norn-cli 2.2.2 → 2.4.0

package/dist/cli.js

@@ -127575,12 +127575,20 @@ function stringifyRequestValue(value) {
   }
   return String(value);
 }
+function shouldResolveBareRequestValue(value, variables) {
+  if (!Object.prototype.hasOwnProperty.call(variables, value)) {
+    return false;
+  }
+  const envScope = variables["$env"];
+  const isEnvOnlyValue = envScope && typeof envScope === "object" && Object.prototype.hasOwnProperty.call(envScope, value) && variables[value] === envScope[value];
+  return !isEnvOnlyValue;
+}
 function resolveRequestValueExpression(value, variables) {
-  if (variables[value] !== void 0) {
+  if (shouldResolveBareRequestValue(value, variables)) {
     return stringifyRequestValue(variables[value]);
   }
   const pathMatch2 = value.match(/^([a-zA-Z_][a-zA-Z0-9_]*)(\.\w[\w-]*(?:\.\w[\w-]*|\[\d+\])*|\[\d+\](?:\.\w[\w-]*|\[\d+\])*)$/);
-  if (pathMatch2 && variables[pathMatch2[1]] !== void 0) {
+  if (pathMatch2 && shouldResolveBareRequestValue(pathMatch2[1], variables)) {
     const nestedValue = getNestedPathValue(variables[pathMatch2[1]], pathMatch2[2].replace(/^\./, ""));
     if (nestedValue !== void 0) {
       return stringifyRequestValue(nestedValue);
@@ -127832,7 +127840,7 @@ function resolveEnvironmentTemplateValue(variableName, variables, secretNames =
           kind: "scope",
           variableName: name,
           reference: referenceName,
-          message: `.nornenv template reference '${referenceName}' is environment-specific. Values inside [env:...] sections can only reference common variables.`
+          message: `.nornenv template reference '${referenceName}' is not in scope. Values inside [env:...] sections can reference common variables and inherited ancestor variables only.`
         });
       }
       if (resolved.secret) {
@@ -132675,24 +132683,58 @@ function listCachedSecretKeyIds(targetPath) {
 // src/environmentParser.ts
 var ENV_FILENAME = ".nornenv";
 var importRegex = /^import\s+["']?(.+?)["']?\s*$/;
-var envRegex = /^\[env:([a-zA-Z_][a-zA-Z0-9_-]*)\]$/;
+var sectionHeaderRegex = /^\[(env|template):([a-zA-Z_][a-zA-Z0-9_-]*)(?:\s+extends\s+([^\]]+?))?\]\s*$/;
+var identifierRegex = /^[a-zA-Z_][a-zA-Z0-9_-]*$/;
 var varRegex = /^var\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.+)$/;
 var connectionStringRegex = /^connectionString\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.+)$/;
 var secretRegex = /^secret\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.+)$/;
 var secretConnectionStringRegex = /^secret\s+connectionString\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.+)$/;
+function parseExtendsClause(clause) {
+  if (!clause) {
+    return [];
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const names = [];
+  for (const raw of clause.split(",")) {
+    const name = raw.trim();
+    if (!name || !identifierRegex.test(name) || seen.has(name)) {
+      continue;
+    }
+    seen.add(name);
+    names.push(name);
+  }
+  return names;
+}
 function parseEnvFile(content, sourceFilePath) {
   const lines = content.split("\n");
   const config2 = {
     common: {},
     environments: [],
+    templates: [],
     secretNames: /* @__PURE__ */ new Set(),
     secretValues: /* @__PURE__ */ new Map(),
     imports: [],
     misplacedImports: [],
     secretDeclarations: []
   };
-  let currentEnv = null;
+  let currentSection = null;
+  let currentKind = null;
   let seenContent = false;
+  const assignVariable = (varName, varValue) => {
+    if (currentSection) {
+      currentSection.variables[varName] = varValue;
+    } else {
+      config2.common[varName] = varValue;
+    }
+  };
+  const buildSecretDeclaration = (varName, varValue, lineNumber) => ({
+    name: varName,
+    value: varValue,
+    envName: currentKind === "env" ? currentSection?.name : void 0,
+    templateName: currentKind === "template" ? currentSection?.name : void 0,
+    lineNumber,
+    filePath: sourceFilePath
+  });
   for (let i = 0; i < lines.length; i++) {
     const trimmed = lines[i].trim();
     if (!trimmed || trimmed.startsWith("#")) {
@@ -132711,13 +132753,21 @@ function parseEnvFile(content, sourceFilePath) {
       continue;
     }
     seenContent = true;
-    const envMatch = trimmed.match(envRegex);
-    if (envMatch) {
-      currentEnv = {
-        name: envMatch[1],
-        variables: {}
-      };
-      config2.environments.push(currentEnv);
+    const sectionMatch = trimmed.match(sectionHeaderRegex);
+    if (sectionMatch) {
+      const kind = sectionMatch[1];
+      const name = sectionMatch[2];
+      const parents = parseExtendsClause(sectionMatch[3]);
+      if (kind === "env") {
+        const env3 = { name, variables: {}, parents };
+        config2.environments.push(env3);
+        currentSection = env3;
+      } else {
+        const template = { name, variables: {}, parents };
+        config2.templates.push(template);
+        currentSection = template;
+      }
+      currentKind = kind;
       continue;
     }
     const secretConnectionStringMatch = trimmed.match(secretConnectionStringRegex);
@@ -132725,40 +132775,20 @@ function parseEnvFile(content, sourceFilePath) {
       const profileName = secretConnectionStringMatch[1];
       const varName = `${profileName}_connectionString`;
       const varValue = secretConnectionStringMatch[2].trim();
-      config2.secretDeclarations.push({
-        name: varName,
-        value: varValue,
-        envName: currentEnv?.name,
-        lineNumber: i,
-        filePath: sourceFilePath
-      });
+      config2.secretDeclarations.push(buildSecretDeclaration(varName, varValue, i));
       config2.secretNames.add(varName);
       config2.secretValues.set(varName, varValue);
-      if (currentEnv) {
-        currentEnv.variables[varName] = varValue;
-      } else {
-        config2.common[varName] = varValue;
-      }
+      assignVariable(varName, varValue);
       continue;
     }
     const secretMatch = trimmed.match(secretRegex);
     if (secretMatch) {
       const varName = secretMatch[1];
       const varValue = secretMatch[2].trim();
-      config2.secretDeclarations.push({
-        name: varName,
-        value: varValue,
-        envName: currentEnv?.name,
-        lineNumber: i,
-        filePath: sourceFilePath
-      });
+      config2.secretDeclarations.push(buildSecretDeclaration(varName, varValue, i));
       config2.secretNames.add(varName);
       config2.secretValues.set(varName, varValue);
-      if (currentEnv) {
-        currentEnv.variables[varName] = varValue;
-      } else {
-        config2.common[varName] = varValue;
-      }
+      assignVariable(varName, varValue);
       continue;
     }
     const connectionStringMatch = trimmed.match(connectionStringRegex);
@@ -132766,22 +132796,14 @@ function parseEnvFile(content, sourceFilePath) {
       const profileName = connectionStringMatch[1];
       const varName = `${profileName}_connectionString`;
       const varValue = connectionStringMatch[2].trim();
-      if (currentEnv) {
-        currentEnv.variables[varName] = varValue;
-      } else {
-        config2.common[varName] = varValue;
-      }
+      assignVariable(varName, varValue);
       continue;
     }
     const varMatch = trimmed.match(varRegex);
     if (varMatch) {
       const varName = varMatch[1];
       const varValue = varMatch[2].trim();
-      if (currentEnv) {
-        currentEnv.variables[varName] = varValue;
-      } else {
-        config2.common[varName] = varValue;
-      }
+      assignVariable(varName, varValue);
     }
   }
   return config2;
@@ -132910,6 +132932,11 @@ function registerVariableOrigins(config2, filePath, origins) {
       origins.set(`env:${env3.name}:${varName}`, { filePath, line: -1, varName });
     }
   }
+  for (const template of config2.templates) {
+    for (const varName of Object.keys(template.variables)) {
+      origins.set(`template:${template.name}:${varName}`, { filePath, line: -1, varName });
+    }
+  }
 }
 function mergeConfigs(target, source, targetFilePath, sourceFilePath, variableOrigins, errors) {
   for (const [varName, varValue] of Object.entries(source.common)) {
@@ -132932,8 +132959,14 @@ function mergeConfigs(target, source, targetFilePath, sourceFilePath, variableOr
   for (const sourceEnv of source.environments) {
     let targetEnv = target.environments.find((e) => e.name === sourceEnv.name);
     if (!targetEnv) {
-      targetEnv = { name: sourceEnv.name, variables: {} };
+      targetEnv = { name: sourceEnv.name, variables: {}, parents: [...sourceEnv.parents] };
       target.environments.push(targetEnv);
+    } else {
+      for (const parent of sourceEnv.parents) {
+        if (!targetEnv.parents.includes(parent)) {
+          targetEnv.parents.push(parent);
+        }
+      }
     }
     for (const [varName, varValue] of Object.entries(sourceEnv.variables)) {
       const key = `env:${sourceEnv.name}:${varName}`;
@@ -132952,6 +132985,35 @@ function mergeConfigs(target, source, targetFilePath, sourceFilePath, variableOr
       }
     }
   }
+  for (const sourceTemplate of source.templates) {
+    let targetTemplate = target.templates.find((t) => t.name === sourceTemplate.name);
+    if (!targetTemplate) {
+      targetTemplate = { name: sourceTemplate.name, variables: {}, parents: [...sourceTemplate.parents] };
+      target.templates.push(targetTemplate);
+    } else {
+      for (const parent of sourceTemplate.parents) {
+        if (!targetTemplate.parents.includes(parent)) {
+          targetTemplate.parents.push(parent);
+        }
+      }
+    }
+    for (const [varName, varValue] of Object.entries(sourceTemplate.variables)) {
+      const key = `template:${sourceTemplate.name}:${varName}`;
+      const existing = variableOrigins.get(key);
+      if (existing) {
+        const sourceLabel = toDisplayPath(sourceFilePath, targetFilePath);
+        const existingLabel = toDisplayPath(existing.filePath, targetFilePath);
+        errors.push({
+          message: `Duplicate variable '${varName}' in [template:${sourceTemplate.name}] section. Found in '${existingLabel}' and '${sourceLabel}'.`,
+          filePath: sourceFilePath,
+          line: -1
+        });
+      } else {
+        targetTemplate.variables[varName] = varValue;
+        variableOrigins.set(key, { filePath: sourceFilePath, line: -1, varName });
+      }
+    }
+  }
   for (const name of source.secretNames) {
     target.secretNames.add(name);
   }
@@ -132983,6 +133045,90 @@ function loadAndResolveEnvFile(filePath) {
   result.secretErrors.push(...resolveEncryptedSecretValues(result.config, filePath));
   return result;
 }
+function findExtendsNode(name, config2) {
+  const env3 = config2.environments.find((e) => e.name === name);
+  if (env3) {
+    return { node: env3, kind: "env" };
+  }
+  const template = config2.templates.find((t) => t.name === name);
+  if (template) {
+    return { node: template, kind: "template" };
+  }
+  return void 0;
+}
+function findExtendsTemplate(name, config2) {
+  const template = config2.templates.find((t) => t.name === name);
+  return template ? { node: template, kind: "template" } : void 0;
+}
+function resolveEffectiveEnvVariables(envName, config2) {
+  return Object.fromEntries(
+    Array.from(resolveEffectiveEnvVariableDetails(envName, config2).entries()).map(([name, detail]) => [name, detail.value])
+  );
+}
+function resolveInheritedVariableDetails(nodeName, config2) {
+  const inherited = /* @__PURE__ */ new Map();
+  const visited = /* @__PURE__ */ new Set();
+  const stack = /* @__PURE__ */ new Set();
+  const self2 = findExtendsNode(nodeName, config2);
+  if (!self2) {
+    return inherited;
+  }
+  const walk = (name) => {
+    if (visited.has(name) || stack.has(name)) {
+      return;
+    }
+    const found = findExtendsTemplate(name, config2);
+    if (!found) {
+      return;
+    }
+    stack.add(name);
+    for (const parent of found.node.parents) {
+      walk(parent);
+    }
+    for (const [varName, value] of Object.entries(found.node.variables)) {
+      inherited.set(varName, {
+        name: varName,
+        value,
+        sourceKind: found.kind,
+        sourceName: found.node.name,
+        inherited: true
+      });
+    }
+    visited.add(name);
+    stack.delete(name);
+  };
+  for (const parent of self2.node.parents) {
+    walk(parent);
+  }
+  return inherited;
+}
+function resolveEffectiveEnvVariableDetails(envName, config2) {
+  const details = /* @__PURE__ */ new Map();
+  for (const [name, value] of Object.entries(config2.common)) {
+    details.set(name, {
+      name,
+      value,
+      sourceKind: "common",
+      inherited: true
+    });
+  }
+  for (const [name, detail] of resolveInheritedVariableDetails(envName, config2)) {
+    details.set(name, detail);
+  }
+  const env3 = config2.environments.find((e) => e.name === envName);
+  if (env3) {
+    for (const [name, value] of Object.entries(env3.variables)) {
+      details.set(name, {
+        name,
+        value,
+        sourceKind: "env",
+        sourceName: env3.name,
+        inherited: false
+      });
+    }
+  }
+  return details;
+}
 function resolveEncryptedSecretValues(config2, entryFilePath) {
   const errors = [];
   for (const declaration of config2.secretDeclarations) {
@@ -133035,6 +133181,11 @@ function resolveEncryptedSecretValues(config2, entryFilePath) {
       if (env3) {
         env3.variables[declaration.name] = plaintext;
       }
+    } else if (declaration.templateName) {
+      const template = config2.templates.find((t) => t.name === declaration.templateName);
+      if (template) {
+        template.variables[declaration.name] = plaintext;
+      }
     } else {
       config2.common[declaration.name] = plaintext;
     }
@@ -133052,7 +133203,7 @@ var import_process = require("process");
 // src/secrets/envFileSecrets.ts
 var fs16 = __toESM(require("fs"));
 var path16 = __toESM(require("path"));
-var envRegex2 = /^\s*\[env:([a-zA-Z_][a-zA-Z0-9_-]*)\]\s*$/;
+var envRegex = /^\s*\[env:([a-zA-Z_][a-zA-Z0-9_-]*)\]\s*$/;
 var secretConnectionStringRegex2 = /^(\s*secret\s+connectionString\s+)([a-zA-Z_][a-zA-Z0-9_]*)(\s*=\s*)(.+)$/;
 var secretRegex2 = /^(\s*secret\s+)([a-zA-Z_][a-zA-Z0-9_]*)(\s*=\s*)(.+)$/;
 function splitContentLines(content) {
@@ -133074,7 +133225,7 @@ function extractSecretLines(content, filePath) {
     if (!trimmed || trimmed.startsWith("#")) {
       continue;
     }
-    const envMatch = trimmed.match(envRegex2);
+    const envMatch = trimmed.match(envRegex);
     if (envMatch) {
       currentEnv = envMatch[1];
       continue;
@@ -133619,6 +133770,294 @@ function splitImportResolutionErrors(errors) {
   return { blockingErrors, warningErrors };
 }
 
+// src/nornenvLanguageModel.ts
+var SECTION_HEADER_REGEX = /^\s*\[(env|template):([a-zA-Z_][a-zA-Z0-9_-]*)(?:\s+extends\s+([^\]]+))?\]\s*$/i;
+function parseParentList(clause) {
+  if (!clause) {
+    return [];
+  }
+  return clause.split(",").map((parent) => parent.trim()).filter((parent) => /^[a-zA-Z_][a-zA-Z0-9_-]*$/.test(parent));
+}
+function parseNornenvDocumentModel(text) {
+  const sections = [];
+  const declarations = [];
+  const lines = text.split("\n");
+  let currentSection;
+  for (let lineNumber = 0; lineNumber < lines.length; lineNumber++) {
+    const line2 = lines[lineNumber];
+    const sectionMatch = line2.trim().match(SECTION_HEADER_REGEX);
+    if (sectionMatch) {
+      currentSection = {
+        kind: sectionMatch[1].toLowerCase(),
+        name: sectionMatch[2],
+        parents: parseParentList(sectionMatch[3]),
+        lineNumber
+      };
+      sections.push(currentSection);
+      continue;
+    }
+    const connectionMatch = line2.match(/^(\s*)(secret\s+)?connectionString\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.*)$/i);
+    if (connectionMatch) {
+      const displayName = connectionMatch[3];
+      const name = `${displayName}_connectionString`;
+      const nameStart = line2.indexOf(displayName);
+      const value = connectionMatch[4];
+      const valueStart = line2.length - value.length;
+      declarations.push({
+        name,
+        displayName,
+        value,
+        secret: Boolean(connectionMatch[2]),
+        sectionKind: currentSection?.kind,
+        sectionName: currentSection?.name,
+        lineNumber,
+        nameStart,
+        nameEnd: nameStart + displayName.length,
+        valueStart,
+        valueEnd: line2.length
+      });
+      continue;
+    }
+    const variableMatch = line2.match(/^(\s*)(secret|var)\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.*)$/i);
+    if (variableMatch) {
+      const name = variableMatch[3];
+      const nameStart = line2.indexOf(name);
+      const value = variableMatch[4];
+      const valueStart = line2.length - value.length;
+      declarations.push({
+        name,
+        displayName: name,
+        value,
+        secret: variableMatch[2].toLowerCase() === "secret",
+        sectionKind: currentSection?.kind,
+        sectionName: currentSection?.name,
+        lineNumber,
+        nameStart,
+        nameEnd: nameStart + name.length,
+        valueStart,
+        valueEnd: line2.length
+      });
+    }
+  }
+  return { sections, declarations };
+}
+
+// src/nornenvRegionRefactor.ts
+var MATRIX_ENV_NAME_REGEX = /^([a-zA-Z][a-zA-Z0-9-]*)_([a-zA-Z][a-zA-Z0-9-]*)$/;
+var MIN_STAGES = 2;
+var MIN_REGIONS = 2;
+var MIN_CELLS = 3;
+function isConnectionStringVar(name) {
+  return name.endsWith("_connectionString");
+}
+function inferDeclarationKind(name) {
+  return isConnectionStringVar(name) ? "connectionString" : "var";
+}
+function inferDisplayName(name) {
+  return isConnectionStringVar(name) ? name.slice(0, -"_connectionString".length) : name;
+}
+function declarationKind(declaration) {
+  return declaration.name.endsWith("_connectionString") && declaration.displayName !== declaration.name ? "connectionString" : "var";
+}
+function buildDeclarationMap(text) {
+  const model = parseNornenvDocumentModel(text);
+  const byEnv = /* @__PURE__ */ new Map();
+  for (const declaration of model.declarations) {
+    if (declaration.sectionKind !== "env" || !declaration.sectionName) {
+      continue;
+    }
+    if (!byEnv.has(declaration.sectionName)) {
+      byEnv.set(declaration.sectionName, /* @__PURE__ */ new Map());
+    }
+    byEnv.get(declaration.sectionName).set(declaration.name, declaration);
+  }
+  return byEnv;
+}
+function getCellValue(cell, name, declarationsByEnv, config2) {
+  const value = cell.env.variables[name];
+  if (value === void 0) {
+    return void 0;
+  }
+  const declaration = declarationsByEnv.get(cell.envName)?.get(name);
+  return {
+    value,
+    secret: declaration?.secret ?? config2.secretNames.has(name),
+    kind: declaration ? declarationKind(declaration) : inferDeclarationKind(name),
+    displayName: declaration?.displayName ?? inferDisplayName(name)
+  };
+}
+function classifyByAxis(name, cells, axisKeys, getAxisKey, declarationsByEnv, config2) {
+  const byKey = /* @__PURE__ */ new Map();
+  let presentCells = 0;
+  for (const key of axisKeys) {
+    const axisCells = cells.filter((cell) => getAxisKey(cell) === key);
+    const presentValues = axisCells.map((cell) => getCellValue(cell, name, declarationsByEnv, config2)).filter((value) => value !== void 0);
+    if (presentValues.length === 0) {
+      continue;
+    }
+    presentCells += presentValues.length;
+    if (presentValues.length !== axisCells.length) {
+      return void 0;
+    }
+    const first = presentValues[0];
+    if (presentValues.some((value) => value.value !== first.value)) {
+      return void 0;
+    }
+    byKey.set(key, {
+      value: first.value,
+      secret: presentValues.some((value) => value.secret),
+      kind: first.kind,
+      displayName: first.displayName
+    });
+  }
+  return byKey.size > 0 && presentCells >= 2 ? byKey : void 0;
+}
+function detectRegionPattern(config2, text) {
+  const cells = [];
+  for (const env3 of config2.environments) {
+    const match = env3.name.match(MATRIX_ENV_NAME_REGEX);
+    if (!match) {
+      continue;
+    }
+    if (env3.parents.length > 0) {
+      return void 0;
+    }
+    cells.push({ stage: match[1], region: match[2], envName: env3.name, env: env3 });
+  }
+  const stages = Array.from(new Set(cells.map((c) => c.stage)));
+  const regions = Array.from(new Set(cells.map((c) => c.region)));
+  if (stages.length < MIN_STAGES || regions.length < MIN_REGIONS || cells.length < MIN_CELLS) {
+    return void 0;
+  }
+  if ((/* @__PURE__ */ new Set([...stages, ...regions])).size !== stages.length + regions.length) {
+    return void 0;
+  }
+  const existingTemplates = new Set(config2.templates.map((template) => template.name));
+  if ([...stages, ...regions].some((name) => existingTemplates.has(name))) {
+    return void 0;
+  }
+  const allVarNames = /* @__PURE__ */ new Set();
+  for (const cell of cells) {
+    for (const name of Object.keys(cell.env.variables)) {
+      allVarNames.add(name);
+    }
+  }
+  let liftedToStage = 0;
+  let liftedToRegion = 0;
+  let leafSpecific = 0;
+  let skippedConnectionStrings = 0;
+  const assignments = [];
+  const declarationsByEnv = buildDeclarationMap(text);
+  for (const name of allVarNames) {
+    if (isConnectionStringVar(name)) {
+      skippedConnectionStrings++;
+    }
+    const stageValues = isConnectionStringVar(name) ? void 0 : classifyByAxis(name, cells, stages, (cell) => cell.stage, declarationsByEnv, config2);
+    const regionValues = isConnectionStringVar(name) ? void 0 : classifyByAxis(name, cells, regions, (cell) => cell.region, declarationsByEnv, config2);
+    if (stageValues) {
+      assignments.push({ name, axis: "stage", byKey: stageValues });
+      liftedToStage++;
+    } else if (regionValues) {
+      assignments.push({ name, axis: "region", byKey: regionValues });
+      liftedToRegion++;
+    } else {
+      const byKey = /* @__PURE__ */ new Map();
+      for (const cell of cells) {
+        const value = getCellValue(cell, name, declarationsByEnv, config2);
+        if (value !== void 0) {
+          byKey.set(cell.envName, value);
+        }
+      }
+      if (byKey.size > 0) {
+        assignments.push({ name, axis: "leaf", byKey });
+        leafSpecific++;
+      }
+    }
+  }
+  const model = parseNornenvDocumentModel(text);
+  const matrixNames = new Set(cells.map((c) => c.envName));
+  const matrixSectionLines = model.sections.filter((s) => s.kind === "env" && matrixNames.has(s.name)).map((s) => s.lineNumber).sort((a, b) => a - b);
+  if (matrixSectionLines.length === 0) {
+    return void 0;
+  }
+  const firstLine = matrixSectionLines[0];
+  const lastMatrixHeaderLine = matrixSectionLines[matrixSectionLines.length - 1];
+  const sectionsInReplacementRange = model.sections.filter(
+    (section) => section.lineNumber >= firstLine && section.lineNumber <= lastMatrixHeaderLine
+  );
+  if (sectionsInReplacementRange.some((section) => section.kind !== "env" || !matrixNames.has(section.name))) {
+    return void 0;
+  }
+  const lineCount = text.split("\n").length;
+  const sectionsAfter = model.sections.filter((s) => s.lineNumber > lastMatrixHeaderLine).map((s) => s.lineNumber).sort((a, b) => a - b);
+  const lastLine = sectionsAfter.length > 0 ? sectionsAfter[0] - 1 : lineCount - 1;
+  return {
+    stages,
+    regions,
+    cells,
+    assignments,
+    replaceRange: { startLine: firstLine, endLine: lastLine },
+    summary: { liftedToStage, liftedToRegion, leafSpecific, skippedConnectionStrings }
+  };
+}
+function generateRegionRefactor(pattern) {
+  const blocks = [];
+  const fmtVar = (assignment, value) => {
+    if (value.kind === "connectionString") {
+      const secretPrefix = value.secret ? "secret " : "";
+      return `    ${secretPrefix}connectionString ${value.displayName} = ${value.value}`;
+    }
+    const keyword = value.secret ? "secret" : "var";
+    return `    ${keyword} ${assignment.name} = ${value.value}`;
+  };
+  for (const stage of pattern.stages) {
+    const stageVars = pattern.assignments.filter((a) => a.axis === "stage" && a.byKey.has(stage));
+    if (stageVars.length === 0) {
+      continue;
+    }
+    const lines = [`[template:${stage}]`];
+    for (const v of stageVars) {
+      lines.push(fmtVar(v, v.byKey.get(stage)));
+    }
+    blocks.push(lines.join("\n"));
+  }
+  for (const region of pattern.regions) {
+    const regionVars = pattern.assignments.filter((a) => a.axis === "region" && a.byKey.has(region));
+    if (regionVars.length === 0) {
+      continue;
+    }
+    const lines = [`[template:${region}]`];
+    for (const v of regionVars) {
+      lines.push(fmtVar(v, v.byKey.get(region)));
+    }
+    blocks.push(lines.join("\n"));
+  }
+  for (const cell of pattern.cells) {
+    const leafVars = pattern.assignments.filter((a) => a.axis === "leaf" && a.byKey.has(cell.envName));
+    const header = `[env:${cell.envName} extends ${cell.stage}, ${cell.region}]`;
+    if (leafVars.length === 0) {
+      blocks.push(header);
+      continue;
+    }
+    const lines = [header];
+    for (const v of leafVars) {
+      lines.push(fmtVar(v, v.byKey.get(cell.envName)));
+    }
+    blocks.push(lines.join("\n"));
+  }
+  return blocks.join("\n\n");
+}
+function applyRegionRefactorToText(text, pattern) {
+  const lines = text.split("\n");
+  const startLine = pattern.replaceRange.startLine;
+  const endLine = Math.min(pattern.replaceRange.endLine, lines.length - 1);
+  const replacementLines = generateRegionRefactor(pattern).split("\n");
+  lines.splice(startLine, endLine - startLine + 1, ...replacementLines);
+  const result = lines.join("\n");
+  return text.endsWith("\n") && !result.endsWith("\n") ? `${result}
+` : result;
+}
+
 // src/cli.ts
 function handleImportResolutionErrors(errors, colors) {
   const { blockingErrors, warningErrors } = splitImportResolutionErrors(errors);
@@ -133653,7 +134092,7 @@ function resolveEnvironmentForPath(targetPath, selectedEnv) {
     console.error(`Fix .nornenv import errors before running tests.`);
     process.exit(1);
   }
-  const variables = { ...envConfig.common };
+  let variables = { ...envConfig.common };
   const secretNames = new Set(envConfig.secretNames);
   const secretValues = new Map(envConfig.secretValues);
   const availableEnvironments = envConfig.environments.map((e) => e.name);
@@ -133672,9 +134111,9 @@ function resolveEnvironmentForPath(targetPath, selectedEnv) {
       };
     }
     targetEnvVariables = targetEnv.variables;
-    Object.assign(variables, targetEnvVariables);
-    for (const [name, value] of Object.entries(targetEnvVariables)) {
-      if (secretNames.has(name)) {
+    variables = resolveEffectiveEnvVariables(selectedEnv, envConfig);
+    for (const [name, value] of Object.entries(variables)) {
+      if (secretNames.has(name) && !secretValues.has(name)) {
         secretValues.set(name, value);
       }
     }
@@ -133733,7 +134172,9 @@ function parseArgs(args) {
     noRedact: false,
     tagFilters: [],
     tagsFilter: [],
-    insecure: false
+    insecure: false,
+    refactorRegionPattern: false,
+    writeRefactor: false
   };
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
@@ -133751,6 +134192,10 @@ function parseArgs(args) {
       options.timeout = parseInt(args[++i], 10) * 1e3;
     } else if (arg === "--insecure") {
       options.insecure = true;
+    } else if (arg === "--refactor-region-pattern" || arg === "--refactor-nornenv-region-pattern") {
+      options.refactorRegionPattern = true;
+    } else if (arg === "--write") {
+      options.writeRefactor = true;
     } else if (arg === "--no-fail") {
       options.failOnError = false;
     } else if (arg === "--no-redact") {
@@ -133806,6 +134251,9 @@ Options:
   -o, --output-dir <dir> Output directory for reports (auto-generates timestamped files)
   --tag <filter>         Filter sequences by tag (AND logic, can be repeated)
   --tags <filters>       Filter sequences by tags (OR logic, comma-separated)
+  --refactor-region-pattern
+                          Refactor a flat .nornenv STAGE_REGION matrix to templates
+  --write                 Apply --refactor-region-pattern instead of printing result
   -h, --help             Show this help message
 
 Report Generation:
@@ -133849,11 +134297,62 @@ Examples:
   norn api-tests.norn --html report.html    # Generate HTML report (explicit)
   norn api-tests.norn --insecure            # Allow self-signed/local TLS certs
   norn api-tests.norn --no-redact           # Show all data (no redaction)
+  norn .nornenv --refactor-region-pattern   # Print refactored .nornenv
+  norn .nornenv --refactor-region-pattern --write
   norn secrets keygen --name team-main      # Generate shared key and cache locally
   norn secrets import-key --kid team-main   # Save shared key from your vault
   norn secrets audit .                       # Fail if plaintext secrets are committed
 `);
 }
+function formatRegionPatternSummary(pattern) {
+  const { liftedToStage, liftedToRegion, leafSpecific, skippedConnectionStrings } = pattern.summary;
+  const lines = [
+    `Detected ${pattern.cells.length} envs across ${pattern.stages.length} stages x ${pattern.regions.length} regions.`,
+    `Lifted ${liftedToStage} vars to stage templates (${pattern.stages.join(", ")}).`,
+    `Lifted ${liftedToRegion} vars to region templates (${pattern.regions.join(", ")}).`,
+    `Kept ${leafSpecific} vars leaf-specific.`
+  ];
+  if (skippedConnectionStrings > 0) {
+    lines.push(`Kept ${skippedConnectionStrings} connection-string var${skippedConnectionStrings === 1 ? "" : "s"} in leaf envs.`);
+  }
+  return lines;
+}
+function runNornenvRegionRefactor(filePath, options) {
+  const content = fs19.readFileSync(filePath, "utf-8");
+  const config2 = parseEnvFile(content, filePath);
+  const pattern = detectRegionPattern(config2, content);
+  if (!pattern) {
+    if (options.output === "json") {
+      console.log(JSON.stringify({ success: false, changed: false, error: "No region pattern detected" }, null, 2));
+    } else {
+      console.error("No region pattern detected in this .nornenv file.");
+    }
+    process.exit(1);
+  }
+  const refactored = applyRegionRefactorToText(content, pattern);
+  if (options.writeRefactor) {
+    fs19.writeFileSync(filePath, refactored, "utf-8");
+  }
+  if (options.output === "json") {
+    console.log(JSON.stringify({
+      success: true,
+      changed: refactored !== content,
+      file: filePath,
+      summary: pattern.summary,
+      stages: pattern.stages,
+      regions: pattern.regions,
+      output: options.writeRefactor ? void 0 : refactored
+    }, null, 2));
+  } else if (options.writeRefactor) {
+    for (const line2 of formatRegionPatternSummary(pattern)) {
+      console.log(line2);
+    }
+    console.log(`Refactored ${filePath}`);
+  } else {
+    console.log(refactored);
+  }
+  process.exit(0);
+}
 async function runSingleRequest(fileContent, variables, cookieJar, apiDefinitions, filePath, envContext) {
   const lines = fileContent.split("\n");
   const requestLines = [];
@@ -134018,6 +134517,17 @@ async function main() {
     process.exit(1);
   }
   const isDirectory = fs19.statSync(inputPath).isDirectory();
+  if (options.writeRefactor && !options.refactorRegionPattern) {
+    console.error("Error: --write can only be used with --refactor-region-pattern");
+    process.exit(1);
+  }
+  if (options.refactorRegionPattern) {
+    if (isDirectory) {
+      console.error("Error: --refactor-region-pattern requires a specific .nornenv file, not a directory");
+      process.exit(1);
+    }
+    runNornenvRegionRefactor(inputPath, options);
+  }
   let filesToRun;
   if (isDirectory) {
     filesToRun = discoverNornFiles(inputPath);