varlock 0.0.14 → 0.1.0

package/dist/{chunk-FCVBOYES.js → chunk-MLIGQWID.js}

@@ -1,91 +1,193 @@
 import { redactString } from './chunk-FGMXIEFA.js';
 import { __commonJS, __name, __toESM } from './chunk-XN24GZXQ.js';
+import process2 from 'process';
 import { exec } from 'child_process';
 import { promisify } from 'util';
 import fs, { accessSync } from 'fs';
 import fs2, { access } from 'fs/promises';
 import path2 from 'path';
-import { ParsedEnvSpecStaticValue, ParsedEnvSpecFunctionCall, ParsedEnvSpecKeyValuePair, parseEnvSpecDotEnvFile } from '@env-spec/parser';
-import process2 from 'process';
+import { ParsedEnvSpecFunctionCall, ParsedEnvSpecStaticValue, ParsedEnvSpecFunctionArgs, ParsedEnvSpecKeyValuePair, parseEnvSpecDotEnvFile } from '@env-spec/parser';
+import os from 'os';
+import crypto from 'crypto';
+import https from 'https';
+import semver from 'semver';
+import Debug from 'debug';
 
-// ../../node_modules/.pnpm/ansis@4.1.0/node_modules/ansis/index.cjs
+// ../../node_modules/.pnpm/ansis@4.2.0/node_modules/ansis/index.cjs
 var require_ansis = __commonJS({
-  "../../node_modules/.pnpm/ansis@4.1.0/node_modules/ansis/index.cjs"(exports, module) {
+  "../../node_modules/.pnpm/ansis@4.2.0/node_modules/ansis/index.cjs"(exports, module) {
     var e;
     var t;
     var r;
-    var { defineProperty: n, setPrototypeOf: l, create: o, keys: s } = Object;
+    var { defineProperty: l, setPrototypeOf: n, create: o, keys: s } = Object;
     var i = "";
     var { round: c, max: a2 } = Math;
     var p = /* @__PURE__ */ __name((e2) => {
-      let t2 = /([a-f\d]{3,6})/i.exec(e2)?.[1], r2 = t2?.length, n2 = parseInt(6 ^ r2 ? 3 ^ r2 ? "0" : t2[0] + t2[0] + t2[1] + t2[1] + t2[2] + t2[2] : t2, 16);
-      return [n2 >> 16 & 255, n2 >> 8 & 255, 255 & n2];
+      let t2 = /([a-f\d]{3,6})/i.exec(e2)?.[1], r2 = t2?.length, l2 = parseInt(6 ^ r2 ? 3 ^ r2 ? "0" : t2[0] + t2[0] + t2[1] + t2[1] + t2[2] + t2[2] : t2, 16);
+      return [l2 >> 16 & 255, l2 >> 8 & 255, 255 & l2];
     }, "p");
     var u = /* @__PURE__ */ __name((e2, t2, r2) => e2 ^ t2 || t2 ^ r2 ? 16 + 36 * c(e2 / 51) + 6 * c(t2 / 51) + c(r2 / 51) : 8 > e2 ? 16 : e2 > 248 ? 231 : c(24 * (e2 - 8) / 247) + 232, "u");
     var d = /* @__PURE__ */ __name((e2) => {
-      let t2, r2, n2, l2, o2;
-      return 8 > e2 ? 30 + e2 : 16 > e2 ? e2 - 8 + 90 : (232 > e2 ? (o2 = (e2 -= 16) % 36, t2 = (e2 / 36 | 0) / 5, r2 = (o2 / 6 | 0) / 5, n2 = o2 % 6 / 5) : t2 = r2 = n2 = (10 * (e2 - 232) + 8) / 255, l2 = 2 * a2(t2, r2, n2), l2 ? 30 + (c(n2) << 2 | c(r2) << 1 | c(t2)) + (2 ^ l2 ? 0 : 60) : 30);
+      let t2, r2, l2, n2, o2;
+      return 8 > e2 ? 30 + e2 : 16 > e2 ? e2 - 8 + 90 : (232 > e2 ? (o2 = (e2 -= 16) % 36, t2 = (e2 / 36 | 0) / 5, r2 = (o2 / 6 | 0) / 5, l2 = o2 % 6 / 5) : t2 = r2 = l2 = (10 * (e2 - 232) + 8) / 255, n2 = 2 * a2(t2, r2, l2), n2 ? 30 + (c(l2) << 2 | c(r2) << 1 | c(t2)) + (2 ^ n2 ? 0 : 60) : 30);
     }, "d");
-    var g = (() => {
-      let r2 = /* @__PURE__ */ __name((e2) => o2.some((t2) => e2.test(t2)), "r"), n2 = globalThis, l2 = n2.process ?? {}, o2 = l2.argv ?? [], i2 = l2.env ?? {}, c2 = -1;
+    var f = (() => {
+      let r2 = /* @__PURE__ */ __name((e2) => o2.some((t2) => e2.test(t2)), "r"), l2 = globalThis, n2 = l2.process ?? {}, o2 = n2.argv ?? [], i2 = n2.env ?? {}, c2 = -1;
       try {
         e = "," + s(i2).join(",");
       } catch (e2) {
         i2 = {}, c2 = 0;
       }
       let a3 = "FORCE_COLOR", p2 = { false: 0, 0: 0, 1: 1, 2: 2, 3: 3 }[i2[a3]] ?? -1, u2 = a3 in i2 && p2 || r2(/^--color=?(true|always)?$/);
-      return u2 && (c2 = p2), ~c2 || (c2 = ((r3, n3, l3) => (t = r3.TERM, { "24bit": 3, truecolor: 3, ansi256: 2, ansi: 1 }[r3.COLORTERM] || (r3.CI ? /,GITHUB/.test(e) ? 3 : 1 : n3 && "dumb" !== t ? l3 ? 3 : /-256/.test(t) ? 2 : 1 : 0)))(i2, !!i2.PM2_HOME || i2.NEXT_RUNTIME?.includes("edge") || !!l2.stdout?.isTTY, "win32" === l2.platform)), !p2 || i2.NO_COLOR || r2(/^--(no-color|color=(false|never))$/) ? 0 : n2.window?.chrome || u2 && !c2 ? 3 : c2;
+      return u2 && (c2 = p2), ~c2 || (c2 = ((r3, l3, n3) => (t = r3.TERM, { "24bit": 3, truecolor: 3, ansi256: 2, ansi: 1 }[r3.COLORTERM] || (r3.CI ? /,GITHUB/.test(e) ? 3 : 1 : l3 && "dumb" !== t ? n3 ? 3 : /-256/.test(t) ? 2 : 1 : 0)))(i2, !!i2.PM2_HOME || i2.NEXT_RUNTIME?.includes("edge") || !!n2.stdout?.isTTY, "win32" === n2.platform)), !p2 || i2.NO_COLOR || r2(/^--(no-color|color=(false|never))$/) ? 0 : l2.window?.chrome || u2 && !c2 ? 3 : c2;
     })();
-    var f = { open: i, close: i };
+    var g = { open: i, close: i };
     var h = 39;
     var b = 49;
     var O = {};
-    var m = /* @__PURE__ */ __name(({ p: e2 }, { open: t2, close: n2 }) => {
+    var m = /* @__PURE__ */ __name(({ p: e2 }, { open: t2, close: l2 }) => {
       let o2 = /* @__PURE__ */ __name((e3, ...r2) => {
         if (!e3) {
-          if (t2 && t2 === n2) return t2;
+          if (t2 && t2 === l2) return t2;
           if ((e3 ?? i) === i) return i;
         }
-        let l2, s3 = e3.raw ? String.raw({ raw: e3 }, ...r2) : i + e3, c3 = o2.p, a3 = c3.o, p2 = c3.c;
+        let n2, s3 = e3.raw ? String.raw({ raw: e3 }, ...r2) : i + e3, c3 = o2.p, a3 = c3.o, p2 = c3.c;
         if (s3.includes("\x1B")) for (; c3; c3 = c3.p) {
-          let { open: e4, close: t3 } = c3, r3 = t3.length, n3 = i, o3 = 0;
-          if (r3) for (; ~(l2 = s3.indexOf(t3, o3)); o3 = l2 + r3) n3 += s3.slice(o3, l2) + e4;
-          s3 = n3 + s3.slice(o3);
+          let { open: e4, close: t3 } = c3, r3 = t3.length, l3 = i, o3 = 0;
+          if (r3) for (; ~(n2 = s3.indexOf(t3, o3)); o3 = n2 + r3) l3 += s3.slice(o3, n2) + e4;
+          s3 = l3 + s3.slice(o3);
         }
         return a3 + (s3.includes("\n") ? s3.replace(/(\r?\n)/g, p2 + "$1" + a3) : s3) + p2;
-      }, "o"), s2 = t2, c2 = n2;
-      return e2 && (s2 = e2.o + t2, c2 = n2 + e2.c), l(o2, r), o2.p = { open: t2, close: n2, o: s2, c: c2, p: e2 }, o2.open = s2, o2.close = c2, o2;
+      }, "o"), s2 = t2, c2 = l2;
+      return e2 && (s2 = e2.o + t2, c2 = l2 + e2.c), n(o2, r), o2.p = { open: t2, close: l2, o: s2, c: c2, p: e2 }, o2.open = s2, o2.close = c2, o2;
     }, "m");
-    var w = /* @__PURE__ */ __name(function(e2 = g) {
-      let t2 = { Ansis: w, level: e2, isSupported: /* @__PURE__ */ __name(() => s2, "isSupported"), strip: /* @__PURE__ */ __name((e3) => e3.replace(/[›][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]/g, i), "strip"), extend(e3) {
+    var w = new (/* @__PURE__ */ __name(function e2(t2 = f) {
+      let s2 = { Ansis: e2, level: t2, isSupported: /* @__PURE__ */ __name(() => a3, "isSupported"), strip: /* @__PURE__ */ __name((e3) => e3.replace(/[›][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]/g, i), "strip"), extend(e3) {
         for (let t3 in e3) {
-          let r2 = e3[t3], l2 = (typeof r2)[0], o2 = "s" === l2 ? x(...p(r2)) : r2;
-          O[t3] = "f" === l2 ? { get() {
-            return (...e4) => m(this, r2(...e4));
-          } } : { get() {
-            let e4 = m(this, o2);
-            return n(this, t3, { value: e4 }), e4;
-          } };
+          let r2 = e3[t3], l2 = (typeof r2)[0];
+          "s" === l2 ? (c2(t3, T(...p(r2))), c2(_4(t3), v(...p(r2)))) : c2(t3, r2, "f" === l2);
         }
-        return r = o({}, O), l(t2, r), t2;
-      } }, s2 = e2 > 0, c2 = /* @__PURE__ */ __name((e3, t3) => s2 ? { open: `\x1B[${e3}m`, close: `\x1B[${t3}m` } : f, "c"), a3 = /* @__PURE__ */ __name((e3) => (t3) => e3(...p(t3)), "a"), y2 = /* @__PURE__ */ __name((e3, t3) => (r2, n2, l2) => c2(`${e3}8;2;${r2};${n2};${l2}`, t3), "y"), R = /* @__PURE__ */ __name((e3, t3) => (r2, n2, l2) => c2(((e4, t4, r3) => d(u(e4, t4, r3)))(r2, n2, l2) + e3, t3), "R"), $ = /* @__PURE__ */ __name((e3) => (t3, r2, n2) => e3(u(t3, r2, n2)), "$"), x = y2(3, h), T = y2(4, b), v = /* @__PURE__ */ __name((e3) => c2("38;5;" + e3, h), "v"), C = /* @__PURE__ */ __name((e3) => c2("48;5;" + e3, b), "C");
-      2 === e2 ? (x = $(v), T = $(C)) : 1 === e2 && (x = R(0, h), T = R(10, b), v = /* @__PURE__ */ __name((e3) => c2(d(e3), h), "v"), C = /* @__PURE__ */ __name((e3) => c2(d(e3) + 10, b), "C"));
-      let E, M = { fg: v, bg: C, rgb: x, bgRgb: T, hex: a3(x), bgHex: a3(T), visible: f, reset: c2(0, 0), bold: c2(1, 22), dim: c2(2, 22), italic: c2(3, 23), underline: c2(4, 24), inverse: c2(7, 27), hidden: c2(8, 28), strikethrough: c2(9, 29) }, I = "Bright";
+        return r = o({}, O), n(s2, r), s2;
+      } }, c2 = /* @__PURE__ */ __name((e3, t3, r2) => {
+        O[e3] = { get() {
+          let n2 = r2 ? (...e4) => m(this, t3(...e4)) : m(this, t3);
+          return l(this, e3, { value: n2 }), n2;
+        } };
+      }, "c"), a3 = t2 > 0, w2 = /* @__PURE__ */ __name((e3, t3) => a3 ? { open: `\x1B[${e3}m`, close: `\x1B[${t3}m` } : g, "w"), y = /* @__PURE__ */ __name((e3) => (t3) => e3(...p(t3)), "y"), R = /* @__PURE__ */ __name((e3, t3) => (r2, l2, n2) => w2(`${e3}8;2;${r2};${l2};${n2}`, t3), "R"), $ = /* @__PURE__ */ __name((e3, t3) => (r2, l2, n2) => w2(((e4, t4, r3) => d(u(e4, t4, r3)))(r2, l2, n2) + e3, t3), "$"), x = /* @__PURE__ */ __name((e3) => (t3, r2, l2) => e3(u(t3, r2, l2)), "x"), T = R(3, h), v = R(4, b), C = /* @__PURE__ */ __name((e3) => w2("38;5;" + e3, h), "C"), E = /* @__PURE__ */ __name((e3) => w2("48;5;" + e3, b), "E");
+      2 === t2 ? (T = x(C), v = x(E)) : 1 === t2 && (T = $(0, h), v = $(10, b), C = /* @__PURE__ */ __name((e3) => w2(d(e3), h), "C"), E = /* @__PURE__ */ __name((e3) => w2(d(e3) + 10, b), "E"));
+      let M, I = { fg: C, bg: E, rgb: T, bgRgb: v, hex: y(T), bgHex: y(v), visible: g, reset: w2(0, 0), bold: w2(1, 22), dim: w2(2, 22), italic: w2(3, 23), underline: w2(4, 24), inverse: w2(7, 27), hidden: w2(8, 28), strikethrough: w2(9, 29) }, _4 = /* @__PURE__ */ __name((e3) => "bg" + e3[0].toUpperCase() + e3.slice(1), "_"), k = "Bright";
       return "black,red,green,yellow,blue,magenta,cyan,white,gray".split(",").map((e3, t3) => {
-        E = "bg" + e3[0].toUpperCase() + e3.slice(1), 8 > t3 ? (M[e3 + I] = c2(90 + t3, h), M[E + I] = c2(100 + t3, b)) : t3 = 60, M[e3] = c2(30 + t3, h), M[E] = c2(40 + t3, b);
-      }), t2.extend(M);
-    }, "w");
-    var y = new w();
-    module.exports = y, y.default = y;
+        M = _4(e3), 8 > t3 ? (I[e3 + k] = w2(90 + t3, h), I[M + k] = w2(100 + t3, b)) : t3 = 60, I[e3] = w2(30 + t3, h), I[M] = w2(40 + t3, b);
+      }), s2.extend(I);
+    }, "e"))();
+    module.exports = w, w.default = w;
   }
 });
 
-// ../../node_modules/.pnpm/ansis@4.1.0/node_modules/ansis/index.mjs
+// ../../node_modules/.pnpm/ansis@4.2.0/node_modules/ansis/index.mjs
 var import_index = __toESM(require_ansis(), 1);
 var ansis_default = import_index.default;
 var { Ansis, fg, bg, rgb, bgRgb, hex, bgHex, reset, inverse, hidden, visible, bold, dim, italic, underline, strikethrough, black, red, green, yellow, blue, magenta, cyan, white, gray, redBright, greenBright, yellowBright, blueBright, magentaBright, cyanBright, whiteBright, bgBlack, bgRed, bgGreen, bgYellow, bgBlue, bgMagenta, bgCyan, bgWhite, bgGray, bgRedBright, bgGreenBright, bgYellowBright, bgBlueBright, bgMagentaBright, bgCyanBright, bgWhiteBright } = import_index.default;
+var asyncCallbacks = /* @__PURE__ */ new Set();
+var callbacks = /* @__PURE__ */ new Set();
+var isCalled = false;
+var isRegistered = false;
+async function exit(shouldManuallyExit, isSynchronous, signal) {
+  if (isCalled) {
+    return;
+  }
+  isCalled = true;
+  if (asyncCallbacks.size > 0 && isSynchronous) {
+    console.error([
+      "SYNCHRONOUS TERMINATION NOTICE:",
+      "When explicitly exiting the process via process.exit or via a parent process,",
+      "asynchronous tasks in your exitHooks will not run. Either remove these tasks,",
+      "use gracefulExit() instead of process.exit(), or ensure your parent process",
+      "sends a SIGINT to the process running this code."
+    ].join(" "));
+  }
+  const exitCode = 128 + signal;
+  const done = /* @__PURE__ */ __name((force = false) => {
+    if (force === true || shouldManuallyExit === true) {
+      process2.exit(exitCode);
+    }
+  }, "done");
+  for (const callback of callbacks) {
+    callback(exitCode);
+  }
+  if (isSynchronous) {
+    done();
+    return;
+  }
+  const promises = [];
+  let forceAfter = 0;
+  for (const [callback, wait] of asyncCallbacks) {
+    forceAfter = Math.max(forceAfter, wait);
+    promises.push(Promise.resolve(callback(exitCode)));
+  }
+  const asyncTimer = setTimeout(() => {
+    done(true);
+  }, forceAfter);
+  await Promise.all(promises);
+  clearTimeout(asyncTimer);
+  done();
+}
+__name(exit, "exit");
+function addHook(options) {
+  const { onExit, wait, isSynchronous } = options;
+  const asyncCallbackConfig = [onExit, wait];
+  if (isSynchronous) {
+    callbacks.add(onExit);
+  } else {
+    asyncCallbacks.add(asyncCallbackConfig);
+  }
+  if (!isRegistered) {
+    isRegistered = true;
+    process2.once("beforeExit", exit.bind(void 0, true, false, -128));
+    process2.once("SIGINT", exit.bind(void 0, true, false, 2));
+    process2.once("SIGTERM", exit.bind(void 0, true, false, 15));
+    process2.once("exit", exit.bind(void 0, false, true, 0));
+    process2.on("message", (message) => {
+      if (message === "shutdown") {
+        exit(true, true, -128);
+      }
+    });
+  }
+  return () => {
+    if (isSynchronous) {
+      callbacks.delete(onExit);
+    } else {
+      asyncCallbacks.delete(asyncCallbackConfig);
+    }
+  };
+}
+__name(addHook, "addHook");
+function asyncExitHook(onExit, options = {}) {
+  if (typeof onExit !== "function") {
+    throw new TypeError("onExit must be a function");
+  }
+  if (!(typeof options.wait === "number" && options.wait > 0)) {
+    throw new TypeError("wait must be set to a positive numeric value");
+  }
+  return addHook({
+    onExit,
+    wait: options.wait,
+    isSynchronous: false
+  });
+}
+__name(asyncExitHook, "asyncExitHook");
+function gracefulExit(signal = 0) {
+  exit(true, false, -128 + signal);
+}
+__name(gracefulExit, "gracefulExit");
+
+// ../../node_modules/.pnpm/@sindresorhus+is@7.1.1/node_modules/@sindresorhus/is/distribution/utilities.js
+function keysOf(value) {
+  return Object.keys(value);
+}
+__name(keysOf, "keysOf");
 
-// ../../node_modules/.pnpm/@sindresorhus+is@7.0.2/node_modules/@sindresorhus/is/distribution/index.js
+// ../../node_modules/.pnpm/@sindresorhus+is@7.1.1/node_modules/@sindresorhus/is/distribution/index.js
 var typedArrayTypeNames = [
   "Int8Array",
   "Uint8Array",
@@ -198,9 +300,12 @@ function detect(value) {
     return "Buffer";
   }
   const tagType = getObjectType(value);
-  if (tagType) {
+  if (tagType && tagType !== "Object") {
     return tagType;
   }
+  if (hasPromiseApi(value)) {
+    return "Promise";
+  }
   if (value instanceof String || value instanceof Boolean || value instanceof Number) {
     throw new TypeError("Please don't use object wrappers for primitive types");
   }
@@ -297,6 +402,7 @@ Object.assign(detect, {
   urlInstance: isUrlInstance,
   urlSearchParams: isUrlSearchParams,
   urlString: isUrlString,
+  optional: isOptional,
   validDate: isValidDate,
   validLength: isValidLength,
   weakMap: isWeakMap,
@@ -317,6 +423,10 @@ function isAny(predicate, ...values) {
   return predicates.some((singlePredicate) => predicateOnArray(Array.prototype.some, singlePredicate, values));
 }
 __name(isAny, "isAny");
+function isOptional(value, predicate) {
+  return isUndefined(value) || predicate(value);
+}
+__name(isOptional, "isOptional");
 function isArray(value, assertion) {
   if (!Array.isArray(value)) {
     return false;
@@ -380,7 +490,7 @@ function isBuffer(value) {
 }
 __name(isBuffer, "isBuffer");
 function isClass(value) {
-  return isFunction(value) && value.toString().startsWith("class ");
+  return isFunction(value) && /^class(\s+|{)/.test(value.toString());
 }
 __name(isClass, "isClass");
 function isDataView(value) {
@@ -726,10 +836,6 @@ function predicateOnArray(method, predicate, values) {
   return method.call(values, predicate);
 }
 __name(predicateOnArray, "predicateOnArray");
-function keysOf(value) {
-  return Object.keys(value);
-}
-__name(keysOf, "keysOf");
 
 // ../utils/src/my-dash.ts
 function keyBy(array, key) {
@@ -780,7 +886,7 @@ function mapValues(obj, fn) {
 }
 __name(mapValues, "mapValues");
 function times(count, fn) {
-  return Array.from({ length: count }, (_3, i) => fn(i));
+  return Array.from({ length: count }, (_4, i) => fn(i));
 }
 __name(times, "times");
 function map(array, fn) {
@@ -799,6 +905,14 @@ function pick(obj, keys) {
   return Object.fromEntries(Object.entries(obj).filter(([key]) => keys.includes(key)));
 }
 __name(pick, "pick");
+function uniq(array) {
+  return Array.from(new Set(array));
+}
+__name(uniq, "uniq");
+function fromPairs(pairs) {
+  return Object.fromEntries(pairs);
+}
+__name(fromPairs, "fromPairs");
 var _ = {
   keyBy,
   sortBy,
@@ -815,6 +929,8 @@ var _ = {
   flatMap,
   intersection,
   pick,
+  uniq,
+  fromPairs,
   // type checks
   isString,
   isBoolean,
@@ -863,6 +979,9 @@ var VarlockError = class extends Error {
     if (my_dash_default.isArray(this.more.tip)) return this.more.tip.join("\n");
     return this.more.tip;
   }
+  get location() {
+    return this.more?.location;
+  }
   get code() {
     return this.more?.code;
   }
@@ -913,6 +1032,12 @@ var ConfigLoadError = class extends VarlockError {
     };
   }
 };
+var ParseError = class extends VarlockError {
+  static {
+    __name(this, "ParseError");
+  }
+  static defaultIcon = "\u{1F635}\u200D\u{1F4AB}";
+};
 var SchemaError = class extends VarlockError {
   static {
     __name(this, "SchemaError");
@@ -975,13 +1100,13 @@ __name(tryCatch, "tryCatch");
 var asyncExec = promisify(exec);
 
 // ../utils/src/git-utils.ts
-async function checkIsFileGitIgnored(path3, warnIfNotGitRepo = false) {
+async function checkIsFileGitIgnored(path4, warnIfNotGitRepo = false) {
   try {
-    await asyncExec(`git check-ignore ${path3} -q`);
+    await asyncExec(`git check-ignore ${path4} -q`);
     return true;
   } catch (err) {
     const stderr = err.stderr;
-    if (stderr.includes("not found")) return void 0;
+    if (err.status === 127 || stderr.includes("not found")) return void 0;
     if (err.code === "ENOENT") return void 0;
     if (stderr === "") return false;
     if (stderr.includes("not a git repository")) {
@@ -1028,12 +1153,20 @@ var EnvGraphDataType = class {
   get icon() {
     return this.def.icon;
   }
+  get isSensitive() {
+    return this.def.sensitive;
+  }
+  get docsEntries() {
+    return this.def.docs;
+  }
   /** @internal */
   get _rawDef() {
     return this.def;
   }
   coerce(val) {
-    return this.def.coerce ? this.def.coerce(val) : val;
+    if (this.def.coerce) return this.def.coerce(val);
+    if (val === void 0) return void 0;
+    return typeof val === "string" ? val : String(val);
   }
   validate(val) {
     return this.def.validate ? this.def.validate(val) : true;
@@ -1260,7 +1393,7 @@ var EmailDataType = createEnvGraphDataType(
 );
 var IP_V4_ADDRESS_REGEX = /^(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)){3}$/;
 var IP_V6_ADDRESS_REGEX = /^(?:(?:[a-fA-F\d]{1,4}:){7}(?:[a-fA-F\d]{1,4}|:)|(?:[a-fA-F\d]{1,4}:){6}(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)(?:\\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)){3}|:[a-fA-F\d]{1,4}|:)|(?:[a-fA-F\d]{1,4}:){5}(?::(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)(?:\\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)){3}|(?::[a-fA-F\d]{1,4}){1,2}|:)|(?:[a-fA-F\d]{1,4}:){4}(?:(?::[a-fA-F\d]{1,4}){0,1}:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)(?:\\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)){3}|(?::[a-fA-F\d]{1,4}){1,3}|:)|(?:[a-fA-F\d]{1,4}:){3}(?:(?::[a-fA-F\d]{1,4}){0,2}:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)(?:\\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)){3}|(?::[a-fA-F\d]{1,4}){1,4}|:)|(?:[a-fA-F\d]{1,4}:){2}(?:(?::[a-fA-F\d]{1,4}){0,3}:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)(?:\\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)){3}|(?::[a-fA-F\d]{1,4}){1,5}|:)|(?:[a-fA-F\d]{1,4}:){1}(?:(?::[a-fA-F\d]{1,4}){0,4}:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)(?:\\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)){3}|(?::[a-fA-F\d]{1,4}){1,6}|:)|(?::(?:(?::[a-fA-F\d]{1,4}){0,5}:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)(?:\\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d|\d)){3}|(?::[a-fA-F\d]{1,4}){1,7}|:)))(?:%[0-9a-zA-Z]{1,})?$/;
-var ipAddressDataType = createEnvGraphDataType(
+var IpAddressDataType = createEnvGraphDataType(
   (settings) => ({
     name: "ip",
     icon: "iconoir:ip-address-tag",
@@ -1350,21 +1483,21 @@ var Md5DataType = createEnvGraphDataType({
     return new ValidationError("Value must be a valid MD5 hash string");
   }
 });
-var BaseDataTypes = {
-  string: StringDataType,
-  number: NumberDataType,
-  boolean: BooleanDataType,
-  simpleObject: SimpleObjectDataType,
-  enum: EnumDataType,
-  email: EmailDataType,
-  url: UrlDataType,
-  ipAddress: ipAddressDataType,
-  port: PortDataType,
-  semver: SemverDataType,
-  isoDate: IsoDateDataType,
-  uuid: UuidDataType,
-  md5: Md5DataType
-};
+var BaseDataTypes = [
+  StringDataType,
+  NumberDataType,
+  BooleanDataType,
+  SimpleObjectDataType,
+  EnumDataType,
+  EmailDataType,
+  UrlDataType,
+  IpAddressDataType,
+  PortDataType,
+  SemverDataType,
+  IsoDateDataType,
+  UuidDataType,
+  Md5DataType
+];
 
 // env-graph/lib/simple-queue.ts
 var SimpleQueue = class {
@@ -1403,22 +1536,242 @@ var SimpleQueue = class {
     }
   }
 };
+var DecoratorInstance = class {
+  static {
+    __name(this, "DecoratorInstance");
+  }
+  get name() {
+    return this.parsedDecorator.name;
+  }
+  get isFunctionCall() {
+    return !!this.parsedDecorator.isBareFnCall;
+  }
+  // decorator value/args are translated into a resolver when we process the decorator
+  _decValueResolver;
+  get decValueResolver() {
+    return this._decValueResolver;
+  }
+  _schemaErrors = [];
+  get schemaErrors() {
+    return [
+      ...this._schemaErrors,
+      ...this._decValueResolver?.schemaErrors || []
+    ];
+  }
+  // error encountered during `execute` function
+  _executionError;
+  decoratorDef;
+  get incompatibleWith() {
+    return this.decoratorDef?.incompatibleWith;
+  }
+  processed = false;
+  processedData;
+  async process() {
+    if (this.processed) return;
+    this.processed = true;
+    if (!this.graph) throw new Error("expected graph to be set");
+    try {
+      const decRegistry = this.isRootDecorator ? this.graph.rootDecoratorsRegistry : this.graph.itemDecoratorsRegistry;
+      this.decoratorDef = decRegistry[this.name];
+      if (!this.decoratorDef) {
+        throw new Error(`Unknown decorator: @${this.name}`);
+      }
+      if (this.decoratorDef.useFnArgsResolver && this.parsedDecorator.value instanceof ParsedEnvSpecFunctionCall) {
+        this._decValueResolver = convertParsedValueToResolvers(
+          this.parsedDecorator.value.data.args,
+          this.dataSource,
+          this.graph.registeredResolverFunctions
+        );
+      } else {
+        this._decValueResolver = convertParsedValueToResolvers(
+          this.parsedDecorator.value,
+          this.dataSource,
+          this.graph.registeredResolverFunctions
+        );
+      }
+      if (this.decValueResolver) {
+        await this.decValueResolver.process(this);
+        this.processedData = await this.decoratorDef.process?.(this.decValueResolver);
+      }
+    } catch (e) {
+      this._schemaErrors.push(e instanceof SchemaError ? e : new SchemaError(e));
+    }
+  }
+  async execute() {
+    await this.decoratorDef.execute?.(this.processedData);
+  }
+  resolvedValue;
+  isResolved = false;
+  async resolve() {
+    if (this.isResolved) return this.resolvedValue;
+    await this.process();
+    if (!this.decValueResolver) throw new Error("expected decorator to have a value resolver");
+    try {
+      this.resolvedValue = await this.decValueResolver.resolve();
+    } catch (err) {
+      this._schemaErrors.push(err);
+    }
+    this.isResolved = true;
+    return this.resolvedValue;
+  }
+};
+var ItemDecoratorInstance = class extends DecoratorInstance {
+  constructor(configItem, dataSource, parsedDecorator) {
+    super();
+    this.configItem = configItem;
+    this.dataSource = dataSource;
+    this.parsedDecorator = parsedDecorator;
+  }
+  static {
+    __name(this, "ItemDecoratorInstance");
+  }
+  isRootDecorator = false;
+  get graph() {
+    return this.dataSource.graph;
+  }
+};
+var RootDecoratorInstance = class extends DecoratorInstance {
+  constructor(dataSource, parsedDecorator) {
+    super();
+    this.dataSource = dataSource;
+    this.parsedDecorator = parsedDecorator;
+  }
+  static {
+    __name(this, "RootDecoratorInstance");
+  }
+  isRootDecorator = true;
+  get graph() {
+    return this.dataSource.graph;
+  }
+};
+var builtInRootDecorators = [
+  {
+    name: "envFlag",
+    deprecated: "use @currentEnv instead"
+  },
+  {
+    name: "currentEnv",
+    incompatibleWith: ["envFlag"]
+  },
+  {
+    name: "defaultRequired",
+    process: /* @__PURE__ */ __name((decVal) => {
+      if (!decVal.isStatic || ![true, false, "infer"].includes(decVal.staticValue)) {
+        throw new Error('@defaultRequired decorator value must be set to a static value of true, false, or "infer"');
+      }
+    }, "process")
+  },
+  {
+    name: "defaultSensitive",
+    process: /* @__PURE__ */ __name((decVal) => {
+      if (decVal.isStatic && !my_dash_default.isBoolean(decVal.staticValue) || !decVal.isStatic && decVal.fnName && decVal.fnName !== "inferFromPrefix") {
+        throw new Error("only true, false, or `inferFromPrefix()` is allowed for @defaultSensitive decorator");
+      }
+    }, "process")
+  },
+  {
+    name: "disable"
+  },
+  {
+    name: "generateTypes",
+    isFunction: true
+  },
+  {
+    name: "import",
+    isFunction: true,
+    process: /* @__PURE__ */ __name((decVal) => {
+      if (!decVal.arrArgs || decVal.arrArgs.length === 0) {
+        throw new Error("@import decorator must have at least one argument - the path to import");
+      }
+      if (decVal.arrArgs.some((a2) => !a2.isStatic)) {
+        throw new Error("@import decorator cannot use any dynamic values - all args must be static");
+      }
+    }, "process")
+  },
+  {
+    name: "plugin",
+    isFunction: true
+  },
+  {
+    name: "redactLogs"
+  },
+  {
+    name: "preventLeaks"
+  }
+];
+var builtInItemDecorators = [
+  {
+    name: "required"
+  },
+  {
+    name: "optional",
+    incompatibleWith: ["required"]
+  },
+  {
+    name: "sensitive"
+  },
+  {
+    name: "type",
+    useFnArgsResolver: true
+  },
+  {
+    name: "example"
+  },
+  {
+    name: "docsUrl",
+    deprecated: "use `docs()` instead"
+  },
+  {
+    name: "docs",
+    isFunction: true
+  },
+  {
+    name: "icon"
+  }
+];
 
 // env-graph/lib/resolver.ts
 var execAsync = promisify(exec);
 var Resolver = class {
-  constructor(fnArgs) {
-    this.fnArgs = fnArgs;
+  constructor(arrArgs, objArgs, dataSource) {
+    this.arrArgs = arrArgs;
+    this.objArgs = objArgs;
+    this.dataSource = dataSource;
+    if (this.def.inferredType) this.inferredType = this.def.inferredType;
   }
   static {
     __name(this, "Resolver");
   }
-  static fnName;
+  static def;
+  static get fnName() {
+    return this.def.name;
+  }
+  get def() {
+    return this.constructor.def;
+  }
+  get fnName() {
+    return this.def.name;
+  }
+  get label() {
+    return this.def.label;
+  }
+  get icon() {
+    return this.def.icon;
+  }
+  get isStatic() {
+    return false;
+  }
+  get staticValue() {
+    return void 0;
+  }
   inferredType;
   _schemaErrors = [];
   _depsObj = {};
   get childResolvers() {
-    return this.fnArgs.flatMap((r) => my_dash_default.isPlainObject(r) ? my_dash_default.values(r) : r);
+    return [
+      ...this.arrArgs ?? [],
+      ...Object.values(this.objArgs ?? {})
+    ];
   }
   get schemaErrors() {
     return [
@@ -1426,6 +1779,9 @@ var Resolver = class {
       ...this.childResolvers.flatMap((r) => r.schemaErrors)
     ];
   }
+  set schemaErrors(v) {
+    throw new Error("set _schemaErrors instead");
+  }
   get depsObj() {
     const mergedDepsObj = { ...this._depsObj };
     this.childResolvers.forEach((r) => Object.assign(mergedDepsObj, r.depsObj));
@@ -1434,243 +1790,308 @@ var Resolver = class {
   get deps() {
     return Object.keys(this.depsObj);
   }
-  configItem;
-  async process(configItem) {
-    this.configItem = configItem;
-    try {
-      await this._process(configItem);
-    } catch (error) {
-      if (error instanceof SchemaError) {
-        this._schemaErrors.push(error);
-      } else if (error instanceof Error) {
-        this._schemaErrors.push(new SchemaError(error));
-      } else {
-        throw new Error(`Non-error thrown while processing resolver - ${error}`);
+  parent;
+  meta;
+  process(parent) {
+    this.parent = parent;
+    const { argsSchema } = this.def;
+    if (argsSchema?.type === "array" && this.objArgs !== void 0) {
+      this._schemaErrors.push(new SchemaError("Resolver does not support key-value args"));
+    } else if (argsSchema?.type === "object" && this.arrArgs !== void 0) {
+      this._schemaErrors.push(new SchemaError("Resolver expects only key-value args"));
+    }
+    if (argsSchema?.arrayExactLength !== void 0) {
+      if (this.arrArgs?.length !== argsSchema.arrayExactLength) {
+        this._schemaErrors.push(
+          new SchemaError(
+            `expects exactly ${argsSchema.arrayExactLength} argument${argsSchema.arrayExactLength > 1 ? "s" : ""}`
+          )
+        );
+      }
+    }
+    if (argsSchema?.arrayMinLength !== void 0) {
+      if ((this.arrArgs?.length ?? 0) < argsSchema.arrayMinLength) {
+        this._schemaErrors.push(
+          new SchemaError(
+            `expects at least ${argsSchema.arrayMinLength} argument${argsSchema.arrayMinLength > 1 ? "s" : ""}`
+          )
+        );
+      }
+    }
+    if (argsSchema?.arrayMaxLength !== void 0) {
+      if ((this.arrArgs?.length ?? 0) > argsSchema.arrayMaxLength) {
+        this._schemaErrors.push(
+          new SchemaError(`expects at most ${argsSchema.arrayMaxLength} argument${argsSchema.arrayMaxLength > 1 ? "s" : ""}`)
+        );
+      }
+    }
+    if (argsSchema?.objKeyMinLength !== void 0) {
+      const objKeyLengths = Object.keys(this.objArgs || {}).length;
+      if (objKeyLengths < argsSchema.objKeyMinLength) {
+        this._schemaErrors.push(
+          new SchemaError(
+            `expects at least ${argsSchema.objKeyMinLength} key value arg${argsSchema.objKeyMinLength > 1 ? "s" : ""}`
+          )
+        );
+      }
+    }
+    if (this._schemaErrors.length === 0) {
+      try {
+        this.meta = this.def.process?.call(this);
+      } catch (error) {
+        if (error instanceof SchemaError) {
+          this._schemaErrors.push(error);
+        } else if (error instanceof Error) {
+          this._schemaErrors.push(new SchemaError(error));
+        } else {
+          throw new Error(`Non-error thrown while processing resolver - ${error}`);
+        }
+      }
+    }
+    if (!this.def.name.startsWith("\0")) {
+      for (const e of this._schemaErrors) {
+        e.message = `${this.def.name}(): ${e.message}`;
       }
     }
-    this.childResolvers.forEach((r) => r.process(configItem));
+    this.childResolvers.forEach((r) => {
+      r.process(parent);
+    });
   }
   // meant to be used by subclass _process methods
   addDep(key) {
-    this._depsObj[key] = true;
-    if (!this.configItem) throw new Error("expected configItem to be set");
-    if (!this.configItem.envGraph.configSchema[key]) {
-      this._schemaErrors.push(new SchemaError(`Unknown referenced key: ${key}`));
+    if (!this.envGraph.configSchema[key]) {
+      throw new Error(`invalid dependency: ${key}`);
     }
+    this._depsObj[key] = true;
+  }
+  async getCurrentEnv() {
+    if (!this.dataSource) throw new Error("expected dataSource to be set");
+    await this.dataSource.resolveCurrentEnv();
+    return this.dataSource.envFlagValue ? String(this.dataSource.envFlagValue) : void 0;
   }
   async resolve() {
-    const resolvedValue = await this._resolve();
+    const resolvedValue = await this.def.resolve.call(this, this.meta);
     return resolvedValue;
   }
+  get envGraph() {
+    if (this.parent instanceof ConfigItem) {
+      return this.parent.envGraph;
+    } else if (this.parent instanceof DecoratorInstance) {
+      return this.parent.graph;
+    }
+  }
   // meant to be used by subclass _resolve methods
   getDepValue(key) {
-    const depItem = this.configItem?.envGraph.configSchema[key];
-    if (!depItem) throw new Error(`Expected to find item - ${key}`);
+    const depItem = this.envGraph?.configSchema[key];
+    if (!depItem) throw new Error(`Referenced item "${key}" not found`);
+    if (!depItem.isValid) throw new Error(`Referenced item "${key}" is not valid`);
     return depItem.resolvedValue;
   }
 };
 var StaticValueResolver = class extends Resolver {
-  constructor(staticValue) {
+  constructor(_staticValue) {
     super([]);
-    this.staticValue = staticValue;
-    if (staticValue !== void 0) {
-      this.inferredType = typeof staticValue;
+    this._staticValue = _staticValue;
+    if (_staticValue !== void 0) {
+      this.inferredType = typeof _staticValue;
     }
   }
   static {
     __name(this, "StaticValueResolver");
   }
-  label = "static";
-  icon = "bi:dash";
-  async _resolve() {
-    return this.staticValue;
+  static def = {
+    name: "\0static",
+    // used internally, so we add the extra \0
+    icon: "bi:dash",
+    async resolve() {
+      return this.staticValue;
+    }
+  };
+  // helper so plugins dont need to import and use instanceof
+  get isStatic() {
+    return true;
   }
-  async _process() {
+  get staticValue() {
+    return this._staticValue;
   }
 };
-var ErrorResolver = class extends Resolver {
+var FunctionArgsResolver = class extends Resolver {
   static {
-    __name(this, "ErrorResolver");
+    __name(this, "FunctionArgsResolver");
+  }
+  // we might want to just have a resolve function which resolves all children
+  // but it might be useful to let the decorator do it individually
+  // so that some can be skipped depending on the other args
+  static def = {
+    name: "\0fnArgs",
+    // used internally, so we add the extra \0
+    label: "function args",
+    icon: "bi:dash",
+    // not actualyl used
+    resolve() {
+      return void 0;
+    }
+  };
+  // special helper to resolve all child args
+  async resolve() {
+    const resolvedArrayArgs = [];
+    const resolvedObjArgs = {};
+    for (const arg of this.arrArgs || []) {
+      resolvedArrayArgs.push(await arg.resolve());
+    }
+    for (const key in this.objArgs) {
+      resolvedObjArgs[key] = await this.objArgs[key].resolve();
+    }
+    return {
+      arr: resolvedArrayArgs,
+      obj: resolvedObjArgs
+    };
   }
+};
+var ErrorResolver = class extends Resolver {
   constructor(err) {
     super([]);
+    this.err = err;
     this._schemaErrors.push(err);
   }
-  label = "error";
-  icon = "bi:dash";
-  async _resolve() {
-    return void 0;
-  }
-  async _process() {
-  }
-};
-var ConcatResolver = class extends Resolver {
   static {
-    __name(this, "ConcatResolver");
+    __name(this, "ErrorResolver");
   }
-  static fnName = "concat";
-  label = "concat";
-  icon = "material-symbols:join";
-  inferredType = "string";
-  async _process() {
-    if (this.fnArgs.some((arg) => my_dash_default.isPlainObject(arg))) {
-      throw new SchemaError("concat() does not support key-value arguments");
+  static def = {
+    name: "\0error",
+    // used internally, so we add the extra \0
+    icon: "bi:dash",
+    async resolve() {
+      return void 0;
     }
-    if (this.fnArgs.length < 2) {
-      throw new SchemaError("concat() expects at least two arguments");
+  };
+};
+function createResolver(def) {
+  const ResolverClass = class extends Resolver {
+    static {
+      __name(this, "ResolverClass");
     }
-  }
-  async _resolve() {
+  };
+  ResolverClass.def = def;
+  return ResolverClass;
+}
+__name(createResolver, "createResolver");
+var ConcatResolver = createResolver({
+  name: "concat",
+  icon: "material-symbols:join",
+  inferredType: "string",
+  argsSchema: {
+    type: "array",
+    arrayMinLength: 2
+  },
+  async resolve() {
     const resolvedValues = [];
-    for (const arg of this.fnArgs) {
-      if (my_dash_default.isPlainObject(arg)) {
-        throw new Error("concat() does not support key-value arguments");
-      }
+    for (const arg of this.arrArgs ?? []) {
       const resolvedChildValue = await arg.resolve();
       resolvedValues.push(String(resolvedChildValue ?? ""));
     }
     return resolvedValues.join("");
   }
-};
-var FallbackResolver = class extends Resolver {
-  static {
-    __name(this, "FallbackResolver");
-  }
-  static fnName = "fallback";
-  label = "fallback";
-  icon = "memory:table-top-stairs-up";
-  async _process() {
-    if (this.fnArgs.some((arg) => my_dash_default.isPlainObject(arg))) {
-      throw new SchemaError("fallback() does not support key-value arguments");
-    }
-    if (this.fnArgs.length < 2) {
-      throw new SchemaError("fallback() expects at least two arguments");
-    }
-  }
-  async _resolve() {
-    for (const arg of this.fnArgs) {
-      if (my_dash_default.isPlainObject(arg)) throw new Error("fallback() does not support key-value arguments");
+});
+var FallbackResolver = createResolver({
+  name: "fallback",
+  icon: "memory:table-top-stairs-up",
+  argsSchema: {
+    type: "array",
+    arrayMinLength: 2
+  },
+  async resolve() {
+    for (const arg of this.arrArgs ?? []) {
       const resolvedChildValue = await arg.resolve();
       if (resolvedChildValue !== void 0 && resolvedChildValue !== "") {
         return resolvedChildValue;
       }
     }
   }
-};
-var ExecResolver = class _ExecResolver extends Resolver {
-  static {
-    __name(this, "ExecResolver");
-  }
-  static fnName = "exec";
-  label = "exec";
-  icon = "iconoir:terminal";
-  async _process() {
-    if (this.fnArgs.length !== 1) {
-      throw new SchemaError("exec() expects a single child arg");
-    }
-    if (this.fnArgs.some((arg) => my_dash_default.isPlainObject(arg))) {
-      throw new SchemaError("exec() does not support key-value arguments");
-    }
-  }
-  static execQueue = new SimpleQueue();
-  async _resolve() {
-    if (my_dash_default.isPlainObject(this.fnArgs[0])) throw new Error("exec() does not support key-value arguments");
-    const commandStr = await this.fnArgs[0].resolve();
+});
+var execQueue = new SimpleQueue();
+var ExecResolver = createResolver({
+  name: "exec",
+  icon: "iconoir:terminal",
+  argsSchema: {
+    type: "array",
+    arrayExactLength: 1
+  },
+  async resolve() {
+    const commandStr = await this.arrArgs?.[0].resolve();
     if (typeof commandStr !== "string") {
-      throw new ResolutionError("exec() expects a string child arg");
+      throw new ResolutionError("exec() expects a string arg");
     }
     try {
-      const { stdout } = await _ExecResolver.execQueue.enqueue(() => execAsync(commandStr));
+      const { stdout } = await execQueue.enqueue(() => execAsync(commandStr));
       return stdout.replace(/\n$/, "");
     } catch (err) {
       console.log("exec() failed", err);
       throw new ResolutionError(`exec() command failed: ${commandStr}`);
     }
   }
-};
-var RefResolver = class extends Resolver {
-  static {
-    __name(this, "RefResolver");
-  }
-  static fnName = "ref";
-  label = "ref";
-  icon = "mdi-light:content-duplicate";
-  refKey;
-  async _process() {
-    if (this.fnArgs.length !== 1) {
-      throw new SchemaError("ref() expects a single child arg");
-    }
-    if (!(this.fnArgs[0] instanceof StaticValueResolver)) {
-      throw new SchemaError("ref() expects a single static value passed in");
+});
+var RefResolver = createResolver({
+  name: "ref",
+  icon: "mdi-light:content-duplicate",
+  argsSchema: {
+    type: "array",
+    arrayExactLength: 1
+  },
+  process() {
+    if (!(this.arrArgs?.[0] instanceof StaticValueResolver)) {
+      throw new SchemaError("expects a single static value passed in");
     }
-    const keyName = this.fnArgs[0].staticValue;
-    if (typeof keyName !== "string") {
-      throw new SchemaError("ref() expects a string keyname passed in");
+    const refKey = this.arrArgs[0].staticValue;
+    if (typeof refKey !== "string") {
+      throw new SchemaError("expects a string keyname passed in");
     }
-    this.refKey = keyName;
-    this.addDep(keyName);
-  }
-  async _resolve() {
-    if (!this.refKey) throw new Error("expected refKey to be set");
-    return this.getDepValue(this.refKey);
-  }
-};
-var RegexResolver = class extends Resolver {
-  static {
-    __name(this, "RegexResolver");
+    this.addDep(refKey);
+    return refKey;
+  },
+  async resolve(refKey) {
+    return this.getDepValue(refKey);
   }
-  static fnName = "regex";
-  label = "regex";
-  icon = "mdi:regex";
-  regex;
-  async _process() {
-    if (this.fnArgs.length !== 1) {
-      throw new SchemaError("regex() expects a single child arg");
-    }
-    if (!(this.fnArgs[0] instanceof StaticValueResolver)) {
-      throw new SchemaError("regex() expects a single static value passed in");
+});
+var RegexResolver = createResolver({
+  name: "regex",
+  icon: "mdi:regex",
+  argsSchema: {
+    type: "array",
+    arrayExactLength: 1
+  },
+  process() {
+    if (!(this.arrArgs?.[0] instanceof StaticValueResolver)) {
+      throw new SchemaError("expects a single static value passed in");
     }
-    const regexStr = this.fnArgs[0].staticValue;
+    const regexStr = this.arrArgs[0].staticValue;
     if (typeof regexStr !== "string") {
-      throw new SchemaError("regex() expects a string");
-    }
-    this.regex = new RegExp(regexStr);
-  }
-  async _resolve() {
-    if (!this.regex) throw new Error("expected regex to be set");
-    return this.regex;
-  }
-};
-var RemapResolver = class extends Resolver {
-  static {
-    __name(this, "RemapResolver");
-  }
-  static fnName = "remap";
-  label = "remap";
-  icon = "codicon:replace";
-  remappings;
-  async _process() {
-    if (my_dash_default.isPlainObject(this.fnArgs[0])) {
-      throw new SchemaError("remap() expects the first arg to be the value to remap");
-    }
-    if (!my_dash_default.isPlainObject(this.fnArgs[1])) {
-      throw new SchemaError("remap() expects the all args after the first to be key-value pairs of remappings");
+      throw new SchemaError("expects a string");
     }
-    if (this.fnArgs.length !== 2) {
-      throw new SchemaError("remap() should not have any additional non key-value args after remappings");
+    try {
+      return new RegExp(regexStr);
+    } catch (err) {
+      throw new SchemaError(err.message);
     }
-    this.remappings = this.fnArgs[1];
+  },
+  async resolve(regex) {
+    return regex;
   }
-  async _resolve() {
-    if (my_dash_default.isPlainObject(this.fnArgs[0])) {
-      throw new SchemaError("remap() expects the first arg to be the value to remap");
-    }
-    if (!my_dash_default.isPlainObject(this.fnArgs[1])) {
-      throw new SchemaError("remap() expects the all args after the first to be key-value pairs of remappings");
-    }
-    const originalValue = await this.fnArgs[0].resolve();
-    if (!this.remappings) throw new Error("expected remappings to be set");
-    for (const [remappedVal, matchValResolver] of Object.entries(this.remappings)) {
+});
+var RemapResolver = createResolver({
+  name: "remap",
+  icon: "codicon:replace",
+  argsSchema: {
+    type: "mixed",
+    arrayExactLength: 1,
+    objKeyMinLength: 1
+  },
+  process() {
+    return this.objArgs;
+  },
+  async resolve(remappings) {
+    const originalValue = await this.arrArgs[0].resolve();
+    for (const [remappedVal, matchValResolver] of Object.entries(remappings)) {
       const matchVal = await matchValResolver.resolve();
       if (matchVal instanceof RegExp && originalValue !== void 0) {
         if (matchVal.test(String(originalValue))) return remappedVal;
@@ -1680,15 +2101,137 @@ var RemapResolver = class extends Resolver {
     }
     return originalValue;
   }
-};
+});
+var ForEnvResolver = createResolver({
+  name: "forEnv",
+  icon: "tabler:flag-question",
+  inferredType: "boolean",
+  argsSchema: {
+    type: "array",
+    arrayMinLength: 1
+  },
+  process() {
+    const matchEnvs = this.arrArgs.map((r) => String(r.staticValue));
+    return matchEnvs;
+  },
+  async resolve(matchEnvs) {
+    const currentEnv = await this.getCurrentEnv();
+    if (!currentEnv) throw new Error("current environment is not set");
+    return currentEnv && matchEnvs.includes(currentEnv || "");
+  }
+});
+var EqResolver = createResolver({
+  name: "eq",
+  icon: "material-symbols:equal",
+  inferredType: "boolean",
+  argsSchema: {
+    type: "array",
+    arrayExactLength: 2
+  },
+  process() {
+    return { left: this.arrArgs[0], right: this.arrArgs[1] };
+  },
+  async resolve({ left, right }) {
+    const leftVal = await left.resolve();
+    const rightVal = await right.resolve();
+    return leftVal === rightVal;
+  }
+});
+var IfResolver = createResolver({
+  name: "if",
+  icon: "material-symbols:help-center",
+  // question mark
+  argsSchema: {
+    type: "array",
+    arrayMinLength: 2
+  },
+  process() {
+    const condition = this.arrArgs[0];
+    const trueVal = this.arrArgs[1];
+    const falseVal = this.arrArgs[2];
+    if (!falseVal || trueVal.inferredType === falseVal.inferredType) {
+      this.inferredType = trueVal.inferredType;
+    }
+    return { condition, trueVal, falseVal };
+  },
+  async resolve({ condition, trueVal, falseVal }) {
+    const conditionVal = await condition.resolve();
+    if (conditionVal) {
+      return trueVal.resolve();
+    } else {
+      return falseVal?.resolve();
+    }
+  }
+});
+var InferFromPrefixResolver = createResolver({
+  name: "inferFromPrefix",
+  icon: "material-symbols:help-center",
+  // question mark
+  argsSchema: {
+    type: "array",
+    arrayExactLength: 1
+  },
+  process() {
+    return this.arrArgs[0].staticValue;
+  },
+  async resolve(_prefix) {
+    return void 0;
+  }
+});
 var BaseResolvers = [
   ConcatResolver,
   FallbackResolver,
   RefResolver,
   ExecResolver,
   RemapResolver,
-  RegexResolver
+  ForEnvResolver,
+  EqResolver,
+  IfResolver,
+  RegexResolver,
+  InferFromPrefixResolver
 ];
+function convertParsedValueToResolvers(value, dataSource, registeredResolvers) {
+  if (value === void 0) {
+    return void 0;
+  } else if (value instanceof ParsedEnvSpecStaticValue) {
+    return new StaticValueResolver(value.unescapedValue);
+  } else if (value instanceof ParsedEnvSpecFunctionCall || value instanceof ParsedEnvSpecFunctionArgs) {
+    let ResolverFnClass;
+    let argsFromParser;
+    if (value instanceof ParsedEnvSpecFunctionCall) {
+      ResolverFnClass = registeredResolvers[value.name];
+      if (!ResolverFnClass) {
+        return new ErrorResolver(new SchemaError(`Unknown resolver function: ${value.name}()`));
+      }
+      argsFromParser = value.data.args.values;
+    } else {
+      ResolverFnClass = FunctionArgsResolver;
+      argsFromParser = value.values;
+    }
+    let arrArgsAsResolvers;
+    let objArgsAsResolvers;
+    for (const arg of argsFromParser) {
+      if (arg instanceof ParsedEnvSpecKeyValuePair) {
+        objArgsAsResolvers ??= {};
+        const valResolver = convertParsedValueToResolvers(arg.value, dataSource, registeredResolvers);
+        if (!valResolver) throw new Error("Did not expect to find undefined resolver in key-value arg");
+        objArgsAsResolvers[arg.key] = valResolver;
+      } else {
+        if (objArgsAsResolvers) {
+          return new ErrorResolver(new SchemaError("After switching to key-value function args, cannot switch back"));
+        }
+        const argResolver = convertParsedValueToResolvers(arg, dataSource, registeredResolvers);
+        if (!argResolver) throw new Error("Did not expect to find undefined resolver in array arg");
+        arrArgsAsResolvers ??= [];
+        arrArgsAsResolvers.push(argResolver);
+      }
+    }
+    return new ResolverFnClass(arrArgsAsResolvers, objArgsAsResolvers, dataSource);
+  } else {
+    throw new Error("Unknown value type");
+  }
+}
+__name(convertParsedValueToResolvers, "convertParsedValueToResolvers");
 
 // env-graph/lib/graph-utils.ts
 function findGraphCycles(graph) {
@@ -1873,6 +2416,21 @@ async function generateTypes(graph, lang, typesPath) {
 }
 __name(generateTypes, "generateTypes");
 
+// env-graph/lib/error-location.ts
+function getErrorLocation(source, parserNode) {
+  if (!(source instanceof FileBasedDataSource)) return;
+  if (!parserNode.data || !parserNode.data._location || !my_dash_default.isNumber(parserNode.data._location.start.line)) return;
+  const lineNumber = parserNode.data._location?.start.line;
+  const colNumber = parserNode.data._location?.start.column;
+  return {
+    id: source.fullPath,
+    lineNumber,
+    colNumber,
+    lineStr: source.rawContents?.split("\n")[lineNumber - 1]?.trim() || ""
+  };
+}
+__name(getErrorLocation, "getErrorLocation");
+
 // env-graph/lib/env-graph.ts
 var processExists = !!globalThis.process;
 var originalProcessEnv = { ...processExists && process.env };
@@ -1918,15 +2476,41 @@ var EnvGraph2 = class {
   }
   dataTypesRegistry = {};
   registerDataType(factory) {
+    const name = factory.dataTypeName;
+    if (name in this.dataTypesRegistry) {
+      throw new Error(`Data type "${name}" already registered`);
+    }
     this.dataTypesRegistry[factory.dataTypeName] = factory;
   }
+  itemDecoratorsRegistry = {};
+  registerItemDecorator(decoratorDef) {
+    const name = decoratorDef.name;
+    if (name in this.itemDecoratorsRegistry) {
+      throw new Error(`Item decorator "${name}" already registered`);
+    }
+    this.itemDecoratorsRegistry[decoratorDef.name] = decoratorDef;
+  }
+  rootDecoratorsRegistry = {};
+  registerRootDecorator(decoratorDef) {
+    const name = decoratorDef.name;
+    if (name in this.itemDecoratorsRegistry) {
+      throw new Error(`Root decorator "${name}" already registered`);
+    }
+    this.rootDecoratorsRegistry[decoratorDef.name] = decoratorDef;
+  }
   constructor() {
-    for (const dataType of my_dash_default.values(BaseDataTypes)) {
+    for (const dataType of BaseDataTypes) {
       this.registerDataType(dataType);
     }
     for (const resolverClass of BaseResolvers) {
       this.registerResolver(resolverClass);
     }
+    for (const rootDec of builtInRootDecorators) {
+      this.registerRootDecorator(rootDec);
+    }
+    for (const itemDec of builtInItemDecorators) {
+      this.registerItemDecorator(itemDec);
+    }
     this.overrideValues = originalProcessEnv;
   }
   async setRootDataSource(source) {
@@ -1936,33 +2520,67 @@ var EnvGraph2 = class {
     await source.finishInit();
   }
   async finishLoad() {
+    for (const source of this.sortedDataSources) {
+      if (!source.isValid) return;
+    }
+    for (const plugin of this.plugins) {
+      if (plugin.loadingError) return;
+    }
+    let processingError = false;
+    for (const source of this.sortedDataSources) {
+      if (source.disabled) continue;
+      for (const decInstance of source.rootDecorators) {
+        await decInstance.process();
+        if (decInstance.schemaErrors.length) processingError = true;
+      }
+    }
     for (const itemKey in this.configSchema) {
       const item = this.configSchema[itemKey];
       await item.process();
+      if (item.errors.length) processingError = true;
     }
+    if (processingError) return;
     const cycles = findGraphCycles(this.graphAdjacencyList);
     for (const cycleItemKeys of cycles) {
       for (const itemKey of cycleItemKeys) {
         const item = this.configSchema[itemKey];
-        item.schemaErrors.push(
+        item._schemaErrors.push(
           new SchemaError(
             cycleItemKeys.length === 1 ? "Item cannot have dependency on itself" : `Dependency cycle detected: (${cycleItemKeys.join(", ")})`
           )
         );
       }
     }
+    for (const source of this.sortedDataSources) {
+      if (source.disabled) continue;
+      for (const decInstance of source.rootDecorators) {
+        if (!decInstance.decValueResolver) throw new Error("expected decorator value resolver");
+        await this.resolveEnvValues(decInstance.decValueResolver.deps);
+        try {
+          await decInstance.execute();
+        } catch (err) {
+          decInstance._executionError = new SchemaError(
+            err,
+            { location: getErrorLocation(source, decInstance.parsedDecorator) }
+          );
+        }
+      }
+    }
+    await this.getRootDec("redactLogs")?.resolve();
+    await this.getRootDec("preventLeaks")?.resolve();
   }
   get graphAdjacencyList() {
     const adjList = {};
     for (const itemKey in this.configSchema) {
       const item = this.configSchema[itemKey];
-      adjList[itemKey] = item.valueResolver?.deps || [];
+      adjList[itemKey] = item.dependencyKeys;
     }
     return adjList;
   }
-  async resolveEnvValues() {
-    if (my_dash_default.keys(this.configSchema).length === 0) return;
-    const adjList = this.graphAdjacencyList;
+  async resolveEnvValues(keys) {
+    const keysToResolve = keys ?? my_dash_default.keys(this.configSchema);
+    if (!keysToResolve.length) return;
+    const adjList = my_dash_default.pick(this.graphAdjacencyList, keysToResolve);
     const reverseAdjList = {};
     for (const itemKey in adjList) {
       const itemDeps = adjList[itemKey];
@@ -1971,7 +2589,7 @@ var EnvGraph2 = class {
         reverseAdjList[dep].push(itemKey);
       }
     }
-    const itemsToResolveStatus = my_dash_default.mapValues(this.configSchema, () => false);
+    const itemsToResolveStatus = my_dash_default.fromPairs(keysToResolve.map((key) => [key, false]));
     const deferred = new Promise((resolve, _reject) => {
       const markItemCompleted = /* @__PURE__ */ __name((itemKey) => {
         delete itemsToResolveStatus[itemKey];
@@ -1987,7 +2605,7 @@ var EnvGraph2 = class {
           markItemCompleted(itemKey);
           return;
         }
-        for (const depKey of adjList[itemKey]) {
+        for (const depKey of adjList[itemKey] || []) {
           const depItem = this.configSchema[depKey];
           if (depItem.validationState === "error") {
             item.resolutionError = new ResolutionError(`Dependency ${depKey} is invalid`);
@@ -2036,8 +2654,8 @@ var EnvGraph2 = class {
         isSensitive: item.isSensitive
       };
     }
-    serializedGraph.settings.redactLogs = this.getRootDecoratorValue("redactLogs") ?? true;
-    serializedGraph.settings.preventLeaks = this.getRootDecoratorValue("preventLeaks") ?? true;
+    serializedGraph.settings.redactLogs = this.getRootDec("redactLogs")?.resolvedValue ?? true;
+    serializedGraph.settings.preventLeaks = this.getRootDec("preventLeaks")?.resolvedValue ?? true;
     return serializedGraph;
   }
   get isInvalid() {
@@ -2046,57 +2664,50 @@ var EnvGraph2 = class {
   async generateTypes(lang, outputPath) {
     await generateTypes(this, lang, outputPath);
   }
-  getRootDecoratorValue(decoratorName) {
+  getRootDec(decoratorName) {
     const sources = Array.from(this.sortedDataSources).reverse();
     for (const s of sources) {
       if (s.disabled) continue;
       if (s.isPartialImport) continue;
-      const decs = s.getRootDecorators(decoratorName);
-      if (decs.length) return decs[0].simplifiedValue;
+      const dec = s.getRootDec(decoratorName);
+      if (dec) return dec;
     }
     return void 0;
   }
-  getRootDecorators(decoratorName) {
+  getRootDecFns(decoratorName) {
+    const allDecs = [];
     const sources = Array.from(this.sortedDataSources).reverse();
-    const combinedDecsWithSources = [];
     for (const source of sources) {
       if (source.disabled) continue;
       if (source.isPartialImport) continue;
-      const decs = source.getRootDecorators(decoratorName);
-      combinedDecsWithSources.push([source, decs]);
+      const decs = source.getRootDecFns(decoratorName);
+      allDecs.push(...decs);
     }
-    return combinedDecsWithSources;
+    return allDecs;
   }
+  /** plugins installed globally in the graph */
+  plugins = [];
 };
 
 // env-graph/lib/config-item.ts
-var ConfigItem4 = class {
+var ConfigItem = class {
+  constructor(envGraph, key) {
+    this.envGraph = envGraph;
+    this.key = key;
+  }
   static {
     __name(this, "ConfigItem");
   }
-  // annoyingly we cannot use readonly if we want to support `erasableSyntaxOnly`
-  #envGraph;
-  #key;
-  constructor(_envGraph, _key) {
-    this.#envGraph = _envGraph;
-    this.#key = _key;
-  }
-  get envGraph() {
-    return this.#envGraph;
-  }
-  get key() {
-    return this.#key;
-  }
   /**
    * fetch ordered list of definitions for this item, by following up sorted data sources list
    */
   get defs() {
     const defs = [];
-    for (const source of this.#envGraph.sortedDataSources) {
-      if (!source.configItemDefs[this.#key]) continue;
+    for (const source of this.envGraph.sortedDataSources) {
+      if (!source.configItemDefs[this.key]) continue;
       if (source.disabled) continue;
-      if (source.importKeys && !source.importKeys.includes(this.#key)) continue;
-      const itemDef = source.configItemDefs[this.#key];
+      if (source.importKeys && !source.importKeys.includes(this.key)) continue;
+      const itemDef = source.configItemDefs[this.key];
       if (itemDef) defs.push({ itemDef, source });
     }
     return defs;
@@ -2107,14 +2718,32 @@ var ConfigItem4 = class {
     }
   }
   get icon() {
-    const explicitIcon = this.getDecoratorValueString("icon");
-    if (explicitIcon) return explicitIcon;
+    const explicitIconDec = this.getDec("icon");
+    if (explicitIconDec) return explicitIconDec.resolvedValue;
     return this.dataType?.icon;
   }
   get docsLinks() {
     const links = [];
-    const docsUrl = this.getDecoratorValueString("docsUrl");
-    if (docsUrl) links.push({ url: docsUrl });
+    if (this.dataType?.docsEntries) {
+      for (const entry of this.dataType.docsEntries) {
+        if (my_dash_default.isPlainObject(entry)) links.push(entry);
+        else links.push({ url: entry });
+      }
+    }
+    const docsUrlDec = this.getDec("docsUrl");
+    if (docsUrlDec) {
+      links.push({ url: docsUrlDec.resolvedValue });
+    }
+    const docsDecs = this.getDecFns("docs");
+    for (const docsDec of docsDecs) {
+      const decVal = docsDec.resolvedValue;
+      if (!decVal.arr || !my_dash_default.isArray(decVal.arr)) throw new Error("expected an array of docs() args");
+      if (decVal.arr.length === 1) {
+        links.push({ url: decVal.arr[0] });
+      } else if (decVal.arr.length === 2) {
+        links.push({ url: decVal.arr[1], description: decVal.arr[0] });
+      }
+    }
     return links;
   }
   get valueResolver() {
@@ -2122,61 +2751,114 @@ var ConfigItem4 = class {
       return new StaticValueResolver(this.envGraph.overrideValues[this.key]);
     }
     for (const def of this.defs) {
-      if (def.itemDef.resolver) return def.itemDef.resolver;
-    }
-  }
-  getDecorator(decoratorName) {
-    for (const def of this.defs) {
-      const defDecorators = def.itemDef.decorators || {};
-      if (decoratorName in defDecorators) {
-        return defDecorators[decoratorName];
+      if (def.itemDef.resolver) {
+        return def.itemDef.resolver;
       }
     }
   }
-  getDecoratorValueRaw(decoratorName) {
-    for (const def of this.defs) {
-      const defDecorators = def.itemDef.decorators || {};
-      if (decoratorName in defDecorators) {
-        return defDecorators[decoratorName].value;
+  allDecorators = [];
+  effectiveDecorators = {};
+  effectiveDecoratorFns = {};
+  getDec(decoratorName) {
+    return this.effectiveDecorators[decoratorName];
+  }
+  getDecFns(decoratorName) {
+    return this.effectiveDecoratorFns[decoratorName] || [];
+  }
+  async resolveDecorators() {
+    for (const dec of Object.values(this.effectiveDecorators)) {
+      await dec.resolve();
+    }
+    for (const decs of Object.values(this.effectiveDecoratorFns)) {
+      for (const dec of decs) {
+        await dec.resolve();
       }
     }
   }
-  getDecoratorValueString(decoratorName) {
-    const dec = this.getDecoratorValueRaw(decoratorName);
-    if (dec instanceof ParsedEnvSpecStaticValue) return String(dec.value);
-  }
   dataType;
-  schemaErrors = [];
+  _schemaErrors = [];
   get resolverSchemaErrors() {
     return this.valueResolver?.schemaErrors || [];
   }
+  get decoratorSchemaErrors() {
+    return my_dash_default.values(this.allDecorators).flatMap((d) => d.schemaErrors);
+  }
+  isProcessed = false;
   async process() {
+    if (this.isProcessed) return;
+    this.isProcessed = true;
     for (const def of this.defs) {
+      if (def.itemDef.parsedValue && !def.itemDef.resolver) {
+        def.itemDef.resolver = convertParsedValueToResolvers(
+          def.itemDef.parsedValue,
+          def.source,
+          this.envGraph.registeredResolverFunctions
+        );
+      }
       await def.itemDef.resolver?.process(this);
     }
-    const typeDecoratorValue = this.getDecoratorValueRaw("type");
+    for (const def of this.defs) {
+      def.itemDef.decorators = def.itemDef.parsedDecorators?.map((d) => new ItemDecoratorInstance(this, def.source, d));
+      const decKeysInThisDef = /* @__PURE__ */ new Set();
+      const allDecsInThisDef = def.itemDef.decorators?.map((d) => d.name);
+      for (const dec of def.itemDef.decorators || []) {
+        await dec.process();
+        this.allDecorators?.push(dec);
+        if (dec.isFunctionCall) {
+          this.effectiveDecoratorFns[dec.name] ||= [];
+          this.effectiveDecoratorFns[dec.name].push(dec);
+        } else {
+          if (decKeysInThisDef.has(dec.name)) {
+            dec._schemaErrors.push(new SchemaError(`decorator @${dec.name} cannot be used twice in same definition`));
+            continue;
+          }
+          if (dec.incompatibleWith) {
+            for (const otherDecName of dec.incompatibleWith) {
+              if (allDecsInThisDef?.includes(otherDecName)) {
+                dec._schemaErrors.push(new SchemaError(`decorator @${dec.name} is incompatible with @${otherDecName} in the same definition`));
+                continue;
+              }
+            }
+          }
+          this.effectiveDecorators[dec.name] ||= dec;
+        }
+        decKeysInThisDef.add(dec.name);
+      }
+    }
+    const typeDec = this.getDec("type");
     let dataTypeName;
     let dataTypeArgs;
-    if (typeDecoratorValue instanceof ParsedEnvSpecStaticValue) {
-      dataTypeName = typeDecoratorValue.value;
-    } else if (typeDecoratorValue instanceof ParsedEnvSpecFunctionCall) {
-      dataTypeName = typeDecoratorValue.name;
-      dataTypeArgs = typeDecoratorValue.simplifiedArgs;
+    const typeDecParsedValue = typeDec?.parsedDecorator.value;
+    if (typeDecParsedValue instanceof ParsedEnvSpecStaticValue) {
+      dataTypeName = typeDecParsedValue.value;
+    } else if (typeDecParsedValue instanceof ParsedEnvSpecFunctionCall) {
+      dataTypeName = typeDecParsedValue.name;
+      dataTypeArgs = typeDecParsedValue.simplifiedArgs;
     }
-    if (!dataTypeName) {
-      if (this.valueResolver?.inferredType) {
-        dataTypeName = this.valueResolver.inferredType;
-      }
+    if (!dataTypeName && this.valueResolver?.inferredType) {
+      dataTypeName = this.valueResolver.inferredType;
     }
     dataTypeName ||= "string";
     dataTypeArgs ||= [];
     if (!(dataTypeName in this.envGraph.dataTypesRegistry)) {
-      this.schemaErrors.push(new SchemaError(`unknown data type: ${dataTypeName}`));
+      this._schemaErrors.push(new SchemaError(`unknown data type: ${dataTypeName}`));
     } else {
       const dataTypeFactory = this.envGraph.dataTypesRegistry[dataTypeName];
       this.dataType = dataTypeFactory(...my_dash_default.isPlainObject(dataTypeArgs) ? [dataTypeArgs] : dataTypeArgs);
     }
-    this.processRequired();
+  }
+  get dependencyKeys() {
+    return my_dash_default.uniq([
+      ...this.valueResolver?.deps || [],
+      ...my_dash_default.values(this.effectiveDecorators).flatMap(
+        (dec) => dec.decValueResolver?.deps || []
+      ),
+      ...my_dash_default.values(this.effectiveDecoratorFns).flatMap(
+        (decArr) => decArr.flatMap(
+          (d) => d.decValueResolver?.deps || []
+        )
+      )
+    ]);
   }
   /**
    * special early resolution helper
@@ -2184,18 +2866,14 @@ var ConfigItem4 = class {
    * */
   async earlyResolve() {
     await this.process();
-    for (const depKey of this.valueResolver?.deps || []) {
+    for (const depKey of this.dependencyKeys) {
       const depItem = this.envGraph.configSchema[depKey];
       if (!depItem) {
         throw new Error(`eager resolution eror - non-existant dependency: ${depKey}`);
       }
-      await depItem.process();
-      if (depItem.valueResolver?.deps.length) {
-        throw new Error("eager resolution cannot follow a chain of dependencies");
-      }
-      await depItem.resolve(true);
+      await depItem.earlyResolve();
     }
-    await this.resolve(true);
+    await this.resolve();
   }
   _isRequired = true;
   /**
@@ -2203,61 +2881,45 @@ var ConfigItem4 = class {
    * because that will affect type generation (only _always_ required items are never undefined)
    * */
   _isRequiredDynamic = false;
-  processRequired() {
+  async processRequired() {
     try {
       for (const def of this.defs) {
-        const defDecorators = def.itemDef.decorators || {};
-        if ("required" in defDecorators || "optional" in defDecorators) {
-          if ("required" in defDecorators && "optional" in defDecorators) {
-            throw new SchemaError("@required and @optional cannot both be set");
-          }
-          const requiredDecoratorVal = defDecorators.required?.value || defDecorators.optional?.value;
-          const usingOptional = "optional" in defDecorators;
-          if (requiredDecoratorVal instanceof ParsedEnvSpecStaticValue) {
-            const staticVal = requiredDecoratorVal.value;
-            if (my_dash_default.isBoolean(staticVal)) {
-              this._isRequired = usingOptional ? !staticVal : staticVal;
-            } else {
-              throw new SchemaError("@required/@optional can only be set to true/false if using a static value");
-            }
-          } else if (requiredDecoratorVal instanceof ParsedEnvSpecFunctionCall) {
-            this._isRequiredDynamic = true;
-            const requiredFnName = requiredDecoratorVal.name;
-            const requiredFnArgs = requiredDecoratorVal.simplifiedArgs;
-            if (requiredFnName === "forEnv") {
-              const currentEnv = def.source.envFlagValue;
-              if (!currentEnv) {
-                throw new SchemaError("Cannot set @required using forEnv() because environment flag is not set");
-              }
-              const envMatches = requiredFnArgs.includes(currentEnv);
-              this._isRequired = usingOptional ? !envMatches : envMatches;
-            }
+        const requiredDecs = def.itemDef.decorators?.filter((d) => d.name === "required" || d.name === "optional") || [];
+        const requiredDec = requiredDecs[0];
+        if (requiredDec) {
+          const usingOptional = requiredDec.name === "optional";
+          this._isRequiredDynamic = requiredDec.decValueResolver ? requiredDec.decValueResolver.staticValue === void 0 : false;
+          const requiredDecoratorVal = await requiredDec.resolve();
+          if (!my_dash_default.isBoolean(requiredDecoratorVal)) {
+            throw new SchemaError("@required/@optional must resolve to a boolean");
           }
+          this._isRequired = usingOptional ? !requiredDecoratorVal : requiredDecoratorVal;
           return;
         }
-        const defaultRequiredValue = def.source.getRootDecoratorSimpleValue("defaultRequired");
-        if (defaultRequiredValue !== void 0) {
-          if (defaultRequiredValue === "infer") {
-            if (def.source.type === "schema") {
-              const resolver = def.itemDef.resolver;
-              if (resolver === void 0) {
-                this._isRequired = false;
-              } else if (resolver instanceof StaticValueResolver) {
-                this._isRequired = resolver.staticValue !== void 0 && resolver.staticValue !== "";
+        const defaultRequiredDec = def.source.getRootDec("defaultRequired");
+        if (defaultRequiredDec) {
+          const defaultRequiredVal = await defaultRequiredDec.resolve();
+          if (my_dash_default.isBoolean(defaultRequiredVal)) {
+            this._isRequired = defaultRequiredVal;
+            return;
+          } else if (defaultRequiredVal === "infer") {
+            if (def.itemDef.resolver) {
+              if (def.itemDef.resolver instanceof StaticValueResolver) {
+                this._isRequired = def.itemDef.resolver.staticValue !== void 0 && def.itemDef.resolver.staticValue !== "";
               } else {
                 this._isRequired = true;
               }
-              return;
             } else {
-              continue;
+              this._isRequired = false;
             }
+            return;
+          } else {
+            throw new SchemaError('@defaultRequired must resolve to a boolean or "infer"');
           }
-          this._isRequired = defaultRequiredValue;
-          return;
         }
       }
     } catch (err) {
-      this.schemaErrors.push(err instanceof SchemaError ? err : new SchemaError(err));
+      this._schemaErrors.push(err instanceof SchemaError ? err : new SchemaError(err));
     }
   }
   get isRequired() {
@@ -2266,31 +2928,51 @@ var ConfigItem4 = class {
   get isRequiredDynamic() {
     return this._isRequiredDynamic;
   }
+  _isSensitive = true;
   get isSensitive() {
+    return this._isSensitive;
+  }
+  async processSensitive() {
+    const sensitiveFromDataType = this.dataType?.isSensitive;
     for (const def of this.defs) {
-      const defDecorators = def.itemDef.decorators || {};
-      if ("sensitive" in defDecorators) {
-        return defDecorators.sensitive.simplifiedValue;
+      const sensitiveDec = def.itemDef.decorators?.find((d) => d.name === "sensitive");
+      if (sensitiveDec) {
+        const sensitiveDecValue = await sensitiveDec.resolve();
+        if (sensitiveDecValue !== void 0) {
+          this._isSensitive = sensitiveDecValue;
+          return;
+        }
       }
-      const defaultSensitiveDec = def.source.getRootDecorators("defaultSensitive")[0];
+      if (sensitiveFromDataType !== void 0) continue;
+      const defaultSensitiveDec = def.source.getRootDec("defaultSensitive");
       if (defaultSensitiveDec) {
-        if (defaultSensitiveDec.value instanceof ParsedEnvSpecFunctionCall && defaultSensitiveDec.value.name === "inferFromPrefix") {
-          const args = defaultSensitiveDec.value.simplifiedArgs;
-          const prefix = Array.isArray(args) && args.length > 0 ? args[0] : void 0;
-          if (typeof prefix === "string" && this.key.startsWith(prefix)) {
-            return false;
+        if (!defaultSensitiveDec.decValueResolver) throw new Error("expected defaultSensitive to have a value resolver");
+        if (defaultSensitiveDec.decValueResolver.fnName === "inferFromPrefix") {
+          const prefix = defaultSensitiveDec.decValueResolver.arrArgs[0].staticValue;
+          if (!my_dash_default.isString(prefix)) {
+            this._schemaErrors.push(new SchemaError("@defaultSensitive inferFromPrefix() requires a single string argument"));
+            return;
+          }
+          this._isSensitive = !this.key.startsWith(prefix);
+          return;
+        } else {
+          const defaultSensitiveVal = await defaultSensitiveDec.resolve();
+          if (!my_dash_default.isBoolean(defaultSensitiveVal)) {
+            this._schemaErrors.push(new SchemaError("@defaultSensitive must resolve to a boolean value"));
+          } else {
+            this._isSensitive = defaultSensitiveVal;
+            return;
           }
-          return true;
         }
-        return defaultSensitiveDec.simplifiedValue;
       }
     }
-    return true;
+    if (sensitiveFromDataType !== void 0) this._isSensitive = sensitiveFromDataType;
   }
   get errors() {
     return my_dash_default.compact([
-      ...this.schemaErrors || [],
+      ...this._schemaErrors || [],
       ...this.resolverSchemaErrors || [],
+      ...this.decoratorSchemaErrors || [],
       this.resolutionError,
       this.coercionError,
       ...this.validationErrors || []
@@ -2314,7 +2996,7 @@ var ConfigItem4 = class {
     return this.resolvedRawValue !== this.resolvedValue;
   }
   async resolve(reset2 = false) {
-    if (this.schemaErrors.length) return;
+    if (this._schemaErrors.length) return;
     if (this.resolverSchemaErrors.length) return;
     if (reset2) {
       this.isResolved = false;
@@ -2328,6 +3010,9 @@ var ConfigItem4 = class {
     if (this.isResolved) {
       return;
     }
+    await this.resolveDecorators();
+    await this.processRequired();
+    await this.processSensitive();
     if (!this.valueResolver) {
       this.isResolved = true;
       this.resolvedRawValue = void 0;
@@ -2335,8 +3020,12 @@ var ConfigItem4 = class {
       try {
         this.resolvedRawValue = await this.valueResolver.resolve();
       } catch (err) {
-        this.resolutionError = new ResolutionError(`error resolving value: ${err}`);
-        this.resolutionError.cause = err;
+        if (err instanceof ResolutionError) {
+          this.resolutionError = err;
+        } else {
+          this.resolutionError = new ResolutionError(`error resolving value: ${err}`);
+          this.resolutionError.cause = err;
+        }
       }
     }
     if (this.resolvedRawValue instanceof RegExp) {
@@ -2369,7 +3058,7 @@ var ConfigItem4 = class {
       return;
     }
     try {
-      const validateResult = this.dataType.validate(this.resolvedValue);
+      const validateResult = await this.dataType.validate(this.resolvedValue);
       if (validateResult instanceof Error || my_dash_default.isArray(validateResult) && validateResult[0] instanceof Error) throw validateResult;
       if (validateResult === false) {
         throw new ValidationError("validation failed with `false` return value");
@@ -2396,6 +3085,342 @@ var ConfigItem4 = class {
     return this.validationState === "valid";
   }
 };
+var importedPluginModulePaths = /* @__PURE__ */ new Set();
+var VarlockPlugin = class {
+  static {
+    __name(this, "VarlockPlugin");
+  }
+  // helper so end user code can get same error classes
+  ERRORS = {
+    ValidationError,
+    CoercionError,
+    SchemaError,
+    ResolutionError
+  };
+  _packageJson;
+  _name;
+  get name() {
+    return this._packageJson?.name || this._name || "unnamed plugin";
+  }
+  set name(val) {
+    this._name = val;
+  }
+  _version;
+  get version() {
+    return this._packageJson?.version || this._version || "0.0.0";
+  }
+  set version(val) {
+    this._version = val;
+  }
+  _icon;
+  get icon() {
+    return this._icon || "mdi:puzzle";
+  }
+  set icon(val) {
+    this._icon = val;
+  }
+  loadingError;
+  localPath;
+  /** reference to the `@plugin()` decorator instance(s) that installed the plugin  */
+  installDecoratorInstances = [];
+  type;
+  constructor(opts) {
+    this.type = opts.type;
+    this.localPath = opts?.localPath;
+    this._packageJson = opts?.packageJson;
+  }
+  // awkwardly using get here to make sure we bind the debug function to this
+  // which lets us destructure it in plugin code
+  debugger;
+  get debug() {
+    return (...args) => {
+      if (!this.debugger) {
+        if (!this.name) throw new Error("expected plugin name to be set before using debug");
+        this.debugger = Debug(`varlock:plugin:${this.name}`);
+      }
+      return this.debugger(...args);
+    };
+  }
+  dataTypes = [];
+  registerDataType(dataTypeDef) {
+    this.debug("registerDataType", dataTypeDef.name);
+    this.dataTypes.push(dataTypeDef);
+  }
+  rootDecorators = [];
+  registerRootDecorator(decoratorDef) {
+    this.debug("registerRootDecorator", decoratorDef.name);
+    this.rootDecorators.push(decoratorDef);
+  }
+  itemDecorators = [];
+  registerItemDecorator(decoratorDef) {
+    this.debug("registerItemDecorator", decoratorDef.name);
+    this.itemDecorators.push(decoratorDef);
+  }
+  resolverFunctions = [];
+  registerResolverFunction(resolverDef) {
+    this.debug("registerResolverFunction", resolverDef.name);
+    this.resolverFunctions.push(resolverDef);
+  }
+  get pluginFilePath() {
+    if (this.type === "single-file") return this.localPath;
+    const pluginExport = this._packageJson?.exports?.["./plugin"] || "";
+    if (!pluginExport) throw new Error("Plugin package.json is missing ./plugin export");
+    return path2.join(this.localPath, pluginExport);
+  }
+  async executePluginModule() {
+    globalThis.plugin = this;
+    try {
+      if (!await pathExists(this.pluginFilePath)) throw new Error(`Plugin file not found: ${this.pluginFilePath}`);
+      importedPluginModulePaths.add(this.pluginFilePath);
+      await import(this.pluginFilePath);
+    } catch (err) {
+      this.loadingError = err;
+    }
+    delete globalThis.plugin;
+  }
+};
+async function initPluginFromLocalPath(localPath) {
+  const stats = await fs2.stat(localPath);
+  if (stats.isFile()) {
+    const ext = path2.extname(localPath).toLowerCase();
+    if ([".js", ".cjs", ".mjs"].includes(ext) === false) {
+      throw new SchemaError(`Single-file plugin must be a .js, .cjs, or .mjs file: ${localPath}`);
+    }
+    return new VarlockPlugin({
+      type: "single-file",
+      localPath
+    });
+  } else if (stats.isDirectory()) {
+    const pkgJsonPath = path2.join(localPath, "package.json");
+    if (!await pathExists(pkgJsonPath)) {
+      throw new SchemaError("Plugin is missing package.json file");
+    }
+    const packageJsonContents = JSON.parse(await fs2.readFile(pkgJsonPath, "utf-8"));
+    if (!packageJsonContents.exports?.["./plugin"]) {
+      throw new SchemaError('Plugin is missing "./plugin" export in package.json');
+    }
+    return new VarlockPlugin({
+      type: "package",
+      localPath,
+      packageJson: packageJsonContents
+    });
+  } else {
+    throw new Error(`Invalid plugin path (not a file or directory): ${localPath}`);
+  }
+}
+__name(initPluginFromLocalPath, "initPluginFromLocalPath");
+async function registerPluginInGraph(graph, plugin, pluginDecorator) {
+  let existingPlugin;
+  for (const possibleMatchingPlugin of graph.plugins) {
+    if (plugin.type === "single-file") {
+      if (possibleMatchingPlugin.type === "single-file" && possibleMatchingPlugin.localPath === plugin.localPath) {
+        existingPlugin = possibleMatchingPlugin;
+      }
+    } else if (plugin.type === "package") {
+      if (possibleMatchingPlugin.name === plugin.name) {
+        if (possibleMatchingPlugin.version === plugin.version) {
+          const installedInSources = possibleMatchingPlugin.installDecoratorInstances.map((dec) => dec.dataSource);
+          if (installedInSources.includes(pluginDecorator.dataSource)) {
+            pluginDecorator._schemaErrors.push(new SchemaError(`Plugin ${plugin.name} already installed in this data source`));
+            return;
+          }
+          existingPlugin = possibleMatchingPlugin;
+        } else {
+          pluginDecorator._schemaErrors.push(new SchemaError(`Plugin ${plugin.name} version conflict: tried to install version ${plugin.version} but version ${possibleMatchingPlugin.version} is already installed`));
+          return;
+        }
+      }
+    }
+  }
+  if (existingPlugin) {
+    existingPlugin.installDecoratorInstances.push(pluginDecorator);
+    return;
+  }
+  plugin.installDecoratorInstances.push(pluginDecorator);
+  graph.plugins.push(plugin);
+  await plugin.executePluginModule();
+  for (const rootDec of plugin.rootDecorators || []) {
+    graph.registerRootDecorator(rootDec);
+  }
+  for (const itemDec of plugin.itemDecorators || []) {
+    graph.registerItemDecorator(itemDec);
+  }
+  for (const dataType of plugin.dataTypes || []) {
+    graph.registerDataType(createEnvGraphDataType(dataType));
+  }
+  for (const resolverDef of plugin.resolverFunctions || []) {
+    graph.registerResolver(createResolver(resolverDef));
+  }
+}
+__name(registerPluginInGraph, "registerPluginInGraph");
+async function downloadPlugin(url) {
+  const exec3 = promisify(exec);
+  const cacheDir = path2.join(os.homedir(), ".varlock", "plugins-cache");
+  const indexPath = path2.join(cacheDir, "index.json");
+  await fs2.mkdir(cacheDir, { recursive: true });
+  let index = {};
+  try {
+    const indexRaw = await fs2.readFile(indexPath, "utf-8");
+    index = JSON.parse(indexRaw);
+  } catch {
+  }
+  if (index[url]) {
+    const pluginDir = path2.join(cacheDir, index[url]);
+    if (await fs2.stat(pluginDir).then(() => true, () => false)) {
+      return pluginDir;
+    }
+  }
+  const tmpTgz = path2.join(cacheDir, `tmp-${crypto.randomBytes(8).toString("hex")}.tgz`);
+  await new Promise((resolve, reject) => {
+    const file = fs.createWriteStream(tmpTgz);
+    https.get(url, (res) => {
+      if (res.statusCode !== 200) {
+        reject(new Error(`Failed to download plugin: ${res.statusCode}`));
+        return;
+      }
+      res.pipe(file);
+      file.on("finish", () => file.close(() => resolve()));
+      file.on("error", reject);
+    }).on("error", reject);
+  });
+  const tmpExtractDir = path2.join(cacheDir, `tmp-extract-${crypto.randomBytes(8).toString("hex")}`);
+  await fs2.mkdir(tmpExtractDir);
+  await exec3(`tar -xzf ${tmpTgz} -C ${tmpExtractDir}`);
+  let pkgJsonPath = path2.join(tmpExtractDir, "package", "package.json");
+  let pluginRoot = path2.join(tmpExtractDir, "package");
+  if (!await fs2.stat(pkgJsonPath).then(() => true, () => false)) {
+    pkgJsonPath = path2.join(tmpExtractDir, "package.json");
+    pluginRoot = tmpExtractDir;
+    if (!await fs2.stat(pkgJsonPath).then(() => true, () => false)) {
+      throw new Error("package.json not found in plugin tgz");
+    }
+  }
+  const pkgJson = JSON.parse(await fs2.readFile(pkgJsonPath, "utf-8"));
+  const safePackageName = (pkgJson.name || "").replaceAll("/", "-").replaceAll("@", "");
+  const dirName = `${safePackageName}_${pkgJson.version || ""}_${crypto.randomBytes(4).toString("hex")}`;
+  const finalDir = path2.join(cacheDir, dirName);
+  await fs2.rm(finalDir, { recursive: true, force: true });
+  await fs2.rename(pluginRoot, finalDir);
+  await fs2.rm(tmpTgz, { force: true });
+  await fs2.rm(tmpExtractDir, { recursive: true, force: true });
+  index[url] = dirName;
+  await fs2.writeFile(indexPath, JSON.stringify(index, null, 2));
+  return finalDir;
+}
+__name(downloadPlugin, "downloadPlugin");
+async function processPluginInstallDecorators(dataSource) {
+  const graph = dataSource.graph;
+  if (!graph) throw new Error("Data source not attached to graph");
+  const installPluginDecorators = dataSource.getRootDecFns("plugin");
+  if (installPluginDecorators.length) {
+    if (!(dataSource instanceof FileBasedDataSource)) {
+      dataSource._loadingError = new Error("@plugin can only be used from a file-based data source");
+      return;
+    }
+    const dataSourceDir = path2.dirname(dataSource.fullPath);
+    for (const pluginDecorator of installPluginDecorators) {
+      let pluginSrcPath;
+      try {
+        const installPluginArgs = await pluginDecorator.resolve();
+        const pluginSourceDescriptor = installPluginArgs.arr[0];
+        if (!my_dash_default.isString(pluginSourceDescriptor)) {
+          throw new SchemaError("Bad @plugin - must provide a string source location");
+        }
+        if (pluginSourceDescriptor.startsWith("./") || pluginSourceDescriptor.startsWith("../") || pluginSourceDescriptor.startsWith("/")) {
+          pluginSrcPath = pluginSourceDescriptor.startsWith("/") ? pluginSourceDescriptor : path2.resolve(dataSourceDir, pluginSourceDescriptor);
+          if (!await pathExists(pluginSrcPath)) {
+            throw new SchemaError(`Bad @plugin path: ${pluginSourceDescriptor}`);
+          }
+        } else if (pluginSourceDescriptor.includes(":")) {
+          const protocol = pluginSourceDescriptor.split(":")[0];
+          if (["https", "npm", "jsr", "git"].includes(protocol)) {
+            throw new SchemaError(`@plugin source protocol "${protocol}" is not yet supported`);
+          } else {
+            throw new SchemaError(`Bad @plugin source protocol: ${protocol}`);
+          }
+        } else {
+          const atLocation = pluginSourceDescriptor.indexOf("@", 1);
+          let versionDescriptor;
+          let moduleName;
+          if (atLocation === -1) {
+            moduleName = pluginSourceDescriptor;
+          } else {
+            moduleName = pluginSourceDescriptor.slice(0, atLocation);
+            versionDescriptor = pluginSourceDescriptor.slice(atLocation + 1);
+          }
+          if (!moduleName.startsWith("@varlock/")) {
+            throw new SchemaError(`Plugin "${moduleName}" blocked - only official @varlock/* plugins are supported for now, third-party plugins will be supported in future releases`);
+          }
+          const semverRange = semver.validRange(versionDescriptor);
+          if (versionDescriptor && !semverRange) {
+            throw new SchemaError(`Bad @plugin version descriptor: ${versionDescriptor}`);
+          } else if (semverRange === "*") {
+            throw new SchemaError(`Version descriptor "${versionDescriptor}" is too broad`);
+          } else if (versionDescriptor === "") {
+            throw new SchemaError('Bad @plugin version descriptor - remove "@" or specify a valid version');
+          }
+          let currentDir = dataSourceDir;
+          let nodeModulesPath;
+          while (currentDir) {
+            if (await pathExists(path2.join(currentDir, "package.json"))) {
+              nodeModulesPath = path2.join(currentDir, "node_modules");
+              break;
+            }
+            const parentDir = path2.dirname(currentDir);
+            if (parentDir === currentDir) break;
+            currentDir = parentDir;
+          }
+          if (nodeModulesPath) {
+            const pluginPackagePath = path2.join(nodeModulesPath, moduleName);
+            if (await pathExists(pluginPackagePath)) {
+              const pluginPackageJsonPath = path2.join(pluginPackagePath, "package.json");
+              const packageJsonString = await fs2.readFile(pluginPackageJsonPath, "utf-8");
+              const packageJson = JSON.parse(packageJsonString);
+              const packageVersion = packageJson.version;
+              if (versionDescriptor && !semver.satisfies(packageVersion, versionDescriptor)) {
+                throw new SchemaError(`Installed plugin "${moduleName}" version "${packageVersion}" does not satisfy requested version "${versionDescriptor}"`, {
+                  location: getErrorLocation(dataSource, pluginDecorator)
+                });
+              }
+              pluginSrcPath = pluginPackagePath;
+            }
+          }
+          if (!pluginSrcPath) {
+            if (!versionDescriptor) {
+              if (nodeModulesPath) {
+                throw new SchemaError(`Plugin "${moduleName}" unable to resolve - install locally via your package.json file`);
+              } else {
+                throw new SchemaError(`Plugin "${moduleName}" unable to resolve - set a fixed version (e.g., \`@plugin(${moduleName}@1.2.3)\`)`);
+              }
+            } else if (!semver.valid(versionDescriptor)) {
+              throw new SchemaError(`Plugin "${moduleName}" must use a fixed version when not installing via package.json (e.g., \`@plugin(${moduleName}@1.2.3)\`)`, {
+                location: getErrorLocation(dataSource, pluginDecorator)
+              });
+            }
+            const npmInfoUrl = `https://registry.npmjs.org/${moduleName}/${versionDescriptor}`;
+            const npmInfoReq = await fetch(npmInfoUrl);
+            if (!npmInfoReq.ok) {
+              throw new Error(`Failed to fetch plugin "${moduleName}@${versionDescriptor}" from npm: ${npmInfoReq.status} ${npmInfoReq.statusText}`);
+            }
+            const npmInfo = await npmInfoReq.json();
+            const tarballUrl = npmInfo?.dist?.tarball;
+            if (!tarballUrl) {
+              throw new Error(`Failed to find tarball URL for plugin "${moduleName}@${versionDescriptor}" from npm`);
+            }
+            const downloadedPluginPath = await downloadPlugin(tarballUrl);
+            pluginSrcPath = downloadedPluginPath;
+          }
+        }
+        const plugin = await initPluginFromLocalPath(pluginSrcPath);
+        await registerPluginInGraph(graph, plugin, pluginDecorator);
+      } catch (err) {
+        pluginDecorator._schemaErrors.push(err);
+        continue;
+      }
+    }
+  }
+}
+__name(processPluginInstallDecorators, "processPluginInstallDecorators");
 
 // env-graph/lib/data-source.ts
 var DATA_SOURCE_TYPES = Object.freeze({
@@ -2416,7 +3441,7 @@ var DATA_SOURCE_TYPES = Object.freeze({
   },
   container: {}
 });
-var EnvGraphDataSource3 = class {
+var EnvGraphDataSource4 = class {
   static {
     __name(this, "EnvGraphDataSource");
   }
@@ -2488,6 +3513,7 @@ var EnvGraphDataSource3 = class {
   async resolveCurrentEnv() {
     const envFlagItem = this.envFlagConfigItem;
     if (envFlagItem) {
+      if (envFlagItem.resolvedValue) return envFlagItem.resolvedValue;
       await envFlagItem.earlyResolve();
       return envFlagItem.resolvedValue;
     }
@@ -2500,52 +3526,67 @@ var EnvGraphDataSource3 = class {
     if (this.loadingError) {
       return;
     }
-    const disableDecorator = this.getRootDecorators("disable")?.[0];
-    if (disableDecorator) {
-      if (disableDecorator.value instanceof ParsedEnvSpecFunctionCall) {
-        if (disableDecorator.value.name === "forEnv") {
-          const disableForEnvs = disableDecorator.value.simplifiedArgs;
-          if (!my_dash_default.isArray(disableForEnvs)) {
-            this._loadingError = new Error("expected disable decorator args to be array");
-            return;
-          }
-          const currentEnv = await this.resolveCurrentEnv();
-          if (disableForEnvs.includes(currentEnv)) {
-            this._disabled = true;
-          }
-        } else {
-          this._loadingError = new Error(`unknown disable decorator function: ${disableDecorator.name}`);
-          return;
-        }
-      } else if (disableDecorator.simplifiedValue) {
-        this._disabled = true;
-      }
-    }
-    if (this.disabled) return;
-    const envFlagDecoratorValue = this.getRootDecoratorSimpleValue("envFlag");
-    if (envFlagDecoratorValue) {
-      if (!this.configItemDefs[envFlagDecoratorValue]) {
-        this._loadingError = new Error(`@envFlag key ${envFlagDecoratorValue} must be an item within this schema`);
+    const disabledDec = this.getRootDec("disable");
+    if (disabledDec) {
+      const disabledVal = await disabledDec.resolve();
+      if (!my_dash_default.isBoolean(disabledVal)) {
+        this._loadingError = new Error("expected @disable to be boolean value");
         return;
       }
-      this.setEnvFlag(envFlagDecoratorValue);
+      this._disabled = disabledVal;
     }
+    if (this.disabled) return;
     for (const itemKey of this.importKeys || my_dash_default.keys(this.configItemDefs)) {
       const itemDef = this.configItemDefs[itemKey];
       if (!itemDef) continue;
-      this.graph.configSchema[itemKey] ??= new ConfigItem4(this.graph, itemKey);
-    }
-    const importDecorators = this.getRootDecorators("import");
-    if (importDecorators.length) {
-      for (const importDecorator of importDecorators) {
-        const importArgs = importDecorator.bareFnArgs?.simplifiedValues;
-        if (!my_dash_default.isArray(importArgs)) {
-          throw new Error("expected @import args to be array");
-        }
-        const importPath = importArgs[0];
-        if (!importPath) throw new Error("@import decorator must have a value");
-        if (!my_dash_default.isString(importPath)) throw new Error("expected @import path to be string");
-        const importKeys = importArgs.slice(1);
+      this.graph.configSchema[itemKey] ??= new ConfigItem(this.graph, itemKey);
+    }
+    const currentEnvDec = this.getRootDec("currentEnv");
+    const envFlagDec = this.getRootDec("envFlag");
+    if (currentEnvDec && envFlagDec) {
+      this._loadingError = new Error("Cannot use both @currentEnv and @envFlag decorators");
+    }
+    let envFlagItemKey;
+    if (currentEnvDec) {
+      await currentEnvDec.process();
+      if (!currentEnvDec.decValueResolver) {
+        throw new Error("No resolver found for @currentEnv decorator");
+      }
+      if (currentEnvDec.decValueResolver.fnName !== "ref") {
+        throw new Error("Expected @currentEnv decorator to be set to direct reference - ie `$APP_ENV`");
+      }
+      const refArgValue = currentEnvDec.decValueResolver.arrArgs?.[0]?.staticValue;
+      if (!refArgValue || !my_dash_default.isString(refArgValue)) {
+        throw new Error("@currentEnv ref must be set to a string");
+      }
+      envFlagItemKey = refArgValue;
+    } else if (envFlagDec) {
+      await envFlagDec.process();
+      if (!envFlagDec.decValueResolver) throw new Error("@envFlag resolver not set");
+      if (!envFlagDec.decValueResolver.staticValue) {
+        throw new Error("Expected @envFlag decorator to be static value");
+      }
+      envFlagItemKey = String(envFlagDec.decValueResolver.staticValue);
+    }
+    if (envFlagItemKey) {
+      if (!this.configItemDefs[envFlagItemKey]) {
+        this._loadingError = new Error(`environment flag "${envFlagItemKey}" must be defined within this schema`);
+        return;
+      }
+      this.setEnvFlag(envFlagItemKey);
+    }
+    const defaultSensitiveDec = this.getRootDec("defaultSensitive");
+    await defaultSensitiveDec?.process();
+    const defaultRequiredDec = this.getRootDec("defaultRequired");
+    await defaultRequiredDec?.process();
+    await processPluginInstallDecorators(this);
+    if (!this.isValid) return;
+    const importDecs = this.getRootDecFns("import");
+    if (importDecs.length) {
+      for (const importDec of importDecs) {
+        const importArgs = await importDec.resolve();
+        const importPath = importArgs.arr[0];
+        const importKeys = importArgs.arr.slice(1);
         if (!importKeys.every(my_dash_default.isString)) {
           throw new Error("expected @import keys to all be strings");
         }
@@ -2576,7 +3617,7 @@ var EnvGraphDataSource3 = class {
               await this.addChild(source, { isImport: true, importKeys });
             }
           } else {
-            const fsStat = await tryCatch(async () => fs2.stat(importPath), (_err) => {
+            const fsStat = await tryCatch(async () => fs2.stat(fullImportPath), (_err) => {
             });
             if (!fsStat) {
               this._loadingError = new Error(`Import path does not exist: ${fullImportPath}`);
@@ -2634,8 +3675,18 @@ var EnvGraphDataSource3 = class {
   get loadingError() {
     return this._loadingError;
   }
+  _schemaErrors = [];
+  get schemaErrors() {
+    return my_dash_default.compact([
+      ...this._schemaErrors,
+      ...this.rootDecorators.flatMap((d) => d.schemaErrors)
+    ]);
+  }
+  get resolutionErrors() {
+    return my_dash_default.compact([...this.rootDecorators.flatMap((d) => d._executionError)]);
+  }
   get isValid() {
-    return !this.loadingError;
+    return !this.loadingError && !this.schemaErrors.length && !this.resolutionErrors.length;
   }
   configItemDefs = {};
   decorators = [];
@@ -2648,18 +3699,15 @@ var EnvGraphDataSource3 = class {
     if (decorators.length > 1) throw new Error(`Multiple ${decName} decorators found`);
     return decorators[0].simplifiedValue;
   }
-};
-var EnvSourceParseError = class extends Error {
-  static {
-    __name(this, "EnvSourceParseError");
+  rootDecorators = [];
+  getRootDec(decName) {
+    return this.rootDecorators.find((d) => d.name === decName && !d.isFunctionCall);
   }
-  location;
-  constructor(message, _location) {
-    super(message);
-    this.location = _location;
+  getRootDecFns(decName) {
+    return this.rootDecorators.filter((d) => d.name === decName && d.isFunctionCall);
   }
 };
-var FileBasedDataSource = class extends EnvGraphDataSource3 {
+var FileBasedDataSource = class extends EnvGraphDataSource4 {
   static {
     __name(this, "FileBasedDataSource");
   }
@@ -2670,8 +3718,9 @@ var FileBasedDataSource = class extends EnvGraphDataSource3 {
   get typeLabel() {
     return this.constructor.format;
   }
+  relativePath;
   get label() {
-    return this.fileName;
+    return this.relativePath;
   }
   static format = "unknown";
   // no abstract static
@@ -2683,6 +3732,7 @@ var FileBasedDataSource = class extends EnvGraphDataSource3 {
     super();
     this.fullPath = fullPath;
     this.fileName = path2.basename(fullPath);
+    this.relativePath = path2.relative(process.cwd(), fullPath);
     if (opts?.overrideContents) {
       this.rawContents = opts.overrideContents;
       this.isGitIgnored = opts.overrideGitIgnored;
@@ -2730,51 +3780,18 @@ var DotEnvFileDataSource = class extends FileBasedDataSource {
   static validFileExtensions = [];
   // no extension for dotenv files!
   parsedFile;
-  convertParserValueToResolvers(value) {
-    if (!this.graph) throw new Error("expected graph to be set");
-    if (value === void 0) {
-      return void 0;
-    } else if (value instanceof ParsedEnvSpecStaticValue) {
-      return new StaticValueResolver(value.unescapedValue);
-    } else if (value instanceof ParsedEnvSpecFunctionCall) {
-      const ResolverFnClass = this.graph.registeredResolverFunctions[value.name];
-      if (!ResolverFnClass) {
-        return new ErrorResolver(new SchemaError(`Unknown resolver function: ${value.name}()`));
-      }
-      const argsFromParser = value.data.args.values;
-      let keyValueArgs;
-      const argsAsResolversArray = [];
-      for (const arg of argsFromParser) {
-        if (arg instanceof ParsedEnvSpecKeyValuePair) {
-          keyValueArgs ??= {};
-          const valResolver = this.convertParserValueToResolvers(arg.value);
-          if (!valResolver) throw new Error("Did not expect to find undefined resolver in key-value arg");
-          keyValueArgs[arg.key] = valResolver;
-        } else {
-          if (keyValueArgs) {
-            return new ErrorResolver(new SchemaError("After switching to key-value function args, cannot switch back"));
-          }
-          const argResolver = this.convertParserValueToResolvers(arg);
-          if (!argResolver) throw new Error("Did not expect to find undefined resolver in array arg");
-          argsAsResolversArray.push(argResolver);
-        }
-      }
-      if (keyValueArgs) argsAsResolversArray.push(keyValueArgs);
-      return new ResolverFnClass(argsAsResolversArray);
-    } else {
-      throw new Error("Unknown value type");
-    }
-  }
   async _parseContents() {
     const rawContents = this.rawContents;
     this.parsedFile = await tryCatch(
       () => parseEnvSpecDotEnvFile(rawContents),
       (error) => {
-        this._loadingError = new EnvSourceParseError(error.message, {
-          path: this.fullPath,
-          lineNumber: error.location.start.line,
-          colNumber: error.location.start.column,
-          lineStr: rawContents.split("\n")[error.location.start.line - 1]
+        this._loadingError = new ParseError(`Parse error: ${error.message}`, {
+          location: {
+            id: this.fullPath,
+            lineNumber: error.location.start.line,
+            colNumber: error.location.start.column,
+            lineStr: rawContents.split("\n")[error.location.start.line - 1]
+          }
         });
         this._loadingError.cause = error;
       }
@@ -2782,18 +3799,17 @@ var DotEnvFileDataSource = class extends FileBasedDataSource {
     if (this.loadingError) return;
     if (!this.parsedFile) throw new Error("Failed to parse .env file");
     if (!this.graph) throw new Error("expected graph to be set");
-    this.decorators = this.parsedFile.decoratorsArray;
+    this.rootDecorators = this.parsedFile.decoratorsArray.map((d) => new RootDecoratorInstance(this, d));
     for (const item of this.parsedFile.configItems) {
-      item.processExpansion();
       this.configItemDefs[item.key] = {
-        resolver: this.convertParserValueToResolvers(item.expandedValue),
         description: item.description,
-        decorators: item.decoratorsObject
+        parsedValue: item.value,
+        parsedDecorators: item.decoratorsArray
       };
     }
   }
 };
-var DirectoryDataSource = class extends EnvGraphDataSource3 {
+var DirectoryDataSource = class extends EnvGraphDataSource4 {
   constructor(basePath) {
     super();
     this.basePath = basePath;
@@ -2807,9 +3823,6 @@ var DirectoryDataSource = class extends EnvGraphDataSource3 {
     return `directory - ${this.basePath}`;
   }
   schemaDataSource;
-  get loadingError() {
-    return this._loadingError || this.schemaDataSource?.loadingError;
-  }
   async addAutoLoadedFile(fileName) {
     if (!this.graph) throw new Error("expected graph to be set");
     const filePath = path2.join(this.basePath, fileName);
@@ -2953,100 +3966,8 @@ function getItemSummary(item) {
   return summary.join("\n");
 }
 __name(getItemSummary, "getItemSummary");
-var asyncCallbacks = /* @__PURE__ */ new Set();
-var callbacks = /* @__PURE__ */ new Set();
-var isCalled = false;
-var isRegistered = false;
-async function exit(shouldManuallyExit, isSynchronous, signal) {
-  if (isCalled) {
-    return;
-  }
-  isCalled = true;
-  if (asyncCallbacks.size > 0 && isSynchronous) {
-    console.error([
-      "SYNCHRONOUS TERMINATION NOTICE:",
-      "When explicitly exiting the process via process.exit or via a parent process,",
-      "asynchronous tasks in your exitHooks will not run. Either remove these tasks,",
-      "use gracefulExit() instead of process.exit(), or ensure your parent process",
-      "sends a SIGINT to the process running this code."
-    ].join(" "));
-  }
-  const exitCode = 128 + signal;
-  const done = /* @__PURE__ */ __name((force = false) => {
-    if (force === true || shouldManuallyExit === true) {
-      process2.exit(exitCode);
-    }
-  }, "done");
-  for (const callback of callbacks) {
-    callback(exitCode);
-  }
-  if (isSynchronous) {
-    done();
-    return;
-  }
-  const promises = [];
-  let forceAfter = 0;
-  for (const [callback, wait] of asyncCallbacks) {
-    forceAfter = Math.max(forceAfter, wait);
-    promises.push(Promise.resolve(callback(exitCode)));
-  }
-  const asyncTimer = setTimeout(() => {
-    done(true);
-  }, forceAfter);
-  await Promise.all(promises);
-  clearTimeout(asyncTimer);
-  done();
-}
-__name(exit, "exit");
-function addHook(options) {
-  const { onExit, wait, isSynchronous } = options;
-  const asyncCallbackConfig = [onExit, wait];
-  if (isSynchronous) {
-    callbacks.add(onExit);
-  } else {
-    asyncCallbacks.add(asyncCallbackConfig);
-  }
-  if (!isRegistered) {
-    isRegistered = true;
-    process2.once("beforeExit", exit.bind(void 0, true, false, -128));
-    process2.once("SIGINT", exit.bind(void 0, true, false, 2));
-    process2.once("SIGTERM", exit.bind(void 0, true, false, 15));
-    process2.once("exit", exit.bind(void 0, false, true, 0));
-    process2.on("message", (message) => {
-      if (message === "shutdown") {
-        exit(true, true, -128);
-      }
-    });
-  }
-  return () => {
-    if (isSynchronous) {
-      callbacks.delete(onExit);
-    } else {
-      asyncCallbacks.delete(asyncCallbackConfig);
-    }
-  };
-}
-__name(addHook, "addHook");
-function asyncExitHook(onExit, options = {}) {
-  if (typeof onExit !== "function") {
-    throw new TypeError("onExit must be a function");
-  }
-  if (!(typeof options.wait === "number" && options.wait > 0)) {
-    throw new TypeError("wait must be set to a positive numeric value");
-  }
-  return addHook({
-    onExit,
-    wait: options.wait,
-    isSynchronous: false
-  });
-}
-__name(asyncExitHook, "asyncExitHook");
-function gracefulExit(signal = 0) {
-  exit(true, false, -128 + signal);
-}
-__name(gracefulExit, "gracefulExit");
 //! these are probably not relevant anymore, or needs to move to a plugin layer?
 
-export { CoercionError, ConfigLoadError, DotEnvFileDataSource, EnvGraph2 as EnvGraph, EnvSourceParseError, FileBasedDataSource, ResolutionError, SchemaError, ValidationError, ansis_default, asyncExitHook, checkIsFileGitIgnored, getItemSummary, gracefulExit, joinAndCompact, loadEnvGraph, my_dash_default, pathExists, pathExistsSync, tryCatch };
-//# sourceMappingURL=chunk-FCVBOYES.js.map
-//# sourceMappingURL=chunk-FCVBOYES.js.map
+export { CoercionError, ConfigLoadError, DotEnvFileDataSource, EnvGraph2 as EnvGraph, FileBasedDataSource, ResolutionError, SchemaError, ValidationError, VarlockError, ansis_default, asyncExitHook, checkIsFileGitIgnored, getItemSummary, gracefulExit, joinAndCompact, loadEnvGraph, my_dash_default, pathExists, pathExistsSync, tryCatch };
+//# sourceMappingURL=chunk-MLIGQWID.js.map
+//# sourceMappingURL=chunk-MLIGQWID.js.map