norn-cli 1.6.1 → 1.7.0

package/dist/cli.js

@@ -11599,8 +11599,8 @@ var require_follow_redirects = __commonJS({
       }
       return parsed;
     }
-    function resolveUrl(relative4, base) {
-      return useNativeURL ? new URL2(relative4, base) : parseUrl(url2.resolve(base, relative4));
+    function resolveUrl(relative5, base) {
+      return useNativeURL ? new URL2(relative5, base) : parseUrl(url2.resolve(base, relative5));
     }
     function validateUrl(input2) {
       if (/^\[/.test(input2.hostname) && !/^\[[:0-9a-f]+\]$/i.test(input2.hostname)) {
@@ -15697,49 +15697,49 @@ var require_fast_uri = __commonJS({
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative4, options, skipNormalization) {
+    function resolveComponent(base, relative5, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse2(serialize(base, options), options);
-        relative4 = parse2(serialize(relative4, options), options);
+        relative5 = parse2(serialize(relative5, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative4.scheme) {
-        target.scheme = relative4.scheme;
-        target.userinfo = relative4.userinfo;
-        target.host = relative4.host;
-        target.port = relative4.port;
-        target.path = removeDotSegments(relative4.path || "");
-        target.query = relative4.query;
+      if (!options.tolerant && relative5.scheme) {
+        target.scheme = relative5.scheme;
+        target.userinfo = relative5.userinfo;
+        target.host = relative5.host;
+        target.port = relative5.port;
+        target.path = removeDotSegments(relative5.path || "");
+        target.query = relative5.query;
       } else {
-        if (relative4.userinfo !== void 0 || relative4.host !== void 0 || relative4.port !== void 0) {
-          target.userinfo = relative4.userinfo;
-          target.host = relative4.host;
-          target.port = relative4.port;
-          target.path = removeDotSegments(relative4.path || "");
-          target.query = relative4.query;
+        if (relative5.userinfo !== void 0 || relative5.host !== void 0 || relative5.port !== void 0) {
+          target.userinfo = relative5.userinfo;
+          target.host = relative5.host;
+          target.port = relative5.port;
+          target.path = removeDotSegments(relative5.path || "");
+          target.query = relative5.query;
         } else {
-          if (!relative4.path) {
+          if (!relative5.path) {
             target.path = base.path;
-            if (relative4.query !== void 0) {
-              target.query = relative4.query;
+            if (relative5.query !== void 0) {
+              target.query = relative5.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative4.path[0] === "/") {
-              target.path = removeDotSegments(relative4.path);
+            if (relative5.path[0] === "/") {
+              target.path = removeDotSegments(relative5.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative4.path;
+                target.path = "/" + relative5.path;
               } else if (!base.path) {
-                target.path = relative4.path;
+                target.path = relative5.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative4.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative5.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative4.query;
+            target.query = relative5.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -15747,7 +15747,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative4.fragment;
+      target.fragment = relative5.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -18783,6 +18783,39 @@ var init_schemaGenerator = __esm({
   }
 });
 
+// src/quotedString.ts
+function decodeQuotedStringLiteral(literal) {
+  if (literal.length < 2) {
+    return literal;
+  }
+  const quoteChar = literal[0];
+  if (quoteChar !== '"' && quoteChar !== "'" || literal[literal.length - 1] !== quoteChar) {
+    return literal;
+  }
+  const inner = literal.slice(1, -1);
+  let decoded = "";
+  for (let i = 0; i < inner.length; i++) {
+    const char = inner[i];
+    if (char !== "\\" || i === inner.length - 1) {
+      decoded += char;
+      continue;
+    }
+    const nextChar = inner[i + 1];
+    if (nextChar === "\\" || nextChar === quoteChar) {
+      decoded += nextChar;
+      i++;
+      continue;
+    }
+    decoded += char;
+  }
+  return decoded;
+}
+var init_quotedString = __esm({
+  "src/quotedString.ts"() {
+    "use strict";
+  }
+});
+
 // src/assertionRunner.ts
 var assertionRunner_exports = {};
 __export(assertionRunner_exports, {
@@ -18806,7 +18839,7 @@ function parseAssertCommand(line2) {
   if (pipeIndex !== -1) {
     message = content.substring(pipeIndex + 1).trim();
     if (message.startsWith('"') && message.endsWith('"') || message.startsWith("'") && message.endsWith("'")) {
-      message = message.slice(1, -1);
+      message = decodeQuotedStringLiteral(message);
     }
     content = content.substring(0, pipeIndex).trim();
   }
@@ -18848,8 +18881,17 @@ function parseAssertCommand(line2) {
 function findUnquotedPipe(str) {
   let inQuote = false;
   let quoteChar = "";
+  let escapeNext = false;
   for (let i = 0; i < str.length; i++) {
     const char = str[i];
+    if (escapeNext) {
+      escapeNext = false;
+      continue;
+    }
+    if (inQuote && char === "\\") {
+      escapeNext = true;
+      continue;
+    }
     if ((char === '"' || char === "'") && !inQuote) {
       inQuote = true;
       quoteChar = char;
@@ -18934,11 +18976,28 @@ function resolveValue(expr, responses, variables, getValueByPath2, responseIndex
       }
     }
   }
-  const varMatch = trimmed.match(/^\{\{([a-zA-Z_][a-zA-Z0-9_]*)\}\}$/);
+  const varMatch = trimmed.match(/^\{\{(\$env|[a-zA-Z_][a-zA-Z0-9_]*)((?:\.[a-zA-Z_][a-zA-Z0-9_]*|\[\d+\])*)\}\}$/);
   if (varMatch) {
     const varName = varMatch[1];
+    const pathPart = varMatch[2] || "";
     if (varName in variables) {
       const varValue = variables[varName];
+      if (pathPart) {
+        if (typeof varValue === "object" && varValue !== null) {
+          const path10 = pathPart.replace(/^\./, "");
+          return { value: getNestedValue2(varValue, path10) };
+        }
+        if (typeof varValue === "string") {
+          try {
+            const parsed = JSON.parse(varValue);
+            const path10 = pathPart.replace(/^\./, "");
+            return { value: getNestedValue2(parsed, path10) };
+          } catch {
+            return { value: void 0, error: `Cannot access path on non-object variable: ${varName}` };
+          }
+        }
+        return { value: void 0, error: `Cannot access path on non-object variable: ${varName}` };
+      }
       if (typeof varValue === "string" && /^-?\d+(\.\d+)?$/.test(varValue)) {
         return { value: parseFloat(varValue) };
       }
@@ -18947,7 +19006,7 @@ function resolveValue(expr, responses, variables, getValueByPath2, responseIndex
     return { value: void 0, error: `Variable {{${varName}}} is not defined` };
   }
   if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
-    return { value: trimmed.slice(1, -1) };
+    return { value: decodeQuotedStringLiteral(trimmed) };
   }
   if (/^-?\d+(\.\d+)?$/.test(trimmed)) {
     return { value: parseFloat(trimmed) };
@@ -19227,6 +19286,7 @@ var init_assertionRunner = __esm({
   "src/assertionRunner.ts"() {
     "use strict";
     init_schemaGenerator();
+    init_quotedString();
   }
 });
 
@@ -19850,9 +19910,7 @@ function getEndpoint(definition, name) {
 function resolveHeaderValues(headerGroup, variables) {
   const resolved = {};
   for (const [name, value] of Object.entries(headerGroup.headers)) {
-    resolved[name] = value.replace(/\{\{([a-zA-Z_][a-zA-Z0-9_]*)\}\}/g, (_, varName) => {
-      return variables[varName] ?? `{{${varName}}}`;
-    });
+    resolved[name] = substituteVariables(value, variables);
   }
   return resolved;
 }
@@ -20149,9 +20207,29 @@ function valueToString(value) {
   }
   return String(value);
 }
+var ENV_SCOPE_KEY = "$env";
+function attachEnvironmentScope(variables, envVariables) {
+  if (!envVariables) {
+    return variables;
+  }
+  Object.defineProperty(variables, ENV_SCOPE_KEY, {
+    value: envVariables,
+    enumerable: false,
+    configurable: true,
+    writable: false
+  });
+  return variables;
+}
+function copyEnvironmentScope(target, source) {
+  const envScope = source[ENV_SCOPE_KEY];
+  if (envScope && typeof envScope === "object") {
+    attachEnvironmentScope(target, envScope);
+  }
+  return target;
+}
 function substituteVariables(text, variables) {
   return text.replace(
-    /\{\{(\$\d+|[a-zA-Z_][a-zA-Z0-9_]*)((?:\.[a-zA-Z_][a-zA-Z0-9_-]*|\[\d+\])*)\}\}/g,
+    /\{\{(\$env|\$\d+|[a-zA-Z_][a-zA-Z0-9_]*)((?:\.[a-zA-Z_][a-zA-Z0-9_-]*|\[\d+\])*)\}\}/g,
     (match, varName, pathPart) => {
       if (!(varName in variables)) {
         return match;
@@ -20161,8 +20239,14 @@ function substituteVariables(text, variables) {
         if (pathPart) {
           const path10 = pathPart.replace(/^\./, "");
           const nestedValue = getNestedValue(value, path10);
+          if (nestedValue === void 0 && varName === ENV_SCOPE_KEY) {
+            return match;
+          }
           return valueToString(nestedValue);
         }
+        if (varName === ENV_SCOPE_KEY) {
+          return match;
+        }
         return valueToString(value);
       }
       if (pathPart && typeof value === "string") {
@@ -20170,8 +20254,14 @@ function substituteVariables(text, variables) {
           const parsed = JSON.parse(value);
           const path10 = pathPart.replace(/^\./, "");
           const nestedValue = getNestedValue(parsed, path10);
+          if (nestedValue === void 0 && varName === ENV_SCOPE_KEY) {
+            return match;
+          }
           return valueToString(nestedValue);
         } catch {
+          if (varName === ENV_SCOPE_KEY) {
+            return match;
+          }
           return value;
         }
       }
@@ -26940,7 +27030,7 @@ function formatUserFacingError(error, context) {
 }
 
 // src/requestValidation.ts
-var PLACEHOLDER_REGEX = /\{\{([a-zA-Z_][a-zA-Z0-9_]*)\}\}/g;
+var PLACEHOLDER_REGEX = /\{\{(\$env|\$[0-9]+|[a-zA-Z_][a-zA-Z0-9_]*)((?:\.[a-zA-Z_][a-zA-Z0-9_-]*|\[\d+\])*)\}\}/g;
 function collectUnresolvedPlaceholders(text) {
   if (!text) {
     return [];
@@ -26949,15 +27039,23 @@ function collectUnresolvedPlaceholders(text) {
   let match;
   PLACEHOLDER_REGEX.lastIndex = 0;
   while ((match = PLACEHOLDER_REGEX.exec(text)) !== null) {
-    names.add(match[1]);
+    names.add(match[0]);
   }
   return [...names];
 }
+function extractEnvScopedNames(placeholders) {
+  return placeholders.filter((value) => value.startsWith("{{$env.")).map((value) => value.slice("{{$env.".length, -2).split(/[.[\]]/)[0]).filter(Boolean);
+}
 function buildMissingVariableHint(missingVars, context) {
   const env3 = context?.environment;
+  const envScopedNames = extractEnvScopedNames(missingVars);
+  const unscopedVars = missingVars.filter((value) => !value.startsWith("{{$env."));
   if (env3?.hasEnvFile && env3.availableEnvironments && env3.availableEnvironments.length > 0 && !env3.activeEnvironment) {
     return `A .nornenv file was found but no environment is selected. Select one of: ${env3.availableEnvironments.join(", ")}.`;
   }
+  if (env3?.hasEnvFile && env3.activeEnvironment && envScopedNames.length > 0 && unscopedVars.length === 0) {
+    return `Check that ${envScopedNames.map((v) => `'${v}'`).join(", ")} exist in the active environment '${env3.activeEnvironment}'.`;
+  }
   if (env3?.hasEnvFile && env3.activeEnvironment) {
     return `Check that ${missingVars.map((v) => `'${v}'`).join(", ")} exist in the active environment '${env3.activeEnvironment}' or as file-level variables.`;
   }
@@ -26975,7 +27073,7 @@ function describeUnresolvedLocation(label, vars) {
   if (vars.length === 0) {
     return void 0;
   }
-  return `${label}: unresolved ${vars.length === 1 ? "variable" : "variables"} ${vars.map((v) => `{{${v}}}`).join(", ")}`;
+  return `${label}: unresolved ${vars.length === 1 ? "variable" : "variables"} ${vars.join(", ")}`;
 }
 function shouldValidateBodyPlaceholders(parsed) {
   const method = String(parsed.method || "").toUpperCase();
@@ -26995,7 +27093,7 @@ function validatePreparedRequest(parsed, context) {
     throw new NornError({
       category: "variable-resolution",
       code: "unresolved-request-variables",
-      message: `Request could not be prepared: unresolved ${missingVars.length === 1 ? "variable" : "variables"} ${missingVars.map((v) => `{{${v}}}`).join(", ")}.`,
+      message: `Request could not be prepared: unresolved ${missingVars.length === 1 ? "variable" : "variables"} ${missingVars.join(", ")}.`,
       details,
       hint: buildMissingVariableHint(missingVars, context),
       context: {
@@ -27029,6 +27127,7 @@ function validatePreparedRequest(parsed, context) {
 }
 
 // src/sequenceRunner.ts
+init_quotedString();
 init_assertionRunner();
 function applyHeaderGroupsToRequest(parsed, requestText, headerGroups, variables) {
   const lines = requestText.split("\n");
@@ -27191,7 +27290,7 @@ function parseRunArguments(argsStr) {
     if (namedMatch) {
       let value = namedMatch[2].trim();
       if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-        value = value.slice(1, -1);
+        value = decodeQuotedStringLiteral(value);
       }
       args.push({
         name: namedMatch[1],
@@ -27200,7 +27299,7 @@ function parseRunArguments(argsStr) {
     } else {
       let value = trimmed;
       if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-        value = value.slice(1, -1);
+        value = decodeQuotedStringLiteral(value);
       }
       args.push({ value });
     }
@@ -27371,7 +27470,7 @@ function parseSequenceParameters(line2) {
       hasSeenDefault = true;
       let defaultValue = defaultMatch[2].trim();
       if (defaultValue.startsWith('"') && defaultValue.endsWith('"') || defaultValue.startsWith("'") && defaultValue.endsWith("'")) {
-        defaultValue = defaultValue.slice(1, -1);
+        defaultValue = decodeQuotedStringLiteral(defaultValue);
       }
       params.push({
         name: defaultMatch[1],
@@ -27498,7 +27597,7 @@ function parseTypedValue(value) {
     return parseFloat(value);
   }
   if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-    return value.slice(1, -1);
+    return decodeQuotedStringLiteral(value);
   }
   return value;
 }
@@ -27624,7 +27723,7 @@ function parseVarAssignCommand(line2) {
 function evaluateValueExpression(expr, runtimeVariables) {
   const trimmed = expr.trim();
   if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
-    const inner = trimmed.slice(1, -1);
+    const inner = decodeQuotedStringLiteral(trimmed);
     const substituted = substituteVariables(inner, runtimeVariables);
     return { value: substituted };
   }
@@ -27749,7 +27848,7 @@ function resolveBareVariables(text, variables) {
     const resolvedParts = parts.map((part) => {
       const partTrimmed = part.trim();
       if (partTrimmed.startsWith('"') && partTrimmed.endsWith('"') || partTrimmed.startsWith("'") && partTrimmed.endsWith("'")) {
-        return partTrimmed.slice(1, -1);
+        return decodeQuotedStringLiteral(partTrimmed);
       }
       const varMatch = partTrimmed.match(/^([a-zA-Z_][a-zA-Z0-9_]*)((?:\.[a-zA-Z_][a-zA-Z0-9_]*|\[\d+\])*)$/);
       if (varMatch) {
@@ -27775,8 +27874,19 @@ function splitExpressionParts(expr) {
   let current = "";
   let inString = false;
   let stringChar = "";
+  let escapeNext = false;
   for (let i = 0; i < expr.length; i++) {
     const char = expr[i];
+    if (escapeNext) {
+      current += char;
+      escapeNext = false;
+      continue;
+    }
+    if (inString && char === "\\") {
+      current += char;
+      escapeNext = true;
+      continue;
+    }
     if (!inString && (char === '"' || char === "'")) {
       inString = true;
       stringChar = char;
@@ -28232,7 +28342,7 @@ async function runSequenceWithJar(sequenceContent, fileVariables, cookieJar, wor
       });
     }
   };
-  const runtimeVariables = { ...fileVariables, ...sequenceArgs };
+  const runtimeVariables = copyEnvironmentScope({ ...fileVariables, ...sequenceArgs }, fileVariables);
   const buildRequestValidationContext = (stepNumber, method, url2, requestName) => ({
     source: "sequence",
     filePath: executionContext?.filePath,
@@ -28994,19 +29104,13 @@ ${indentMultiline(userMessage)}`;
                   apiRequest.endpointName
                 );
                 if (endpoint) {
-                  let resolvedPath = endpoint.path;
-                  resolvedPath = resolvedPath.replace(/\{\{([a-zA-Z_][a-zA-Z0-9_]*)\}\}/g, (_, varName) => {
-                    return runtimeVariables[varName] !== void 0 ? String(runtimeVariables[varName]) : `{{${varName}}}`;
-                  });
+                  let resolvedPath = substituteVariables(endpoint.path, runtimeVariables);
                   for (const [paramName, paramValue] of Object.entries(apiRequest.params)) {
                     let resolvedValue = paramValue;
                     if (runtimeVariables[paramValue] !== void 0) {
                       resolvedValue = String(runtimeVariables[paramValue]);
-                    } else if (paramValue.startsWith("{{") && paramValue.endsWith("}}")) {
-                      const varName = paramValue.slice(2, -2);
-                      if (runtimeVariables[varName] !== void 0) {
-                        resolvedValue = String(runtimeVariables[varName]);
-                      }
+                    } else {
+                      resolvedValue = substituteVariables(paramValue, runtimeVariables);
                     }
                     resolvedPath = resolvedPath.replace(`{${paramName}}`, resolvedValue);
                   }
@@ -29019,10 +29123,7 @@ ${indentMultiline(userMessage)}`;
                     }
                   }
                   for (const [headerName, headerValue] of Object.entries(apiRequest.inlineHeaders)) {
-                    let resolved = headerValue;
-                    resolved = resolved.replace(/\{\{([a-zA-Z_][a-zA-Z0-9_]*)\}\}/g, (_, varName) => {
-                      return runtimeVariables[varName] !== void 0 ? String(runtimeVariables[varName]) : `{{${varName}}}`;
-                    });
+                    const resolved = substituteVariables(headerValue, runtimeVariables);
                     combinedHeaders[headerName] = resolved;
                   }
                   const bodyParsed = parserHttpRequest(namedRequest.content, runtimeVariables);
@@ -30775,6 +30876,31 @@ var path4 = __toESM(require("path"));
 var NORN_CACHE_DIR = ".norn-cache";
 var CACHE_GITIGNORE_FILE = ".gitignore";
 var CACHE_GITIGNORE_CONTENT = "*\n";
+var PROJECT_ROOT_MARKERS = [".git", "package.json", "pnpm-workspace.yaml", "package-lock.json", "yarn.lock", ".nornenv"];
+function getSearchStartDirectory(targetPath) {
+  const resolvedPath = path4.resolve(targetPath);
+  try {
+    const stats = fs5.statSync(resolvedPath);
+    return stats.isDirectory() ? resolvedPath : path4.dirname(resolvedPath);
+  } catch {
+    return path4.dirname(resolvedPath);
+  }
+}
+function findProjectRoot(targetPath) {
+  let dir = getSearchStartDirectory(targetPath);
+  let projectRoot;
+  while (true) {
+    if (PROJECT_ROOT_MARKERS.some((marker) => fs5.existsSync(path4.join(dir, marker)))) {
+      projectRoot = dir;
+    }
+    const parent = path4.dirname(dir);
+    if (parent === dir) {
+      break;
+    }
+    dir = parent;
+  }
+  return projectRoot ?? getSearchStartDirectory(targetPath);
+}
 function ensureNornCacheGitignore(cacheDir) {
   const gitignorePath = path4.join(cacheDir, CACHE_GITIGNORE_FILE);
   try {
@@ -30790,46 +30916,114 @@ function ensureNornCacheGitignore(cacheDir) {
 // src/secrets/keyStore.ts
 var CACHE_FILE = "secret-keys.json";
 var CACHE_VERSION = 1;
+var CACHE_SCAN_IGNORED_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "out"]);
 var sessionKeys = /* @__PURE__ */ new Map();
-function getSearchStartDirectory(targetPath) {
-  const resolvedPath = path5.resolve(targetPath);
+var projectSecretKeyCacheDirs = /* @__PURE__ */ new Map();
+function getCacheFilePath(cacheDir) {
+  return path5.join(cacheDir, CACHE_FILE);
+}
+function cacheFileExists(cacheDir) {
+  const cacheFilePath = getCacheFilePath(cacheDir);
   try {
-    const stats = fs6.statSync(resolvedPath);
-    return stats.isDirectory() ? resolvedPath : path5.dirname(resolvedPath);
+    return fs6.existsSync(cacheFilePath) && fs6.statSync(cacheFilePath).isFile();
   } catch {
-    return path5.dirname(resolvedPath);
+    return false;
   }
 }
-function findExistingCacheDir(targetPath) {
-  let dir = getSearchStartDirectory(targetPath);
-  while (true) {
+function getProjectSecretKeyCacheDirs(projectRoot) {
+  const cached = projectSecretKeyCacheDirs.get(projectRoot);
+  if (cached && cached.every((cacheDir) => cacheFileExists(cacheDir))) {
+    return cached;
+  }
+  const results = [];
+  const queue = [projectRoot];
+  while (queue.length > 0) {
+    const dir = queue.shift();
+    if (!dir) {
+      continue;
+    }
     const cacheDir = path5.join(dir, NORN_CACHE_DIR);
-    if (fs6.existsSync(cacheDir) && fs6.statSync(cacheDir).isDirectory()) {
-      return cacheDir;
+    if (cacheFileExists(cacheDir)) {
+      results.push(cacheDir);
     }
-    const parent = path5.dirname(dir);
-    if (parent === dir) {
-      return void 0;
+    let entries;
+    try {
+      entries = fs6.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
     }
-    dir = parent;
+    for (const entry of entries) {
+      if (!entry.isDirectory()) {
+        continue;
+      }
+      if (entry.name === NORN_CACHE_DIR || CACHE_SCAN_IGNORED_DIRS.has(entry.name)) {
+        continue;
+      }
+      queue.push(path5.join(dir, entry.name));
+    }
+  }
+  results.sort();
+  projectSecretKeyCacheDirs.set(projectRoot, results);
+  return results;
+}
+function getCacheDistance(targetPath, cacheDir) {
+  const relative5 = path5.relative(getSearchStartDirectory(targetPath), cacheDir);
+  if (!relative5 || relative5 === ".") {
+    return 0;
+  }
+  return relative5.split(path5.sep).filter((segment) => segment !== "").length;
+}
+function findExistingSecretKeyCacheDir(targetPath) {
+  const projectRoot = findProjectRoot(targetPath);
+  const candidates = getProjectSecretKeyCacheDirs(projectRoot);
+  let bestMatch;
+  let bestScore = Number.POSITIVE_INFINITY;
+  for (const candidate of candidates) {
+    const score = getCacheDistance(targetPath, candidate);
+    if (score < bestScore || score === bestScore && candidate < (bestMatch ?? candidate)) {
+      bestMatch = candidate;
+      bestScore = score;
+    }
+  }
+  return bestMatch;
+}
+function rememberSecretKeyCacheDir(targetPath, cacheDir) {
+  const projectRoot = findProjectRoot(targetPath);
+  const cached = projectSecretKeyCacheDirs.get(projectRoot) ?? [];
+  if (cached.includes(cacheDir)) {
+    return;
   }
+  projectSecretKeyCacheDirs.set(projectRoot, [...cached, cacheDir].sort());
 }
 function ensureCacheDir(targetPath) {
-  const existing = findExistingCacheDir(targetPath);
-  const cacheDir = existing ?? path5.join(getSearchStartDirectory(targetPath), NORN_CACHE_DIR);
+  const existing = findExistingSecretKeyCacheDir(targetPath);
+  const projectRoot = findProjectRoot(targetPath);
+  const cacheDir = existing ?? path5.join(projectRoot, NORN_CACHE_DIR);
   if (!fs6.existsSync(cacheDir)) {
     fs6.mkdirSync(cacheDir, { recursive: true });
   }
   ensureNornCacheGitignore(cacheDir);
+  rememberSecretKeyCacheDir(targetPath, cacheDir);
   return cacheDir;
 }
-function getCachePath(targetPath) {
-  const cacheDir = ensureCacheDir(targetPath);
-  return path5.join(cacheDir, CACHE_FILE);
+function getReadCachePath(targetPath) {
+  const existing = findExistingSecretKeyCacheDir(targetPath);
+  if (existing) {
+    return getCacheFilePath(existing);
+  }
+  const projectRoot = findProjectRoot(targetPath);
+  const projectCacheDir = path5.join(projectRoot, NORN_CACHE_DIR);
+  if (fs6.existsSync(projectCacheDir) && fs6.statSync(projectCacheDir).isDirectory()) {
+    return getCacheFilePath(projectCacheDir);
+  }
+  return void 0;
+}
+function getWriteCachePath(targetPath) {
+  return getCacheFilePath(ensureCacheDir(targetPath));
 }
 function readCache(targetPath) {
-  const cachePath = getCachePath(targetPath);
-  if (!fs6.existsSync(cachePath)) {
+  const cachePath = getReadCachePath(targetPath);
+  if (!cachePath || !fs6.existsSync(cachePath)) {
     return { version: CACHE_VERSION, keys: {} };
   }
   try {
@@ -30843,7 +31037,7 @@ function readCache(targetPath) {
   }
 }
 function writeCache(targetPath, cache) {
-  const cachePath = getCachePath(targetPath);
+  const cachePath = getWriteCachePath(targetPath);
   fs6.writeFileSync(cachePath, JSON.stringify(cache, null, 2), { encoding: "utf8", mode: 384 });
   try {
     fs6.chmodSync(cachePath, 384);
@@ -31173,8 +31367,8 @@ function mergeConfigs(target, source, targetFilePath, sourceFilePath, variableOr
 }
 function toDisplayPath(filePath, entryFilePath) {
   const entryDir = path6.dirname(entryFilePath);
-  const relative4 = path6.relative(entryDir, filePath);
-  return relative4 && relative4 !== "" ? relative4 : path6.basename(filePath);
+  const relative5 = path6.relative(entryDir, filePath);
+  return relative5 && relative5 !== "" ? relative5 : path6.basename(filePath);
 }
 function loadAndResolveEnvFile(filePath) {
   const content = fs7.readFileSync(filePath, "utf-8");
@@ -31263,8 +31457,17 @@ var fs8 = __toESM(require("fs"));
 var path7 = __toESM(require("path"));
 var envRegex2 = /^\s*\[env:([a-zA-Z_][a-zA-Z0-9_-]*)\]\s*$/;
 var secretRegex2 = /^(\s*secret\s+)([a-zA-Z_][a-zA-Z0-9_]*)(\s*=\s*)(.+)$/;
+function splitContentLines(content) {
+  return content.split(/\r?\n/);
+}
+function detectEol(content) {
+  return content.includes("\r\n") ? "\r\n" : "\n";
+}
+function isNornenvFilePath(filePath) {
+  return path7.basename(filePath).toLowerCase() === ".nornenv";
+}
 function extractSecretLines(content, filePath) {
-  const lines = content.split("\n");
+  const lines = splitContentLines(content);
   const secrets = [];
   let currentEnv;
   for (let i = 0; i < lines.length; i++) {
@@ -31304,7 +31507,7 @@ function extractSecretLines(content, filePath) {
   return secrets;
 }
 function updateSecretLineValue(content, lineNumber, newValue) {
-  const lines = content.split("\n");
+  const lines = splitContentLines(content);
   if (lineNumber < 0 || lineNumber >= lines.length) {
     throw new Error(`Line ${lineNumber + 1} is out of range.`);
   }
@@ -31314,7 +31517,7 @@ function updateSecretLineValue(content, lineNumber, newValue) {
     throw new Error(`Line ${lineNumber + 1} is not a secret declaration.`);
   }
   lines[lineNumber] = `${secretMatch[1]}${secretMatch[2]}${secretMatch[3]}${newValue}`;
-  return lines.join("\n");
+  return lines.join(detectEol(content));
 }
 function findSecretLine(content, variableName, envName) {
   const secretLines = extractSecretLines(content);
@@ -31346,7 +31549,7 @@ function discoverNornenvFiles(targetPath) {
   }
   const stats = fs8.statSync(resolved);
   if (stats.isFile()) {
-    return path7.basename(resolved) === ".nornenv" ? [resolved] : [];
+    return isNornenvFilePath(resolved) ? [resolved] : [];
   }
   const results = [];
   const walk = (dir) => {
@@ -31360,7 +31563,7 @@ function discoverNornenvFiles(targetPath) {
         walk(fullPath);
         continue;
       }
-      if (entry.isFile() && entry.name === ".nornenv") {
+      if (entry.isFile() && isNornenvFilePath(entry.name)) {
         results.push(fullPath);
       }
     }
@@ -31411,8 +31614,8 @@ function formatSecretError(err, envFilePath) {
   if (!envFilePath) {
     return `${err.message}`;
   }
-  const relative4 = path8.relative(path8.dirname(envFilePath), err.filePath);
-  const fileLabel = relative4 && relative4 !== "" ? relative4 : path8.basename(err.filePath);
+  const relative5 = path8.relative(path8.dirname(envFilePath), err.filePath);
+  const fileLabel = relative5 && relative5 !== "" ? relative5 : path8.basename(err.filePath);
   const lineLabel = err.line >= 0 ? `${fileLabel}:${err.line + 1}` : fileLabel;
   return `${lineLabel} - ${err.message}`;
 }
@@ -31465,7 +31668,7 @@ Usage:
 
 Notes:
   - Secrets are stored as ENC[NORN_AGE_V1:kid=<id>:<payload>] in .nornenv.
-  - Keys are cached locally in .norn-cache/secret-keys.json (gitignored).
+  - Keys are cached locally in the project .norn-cache/secret-keys.json (gitignored).
   - norn run auto-prompts once for missing kids when interactive.
 `);
 }
@@ -32012,10 +32215,7 @@ async function runSingleRequest(fileContent, variables, cookieJar, apiDefinition
           }
         }
         for (const [headerName, headerValue] of Object.entries(apiRequest.inlineHeaders)) {
-          let resolved = headerValue;
-          resolved = resolved.replace(/\{\{([a-zA-Z_][a-zA-Z0-9_]*)\}\}/g, (_, varName) => {
-            return variables[varName] !== void 0 ? String(variables[varName]) : `{{${varName}}}`;
-          });
+          const resolved = substituteVariables(headerValue, variables);
           combinedHeaders[headerName] = resolved;
         }
         const parsed2 = {
@@ -32306,7 +32506,7 @@ async function main() {
     const redaction2 = createRedactionOptions(combinedSecretNames, combinedSecretValues, !options.noRedact);
     const fileContent = fs10.readFileSync(filePath, "utf-8");
     const fileVariables = extractFileLevelVariables(fileContent);
-    const variables = { ...resolvedEnv.variables, ...fileVariables };
+    const variables = attachEnvironmentScope({ ...resolvedEnv.variables, ...fileVariables }, resolvedEnv.variables);
     const cookieJar = createCookieJar();
     const workingDir = path9.dirname(filePath);
     const importResult = await resolveImports(
@@ -32522,7 +32722,7 @@ ${fileContent}` : fileContent;
     const redaction2 = createRedactionOptions(combinedSecretNames, combinedSecretValues, !options.noRedact);
     const fileContent = fs10.readFileSync(filePath, "utf-8");
     const fileVariables = extractFileLevelVariables(fileContent);
-    const variables = { ...resolvedEnv.variables, ...fileVariables };
+    const variables = attachEnvironmentScope({ ...resolvedEnv.variables, ...fileVariables }, resolvedEnv.variables);
     const cookieJar = createCookieJar();
     const workingDir = path9.dirname(filePath);
     const importResult = await resolveImports(