,CAAA;AACX,IAAAA,oBAAAA,CAAG,aAAA,CAAc,WAAA,EAAa,aAAa,CAAA;AAC3C,IAAA,KAAA,CAAM,CAAA,6CAAA,EAAgD,WAAW,CAAA,CAAE,CAAA;AAAA,EACrE;AAGA,EAAA,KAAA,MAAW,eAAe,gBAAA,EAAkB;AAC1C,IAAA,MAAM,UAAA,GAAaA,oBAAAA,CAAG,YAAA,CAAa,WAAA,EAAa,MAAM,CAAA;AACtD,IAAA,MAAM,aAAA,GAAgB;AAAA,MACpB,SAAA;AAAA,MACA,SAAS,WAAW,CAAA;AAAA,MACpB;AAAA,KACF,CAAE,KAAK,IAAI,CAAA;AACX,IAAAA,oBAAAA,CAAG,aAAA,CAAc,WAAA,EAAa,aAAa,CAAA;AAC3C,IAAA,KAAA,CAAM,CAAA,sCAAA,EAAyC,WAAW,CAAA,CAAE,CAAA;AAAA,EAC9D;AACF;AAEO,SAAS,0BAAA,GAA6B;AAC3C,EAAA,OAAO,wBAAA;AACT;;;AC3EA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe;AAC9B,EAAA,OAAA,CAAQ,KAAA,CAAM;AAAA,IACZ,0DAAA;AAAA,IACA,EAAA;AAAA,IACA,gFAAA;AAAA,IACA,kEAAA;AAAA,IACA;AAAA,GACF,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AACZ,EAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AACtE;AAEAG,+BAAA,EAAmB;AAInB,IAAM,YAAA,GAAe,CAAC,EACpB,OAAA,CAAQ,GAAA,CAAI,SAAA,IACT,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,OAAA,CAAQ,GAAA,CAAI,eAAA,IACZ,QAAQ,GAAA,CAAI,oBAAA,CAAA;AAMjB,IAAI,YAAA,IAAgBN,oBAAgB,YAAA,EAAc;AAChD,EAAAC,6CAAAA,CAA0B;AAAA,IACxB,iBAAA,EAAmB;AAAA,MACjB,4BAAA;AAAA;AAAA,MACA;AAAA;AAAA,KACF;AAAA;AAAA,IAEA,oBAAA,EAAsB;AAAA,GACvB,CAAA;AACH;AAEA,IAAM,SAAA,GAAY,CAAC,CAAC,OAAA,CAAQ,GAAA,CAAI,mBAAA;AAChC,SAASH,UAAS,IAAA,EAAkB;AAClC,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,8BAAA,EAAgC;AACjD,EAAA,OAAA,CAAQ,GAAA;AAAA,IACN,QAAA;AAAA,IACA,YAAY,WAAA,GAAc,UAAA;AAAA,IAC1B,IAAA;AAAA,IACA,GAAG;AAAA,GACL;AACF;AACAA,MAAAA,CAAM,wDAAmD,CAAA;AAMzD,IAAI,kBAAA,GAAqB,KAAA;AACzB,eAAe,gBAAgB,WAAA,EAAqB;AAClD,EAAA,kBAAA,GAAqB,IAAA;AACrB,EAAA,WAAA,MAAiB,QAAQK,oBAAAA,CAAG,QAAA,CAAS,KAAK,CAAA,EAAG,WAAW,YAAY,CAAA,EAAG;AACrE,IAAA,MAAM,eAAe,MAAMA,oBAAAA,CAAG,QAAA,CAAS,QAAA,CAAS,MAAM,MAAM,CAAA;AAC5D,IAAAD,iBAAa,YAAA,EAAc,EAAE,MAAA,EAAQ,+BAAA,EAAiC,MAAM,CAAA;AAAA,EAC9E;AACF;AAEA,IAAI,kBAAA,GAAqB,KAAA;AACzB,eAAe,gBAAgB,WAAA,EAAqB;AAClD,EAAA,IAAI,kBAAA,EAAoB;AACxB,EAAA,kBAAA,GAAqB,IAAA;AAGrB,EAAA,MAAM,WAA+B,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,iBAAiB,IAAI,CAAA;AACjF,EAAA,MAAM,kBAAiE,EAAC;AACxE,EAAA,KAAA,MAAW,OAAA,IAAW,SAAS,MAAA,EAAQ;AACrC,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,MAAA,CAAO,OAAO,CAAA;AACpC,IAAA,IAAI,IAAA,CAAK,WAAA,IAAe,IAAA,CAAK,KAAA,IAAS,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,IAAY,IAAA,CAAK,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG;AAE7F,MAAA,eAAA,CAAgB,IAAA,CAAK;AAAA,QACnB,OAAO,IAAA,CAAK,KAAA;AAAA,QACZ,WAAA,EAAa,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,MAAM,MAAM;AAAA,OAC1C,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,IAAI,CAAC,gBAAgB,MAAA,EAAQ;AAC3B,IAAAJ,OAAM,8CAA8C,CAAA;AACpD,IAAA;AAAA,EACF;AAEA,EAAA,eAAA,CAAgB,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,KAAA,CAAM,MAAA,GAAS,CAAA,CAAE,KAAA,CAAM,MAAM,CAAA;AAE9D,EAAA,IAAI,UAAA,GAAa,CAAA;AACjB,EAAA,WAAA,MAAiB,WAAWK,oBAAAA,CAAG,QAAA,CAAS,KAAK,CAAA,EAAG,WAAW,WAAW,CAAA,EAAG;AACvE,IAAA,MAAM,WAAW,MAAMA,oBAAAA,CAAG,QAAA,CAAS,QAAA,CAAS,SAAS,MAAM,CAAA;AAC3D,IAAA,IAAI,QAAA,GAAW,QAAA;AACf,IAAA,KAAA,MAAW,EAAE,KAAA,EAAO,WAAA,EAAY,IAAK,eAAA,EAAiB;AACpD,MAAA,QAAA,GAAW,QAAA,CAAS,UAAA,CAAW,KAAA,EAAO,WAAW,CAAA;AAAA,IACnD;AACA,IAAA,IAAI,aAAa,QAAA,EAAU;AACzB,MAAA,MAAMA,oBAAAA,CAAG,QAAA,CAAS,SAAA,CAAU,OAAA,EAAS,QAAQ,CAAA;AAC7C,MAAA,UAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAAL,MAAAA,CAAM,CAAA,+BAAA,EAAkC,UAAU,CAAA,gBAAA,CAAkB,CAAA;AACtE;AAEA,IAAI,kBAAA,GAAqB,KAAA;AACzB,eAAe,uBAAA,CAAwB,aAAqB,IAAA,EAAgC;AAC1F,EAAA,IAAI,kBAAA,EAAoB;AACxB,EAAA,kBAAA,GAAqB,IAAA;AAIrB,EAAA,IAAI,eAAeE,mBAAAA,CAAgB,YAAA;AACnC,EAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe;AAC3D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAA+B,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,IAAI,aAAa,CAAA;AACzE,MAAA,YAAA,GAAe,SAAS,QAAA,EAAU,YAAA;AAAA,IACpC,CAAA,CAAA,MAAQ;AAAA,IAAe;AAAA,EACzB;AAGA,EAAA,IAAI,OAAA,CAAQ,IAAI,aAAA,EAAe;AAE7B,IAAA,IAAI;AAAE,MAAAO,kBAAA,EAAe;AAAA,IAAG,CAAA,CAAA,MAAQ;AAAA,IAA+C;AAAA,EACjF;AACA,EAAA,MAAM,gBAAgBC,uBAAA,EAAoB;AAC1C,EAAAV,MAAAA,CAAM,yCAAyC,YAAY,CAAA,gBAAA,EAAmB,KAAK,SAAA,CAAU,aAAa,CAAC,CAAA,CAAE,CAAA;AAC7G,EAAA,IAAI,CAAC,YAAA,EAAc;AAEnB,EAAA,MAAM,cAA6B,EAAC;AACpC,EAAA,IAAI,YAAA,GAAe,CAAA;AAInB,EAAA,WAAA,MAAiB,QAAQK,oBAAAA,CAAG,QAAA,CAAS,KAAK,CAAA,EAAG,WAAW,wBAAwB,CAAA,EAAG;AACjF,IAAA,YAAA,EAAA;AACA,IAAA,MAAM,eAAe,MAAMA,oBAAAA,CAAG,QAAA,CAAS,QAAA,CAAS,MAAM,MAAM,CAAA;AAC5D,IAAA,IAAI;AACF,MAAAD,iBAAa,YAAA,EAAc;AAAA,QACzB,MAAA,EAAQ,wCAAA;AAAA,QACR;AAAA,OACD,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,WAAA,CAAY,KAAK,IAAI,CAAA;AAErB,MAAA,MAAMC,qBAAG,QAAA,CAAS,SAAA,CAAU,IAAA,EAAMC,yBAAAA,CAAsB,YAAY,CAAC,CAAA;AAAA,IACvE;AAAA,EACF;AAEA,EAAAN,MAAAA,CAAM,CAAA,QAAA,EAAW,YAAY,CAAA,uBAAA,EAA0B,WAAW,CAAA,eAAA,CAAiB,CAAA;AAKnF,EAAA,KAAA,MAAW,GAAA,IAAO,CAAC,MAAM,CAAA,EAAG;AAC1B,IAAA,WAAA,MAAiB,IAAA,IAAQK,qBAAG,QAAA,CAAS,IAAA,CAAK,GAAG,WAAW,CAAA,MAAA,EAAS,GAAG,CAAA,CAAE,CAAA,EAAG;AACvE,MAAA,YAAA,EAAA;AACA,MAAA,MAAM,eAAe,MAAMA,oBAAAA,CAAG,QAAA,CAAS,QAAA,CAAS,MAAM,MAAM,CAAA;AAC5D,MAAA,IAAI;AACF,QAAAD,iBAAa,YAAA,EAAc;AAAA,UACzB,MAAA,EAAQ,4BAA4B,GAAG,CAAA,CAAA,CAAA;AAAA,UACvC;AAAA,SACD,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,WAAA,CAAY,KAAK,IAAI,CAAA;AACrB,QAAA,MAAMC,qBAAG,QAAA,CAAS,SAAA,CAAU,IAAA,EAAMC,yBAAAA,CAAsB,YAAY,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AAEA,EAAAN,MAAAA,CAAM,CAAA,QAAA,EAAW,YAAY,CAAA,yBAAA,CAA2B,CAAA;AAExD,EAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,IAAA,MAAM,GAAA,GAAM,CAAA,4DAAA,EAAqD,WAAA,CAAY,MAAM,CAAA;AAAA,EAA2B,WAAA,CAAY,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAC3J,IAAA,IAAI,MAAM,SAAA,EAAW;AACnB,MAAA,MAAM,IAAI,MAAM,GAAG,CAAA;AAAA,IACrB;AACA,IAAA,OAAA,CAAQ,MAAM,GAAG,CAAA;AAAA,EACnB,CAAA,MAAO;AACL,IAAAA,OAAM,uCAAkC,CAAA;AAAA,EAC1C;AACF;AAMA,SAAS,oBAAA,GAAuB;AAC9B,EAAAA,OAAM,4BAA4B,CAAA;AAElC,EAAA,MAAM,eAAA,GAAkBK,qBAAG,QAAA,CAAS,SAAA;AACpC,EAAAA,oBAAAA,CAAG,QAAA,CAAS,SAAA,GAAY,eAAe,wBAAwB,IAAA,EAAM;AACnE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,CAAC,CAAA,CAAE,QAAA,EAAS;AAClC,IAAAL,MAAAA,CAAM,0BAA0B,QAAQ,CAAA;AAIxC,IAAA,IAAI,CAAC,0BAAA,EAA2B,IAAK,QAAA,CAAS,QAAA,CAAS,2BAA2B,CAAA,EAAG;AACnF,MAAA,MAAM,cAAc,QAAA,CAAS,SAAA,CAAU,GAAG,QAAA,CAAS,WAAA,CAAY,GAAG,CAAC,CAAA;AACnE,MAAA,qCAAA,CAAsC,WAAW,CAAA;AAAA,IACnD;AAEA,IAAA,IAAI,QAAA,CAAS,QAAA,CAAS,gCAAgC,CAAA,IAAK,CAAC,kBAAA,EAAoB;AAC9E,MAAA,MAAM,cAAc,QAAA,CAAS,SAAA,CAAU,GAAG,QAAA,CAAS,WAAA,CAAY,GAAG,CAAC,CAAA;AACnE,MAAA,MAAM,gBAAgB,WAAW,CAAA;AAAA,IACnC;AAGA,IAAA,IACE,SAAS,QAAA,CAAS,gCAAgC,KAC/C,QAAA,CAAS,QAAA,CAAS,gCAAgC,CAAA,EACrD;AACA,MAAA,MAAM,cAAc,QAAA,CAAS,SAAA,CAAU,GAAG,QAAA,CAAS,WAAA,CAAY,GAAG,CAAC,CAAA;AACnE,MAAA,IAAI,CAAC,kBAAA,EAAoB,MAAM,eAAA,CAAgB,WAAW,CAAA;AAC1D,MAAA,IAAI,CAAC,oBAAoB,MAAM,uBAAA,CAAwB,aAAa,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,IACzF;AAEA,IAAA,OAAO,eAAA,CAAgB,IAAA,CAAK,IAAA,EAAM,GAAG,IAAI,CAAA;AAAA,EAC3C,CAAA;AAGA,EAAA,MAAM,sBAAsBK,oBAAAA,CAAG,aAAA;AAC/B,EAAAA,oBAAAA,CAAG,aAAA,GAAgB,SAAS,wBAAA,CAAA,GAA4B,IAAA,EAA2C;AACjG,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,CAAC,CAAA,CAAE,QAAA,EAAS;AAClC,IAAAL,MAAAA,CAAM,qBAAqB,QAAQ,CAAA;AAEnC,IAAA,IAAI,CAAC,0BAAA,EAA2B,IAAK,QAAA,CAAS,QAAA,CAAS,2CAA2C,CAAA,EAAG;AACnG,MAAA,MAAM,cAAc,QAAA,CAAS,SAAA,CAAU,GAAG,QAAA,CAAS,WAAA,CAAY,GAAG,CAAC,CAAA;AACnE,MAAA,qCAAA,CAAsC,WAAW,CAAA;AAAA,IACnD;AAEA,IAAA,OAAO,mBAAA,CAAoB,IAAA,CAAK,IAAA,EAAM,GAAG,IAAI,CAAA;AAAA,EAC/C,CAAA;AACF;AAUO,SAAS,wBAAwB,cAAA,EAAuC;AAG7E,EAAA,OAAO,CAAC,UAAA,KAA0E;AAChF,IAAAA,OAAM,iCAAiC,CAAA;AAEvC,IAAA,OAAO,OAAO,OAAe,QAAA,KAA4C;AACvE,MAAA,IAAI,kBAAA;AACJ,MAAA,IAAI,OAAO,eAAe,UAAA,EAAY;AACpC,QAAA,MAAM,kBAAA,GAAqB,UAAA,CAAW,KAAA,EAAO,QAAQ,CAAA;AACrD,QAAA,kBAAA,GAAqB,MAAM,kBAAA;AAAA,MAC7B,CAAA,MAAO;AACL,QAAA,kBAAA,GAAqB,UAAA;AAAA,MACvB;AAGA,MAAA,MAAM,WAAA,GAAc,CAAC,EACnB,OAAA,CAAQ,GAAA,CAAI,SAAA,IACT,OAAA,CAAQ,GAAA,CAAI,aAAA,IACZ,OAAA,CAAQ,GAAA,CAAI,eAAA,IACZ,QAAQ,GAAA,CAAI,oBAAA,CAAA;AAEjB,MAAA,MAAM,UAAU,KAAA,KAAU,wBAAA;AAC1B,MAAAA,OAAM,CAAA,+BAAA,EAAkC,OAAA,CAAQ,IAAI,SAAS,CAAA,gBAAA,EAAmB,QAAQ,GAAA,CAAI,aAAa,qBAAqB,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,QAAA,EAAW,KAAK,iBAAiB,WAAW,CAAA,UAAA,EAAa,OAAO,CAAA,CAAE,CAAA;AAM3N,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAA,CAAQ,IAAA,CAAK,cAAc,MAAM;AAC/B,UAAA,MAAM,cAAcO,sBAAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,GAAA,IAAO,OAAO,CAAA;AACvD,UAAA,MAAM,eAAqC,EAAC;AAC5C,UAAA,IAAI,CAAC,kBAAA,EAAoB,YAAA,CAAa,IAAA,CAAK,eAAA,CAAgB,WAAW,CAAC,CAAA;AACvE,UAAA,IAAI,CAAC,kBAAA,EAAoB,YAAA,CAAa,IAAA,CAAK,uBAAA,CAAwB,aAAa,EAAE,SAAA,EAAW,IAAA,EAAM,CAAC,CAAA;AACpG,UAAA,IAAI,YAAA,CAAa,SAAS,CAAA,EAAG;AAG3B,YAAA,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AACvC,cAAA,OAAA,CAAQ,KAAA,CAAM,qCAAqC,GAAG,CAAA;AACtD,cAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AAAA,YACrB,CAAC,CAAA;AAAA,UACH;AAAA,QACF,CAAC,CAAA;AAAA,MACH;AAEA,MAAA,IAAI,WAAA,EAAa;AACf,QAAAP,OAAM,4CAA4C,CAAA;AAGlD,QAAA,IAAI,SAAS,oBAAA,EAAqB;AAGlC,QAAA,IAAI,eAAA,GAAmB,kBAAA,CAA2B,SAAA,IAC5C,kBAAA,CAA2B,YAAA,EAAc,KAAA;AAE/C,QAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,UAAA,eAAA,GAAkB,EAAC;AACnB,UAAC,mBAA2B,SAAA,GAAY,eAAA;AAAA,QAC1C;AAGA,QAAA,MAAM,UAAA,GAAa;AAAA,UACjB,OAAA,EAAS,CAAC,SAAA,CAAQ,OAAA,CAAQ,UAAU,CAAC;AAAA,SACvC;AACA,QAAA,eAAA,CAAgB,UAAU,EAAC;AAC3B,QAAA,eAAA,CAAgB,KAAA,CAAM,2BAA2B,CAAA,GAAI,UAAA;AAKrD,QAAA,MAAM,yBAAyBO,sBAAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,GAAA,IAAO,sBAAsB,CAAA;AACjF,QAAA,IAAI,WAAA,GAAc,KAAA;AAClB,QAAA,IAAI;AACF,UAAA,WAAA,GAAcF,oBAAAA,CAAG,SAAA,CAAU,sBAAsB,CAAA,CAAE,cAAA,EAAe;AAAA,QACpE,CAAA,CAAA,MAAQ;AAAA,QAAqD;AAE7D,QAAA,IAAI,WAAA,EAAa;AACf,UAAAL,OAAM,wDAAwD,CAAA;AAC9D,UAAA,MAAM,cAAA,GAAiBO,sBAAAA,CAAK,OAAA,CAAQA,sBAAAA,CAAK,OAAA,CAAQ,UAAQ,OAAA,CAAQ,aAAa,CAAC,CAAA,EAAG,IAAI,CAAA;AACtF,UAAA,MAAM,WAAA,GAAcA,sBAAAA,CAAK,OAAA,CAAQ,cAAA,EAAgB,IAAI,CAAA;AACrD,UAAA,MAAM,WAAWA,sBAAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,GAAA,IAAO,uBAAuB,CAAA;AACpE,UAAA,MAAM,YAAA,GAAeA,sBAAAA,CAAK,IAAA,CAAK,QAAA,EAAU,MAAM,CAAA;AAC/C,UAAA,IAAI;AACF,YAAAF,qBAAG,SAAA,CAAU,QAAA,EAAU,EAAE,SAAA,EAAW,MAAM,CAAA;AAE1C,YAAAA,qBAAG,MAAA,CAAO,cAAA,EAAgB,cAAc,EAAE,SAAA,EAAW,MAAM,CAAA;AAC3D,YAAAA,oBAAAA,CAAG,YAAA,CAAaE,sBAAAA,CAAK,IAAA,CAAK,WAAA,EAAa,cAAc,CAAA,EAAGA,sBAAAA,CAAK,IAAA,CAAK,QAAA,EAAU,cAAc,CAAC,CAAA;AAC3F,YAAAP,MAAAA,CAAM,mCAAmC,QAAQ,CAAA;AAAA,UACnD,SAAS,GAAA,EAAK;AACZ,YAAA,OAAA,CAAQ,IAAA,CAAK,mDAAmD,GAAG,CAAA;AAAA,UACrE;AAEA,UAAA,eAAA,CAAgB,iBAAiB,EAAC;AAClC,UAAA,eAAA,CAAgB,YAAA,CAAa,aAAa,CAAA,GAAI,6CAAA;AAC9C,UAAA,eAAA,CAAgB,YAAA,CAAa,uBAAuB,CAAA,GAAI,uDAAA;AACxD,UAAA,eAAA,CAAgB,YAAA,CAAa,+BAA+B,CAAA,GAAI,+DAAA;AAChE,UAAA,eAAA,CAAgB,YAAA,CAAa,wBAAwB,CAAA,GAAI,wDAAA;AACzD,UAAA,eAAA,CAAgB,YAAA,CAAa,qBAAqB,CAAA,GAAI,sDAAA;AACtD,UAAA,eAAA,CAAgB,YAAA,CAAa,mBAAmB,CAAA,GAAI,oDAAA;AACpD,UAAAA,OAAM,2EAA2E,CAAA;AAAA,QACnF,CAAA,MAAO;AACL,UAAAA,OAAM,6DAA6D,CAAA;AAAA,QACrE;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,GAAG,kBAAA;AAAA,QACH,GAAG,WAAA,IAAe;AAAA,UAChB,WAAY,kBAAA,CAA2B;AAAA,SACzC;AAAA,QACA,GAAG,CAAC,YAAA,IAAgB;AAAA,UAClB,OAAA,EAAS,qBAAA,CAAsB,kBAAA,EAAoB,oBAAA,EAAsBA,QAAO,OAAO;AAAA;AACzF,OACF;AAAA,IACF,CAAA;AAAA,EACF,CAAA;AACF","file":"plugin.js","sourcesContent":["import fs from 'node:fs';\n\nimport {\n  redactSensitiveConfig, scanForLeaks, varlockSettings,\n} from 'varlock/env';\nimport { patchGlobalServerResponse } from 'varlock/patch-server-response';\n\nimport { type SerializedEnvGraph } from 'varlock';\nimport type { NextConfig } from 'next';\n\nconst WEBPACK_PLUGIN_NAME = 'VarlockNextWebpackPlugin';\n\n// We use a proxy object for the static replacements that we pass to webpack.DefinePlugin\n// because this plugin/webpack code is not invoked again when env files change\n// instead next is direcly messing with the existing plugins for their own changes\n// so instead we use a proxy object, and grab the values off of process.env.__VARLOCK_ENV\n// which will have been updated by our next-env-compat code\nlet latestLoadedVarlockEnv: SerializedEnvGraph | undefined;\nfunction createStaticReplacementsProxy(debug: (...args: Array<any>) => void) {\n  return new Proxy({} as Record<string, string>, {\n    ownKeys(_target) {\n      latestLoadedVarlockEnv = JSON.parse(process.env.__VARLOCK_ENV || '{}') as SerializedEnvGraph;\n      const replaceKeys = [] as Array<string>;\n      for (const itemKey in latestLoadedVarlockEnv.config) {\n        const item = latestLoadedVarlockEnv.config[itemKey];\n        if (!item.isSensitive) replaceKeys.push(`ENV.${itemKey}`);\n      }\n      debug('reloaded static replacements keys', replaceKeys);\n      return replaceKeys;\n    },\n    getOwnPropertyDescriptor(_target, prop) {\n      const itemKey = prop.toString().split('.')[1];\n      const item = latestLoadedVarlockEnv?.config[itemKey];\n      if (!item || item.isSensitive) return;\n      return {\n        value: '', // this value is not used, the get handler will return the value\n        writable: false,\n        enumerable: true,\n        configurable: true,\n      };\n    },\n    get(_target, prop) {\n      const itemKey = prop.toString().split('.')[1];\n      const item = latestLoadedVarlockEnv?.config[itemKey];\n      if (item && !item.isSensitive) return JSON.stringify(item.value);\n    },\n  });\n}\n\nexport function createWebpackConfigFn(\n  resolvedNextConfig: NextConfig,\n  patchGlobalFsMethods: () => void,\n  debug: (...args: Array<any>) => void,\n  isBuild: boolean,\n) {\n  const staticReplacementsProxy = createStaticReplacementsProxy(debug);\n\n  return function webpackConfigFn(webpackConfig: any, options: any) {\n    debug('varlockNextConfigPlugin webpack config patching');\n\n    const { dev } = options; // also available - isServer, nextRuntime\n\n    // only patch fs methods during builds — they create \"hooks\" for post-build\n    // scanning/scrubbing and are unnecessary during dev\n    if (isBuild) patchGlobalFsMethods();\n\n    if (varlockSettings.preventLeaks) {\n      // have to wait to run this until here when we know if this is dev mode or not\n      patchGlobalServerResponse({\n        ignoreUrlPatterns: [\n          /^\\/__nextjs_source-map\\?.*/, // sourcemaps\n          /[?&]_rsc=/, // RSC payloads are server-side and expected to contain sensitive data\n        ],\n        // in dev mode, we redact the secrets rather than throwing, because otherwise the dev server crashes\n        redactInsteadOfThrow: dev,\n      });\n    }\n\n    // webpack itself is passed in so we dont have to import it (or make it a dependency)\n    const webpack = options.webpack;\n\n    // apply existing user customizations if there are any\n    if (resolvedNextConfig.webpack) {\n      webpackConfig = resolvedNextConfig.webpack(webpackConfig, options);\n    }\n\n    if (!process.env.__VARLOCK_ENV) throw new Error('VarlockNextWebpackPlugin: __VARLOCK_ENV is not set');\n\n    // Add per-file init guard for server (non-edge) compilations.\n    // Pre-rendering workers may receive compiled code via IPC rather than loading\n    // runtime files from disk, so runtime injection alone isn't sufficient.\n    // The loader ensures initVarlockEnv() and patchGlobalConsole() run in every worker.\n    // alwaysRepatchConsole: in webpack, React wraps console for RSC dev replay AFTER\n    // our initial patch in the runtime file, so we re-patch in each file to ensure\n    // our redaction wraps React's wrapper. (Turbopack doesn't need this.)\n    if (options.isServer && options.nextRuntime !== 'edge') {\n      webpackConfig.module.rules.push({\n        test: /\\.(js|jsx|ts|tsx|mjs|mts)$/,\n        exclude: /node_modules/,\n        use: [\n          {\n            loader: require.resolve('./loader'),\n            options: { bundler: 'webpack' },\n          },\n        ],\n      });\n    }\n    // Edge compilation: also re-patch console to wrap React's RSC dev replay wrapper.\n    // Edge can't use require(), so we call globalThis.__varlockPatchConsole which the\n    // init-edge bundle exposes after running.\n    if (options.isServer && options.nextRuntime === 'edge') {\n      webpackConfig.module.rules.push({\n        test: /\\.(js|jsx|ts|tsx|mjs|mts)$/,\n        exclude: /node_modules/,\n        use: [\n          {\n            loader: require.resolve('./loader'),\n            options: { bundler: 'webpack', isEdge: true },\n          },\n        ],\n      });\n    }\n\n    // Set up build-time replacements / rewrites - using webpack.DefinePlugin and a proxy\n    // TODO: use shared helpers from core library?\n    debug('adding ENV.xxx static replacements proxy object');\n    webpackConfig.plugins.push(new webpack.DefinePlugin(staticReplacementsProxy));\n\n    if (varlockSettings.preventLeaks) {\n      webpackConfig.plugins.push({\n        apply(compiler: any) {\n          compiler.hooks.assetEmitted.tap(WEBPACK_PLUGIN_NAME, (_file: any, assetDetails: any) => {\n            const { content, targetPath } = assetDetails;\n\n            if (\n              targetPath.includes('/.next/static/chunks/')\n              || targetPath.endsWith('.html')\n              // .rsc and .body are server-side (RSC payloads), not client-facing\n            ) {\n              // NOTE - in dev mode the request hangs on the error, but the console error should help\n              // and during a build, it will actually fail the build\n              try {\n                scanForLeaks(content, {\n                  method: '@varlock/nextjs-integration/plugin - assetEmitted hook',\n                  file: targetPath,\n                });\n              } catch (err) {\n                if (dev) {\n                  // overwrite file with redacted version\n                  fs.writeFileSync(targetPath, redactSensitiveConfig(content.toString()));\n                } else {\n                  throw err;\n                }\n              }\n            }\n          });\n        },\n      });\n    }\n\n    // Inject varlock init into webpack runtime files.\n    // We prepend the self-contained init bundle as raw JS so it runs before any module code.\n    // Server runtimes get the full init (with server-response patching),\n    // edge runtimes get the edge-safe init (no node:zlib/node:http).\n    function injectVarlockInitIntoWebpackRuntime(edgeRuntime = false) {\n      return function assetUpdateFn(origSource: any) {\n        const origSourceStr = origSource.source();\n\n        const initBundleName = edgeRuntime ? 'init-edge' : 'init-server';\n        const injectorPath = require.resolve(`varlock/${initBundleName}`);\n        const injectorSrc = fs.readFileSync(injectorPath, 'utf8');\n\n        // inline the resolved env so it's baked into the build\n        // this removes the need for a .env.production.local file on platforms like Vercel\n        const rawEnv = process.env.__VARLOCK_ENV;\n        const envInline = rawEnv\n          ? `process.env.__VARLOCK_ENV = process.env.__VARLOCK_ENV || ${JSON.stringify(rawEnv)};`\n          : '';\n\n        const updatedSourceStr = [\n          envInline,\n          // Wrap in IIFE to avoid symbol collisions when bundlers concatenate files.\n          // Provide dummy exports/module since the CJS bundle uses `exports.X = ...`\n          `(function(exports,module){${injectorSrc}})({},{exports:{}});`,\n          origSourceStr,\n        ].join('\\n');\n\n        return new webpack.sources.RawSource(updatedSourceStr);\n      };\n    }\n\n    const isEdgeRuntime = options.nextRuntime === 'edge';\n    webpackConfig.plugins.push({\n      apply(compiler: any) {\n        compiler.hooks.thisCompilation.tap(WEBPACK_PLUGIN_NAME, (compilation: any) => {\n          compilation.hooks.processAssets.tap(\n            {\n              name: WEBPACK_PLUGIN_NAME,\n              stage: webpack.Compilation.PROCESS_ASSETS_STAGE_ADDITIONS,\n            },\n            () => {\n              if (isEdgeRuntime) {\n                // Edge compilation — only inject the edge-safe init bundle (no node builtins)\n                if (compilation.getAsset('edge-runtime-webpack.js')) {\n                  compilation.updateAsset('edge-runtime-webpack.js', injectVarlockInitIntoWebpackRuntime(true));\n                }\n                // Edge compilation also has webpack-runtime.js — inject init-edge there too\n                for (const name of ['webpack-runtime.js', '../webpack-runtime.js']) {\n                  if (compilation.getAsset(name)) {\n                    compilation.updateAsset(name, injectVarlockInitIntoWebpackRuntime(true));\n                  }\n                }\n              } else if (options.isServer) {\n                // Server (node.js) compilation — inject full init with server-response patching\n                for (const name of ['webpack-runtime.js', '../webpack-runtime.js', 'webpack-api-runtime.js', '../webpack-api-runtime.js']) {\n                  if (compilation.getAsset(name)) {\n                    compilation.updateAsset(name, injectVarlockInitIntoWebpackRuntime());\n                  }\n                }\n              }\n            },\n          );\n        });\n      },\n    });\n\n    return webpackConfig; // must return the modified config\n  };\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\n\nfunction debug(...args: Array<any>) {\n  if (!process.env.DEBUG_VARLOCK_NEXT_INTEGRATION) return;\n  // eslint-disable-next-line no-console\n  console.log('[varlock]', ...args);\n}\n\n/**\n * Inject varlock init bundle into turbopack runtime files (analogous to webpack runtime injection).\n * Turbopack writes `[turbopack]_runtime.js` files during compilation — these are loaded by\n * the deployed server before any user code runs, making them the ideal injection point.\n *\n * Note: pre-rendering workers during builds receive compiled code via IPC (not from disk),\n * so this injection only takes effect for the deployed server. Build-time init is handled\n * by the turbopack loader's init guard snippet.\n */\nlet injectedTurbopackRuntime = false;\nexport function injectVarlockInitIntoTurbopackRuntime(nextDirPath: string) {\n  if (injectedTurbopackRuntime) return;\n\n  const rawEnv = process.env.__VARLOCK_ENV;\n  if (!rawEnv) {\n    return;\n  }\n\n  // Find turbopack runtime files ([turbopack]_runtime.js) and edge-wrapper files.\n  // Node.js SSR/build uses [turbopack]_runtime.js, while edge runtime uses\n  // edge-wrapper JS files (no [turbopack]_runtime.js exists for edge).\n  const serverRuntimeFiles: Array<string> = [];\n  const edgeWrapperFiles: Array<string> = [];\n  const walkDir = (dir: string) => {\n    if (!fs.existsSync(dir)) return;\n    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {\n      if (entry.isDirectory()) {\n        walkDir(path.join(dir, entry.name));\n      } else if (entry.name === '[turbopack]_runtime.js') {\n        serverRuntimeFiles.push(path.join(dir, entry.name));\n      } else if (entry.name.includes('edge-wrapper') && entry.name.endsWith('.js')) {\n        edgeWrapperFiles.push(path.join(dir, entry.name));\n      }\n    }\n  };\n  walkDir(nextDirPath);\n\n  debug(`turbopack runtime injection: found ${serverRuntimeFiles.length} server runtime files, ${edgeWrapperFiles.length} edge wrapper files`);\n\n  if (!serverRuntimeFiles.length) {\n    // Runtime files may not exist yet — turbopack (Rust) writes them directly.\n    // We'll retry on subsequent fs writes until they appear.\n    return;\n  }\n\n  // Mark as done so we don't retry\n  injectedTurbopackRuntime = true;\n\n  // Load both init bundles — server (full, node:zlib/node:http) and edge (no node builtins)\n  const initServerSrc = fs.readFileSync(require.resolve('varlock/init-server'), 'utf8');\n  const initEdgeSrc = fs.readFileSync(require.resolve('varlock/init-edge'), 'utf8');\n  const envInline = `process.env.__VARLOCK_ENV = process.env.__VARLOCK_ENV || ${JSON.stringify(rawEnv)};`;\n\n  // The CJS init bundles use `exports.X = ...` at the end, so we must provide\n  // a dummy `exports` object when wrapping in an IIFE to avoid ReferenceError.\n  const iifeWrap = (src: string) => `(function(exports,module){${src}})({},{exports:{}});`;\n\n  // Inject init-server into [turbopack]_runtime.js files (node.js SSR + build)\n  for (const runtimeFile of serverRuntimeFiles) {\n    const origSource = fs.readFileSync(runtimeFile, 'utf8');\n    const updatedSource = [\n      envInline,\n      iifeWrap(initServerSrc),\n      origSource,\n    ].join('\\n');\n    fs.writeFileSync(runtimeFile, updatedSource);\n    debug(`injected init-server into turbopack runtime: ${runtimeFile}`);\n  }\n\n  // Inject init-edge into edge-wrapper files (edge runtime — no node builtins)\n  for (const wrapperFile of edgeWrapperFiles) {\n    const origSource = fs.readFileSync(wrapperFile, 'utf8');\n    const updatedSource = [\n      envInline,\n      iifeWrap(initEdgeSrc),\n      origSource,\n    ].join('\\n');\n    fs.writeFileSync(wrapperFile, updatedSource);\n    debug(`injected init-edge into edge wrapper: ${wrapperFile}`);\n  }\n}\n\nexport function isInjectedTurbopackRuntime() {\n  return injectedTurbopackRuntime;\n}\n","/* eslint-disable no-console */\n\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { NextConfig } from 'next';\n\nimport {\n  getRedactionMapInfo, initVarlockEnv, redactSensitiveConfig, scanForLeaks, varlockSettings,\n} from 'varlock/env';\nimport { patchGlobalConsole } from 'varlock/patch-console';\nimport { patchGlobalServerResponse } from 'varlock/patch-server-response';\n\nimport { type SerializedEnvGraph } from 'varlock';\nimport { createWebpackConfigFn } from './webpack-plugin';\nimport { injectVarlockInitIntoTurbopackRuntime, isInjectedTurbopackRuntime } from './turbopack-runtime-inject';\n\n// make sure varlock has actually loaded the env files\n// NOTE - we don't need to call `initVarlockEnv` because the next-env-compat has already been loaded and called it\nif (!process.env.__VARLOCK_ENV) {\n  console.error([\n    '🚨 process.env.__VARLOCK_ENV is not set 🚨',\n    '',\n    'To use this plugin, you must override @next/env with @varlock/next-integration',\n    'See https://varlock.dev/integrations/nextjs for more information',\n    '',\n  ].join('\\n'));\n  throw new Error('VarlockNextWebpackPlugin: __VARLOCK_ENV is not set');\n}\n\npatchGlobalConsole();\n\n// Turbopack detection at module level — needed to apply patches in worker processes\n// (the config function only runs in the main process, but workers also load this module)\nconst IS_TURBOPACK = !!(\n  process.env.TURBOPACK\n  || process.env.TURBOPACK_DEV\n  || process.env.TURBOPACK_BUILD\n  || process.env.npm_config_turbopack\n);\n\n// For turbopack, apply server response patching at module level so it takes effect\n// in worker processes (which serve actual responses). The config function's turbopack\n// branch only runs in the main process, which doesn't handle HTTP responses.\nif (IS_TURBOPACK && varlockSettings.preventLeaks) {\n  patchGlobalServerResponse({\n    ignoreUrlPatterns: [\n      /^\\/__nextjs_source-map\\?.*/, // sourcemaps\n      /[?&]_rsc=/, // RSC payloads are server-side and expected to contain sensitive data\n    ],\n    // always redact in dev to avoid crashing the dev server; prod builds override via init bundles\n    redactInsteadOfThrow: true,\n  });\n}\n\nconst IS_WORKER = !!process.env.NEXT_PRIVATE_WORKER;\nfunction debug(...args: Array<any>) {\n  if (!process.env.DEBUG_VARLOCK_NEXT_INTEGRATION) return;\n  console.log(\n    'plugin',\n    IS_WORKER ? '[worker] ' : '[server]',\n    '--',\n    ...args,\n  );\n}\ndebug('✨ LOADED @varlock/next-integration/plugin module!');\n\ntype VarlockPluginOptions = {\n  // injectResolvedConfigAtBuildTime: boolean,\n};\n\nlet scannedStaticFiles = false;\nasync function scanStaticFiles(nextDirPath: string) {\n  scannedStaticFiles = true;\n  for await (const file of fs.promises.glob(`${nextDirPath}/**/*.html`)) {\n    const fileContents = await fs.promises.readFile(file, 'utf8');\n    scanForLeaks(fileContents, { method: 'nextjs scan static html files', file });\n  }\n}\n\nlet scrubbedSourcemaps = false;\nasync function scrubSourcemaps(nextDirPath: string) {\n  if (scrubbedSourcemaps) return;\n  scrubbedSourcemaps = true;\n\n  // build a list of sensitive values and their same-length replacements\n  const envGraph: SerializedEnvGraph = JSON.parse(process.env.__VARLOCK_ENV || '{}');\n  const sensitiveValues: Array<{ value: string, replacement: string }> = [];\n  for (const itemKey in envGraph.config) {\n    const item = envGraph.config[itemKey];\n    if (item.isSensitive && item.value && typeof item.value === 'string' && item.value.length > 0) {\n      // same-length replacement to preserve sourcemap column offsets\n      sensitiveValues.push({\n        value: item.value,\n        replacement: '*'.repeat(item.value.length),\n      });\n    }\n  }\n  if (!sensitiveValues.length) {\n    debug('no sensitive values to scrub from sourcemaps');\n    return;\n  }\n  // sort longest first for maximal munch\n  sensitiveValues.sort((a, b) => b.value.length - a.value.length);\n\n  let scrubCount = 0;\n  for await (const mapFile of fs.promises.glob(`${nextDirPath}/**/*.map`)) {\n    const contents = await fs.promises.readFile(mapFile, 'utf8');\n    let scrubbed = contents;\n    for (const { value, replacement } of sensitiveValues) {\n      scrubbed = scrubbed.replaceAll(value, replacement);\n    }\n    if (scrubbed !== contents) {\n      await fs.promises.writeFile(mapFile, scrubbed);\n      scrubCount++;\n    }\n  }\n  debug(`scrubbed sensitive values from ${scrubCount} sourcemap files`);\n}\n\nlet scannedBuildOutput = false;\nasync function scanBuildOutputForLeaks(nextDirPath: string, opts?: { failBuild?: boolean }) {\n  if (scannedBuildOutput) return;\n  scannedBuildOutput = true;\n\n  // varlockSettings may not be populated if initVarlockEnv hasn't run in this process,\n  // so fall back to reading the setting directly from the env data\n  let preventLeaks = varlockSettings.preventLeaks;\n  if (preventLeaks === undefined && process.env.__VARLOCK_ENV) {\n    try {\n      const envGraph: SerializedEnvGraph = JSON.parse(process.env.__VARLOCK_ENV);\n      preventLeaks = envGraph.settings?.preventLeaks;\n    } catch { /* ignore */ }\n  }\n  // Ensure the redaction map is populated so scanForLeaks knows what to look for.\n  // initVarlockEnv may not have run in this process (the plugin's main process).\n  if (process.env.__VARLOCK_ENV) {\n    // eslint-disable-next-line @stylistic/max-statements-per-line\n    try { initVarlockEnv(); } catch { /* ignore if already initialized or fails */ }\n  }\n  const redactionInfo = getRedactionMapInfo();\n  debug(`scanBuildOutputForLeaks: preventLeaks=${preventLeaks}, redactionInfo=${JSON.stringify(redactionInfo)}`);\n  if (!preventLeaks) return;\n\n  const leakedFiles: Array<string> = [];\n  let scannedCount = 0;\n\n  // scan JS chunks in .next/static/chunks/ — these are client-facing bundles\n  // that should never contain sensitive values\n  for await (const file of fs.promises.glob(`${nextDirPath}/static/chunks/**/*.js`)) {\n    scannedCount++;\n    const fileContents = await fs.promises.readFile(file, 'utf8');\n    try {\n      scanForLeaks(fileContents, {\n        method: 'nextjs post-build scan (static chunks)',\n        file,\n      });\n    } catch (err) {\n      leakedFiles.push(file);\n      // redact the file so the leak doesn't ship\n      await fs.promises.writeFile(file, redactSensitiveConfig(fileContents));\n    }\n  }\n\n  debug(`scanned ${scannedCount} static chunk files in ${nextDirPath}/static/chunks/`);\n\n  // scan prerendered HTML files (client-facing static output)\n  // NOTE: .rsc and .body files are server-side (RSC payloads) and are expected\n  // to access sensitive data, so we don't scan those\n  for (const ext of ['html']) {\n    for await (const file of fs.promises.glob(`${nextDirPath}/**/*.${ext}`)) {\n      scannedCount++;\n      const fileContents = await fs.promises.readFile(file, 'utf8');\n      try {\n        scanForLeaks(fileContents, {\n          method: `nextjs post-build scan (.${ext})`,\n          file,\n        });\n      } catch (err) {\n        leakedFiles.push(file);\n        await fs.promises.writeFile(file, redactSensitiveConfig(fileContents));\n      }\n    }\n  }\n\n  debug(`scanned ${scannedCount} total build output files`);\n\n  if (leakedFiles.length > 0) {\n    const msg = `[varlock] ⚠️ found and redacted leaked secrets in ${leakedFiles.length} build output file(s):\\n${leakedFiles.map((f) => `  - ${f}`).join('\\n')}`;\n    if (opts?.failBuild) {\n      throw new Error(msg);\n    }\n    console.error(msg);\n  } else {\n    debug('✅ no leaks found in build output');\n  }\n}\n\n// not all file writes go through this, at least in Next 15\n// (likely because webpack and prerendering are happening in workers)\n// but we can use this to monitor writing of certain files and give ourselves a \"hook\"\n// which we can then scan existing files\nfunction patchGlobalFsMethods() {\n  debug('patching global fs methods');\n  // patch fs.promises.writeFile\n  const origWriteFileFn = fs.promises.writeFile;\n  fs.promises.writeFile = async function dmnoPatchedWriteFile(...args) {\n    const filePath = args[0].toString();\n    debug('fs.promises.writeFile:', filePath);\n\n    // BUILD_ID is written after turbopack compilation completes but before pre-rendering.\n    // This is our hook to inject the init bundle into turbopack runtime files.\n    if (!isInjectedTurbopackRuntime() && filePath.endsWith('/.next/export-detail.json')) {\n      const nextDirPath = filePath.substring(0, filePath.lastIndexOf('/'));\n      injectVarlockInitIntoTurbopackRuntime(nextDirPath);\n    }\n\n    if (filePath.endsWith('/.next/next-server.js.nft.json') && !scannedStaticFiles) {\n      const nextDirPath = filePath.substring(0, filePath.lastIndexOf('/'));\n      await scanStaticFiles(nextDirPath);\n    }\n    // next-server.js.nft.json is written near the end of the build, after prerendering (webpack)\n    // prerender-manifest.json is written after \"Generating static pages\" completes (turbopack + webpack)\n    if (\n      filePath.endsWith('/.next/next-server.js.nft.json')\n      || filePath.endsWith('/.next/prerender-manifest.json')\n    ) {\n      const nextDirPath = filePath.substring(0, filePath.lastIndexOf('/'));\n      if (!scrubbedSourcemaps) await scrubSourcemaps(nextDirPath);\n      if (!scannedBuildOutput) await scanBuildOutputForLeaks(nextDirPath, { failBuild: true });\n    }\n\n    return origWriteFileFn.call(this, ...args);\n  };\n\n  // also patch sync version in case turbopack uses it\n  const origWriteFileSyncFn = fs.writeFileSync;\n  fs.writeFileSync = function dmnoPatchedWriteFileSync(...args: Parameters<typeof fs.writeFileSync>) {\n    const filePath = args[0].toString();\n    debug('fs.writeFileSync:', filePath);\n\n    if (!isInjectedTurbopackRuntime() && filePath.endsWith('/.next/diagnostics/build-diagnostics.json')) {\n      const nextDirPath = filePath.substring(0, filePath.lastIndexOf('/'));\n      injectVarlockInitIntoTurbopackRuntime(nextDirPath);\n    }\n\n    return origWriteFileSyncFn.call(this, ...args);\n  };\n}\n\n\nexport type NextConfigFunction = (\n  phase: string,\n  defaults: { defaultConfig: NextConfig },\n) => NextConfig | PromiseLike<NextConfig>;\n\n\n// we make this a plugin a function because we'll likely end up adding some options\nexport function varlockNextConfigPlugin(_pluginOptions?: VarlockPluginOptions) {\n  // nextjs doesnt have a proper plugin system :(\n  // so we use a function which takes in a config object and returns an augmented one\n  return (nextConfig: any | NextConfig | NextConfigFunction): NextConfigFunction => {\n    debug('varlockNextConfigPlugin init fn');\n\n    return async (phase: string, defaults: { defaultConfig: NextConfig }) => {\n      let resolvedNextConfig: NextConfig;\n      if (typeof nextConfig === 'function') {\n        const nextConfigFnResult = nextConfig(phase, defaults);\n        resolvedNextConfig = await nextConfigFnResult;\n      } else {\n        resolvedNextConfig = nextConfig;\n      }\n\n      // Next 16+ uses Turbopack by default for dev, but may not set TURBOPACK env var\n      const isTurbopack = !!(\n        process.env.TURBOPACK\n        || process.env.TURBOPACK_DEV\n        || process.env.TURBOPACK_BUILD\n        || process.env.npm_config_turbopack\n      );\n      const isBuild = phase === 'phase-production-build';\n      debug(`turbopack detection: TURBOPACK=${process.env.TURBOPACK}, TURBOPACK_DEV=${process.env.TURBOPACK_DEV}, TURBOPACK_BUILD=${process.env.TURBOPACK_BUILD}, phase=${phase}, isTurbopack=${isTurbopack}, isBuild=${isBuild}`);\n\n      // For production builds, schedule a post-build scan as a safety net.\n      // The fs.writeFile patches may not intercept all writes (workers), and\n      // BUILD_ID is written before prerendering completes. beforeExit fires\n      // after the build finishes, ensuring all output files exist.\n      if (isBuild) {\n        process.once('beforeExit', () => {\n          const nextDirPath = path.resolve(process.cwd(), '.next');\n          const scanPromises: Array<Promise<void>> = [];\n          if (!scrubbedSourcemaps) scanPromises.push(scrubSourcemaps(nextDirPath));\n          if (!scannedBuildOutput) scanPromises.push(scanBuildOutputForLeaks(nextDirPath, { failBuild: true }));\n          if (scanPromises.length > 0) {\n            // The async work keeps the event loop alive, and beforeExit\n            // will fire again once it completes (but the guards prevent re-runs)\n            Promise.all(scanPromises).catch((err) => {\n              console.error('[varlock] post-build scan failed:', err);\n              process.exitCode = 1;\n            });\n          }\n        });\n      }\n\n      if (isTurbopack) {\n        debug('turbopack detected, injecting loader rules');\n        // only patch fs methods during builds — they create \"hooks\" for post-build\n        // scanning/scrubbing and are unnecessary (and noisy) during dev\n        if (isBuild) patchGlobalFsMethods();\n\n        // turbopack config can be under `turbopack` (Next 15+) or `experimental.turbo` (older)\n        let turbopackConfig = (resolvedNextConfig as any).turbopack\n          ?? (resolvedNextConfig as any).experimental?.turbo;\n\n        if (!turbopackConfig) {\n          turbopackConfig = {};\n          (resolvedNextConfig as any).turbopack = turbopackConfig;\n        }\n\n        // inject loader rules\n        const loaderRule = {\n          loaders: [require.resolve('./loader')],\n        };\n        turbopackConfig.rules ||= {};\n        turbopackConfig.rules['*.{js,jsx,ts,tsx,mjs,mts}'] = loaderRule;\n\n        // Turbopack can't resolve symlinked packages (e.g. link: or workspace: installs).\n        // If varlock is symlinked, we copy dist files into node_modules/.varlock/ as real\n        // files and set up resolve aliases so turbopack can find them.\n        const varlockNodeModulesPath = path.resolve(process.cwd(), 'node_modules/varlock');\n        let isSymlinked = false;\n        try {\n          isSymlinked = fs.lstatSync(varlockNodeModulesPath).isSymbolicLink();\n        } catch { /* not found — might be hoisted or nested, skip */ }\n\n        if (isSymlinked) {\n          debug('varlock is symlinked, copying dist files for turbopack');\n          const varlockDistDir = path.resolve(path.dirname(require.resolve('varlock/env')), '..');\n          const varlockRoot = path.resolve(varlockDistDir, '..');\n          const cacheDir = path.resolve(process.cwd(), 'node_modules/.varlock');\n          const cacheDistDir = path.join(cacheDir, 'dist');\n          try {\n            fs.mkdirSync(cacheDir, { recursive: true });\n            // copy dist/ and package.json so turbopack can resolve subpath exports\n            fs.cpSync(varlockDistDir, cacheDistDir, { recursive: true });\n            fs.copyFileSync(path.join(varlockRoot, 'package.json'), path.join(cacheDir, 'package.json'));\n            debug('copied varlock package files to', cacheDir);\n          } catch (err) {\n            console.warn('[varlock] failed to copy varlock package files:', err);\n          }\n\n          turbopackConfig.resolveAlias ||= {};\n          turbopackConfig.resolveAlias['varlock/env'] = './node_modules/.varlock/dist/runtime/env.js';\n          turbopackConfig.resolveAlias['varlock/patch-console'] = './node_modules/.varlock/dist/runtime/patch-console.js';\n          turbopackConfig.resolveAlias['varlock/patch-server-response'] = './node_modules/.varlock/dist/runtime/patch-server-response.js';\n          turbopackConfig.resolveAlias['varlock/patch-response'] = './node_modules/.varlock/dist/runtime/patch-response.js';\n          turbopackConfig.resolveAlias['varlock/init-server'] = './node_modules/.varlock/dist/runtime/init-server.cjs';\n          turbopackConfig.resolveAlias['varlock/init-edge'] = './node_modules/.varlock/dist/runtime/init-edge.cjs';\n          debug('set resolveAlias for varlock subpaths -> ./node_modules/.varlock/dist/...');\n        } else {\n          debug('varlock is not symlinked, turbopack can resolve it natively');\n        }\n      }\n\n      return {\n        ...resolvedNextConfig,\n        ...isTurbopack && {\n          turbopack: (resolvedNextConfig as any).turbopack,\n        },\n        ...!IS_TURBOPACK && {\n          webpack: createWebpackConfigFn(resolvedNextConfig, patchGlobalFsMethods, debug, isBuild),\n        },\n      };\n    };\n  };\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@varlock/nextjs-integration",
   "description": "drop-in replacement for @next/env that uses varlock to load .env files with validation and extra security features",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/dmno-dev/varlock.git",
@@ -11,11 +11,15 @@
   "types": "dist/next-env-compat.d.ts",
   "exports": {
     ".": "./dist/next-env-compat.js",
-    "./plugin": "./dist/plugin.js"
+    "./plugin": "./dist/plugin.js",
+    "./loader": "./dist/loader.js"
+  },
+  "files": ["dist"],
+  "scripts": {
+    "dev": "tsup --watch",
+    "build": "rm -rf dist && tsup",
+    "typecheck": "tsc --noEmit"
   },
-  "files": [
-    "dist"
-  ],
   "keywords": [
     "varlock",
     "nextjs",
@@ -36,17 +40,13 @@
     "node": ">=22"
   },
   "peerDependencies": {
-    "next": ">=14",
-    "varlock": "^0.1.0"
+    "varlock": "^1.0.0",
+    "next": ">=14"
   },
   "devDependencies": {
-    "@types/node": "24.9.2",
-    "tsup": "^8.5.0",
-    "vitest": "^4.0.6",
-    "varlock": "^0.1.0"
-  },
-  "scripts": {
-    "dev": "tsup --watch",
-    "build": "tsup"
+    "@types/node": "25.3.2",
+    "tsup": "^8.5.1",
+    "varlock": "^1.0.0",
+    "vitest": "^4.0.18"
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2025 DMNO Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/patch-next-runtime.js

@@ -1,14 +0,0 @@
-'use strict';
-
-var env = require('varlock/env');
-var patchConsole = require('varlock/patch-console');
-var patchServerResponse = require('varlock/patch-server-response');
-var patchResponse = require('varlock/patch-response');
-
-// src/patch-next-runtime.ts
-env.initVarlockEnv();
-patchConsole.patchGlobalConsole();
-patchServerResponse.patchGlobalServerResponse();
-patchResponse.patchGlobalResponse();
-//# sourceMappingURL=patch-next-runtime.js.map
-//# sourceMappingURL=patch-next-runtime.js.map

package/dist/patch-next-runtime.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/patch-next-runtime.ts"],"names":["initVarlockEnv","patchGlobalConsole","patchGlobalServerResponse","patchGlobalResponse"],"mappings":";;;;;;;;AAOAA,kBAAA,EAAe;AACfC,+BAAA,EAAmB;AACnBC,6CAAA,EAA0B;AAC1BC,iCAAA,EAAoB","file":"patch-next-runtime.js","sourcesContent":["import { initVarlockEnv } from 'varlock/env';\nimport { patchGlobalConsole } from 'varlock/patch-console';\nimport { patchGlobalServerResponse } from 'varlock/patch-server-response';\nimport { patchGlobalResponse } from 'varlock/patch-response';\n\n// process.env.__VARLOCK_ENV is already set by either our next-env-compat\n// or by the platform, because we generated a temp .env file which included it\ninitVarlockEnv();\npatchGlobalConsole();\npatchGlobalServerResponse();\npatchGlobalResponse();\n"]}