morphix-env 0.7.1 → 0.9.0

package/dist/index.js

@@ -0,0 +1,732 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  CompositionError: () => CompositionError,
+  StreamingRedactor: () => StreamingRedactor,
+  composeEnvironment: () => composeEnvironment,
+  loadConfigLayers: () => loadConfigLayers,
+  validateConfig: () => validateConfig
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/composition.ts
+var import_os2 = require("os");
+
+// src/config.ts
+var import_fs = require("fs");
+var import_path = require("path");
+var import_os = require("os");
+var CONFIG_FILE = "mx-env.config.json";
+var GLOBAL_CONFIG_DIR = ".mx-env";
+var GLOBAL_CONFIG_FILE = "config.json";
+var GLOBAL_ENV_FILE = ".env";
+function safeParseConfig(path) {
+  try {
+    const value = JSON.parse((0, import_fs.readFileSync)(path, "utf8"));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  } catch (e) {
+    console.warn(`[morphix-env] Failed to parse configuration at ${path}: ${e?.name || "invalid JSON"}`);
+    return {};
+  }
+}
+function loadConfigAt(path) {
+  const absolutePath = (0, import_path.resolve)(path);
+  if (!(0, import_fs.existsSync)(absolutePath)) {
+    return { config: {}, path: absolutePath, baseDir: (0, import_path.dirname)(absolutePath), exists: false };
+  }
+  return {
+    config: safeParseConfig(absolutePath),
+    path: absolutePath,
+    baseDir: (0, import_path.dirname)(absolutePath),
+    exists: true
+  };
+}
+function loadConfigLayers(options = {}) {
+  const cwd = options.cwd || process.cwd();
+  const homeDir = options.homeDir || (0, import_os.homedir)();
+  const globalDir = (0, import_path.resolve)(homeDir, GLOBAL_CONFIG_DIR);
+  return {
+    global: loadConfigAt((0, import_path.resolve)(globalDir, GLOBAL_CONFIG_FILE)),
+    project: loadConfigAt((0, import_path.resolve)(cwd, CONFIG_FILE)),
+    globalEnvFile: (0, import_path.resolve)(globalDir, GLOBAL_ENV_FILE)
+  };
+}
+function normalizeProfile(input) {
+  if (Array.isArray(input)) return { sources: input };
+  return {
+    sources: Array.isArray(input?.sources) ? input.sources : [],
+    ...input?.extends ? { extends: input.extends } : {}
+  };
+}
+function expandHomePath(path, homeDir = (0, import_os.homedir)()) {
+  if (path === "~") return homeDir;
+  if (path.startsWith("~/")) return (0, import_path.resolve)(homeDir, path.slice(2));
+  return path;
+}
+function validateConfig(config, label = CONFIG_FILE) {
+  const errors = [];
+  const sources = config.sources || {};
+  for (const [name, source] of Object.entries(sources)) {
+    if (!name.trim()) errors.push(`${label}: source names cannot be empty`);
+    if (!source || typeof source !== "object" || !("provider" in source)) {
+      errors.push(`${label}: source "${name}" must declare a provider`);
+      continue;
+    }
+    switch (source.provider) {
+      case "infisical":
+        if (!Array.isArray(source.paths) || source.paths.length === 0) errors.push(`${label}: Infisical source "${name}" needs paths`);
+        if (source.optional) errors.push(`${label}: remote source "${name}" cannot be optional`);
+        break;
+      case "local":
+      case "dotenvx":
+        if (!Array.isArray(source.files) || source.files.length === 0) errors.push(`${label}: ${source.provider} source "${name}" needs files`);
+        break;
+      case "os-keychain":
+        if (!source.service) errors.push(`${label}: os-keychain source "${name}" needs service`);
+        if (source.optional) errors.push(`${label}: remote source "${name}" cannot be optional`);
+        break;
+      case "doppler":
+        if (!source.project || !source.config) errors.push(`${label}: Doppler source "${name}" needs project and config`);
+        if (source.optional) errors.push(`${label}: remote source "${name}" cannot be optional`);
+        break;
+      case "plugin":
+        if (typeof source.plugin !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(source.plugin)) {
+          errors.push(`${label}: plugin source "${name}" needs a plugin name (letters, digits, ".", "_", "-")`);
+        }
+        if (!Array.isArray(source.keys) || !source.keys.length || source.keys.some((key) => typeof key !== "string" || !key)) {
+          errors.push(`${label}: plugin source "${name}" needs at least one key`);
+        }
+        break;
+      default:
+        errors.push(`${label}: source "${name}" has an unsupported provider`);
+    }
+  }
+  for (const [name, profileInput] of Object.entries(config.profiles || {})) {
+    const profile = normalizeProfile(profileInput);
+    if (!profile.sources.length) errors.push(`${label}: profile "${name}" needs sources`);
+    for (const sourceName of profile.sources) {
+      if (typeof sourceName !== "string" || !sourceName) errors.push(`${label}: profile "${name}" has an invalid source reference`);
+    }
+  }
+  return errors;
+}
+
+// src/sources.ts
+var import_child_process2 = require("child_process");
+var import_fs4 = require("fs");
+var import_path4 = require("path");
+var import_dotenv3 = require("dotenv");
+
+// src/env.ts
+var import_fs2 = require("fs");
+var import_path2 = require("path");
+var import_dotenv = require("dotenv");
+function parseEnvFile(filePath) {
+  const absPath = (0, import_path2.resolve)(filePath);
+  if (!(0, import_fs2.existsSync)(absPath)) return {};
+  return (0, import_dotenv.parse)((0, import_fs2.readFileSync)(absPath, "utf8"));
+}
+
+// src/infisical.ts
+var import_sdk = require("@infisical/sdk");
+var import_child_process = require("child_process");
+var import_fs3 = require("fs");
+var import_path3 = require("path");
+var import_dotenv2 = require("dotenv");
+function applyPrefix(key, prefix) {
+  if (!prefix) return key;
+  return key.startsWith(prefix) ? key : prefix + key;
+}
+async function resolveInfisicalSecrets(config, envPrefix) {
+  const client = new import_sdk.InfisicalSDK({
+    ...config.siteUrl ? { siteUrl: config.siteUrl } : {}
+  });
+  await client.auth().universalAuth.login({
+    clientId: config.clientId,
+    clientSecret: config.clientSecret
+  });
+  const values = {};
+  for (const secretPath of config.paths) {
+    const result = await client.secrets().listSecrets({
+      environment: config.environment,
+      projectId: config.projectId,
+      secretPath,
+      expandSecretReferences: true,
+      viewSecretValue: true
+    });
+    for (const secret of result.secrets) {
+      const key = applyPrefix(secret.secretKey, envPrefix);
+      values[key] = secret.secretValue;
+    }
+  }
+  return { values, count: Object.keys(values).length };
+}
+function hasInfisicalCLI() {
+  try {
+    (0, import_child_process.execSync)("infisical --version", { stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isInfisicalLoggedIn() {
+  try {
+    (0, import_child_process.execSync)("infisical user", { stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readInfisicalJson() {
+  const filePath = (0, import_path3.resolve)(".infisical.json");
+  if (!(0, import_fs3.existsSync)(filePath)) return {};
+  try {
+    return JSON.parse((0, import_fs3.readFileSync)(filePath, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function fetchSecretsViaCLI(environment, paths, envPrefix) {
+  const values = {};
+  const errors = [];
+  for (const secretPath of paths) {
+    try {
+      const output = (0, import_child_process.execFileSync)(
+        "infisical",
+        ["export", `--path=${secretPath}`, `--env=${environment}`, "--format=dotenv"],
+        { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }
+      );
+      const vars = (0, import_dotenv2.parse)(output);
+      for (const [key, value] of Object.entries(vars)) {
+        values[applyPrefix(key, envPrefix)] = value;
+      }
+    } catch (e) {
+      const stderr = String(e?.stderr || e?.message || "");
+      const lower = stderr.toLowerCase();
+      let kind = "other";
+      if (lower.includes("login expired") || lower.includes("no login session") || lower.includes("not logged in") || lower.includes("please login") || lower.includes("user is not logged")) {
+        kind = "not-logged-in";
+      } else if (lower.includes("workspaceid") || lower.includes("project id") || lower.includes("infisical.json")) {
+        kind = "no-project";
+      }
+      errors.push({ kind, path: secretPath, stderr });
+    }
+  }
+  return { values, count: Object.keys(values).length, errors };
+}
+
+// src/sources.ts
+var SourceError = class extends Error {
+  constructor(sourceName, provider, message) {
+    super(message);
+    this.sourceName = sourceName;
+    this.provider = provider;
+    this.name = "SourceError";
+  }
+};
+function resolveSourcePath(path, entry, homeDir) {
+  const expanded = expandHomePath(path, homeDir);
+  return (0, import_path4.isAbsolute)(expanded) ? expanded : (0, import_path4.resolve)(entry.baseDir, expanded);
+}
+function isPublicKey(key) {
+  return key.startsWith("NEXT_PUBLIC_") || key.startsWith("VITE_") || key.startsWith("EXPO_PUBLIC_");
+}
+function assertSafeGlobalFile(file, context, entry) {
+  if (!entry.globalImplicit || context.allowInsecureGlobal || process.platform === "win32") return;
+  const mode = (0, import_fs4.statSync)(file).mode;
+  if ((mode & 63) !== 0) {
+    throw new SourceError(
+      entry.name,
+      "local",
+      `[morphix-env] Global env file ${file} is readable by group or other users; set mode 0600 or pass --allow-insecure-global.`
+    );
+  }
+}
+function resolveLocal(entry, source, context) {
+  const values = {};
+  let found = false;
+  for (const rawFile of source.files) {
+    const file = resolveSourcePath(rawFile, entry, context.homeDir);
+    if (!(0, import_fs4.existsSync)(file)) continue;
+    found = true;
+    assertSafeGlobalFile(file, context, entry);
+    Object.assign(values, parseEnvFile(file));
+  }
+  if (!found) {
+    if (source.optional) {
+      return { name: entry.name, provider: source.provider, values: {}, availability: "missing-optional" };
+    }
+    throw new SourceError(entry.name, source.provider, `[morphix-env] Local source "${entry.name}" has no available env file.`);
+  }
+  return { name: entry.name, provider: source.provider, values, availability: "loaded" };
+}
+async function resolveInfisical(entry, source, context) {
+  if (context.noInfisical) {
+    return { name: entry.name, provider: source.provider, values: {}, availability: "skipped" };
+  }
+  const environment = source.env || context.envName || process.env.DEPLOY_ENV || process.env.INFISICAL_ENV || "prod";
+  const projectId = source.projectId || process.env.INFISICAL_PROJECT_ID || readInfisicalJson().workspaceId || "";
+  const clientId = process.env.INFISICAL_CLIENT_ID || "";
+  const clientSecret = process.env.INFISICAL_CLIENT_SECRET || "";
+  if (clientId && clientSecret && projectId) {
+    try {
+      const result2 = await resolveInfisicalSecrets({
+        clientId,
+        clientSecret,
+        projectId,
+        environment,
+        paths: source.paths,
+        siteUrl: source.siteUrl
+      }, source.envPrefix);
+      return { name: entry.name, provider: source.provider, values: result2.values, availability: "loaded" };
+    } catch {
+      throw new SourceError(entry.name, source.provider, `[morphix-env] Infisical source "${entry.name}" could not authenticate or load.`);
+    }
+  }
+  if (!hasInfisicalCLI()) {
+    if (entry.legacy) return { name: entry.name, provider: source.provider, values: {}, availability: "skipped" };
+    throw new SourceError(entry.name, source.provider, `[morphix-env] Infisical source "${entry.name}" needs Machine Identity credentials or an installed Infisical CLI.`);
+  }
+  if (!isInfisicalLoggedIn()) {
+    if (entry.legacy) return { name: entry.name, provider: source.provider, values: {}, availability: "skipped" };
+    throw new SourceError(entry.name, source.provider, `[morphix-env] Infisical source "${entry.name}" is not logged in; run infisical login.`);
+  }
+  const result = fetchSecretsViaCLI(environment, source.paths, source.envPrefix);
+  const firstError = result.errors[0];
+  if (firstError) {
+    if (entry.legacy) return { name: entry.name, provider: source.provider, values: {}, availability: "skipped" };
+    throw new SourceError(entry.name, source.provider, `[morphix-env] Infisical source "${entry.name}" could not load (${firstError.kind}).`);
+  }
+  return { name: entry.name, provider: source.provider, values: result.values, availability: "loaded" };
+}
+function ensureCommand(command, sourceName, provider) {
+  const localBinary = (0, import_path4.resolve)(process.cwd(), "node_modules", ".bin", command);
+  try {
+    if ((0, import_fs4.existsSync)(localBinary)) {
+      (0, import_child_process2.execFileSync)(localBinary, ["--version"], { stdio: ["ignore", "ignore", "ignore"] });
+      return localBinary;
+    }
+    (0, import_child_process2.execFileSync)(command, ["--version"], { stdio: ["ignore", "ignore", "ignore"] });
+    return command;
+  } catch {
+    try {
+      if ((0, import_fs4.existsSync)(localBinary)) {
+        (0, import_child_process2.execFileSync)(localBinary, ["--version"], { stdio: ["ignore", "ignore", "ignore"] });
+        return localBinary;
+      }
+    } catch {
+    }
+    throw new SourceError(sourceName, provider, `[morphix-env] ${provider} source "${sourceName}" requires the ${command} CLI.`);
+  }
+}
+function resolveDotenvx(entry, source, context) {
+  const files = source.files.map((file) => resolveSourcePath(file, entry, context.homeDir));
+  const existingFiles = files.filter(import_fs4.existsSync);
+  if (!existingFiles.length) {
+    if (source.optional) return { name: entry.name, provider: source.provider, values: {}, availability: "missing-optional" };
+    throw new SourceError(entry.name, source.provider, `[morphix-env] dotenvx source "${entry.name}" has no available env file.`);
+  }
+  if (existingFiles.length !== files.length) {
+    throw new SourceError(entry.name, source.provider, `[morphix-env] dotenvx source "${entry.name}" is missing a declared env file.`);
+  }
+  const command = ensureCommand("dotenvx", entry.name, source.provider);
+  const keys = [...new Set(existingFiles.flatMap((file) => Object.keys(parseEnvFile(file))))].filter((key) => !key.startsWith("DOTENV_PUBLIC_KEY"));
+  if (!keys.length) return { name: entry.name, provider: source.provider, values: {}, availability: "loaded" };
+  const helper = "const keys=JSON.parse(process.argv[1]);const output={};for(const key of keys){if(process.env[key]!==undefined)output[key]=process.env[key]}process.stdout.write(JSON.stringify(output))";
+  let stage = "run";
+  try {
+    const output = (0, import_child_process2.execFileSync)(
+      command,
+      ["run", "-f", existingFiles.join(","), "--", process.execPath, "-e", helper, JSON.stringify(keys)],
+      {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        env: {
+          ...process.env,
+          ...context.environment,
+          // dotenvx's executable is a node script; direct API callers may
+          // provide an intentionally small environment, so retain a path to
+          // the current Node runtime for its shebang.
+          PATH: [(0, import_path4.dirname)(process.execPath), context.environment.PATH || process.env.PATH || ""].filter(Boolean).join(import_path4.delimiter)
+        },
+        // dotenvx locates .env.keys relative to its working directory.
+        cwd: (0, import_path4.dirname)(existingFiles[0])
+      }
+    );
+    stage = "parse-output";
+    const json = output.trim().split("\n").reverse().find((line) => line.trim().startsWith("{")) || "";
+    const parsed = JSON.parse(json);
+    const values = Object.fromEntries(Object.entries(parsed).filter(([, value]) => typeof value === "string"));
+    return { name: entry.name, provider: source.provider, values, availability: "loaded" };
+  } catch (error) {
+    const category = typeof error?.code === "string" ? error.code : "failed";
+    throw new SourceError(entry.name, source.provider, `[morphix-env] dotenvx source "${entry.name}" could not decrypt or load (${stage}:${category}).`);
+  }
+}
+var keytarModule;
+async function loadKeytar() {
+  if (keytarModule !== void 0) return keytarModule;
+  try {
+    const imported = await import("keytar");
+    keytarModule = imported.default ?? imported;
+  } catch {
+    keytarModule = null;
+  }
+  return keytarModule;
+}
+async function resolveKeychain(entry, source) {
+  if (source.platform === "macos" && process.platform !== "darwin") {
+    throw new SourceError(entry.name, source.provider, `[morphix-env] os-keychain source "${entry.name}" is only available on macOS.`);
+  }
+  if (process.platform !== "darwin") {
+    throw new SourceError(entry.name, source.provider, `[morphix-env] os-keychain source "${entry.name}" is currently supported on macOS only.`);
+  }
+  const keytar = await loadKeytar();
+  if (!keytar) {
+    throw new SourceError(
+      entry.name,
+      source.provider,
+      `[morphix-env] os-keychain source "${entry.name}" needs the optional native module "keytar", which is not usable on this machine. Reinstall morphix-env to rebuild it, or remove this source from the profile.`
+    );
+  }
+  try {
+    const credentials = await keytar.findCredentials(source.service);
+    return {
+      name: entry.name,
+      provider: source.provider,
+      values: Object.fromEntries(credentials.map(({ account, password }) => [account, password])),
+      availability: "loaded"
+    };
+  } catch {
+    throw new SourceError(entry.name, source.provider, `[morphix-env] os-keychain source "${entry.name}" could not be accessed.`);
+  }
+}
+function resolveDoppler(entry, source, context) {
+  const command = ensureCommand("doppler", entry.name, source.provider);
+  try {
+    const output = (0, import_child_process2.execFileSync)(
+      command,
+      ["secrets", "download", "--no-file", "--format", "dotenv", "--project", source.project, "--config", source.config],
+      { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: context.environment }
+    );
+    return { name: entry.name, provider: source.provider, values: parseDotenvText(output), availability: "loaded" };
+  } catch {
+    throw new SourceError(entry.name, source.provider, `[morphix-env] Doppler source "${entry.name}" could not authenticate or load.`);
+  }
+}
+function parseDotenvText(text) {
+  return (0, import_dotenv3.parse)(text);
+}
+var PLUGIN_TIMEOUT_MS = 3e4;
+function resolvePlugin(entry, source, context) {
+  const command = `mx-env-provider-${source.plugin}`;
+  const values = {};
+  for (const key of source.keys) {
+    let output;
+    try {
+      output = (0, import_child_process2.execFileSync)(command, [key], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        env: { ...process.env, ...context.environment },
+        timeout: PLUGIN_TIMEOUT_MS
+      });
+    } catch (error) {
+      if (error?.code === "ENOENT") {
+        if (source.optional) return { name: entry.name, provider: source.provider, values: {}, availability: "missing-optional" };
+        throw new SourceError(entry.name, source.provider, `[morphix-env] plugin source "${entry.name}" needs ${command} on PATH.`);
+      }
+      const reason = typeof error?.code === "string" ? error.code : `exit ${error?.status ?? "unknown"}`;
+      throw new SourceError(entry.name, source.provider, `[morphix-env] plugin source "${entry.name}" failed for key "${key}" (${reason}).`);
+    }
+    values[key] = output.endsWith("\r\n") ? output.slice(0, -2) : output.endsWith("\n") ? output.slice(0, -1) : output;
+  }
+  return { name: entry.name, provider: source.provider, values, availability: "loaded" };
+}
+async function loadSource(entry, context) {
+  switch (entry.source.provider) {
+    case "local":
+      return resolveLocal(entry, entry.source, context);
+    case "infisical":
+      return resolveInfisical(entry, entry.source, context);
+    case "dotenvx":
+      return resolveDotenvx(entry, entry.source, context);
+    case "os-keychain":
+      return resolveKeychain(entry, entry.source);
+    case "doppler":
+      return resolveDoppler(entry, entry.source, context);
+    case "plugin":
+      return resolvePlugin(entry, entry.source, context);
+  }
+}
+
+// src/composition.ts
+var DEFAULT_ENV_FILE = ".env.local";
+var GLOBAL_DOTENV_SOURCE = "__mx_global_dotenv";
+var LEGACY_INFISICAL_SOURCE = "__mx_legacy_infisical";
+var LEGACY_LOCAL_SOURCE = "__mx_legacy_local";
+var CompositionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CompositionError";
+  }
+};
+function collectRedactionValues(environment, provenance) {
+  return [...new Set(Object.entries(provenance).filter(([key]) => !isPublicKey(key) && Boolean(environment[key])).map(([key]) => environment[key]).filter(Boolean))];
+}
+function declaredEntries(loaded) {
+  return new Map(Object.entries(loaded.config.sources || {}).map(([name, source]) => [name, {
+    name,
+    source,
+    baseDir: loaded.baseDir
+  }]));
+}
+function profileEntries(profileName, profiles, sources, visiting = /* @__PURE__ */ new Set()) {
+  if (visiting.has(profileName)) {
+    throw new CompositionError(`[morphix-env] Profile "${profileName}" has a circular extends chain.`);
+  }
+  const input = profiles.get(profileName);
+  if (!input) throw new CompositionError(`[morphix-env] Unknown profile "${profileName}".`);
+  visiting.add(profileName);
+  const profile = normalizeProfile(input);
+  const resolved = profile.extends ? profileEntries(profile.extends, profiles, sources, visiting) : [];
+  for (const sourceName of profile.sources) {
+    const source = sources.get(sourceName);
+    if (!source) throw new CompositionError(`[morphix-env] Profile "${profileName}" references unknown source "${sourceName}".`);
+    resolved.push(source);
+  }
+  visiting.delete(profileName);
+  return resolved;
+}
+function legacyEntries(project, envFilesOverride) {
+  const infisical = project.config.infisical;
+  const entries = [];
+  if (infisical) {
+    const infisicalSource = {
+      provider: "infisical",
+      paths: infisical.paths,
+      // The legacy project source sits above global baseline sources.
+      override: true,
+      ...infisical.projectId ? { projectId: infisical.projectId } : {},
+      ...infisical.siteUrl ? { siteUrl: infisical.siteUrl } : {},
+      ...infisical.envPrefix ? { envPrefix: infisical.envPrefix } : {}
+    };
+    entries.push({
+      name: LEGACY_INFISICAL_SOURCE,
+      source: infisicalSource,
+      baseDir: project.baseDir,
+      legacy: true
+    });
+  }
+  entries.push({
+    name: LEGACY_LOCAL_SOURCE,
+    source: {
+      provider: "local",
+      files: envFilesOverride?.length ? envFilesOverride : project.config.envFiles || [DEFAULT_ENV_FILE],
+      optional: true,
+      override: true
+    },
+    baseDir: project.baseDir,
+    legacy: true
+  });
+  return entries;
+}
+function configProblems(layers, includeGlobal) {
+  return [
+    ...includeGlobal ? validateConfig(layers.global.config, layers.global.path) : [],
+    ...validateConfig(layers.project.config, layers.project.path)
+  ];
+}
+function resolveEntries(layers, options) {
+  const includeGlobal = !options.noGlobal;
+  const errors = configProblems(layers, includeGlobal);
+  if (errors.length) throw new CompositionError(`[morphix-env] Invalid configuration: ${errors.join("; ")}`);
+  const globalSources = includeGlobal ? declaredEntries(layers.global) : /* @__PURE__ */ new Map();
+  const projectSources = declaredEntries(layers.project);
+  const sources = new Map([...globalSources, ...projectSources]);
+  const profiles = new Map([
+    ...includeGlobal ? Object.entries(layers.global.config.profiles || {}) : [],
+    ...Object.entries(layers.project.config.profiles || {})
+  ]);
+  const globalDotenv = includeGlobal ? [{
+    name: GLOBAL_DOTENV_SOURCE,
+    source: { provider: "local", files: [layers.globalEnvFile], optional: true },
+    baseDir: layers.global.baseDir,
+    globalImplicit: true
+  }] : [];
+  const explicitProfile = options.profile || null;
+  const projectDefault = layers.project.config.defaultProfile;
+  const globalDefault = includeGlobal ? layers.global.config.defaultProfile : void 0;
+  const legacy = legacyEntries(layers.project, options.envFiles);
+  const cliLocalOverride = options.envFiles?.length ? [{
+    name: "__mx_cli_local_override",
+    source: { provider: "local", files: options.envFiles, optional: true, override: true },
+    baseDir: layers.project.baseDir
+  }] : [];
+  if (explicitProfile) {
+    return { name: explicitProfile, entries: [...globalDotenv, ...profileEntries(explicitProfile, profiles, sources), ...cliLocalOverride] };
+  }
+  if (projectDefault) {
+    return { name: projectDefault, entries: [...globalDotenv, ...profileEntries(projectDefault, profiles, sources), ...cliLocalOverride] };
+  }
+  if (globalDefault) {
+    const baseline = profileEntries(globalDefault, profiles, sources);
+    return {
+      name: `${globalDefault}+legacy`,
+      entries: [...globalDotenv, ...baseline, ...legacy]
+    };
+  }
+  return { name: "legacy", entries: [...globalDotenv, ...legacy] };
+}
+async function composeEnvironment(layers, options = {}) {
+  const { name: profileName, entries } = resolveEntries(layers, options);
+  const environment = { ...options.baseEnvironment || process.env };
+  const owner = /* @__PURE__ */ new Map();
+  const sourceStatuses = [];
+  const homeDir = options.homeDir || (0, import_os2.homedir)();
+  for (let precedence = 0; precedence < entries.length; precedence++) {
+    const entry = entries[precedence];
+    const loaded = await loadSource(entry, {
+      homeDir,
+      envName: options.envName,
+      noInfisical: options.noInfisical,
+      allowInsecureGlobal: options.allowInsecureGlobal,
+      environment
+    });
+    sourceStatuses.push({
+      name: loaded.name,
+      provider: loaded.provider,
+      availability: loaded.availability,
+      keyCount: Object.keys(loaded.values).length
+    });
+    for (const [key, value] of Object.entries(loaded.values)) {
+      const previous = owner.get(key);
+      if (previous && !entry.source.override) {
+        throw new CompositionError(
+          `[morphix-env] Key "${key}" is provided by both "${previous.source}" and "${entry.name}". Declare override: true on the later source to allow this.`
+        );
+      }
+      environment[key] = value;
+      owner.set(key, {
+        key,
+        source: entry.name,
+        provider: entry.source.provider,
+        precedence,
+        overriddenSources: previous ? [...previous.overriddenSources, previous.source] : []
+      });
+    }
+  }
+  const provenance = Object.fromEntries(owner);
+  return {
+    environment,
+    profileName,
+    sourceStatuses,
+    provenance,
+    sourceEntries: entries,
+    redactionValues: collectRedactionValues(environment, provenance)
+  };
+}
+
+// src/redaction.ts
+var StreamingRedactor = class {
+  constructor(values) {
+    this.pending = "";
+    this.values = [...new Set(values.filter(Boolean))].sort((a, b) => b.length - a.length);
+  }
+  write(chunk) {
+    if (!this.values.length) return typeof chunk === "string" ? chunk : chunk.toString("utf8");
+    const input = this.pending + (typeof chunk === "string" ? chunk : chunk.toString("utf8"));
+    const keep = this.incompletePrefixLength(input);
+    const safe = input.slice(0, input.length - keep);
+    this.pending = input.slice(input.length - keep);
+    return this.redact(safe);
+  }
+  flush() {
+    const output = this.redact(this.pending);
+    this.pending = "";
+    return output;
+  }
+  incompletePrefixLength(input) {
+    const completeEnd = this.lastCompleteMatchEnd(input);
+    const limit = Math.min(input.length, Math.max(...this.values.map((value) => value.length - 1), 0));
+    for (let length = limit; length > 0; length--) {
+      const suffix = input.slice(-length);
+      const start = input.length - length;
+      if (start >= completeEnd && this.values.some((value) => value.startsWith(suffix))) return length;
+    }
+    return 0;
+  }
+  redact(input) {
+    const marks = new Array(input.length).fill(false);
+    for (const value of this.values) {
+      let from = 0;
+      while (from < input.length) {
+        const index = input.indexOf(value, from);
+        if (index < 0) break;
+        for (let i = index; i < index + value.length; i++) marks[i] = true;
+        from = index + 1;
+      }
+    }
+    let output = "";
+    let inRedaction = false;
+    for (let i = 0; i < input.length; i++) {
+      if (marks[i]) {
+        if (!inRedaction) output += "[REDACTED]";
+        inRedaction = true;
+      } else {
+        output += input[i];
+        inRedaction = false;
+      }
+    }
+    return output;
+  }
+  lastCompleteMatchEnd(input) {
+    let lastEnd = 0;
+    for (const value of this.values) {
+      let from = 0;
+      while (from < input.length) {
+        const index = input.indexOf(value, from);
+        if (index < 0) break;
+        lastEnd = Math.max(lastEnd, index + value.length);
+        from = index + 1;
+      }
+    }
+    return lastEnd;
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CompositionError,
+  StreamingRedactor,
+  composeEnvironment,
+  loadConfigLayers,
+  validateConfig
+});