norn-cli 2.2.2 → 2.4.0

package/out/environmentParser.js

@@ -0,0 +1,736 @@
+"use strict";
+/**
+ * Shared environment file parser — used by both the VS Code extension and the CLI.
+ *
+ * IMPORTANT: This module must NOT import 'vscode' or any VS Code-specific APIs.
+ * It must remain pure Node.js so the CLI can use it without the vscode module.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENV_FILENAME = void 0;
+exports.parseEnvFile = parseEnvFile;
+exports.getEnvSearchStartDirectory = getEnvSearchStartDirectory;
+exports.findEnvFileFromPath = findEnvFileFromPath;
+exports.formatNornenvErrorLocation = formatNornenvErrorLocation;
+exports.formatNornenvErrorLocationForSource = formatNornenvErrorLocationForSource;
+exports.resolveNornenvImports = resolveNornenvImports;
+exports.loadAndResolveEnvFile = loadAndResolveEnvFile;
+exports.findExtendsNode = findExtendsNode;
+exports.findExtendsTemplate = findExtendsTemplate;
+exports.resolveEffectiveEnvVariables = resolveEffectiveEnvVariables;
+exports.resolveInheritedVariableDetails = resolveInheritedVariableDetails;
+exports.resolveEffectiveEnvVariableDetails = resolveEffectiveEnvVariableDetails;
+exports.collectAncestorVariableNames = collectAncestorVariableNames;
+exports.detectExtendsCycles = detectExtendsCycles;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto_1 = require("./secrets/crypto");
+const keyStore_1 = require("./secrets/keyStore");
+// ─── Constants ───────────────────────────────────────────────────────────────
+exports.ENV_FILENAME = '.nornenv';
+// ─── Parsing ─────────────────────────────────────────────────────────────────
+const importRegex = /^import\s+["']?(.+?)["']?\s*$/;
+const sectionHeaderRegex = /^\[(env|template):([a-zA-Z_][a-zA-Z0-9_-]*)(?:\s+extends\s+([^\]]+?))?\]\s*$/;
+const identifierRegex = /^[a-zA-Z_][a-zA-Z0-9_-]*$/;
+const varRegex = /^var\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.+)$/;
+const connectionStringRegex = /^connectionString\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.+)$/;
+const secretRegex = /^secret\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.+)$/;
+const secretConnectionStringRegex = /^secret\s+connectionString\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.+)$/;
+/**
+ * Parses an `extends a, b, c` clause into a deduped, ordered name list.
+ * Returns `[]` if the clause is missing or only contains invalid tokens.
+ */
+function parseExtendsClause(clause) {
+    if (!clause) {
+        return [];
+    }
+    const seen = new Set();
+    const names = [];
+    for (const raw of clause.split(',')) {
+        const name = raw.trim();
+        if (!name || !identifierRegex.test(name) || seen.has(name)) {
+            continue;
+        }
+        seen.add(name);
+        names.push(name);
+    }
+    return names;
+}
+/**
+ * Parses the raw content of a .nornenv file into an EnvironmentConfig.
+ * Does NOT resolve imports — only extracts them as ImportStatements.
+ */
+function parseEnvFile(content, sourceFilePath) {
+    const lines = content.split('\n');
+    const config = {
+        common: {},
+        environments: [],
+        templates: [],
+        secretNames: new Set(),
+        secretValues: new Map(),
+        imports: [],
+        misplacedImports: [],
+        secretDeclarations: []
+    };
+    // The active section is either an env, a template, or null (= common scope).
+    let currentSection = null;
+    let currentKind = null;
+    let seenContent = false; // Track whether we've seen var/secret/section content
+    const assignVariable = (varName, varValue) => {
+        if (currentSection) {
+            currentSection.variables[varName] = varValue;
+        }
+        else {
+            config.common[varName] = varValue;
+        }
+    };
+    const buildSecretDeclaration = (varName, varValue, lineNumber) => ({
+        name: varName,
+        value: varValue,
+        envName: currentKind === 'env' ? currentSection?.name : undefined,
+        templateName: currentKind === 'template' ? currentSection?.name : undefined,
+        lineNumber,
+        filePath: sourceFilePath
+    });
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
+        // Skip empty lines and comments
+        if (!trimmed || trimmed.startsWith('#')) {
+            continue;
+        }
+        // Check for import statement
+        const importMatch = trimmed.match(importRegex);
+        if (importMatch) {
+            const importStatement = {
+                path: importMatch[1],
+                lineNumber: i
+            };
+            config.imports.push(importStatement);
+            if (seenContent) {
+                config.misplacedImports.push(importStatement);
+            }
+            continue;
+        }
+        seenContent = true;
+        // Check for [env:NAME] or [template:NAME] section (with optional `extends a, b` clause)
+        const sectionMatch = trimmed.match(sectionHeaderRegex);
+        if (sectionMatch) {
+            const kind = sectionMatch[1];
+            const name = sectionMatch[2];
+            const parents = parseExtendsClause(sectionMatch[3]);
+            if (kind === 'env') {
+                const env = { name, variables: {}, parents };
+                config.environments.push(env);
+                currentSection = env;
+            }
+            else {
+                const template = { name, variables: {}, parents };
+                config.templates.push(template);
+                currentSection = template;
+            }
+            currentKind = kind;
+            continue;
+        }
+        // Check for secret connectionString declaration
+        const secretConnectionStringMatch = trimmed.match(secretConnectionStringRegex);
+        if (secretConnectionStringMatch) {
+            const profileName = secretConnectionStringMatch[1];
+            const varName = `${profileName}_connectionString`;
+            const varValue = secretConnectionStringMatch[2].trim();
+            config.secretDeclarations.push(buildSecretDeclaration(varName, varValue, i));
+            config.secretNames.add(varName);
+            config.secretValues.set(varName, varValue);
+            assignVariable(varName, varValue);
+            continue;
+        }
+        // Check for secret declaration (treated like var but marked for redaction)
+        const secretMatch = trimmed.match(secretRegex);
+        if (secretMatch) {
+            const varName = secretMatch[1];
+            const varValue = secretMatch[2].trim();
+            config.secretDeclarations.push(buildSecretDeclaration(varName, varValue, i));
+            // Track as secret
+            config.secretNames.add(varName);
+            config.secretValues.set(varName, varValue);
+            assignVariable(varName, varValue);
+            continue;
+        }
+        const connectionStringMatch = trimmed.match(connectionStringRegex);
+        if (connectionStringMatch) {
+            const profileName = connectionStringMatch[1];
+            const varName = `${profileName}_connectionString`;
+            const varValue = connectionStringMatch[2].trim();
+            assignVariable(varName, varValue);
+            continue;
+        }
+        // Check for variable declaration
+        const varMatch = trimmed.match(varRegex);
+        if (varMatch) {
+            const varName = varMatch[1];
+            const varValue = varMatch[2].trim();
+            assignVariable(varName, varValue);
+        }
+    }
+    return config;
+}
+// ─── File Discovery ──────────────────────────────────────────────────────────
+/**
+ * Resolves where environment file discovery should start.
+ * If the path points to a directory, search from that directory.
+ * If it points to a file (or non-existent path), search from the parent directory.
+ */
+function getEnvSearchStartDirectory(targetPath) {
+    const resolvedPath = path.resolve(targetPath);
+    try {
+        const stats = fs.statSync(resolvedPath);
+        return stats.isDirectory() ? resolvedPath : path.dirname(resolvedPath);
+    }
+    catch {
+        return path.dirname(resolvedPath);
+    }
+}
+/**
+ * Finds .nornenv file by walking up from a specific file path.
+ */
+function findEnvFileFromPath(filePath) {
+    let dir = getEnvSearchStartDirectory(filePath);
+    while (true) {
+        const envPath = path.join(dir, exports.ENV_FILENAME);
+        if (fs.existsSync(envPath)) {
+            return envPath;
+        }
+        const parentDir = path.dirname(dir);
+        if (parentDir === dir) {
+            break;
+        }
+        dir = parentDir;
+    }
+    return undefined;
+}
+function formatNornenvErrorLocation(rootEnvFilePath, errorFilePath, line) {
+    const baseDir = path.dirname(rootEnvFilePath);
+    const relativePath = path.relative(baseDir, errorFilePath);
+    const fileLabel = relativePath && relativePath !== '' ? relativePath : path.basename(errorFilePath);
+    return line >= 0 ? `${fileLabel}:${line + 1}` : fileLabel;
+}
+function formatNornenvErrorLocationForSource(sourceFilePath, errorFilePath, line) {
+    const envFilePath = findEnvFileFromPath(sourceFilePath);
+    return formatNornenvErrorLocation(envFilePath ?? sourceFilePath, errorFilePath, line);
+}
+/**
+ * Resolves imports in a .nornenv file, merging variables from all imported files.
+ *
+ * **Duplicate rules:**
+ * - Same variable name in `common` across two files → Error
+ * - Same variable name in the same `[env:X]` section across two files → Error
+ * - Variable in `common` (file A) + same name in `[env:X]` (file B) → Allowed (env overrides common)
+ *
+ * @param config - The parsed config of the entry file
+ * @param baseDir - The directory of the entry file (for resolving relative paths)
+ * @param entryFilePath - The absolute path of the entry file (for error reporting)
+ * @param readFile - Function to read file contents (allows async/sync flexibility)
+ * @param importStack - Active import chain for circular detection
+ * @param alreadyImported - Set of already-resolved absolute paths for deduplication
+ */
+function resolveNornenvImports(config, baseDir, entryFilePath, readFile, importStack, alreadyImported) {
+    const errors = [];
+    const secretErrors = [];
+    const resolvedPaths = [];
+    const stack = importStack ?? [entryFilePath];
+    const visited = alreadyImported ?? new Set([entryFilePath]);
+    // Track variable origins for duplicate detection
+    // Key: "common:varName" or "env:envName:varName"
+    const variableOrigins = new Map();
+    // Register the entry file's own variables as originals
+    registerVariableOrigins(config, entryFilePath, variableOrigins);
+    // Import statements are only allowed at the top of the file.
+    for (const imp of config.misplacedImports) {
+        errors.push({
+            message: `Import statements must appear at the top of the file (before any variable declarations or environment sections).`,
+            filePath: entryFilePath,
+            line: imp.lineNumber
+        });
+    }
+    // Process each import
+    for (const imp of config.imports) {
+        const resolvedImportPath = resolveImportPath(imp.path, baseDir);
+        // Check file exists
+        if (!resolvedImportPath || !fs.existsSync(resolvedImportPath)) {
+            errors.push({
+                message: `Imported file not found: '${imp.path}'`,
+                filePath: entryFilePath,
+                line: imp.lineNumber
+            });
+            continue;
+        }
+        // Check it's a .nornenv file
+        if (!resolvedImportPath.endsWith('.nornenv')) {
+            errors.push({
+                message: `Import must reference a .nornenv file: '${imp.path}'`,
+                filePath: entryFilePath,
+                line: imp.lineNumber
+            });
+            continue;
+        }
+        const normalizedPath = path.resolve(resolvedImportPath);
+        // Check for circular imports
+        if (stack.includes(normalizedPath)) {
+            // Use paths relative to the entry file's directory for readable cycle display
+            const entryDir = path.dirname(stack[0]);
+            const cycle = [...stack, normalizedPath]
+                .map(p => path.relative(entryDir, p) || path.basename(p))
+                .join(' → ');
+            errors.push({
+                message: `Circular import detected: ${cycle}`,
+                filePath: entryFilePath,
+                line: imp.lineNumber
+            });
+            continue;
+        }
+        // Skip already imported files (deduplication)
+        if (visited.has(normalizedPath)) {
+            resolvedPaths.push(normalizedPath);
+            continue;
+        }
+        visited.add(normalizedPath);
+        // Read and parse the imported file
+        let importedContent;
+        try {
+            importedContent = readFile(normalizedPath);
+        }
+        catch {
+            errors.push({
+                message: `Failed to read imported file: '${imp.path}'`,
+                filePath: entryFilePath,
+                line: imp.lineNumber
+            });
+            continue;
+        }
+        const importedConfig = parseEnvFile(importedContent, normalizedPath);
+        resolvedPaths.push(normalizedPath);
+        // Recursively resolve chained imports
+        if (importedConfig.imports.length > 0) {
+            const childResult = resolveNornenvImports(importedConfig, path.dirname(normalizedPath), normalizedPath, readFile, [...stack, normalizedPath], visited);
+            errors.push(...childResult.errors);
+            secretErrors.push(...childResult.secretErrors);
+            resolvedPaths.push(...childResult.resolvedPaths);
+            // After recursion, importedConfig is already merged with its own imports
+            // The childResult.config has all the merged data
+            mergeConfigs(config, childResult.config, entryFilePath, normalizedPath, variableOrigins, errors);
+        }
+        else {
+            // No chained imports — merge directly
+            mergeConfigs(config, importedConfig, entryFilePath, normalizedPath, variableOrigins, errors);
+        }
+    }
+    return { config, errors, secretErrors, resolvedPaths };
+}
+/**
+ * Resolves an import path relative to a base directory.
+ */
+function resolveImportPath(importPath, baseDir) {
+    // Remove quotes if present
+    const cleaned = importPath.replace(/^["']|["']$/g, '');
+    return path.resolve(baseDir, cleaned);
+}
+/**
+ * Registers variable origins from a config for duplicate tracking.
+ */
+function registerVariableOrigins(config, filePath, origins) {
+    // We don't have per-variable line info from parseEnvFile, so use -1.
+    // Diagnostics provider will map line numbers from the actual document.
+    for (const varName of Object.keys(config.common)) {
+        origins.set(`common:${varName}`, { filePath, line: -1, varName });
+    }
+    for (const env of config.environments) {
+        for (const varName of Object.keys(env.variables)) {
+            origins.set(`env:${env.name}:${varName}`, { filePath, line: -1, varName });
+        }
+    }
+    for (const template of config.templates) {
+        for (const varName of Object.keys(template.variables)) {
+            origins.set(`template:${template.name}:${varName}`, { filePath, line: -1, varName });
+        }
+    }
+}
+/**
+ * Merges an imported config into the target config, checking for duplicate variables.
+ *
+ * **Same-layer duplicates are errors. Cross-layer (common vs env) is allowed.**
+ */
+function mergeConfigs(target, source, targetFilePath, sourceFilePath, variableOrigins, errors) {
+    // Merge common variables
+    for (const [varName, varValue] of Object.entries(source.common)) {
+        const key = `common:${varName}`;
+        const existing = variableOrigins.get(key);
+        if (existing) {
+            const sourceLabel = toDisplayPath(sourceFilePath, targetFilePath);
+            const existingLabel = toDisplayPath(existing.filePath, targetFilePath);
+            errors.push({
+                message: `Duplicate variable '${varName}' in common section. Found in '${existingLabel}' and '${sourceLabel}'.`,
+                filePath: sourceFilePath,
+                line: -1 // Line resolved by diagnostics provider
+            });
+        }
+        else {
+            target.common[varName] = varValue;
+            variableOrigins.set(key, { filePath: sourceFilePath, line: -1, varName });
+        }
+    }
+    // Merge environment sections
+    for (const sourceEnv of source.environments) {
+        let targetEnv = target.environments.find(e => e.name === sourceEnv.name);
+        if (!targetEnv) {
+            targetEnv = { name: sourceEnv.name, variables: {}, parents: [...sourceEnv.parents] };
+            target.environments.push(targetEnv);
+        }
+        else {
+            // Union parents from both files (preserve order, dedupe).
+            for (const parent of sourceEnv.parents) {
+                if (!targetEnv.parents.includes(parent)) {
+                    targetEnv.parents.push(parent);
+                }
+            }
+        }
+        for (const [varName, varValue] of Object.entries(sourceEnv.variables)) {
+            const key = `env:${sourceEnv.name}:${varName}`;
+            const existing = variableOrigins.get(key);
+            if (existing) {
+                const sourceLabel = toDisplayPath(sourceFilePath, targetFilePath);
+                const existingLabel = toDisplayPath(existing.filePath, targetFilePath);
+                errors.push({
+                    message: `Duplicate variable '${varName}' in [env:${sourceEnv.name}] section. Found in '${existingLabel}' and '${sourceLabel}'.`,
+                    filePath: sourceFilePath,
+                    line: -1
+                });
+            }
+            else {
+                targetEnv.variables[varName] = varValue;
+                variableOrigins.set(key, { filePath: sourceFilePath, line: -1, varName });
+            }
+        }
+    }
+    // Merge template sections — same duplicate rules as envs.
+    for (const sourceTemplate of source.templates) {
+        let targetTemplate = target.templates.find(t => t.name === sourceTemplate.name);
+        if (!targetTemplate) {
+            targetTemplate = { name: sourceTemplate.name, variables: {}, parents: [...sourceTemplate.parents] };
+            target.templates.push(targetTemplate);
+        }
+        else {
+            for (const parent of sourceTemplate.parents) {
+                if (!targetTemplate.parents.includes(parent)) {
+                    targetTemplate.parents.push(parent);
+                }
+            }
+        }
+        for (const [varName, varValue] of Object.entries(sourceTemplate.variables)) {
+            const key = `template:${sourceTemplate.name}:${varName}`;
+            const existing = variableOrigins.get(key);
+            if (existing) {
+                const sourceLabel = toDisplayPath(sourceFilePath, targetFilePath);
+                const existingLabel = toDisplayPath(existing.filePath, targetFilePath);
+                errors.push({
+                    message: `Duplicate variable '${varName}' in [template:${sourceTemplate.name}] section. Found in '${existingLabel}' and '${sourceLabel}'.`,
+                    filePath: sourceFilePath,
+                    line: -1
+                });
+            }
+            else {
+                targetTemplate.variables[varName] = varValue;
+                variableOrigins.set(key, { filePath: sourceFilePath, line: -1, varName });
+            }
+        }
+    }
+    // Merge secrets
+    for (const name of source.secretNames) {
+        target.secretNames.add(name);
+    }
+    for (const [name, value] of source.secretValues) {
+        target.secretValues.set(name, value);
+    }
+    for (const declaration of source.secretDeclarations) {
+        target.secretDeclarations.push({ ...declaration, filePath: declaration.filePath ?? sourceFilePath });
+    }
+}
+/**
+ * Creates a readable path label relative to the entry file being resolved.
+ */
+function toDisplayPath(filePath, entryFilePath) {
+    const entryDir = path.dirname(entryFilePath);
+    const relative = path.relative(entryDir, filePath);
+    return relative && relative !== '' ? relative : path.basename(filePath);
+}
+// ─── Convenience: Load + Resolve ─────────────────────────────────────────────
+/**
+ * Parses a .nornenv file and resolves all its imports.
+ * Returns the fully merged config with any import errors.
+ */
+function loadAndResolveEnvFile(filePath) {
+    const content = fs.readFileSync(filePath, 'utf-8');
+    const config = parseEnvFile(content, filePath);
+    if (config.imports.length === 0) {
+        const secretErrors = resolveEncryptedSecretValues(config, filePath);
+        return { config, errors: [], secretErrors, resolvedPaths: [] };
+    }
+    const result = resolveNornenvImports(config, path.dirname(filePath), filePath, (p) => fs.readFileSync(p, 'utf-8'));
+    result.secretErrors.push(...resolveEncryptedSecretValues(result.config, filePath));
+    return result;
+}
+/** Looks up a selectable env or reusable template by name. */
+function findExtendsNode(name, config) {
+    const env = config.environments.find(e => e.name === name);
+    if (env) {
+        return { node: env, kind: 'env' };
+    }
+    const template = config.templates.find(t => t.name === name);
+    if (template) {
+        return { node: template, kind: 'template' };
+    }
+    return undefined;
+}
+/** Looks up a valid `extends` parent. Parents must be templates, never envs. */
+function findExtendsTemplate(name, config) {
+    const template = config.templates.find(t => t.name === name);
+    return template ? { node: template, kind: 'template' } : undefined;
+}
+/**
+ * Walks the template `extends` chain of an env (or template) and returns the merged
+ * effective variables: `common` ← parent₁ ← parent₂ ← … ← self.
+ *
+ * Rules:
+ * - Left-to-right walk; right-most parent wins on collisions; self always wins over all parents.
+ * - Diamond inheritance applies a shared ancestor only once (first visit wins, then later
+ *   parents may still override its values).
+ * - Cycles are broken silently here (skipped on re-encounter); the diagnostic provider is
+ *   responsible for surfacing cycles to the user via `detectExtendsCycles`.
+ * - Env parents and unknown parent names are skipped silently; the diagnostic provider surfaces those too.
+ */
+function resolveEffectiveEnvVariables(envName, config) {
+    return Object.fromEntries(Array.from(resolveEffectiveEnvVariableDetails(envName, config).entries())
+        .map(([name, detail]) => [name, detail.value]));
+}
+/**
+ * Returns inherited variables for an env or template, with the final source that wins for
+ * each variable after walking parents left-to-right.
+ */
+function resolveInheritedVariableDetails(nodeName, config) {
+    const inherited = new Map();
+    const visited = new Set();
+    const stack = new Set();
+    const self = findExtendsNode(nodeName, config);
+    if (!self) {
+        return inherited;
+    }
+    const walk = (name) => {
+        if (visited.has(name) || stack.has(name)) {
+            return;
+        }
+        const found = findExtendsTemplate(name, config);
+        if (!found) {
+            return;
+        }
+        stack.add(name);
+        for (const parent of found.node.parents) {
+            walk(parent);
+        }
+        for (const [varName, value] of Object.entries(found.node.variables)) {
+            inherited.set(varName, {
+                name: varName,
+                value,
+                sourceKind: found.kind,
+                sourceName: found.node.name,
+                inherited: true
+            });
+        }
+        visited.add(name);
+        stack.delete(name);
+    };
+    for (const parent of self.node.parents) {
+        walk(parent);
+    }
+    return inherited;
+}
+/**
+ * Returns the effective variables for an env with source metadata:
+ * `common` ← parent₁ ← parent₂ ← … ← self.
+ */
+function resolveEffectiveEnvVariableDetails(envName, config) {
+    const details = new Map();
+    for (const [name, value] of Object.entries(config.common)) {
+        details.set(name, {
+            name,
+            value,
+            sourceKind: 'common',
+            inherited: true
+        });
+    }
+    for (const [name, detail] of resolveInheritedVariableDetails(envName, config)) {
+        details.set(name, detail);
+    }
+    const env = config.environments.find(e => e.name === envName);
+    if (env) {
+        for (const [name, value] of Object.entries(env.variables)) {
+            details.set(name, {
+                name,
+                value,
+                sourceKind: 'env',
+                sourceName: env.name,
+                inherited: false
+            });
+        }
+    }
+    return details;
+}
+/**
+ * Returns the set of variable names contributed by the entire ancestor chain of `envName`,
+ * NOT including `common` and NOT including the env's own self-declared variables.
+ *
+ * Used to relax the scope-rule diagnostic so an env-section value may reference any
+ * variable defined in an ancestor template/env (not just `common`).
+ */
+function collectAncestorVariableNames(envName, config) {
+    return new Set(resolveInheritedVariableDetails(envName, config).keys());
+}
+/**
+ * Detects cycles in the template `extends` graph.
+ * Returns one entry per cycle-back edge encountered.
+ */
+function detectExtendsCycles(config) {
+    const cycles = [];
+    const visitedGlobally = new Set();
+    const visit = (name, kind, stack) => {
+        const stackIndex = stack.indexOf(name);
+        if (stackIndex >= 0) {
+            cycles.push({
+                name,
+                kind,
+                path: [...stack.slice(stackIndex), name]
+            });
+            return;
+        }
+        if (visitedGlobally.has(name)) {
+            return;
+        }
+        const found = findExtendsNode(name, config);
+        if (!found) {
+            return;
+        }
+        const nextStack = [...stack, name];
+        for (const parent of found.node.parents) {
+            const parentFound = findExtendsTemplate(parent, config);
+            if (!parentFound) {
+                continue;
+            }
+            visit(parent, parentFound.kind, nextStack);
+        }
+        visitedGlobally.add(name);
+    };
+    for (const env of config.environments) {
+        visit(env.name, 'env', []);
+    }
+    for (const template of config.templates) {
+        visit(template.name, 'template', []);
+    }
+    return cycles;
+}
+function resolveEncryptedSecretValues(config, entryFilePath) {
+    const errors = [];
+    for (const declaration of config.secretDeclarations) {
+        if (!(0, crypto_1.isEncryptedSecretValue)(declaration.value)) {
+            continue;
+        }
+        const parsed = (0, crypto_1.parseEncryptedSecretValue)(declaration.value);
+        const filePath = declaration.filePath ?? entryFilePath;
+        if (!parsed.ok) {
+            errors.push({
+                code: 'invalid-format',
+                message: parsed.error,
+                filePath,
+                line: declaration.lineNumber,
+                variableName: declaration.name
+            });
+            continue;
+        }
+        const { kid } = parsed.parsed;
+        const key = (0, keyStore_1.resolveSecretKey)(kid, filePath);
+        if (!key) {
+            errors.push({
+                code: 'missing-key',
+                message: `Missing secret key for kid '${kid}'.`,
+                filePath,
+                line: declaration.lineNumber,
+                variableName: declaration.name,
+                kid
+            });
+            continue;
+        }
+        let plaintext;
+        try {
+            plaintext = (0, crypto_1.decryptSecretValue)(declaration.value, key);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            errors.push({
+                code: 'decrypt-failed',
+                message: `Failed to decrypt secret '${declaration.name}' with kid '${kid}': ${message}`,
+                filePath,
+                line: declaration.lineNumber,
+                variableName: declaration.name,
+                kid
+            });
+            continue;
+        }
+        declaration.value = plaintext;
+        if (declaration.envName) {
+            const env = config.environments.find(e => e.name === declaration.envName);
+            if (env) {
+                env.variables[declaration.name] = plaintext;
+            }
+        }
+        else if (declaration.templateName) {
+            const template = config.templates.find(t => t.name === declaration.templateName);
+            if (template) {
+                template.variables[declaration.name] = plaintext;
+            }
+        }
+        else {
+            config.common[declaration.name] = plaintext;
+        }
+        config.secretValues.set(declaration.name, plaintext);
+    }
+    return errors;
+}
+//# sourceMappingURL=environmentParser.js.map