varlock 0.1.0 → 0.1.1

package/dist/auto-load.js

@@ -1,9 +1,9 @@
-import './chunk-NMJ5YL5I.js';
-import './chunk-OM3JCP4E.js';
-import './chunk-7JMYT62X.js';
+import './chunk-5NNVZXCM.js';
+import './chunk-7FI2PPMC.js';
+import './chunk-WDC67GVB.js';
 import './chunk-QT5E2RY6.js';
-import './chunk-C5BEZMSO.js';
-import './chunk-2SPIWTVE.js';
+import './chunk-RWBSXJV6.js';
+import './chunk-2JGPOSVQ.js';
 import './chunk-FGMXIEFA.js';
 import './chunk-XN24GZXQ.js';
 //# sourceMappingURL=auto-load.js.map

package/dist/{chunk-2SPIWTVE.js → chunk-2JGPOSVQ.js}

@@ -200,5 +200,5 @@ var EnvProxy = new Proxy({}, {
 var ENV = EnvProxy;
 
 export { ENV, debug, initVarlockEnv, redactSensitiveConfig, resetRedactionMap, revealSensitiveConfig, scanForLeaks, varlockSettings };
-//# sourceMappingURL=chunk-2SPIWTVE.js.map
-//# sourceMappingURL=chunk-2SPIWTVE.js.map
+//# sourceMappingURL=chunk-2JGPOSVQ.js.map
+//# sourceMappingURL=chunk-2JGPOSVQ.js.map

package/dist/chunk-2JGPOSVQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/detect-runtime.ts","../src/runtime/lib/debug.ts","../src/runtime/env.ts"],"names":[],"mappings":";;;;AAO+B,OAAO,OAAA,KAAY,WAAA,IAC7C,QAAQ,QAAA,IAAY,IAAA,IACpB,OAAA,CAAQ,QAAA,CAAS,IAAA,IAAQ;AAOG,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,SAAS,QAAA,IAC5E,OAAO,SAAA,KAAc,WAAA,IACpB,WAAA,IAAe,SAAA,IACf,OAAO,SAAA,CAAU,SAAA,KAAc,QAAA,KAC9B,SAAA,CAAU,SAAA,CAAU,QAAA,CAAS,SAAS,CAAA,IACrC,SAAA,CAAU,SAAA,CAAU,QAAA,CAAS,OAAO,CAAA;AAEd,OAAO,IAAA,KAAS,WAAA,IAC1C,OAAO,IAAA,CAAK,OAAA,KAAY,WAAA,IACxB,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,KAAS;AAGb,OAAO,OAAA,KAAY,WAAA,IAAe,QAAQ,QAAA,IAAY,IAAA,IAAQ,OAAA,CAAQ,QAAA,CAAS,GAAA,IAAO;AAIpG,IAAM,YAAY,OAAO,MAAA,KAAW,eACtC,OAAO,MAAA,CAAO,aAAa,WAAA,IAC3B,OAAO,MAAA,CAAO,QAAA,CAAS,kBAAkB,UAAA,IACzC,OAAO,cAAc,WAAA,IACrB,OAAO,UAAU,SAAA,KAAc,QAAA;;;ACnC7B,SAAS,SAAS,IAAA,EAAkB;AACzC,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe;AAChC,EAAA,OAAA,CAAQ,GAAA,CAAI,GAAG,IAAI,CAAA;AACrB;AAHgB,MAAA,CAAA,KAAA,EAAA,OAAA,CAAA;;;ACUhB,SAAS,SAAS,CAAA,EAAQ;AACxB,EAAA,OAAO,MAAA,CAAO,SAAA,CAAU,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,iBAAA;AAC/C;AAFS,MAAA,CAAA,QAAA,EAAA,UAAA,CAAA;AAIT,IAAM,UAAA,GAAa,WAAA;AAInB,IAAI,sBAAyE,EAAC;AAG9E,IAAI,mBAAA;AAEG,SAAS,kBAAkB,KAAA,EAA2B;AAE3D,EAAA,mBAAA,GAAsB,EAAC;AACvB,EAAA,KAAA,MAAW,OAAA,IAAW,MAAM,MAAA,EAAQ;AAClC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA;AACjC,IAAA,IAAI,KAAK,WAAA,IAAe,IAAA,CAAK,SAAS,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,EAAG;AAE1D,MAAA,MAAM,QAAA,GAAW,YAAA,CAAa,IAAA,CAAK,KAAK,CAAA;AACxC,MAAA,IAAI,QAAA,sBAA8B,IAAA,CAAK,KAAK,IAAI,EAAE,GAAA,EAAK,SAAS,QAAA,EAAS;AAAA,IAC3E;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,mBAAmB,EAAE,MAAA,EAAQ;AAC5C,IAAA,mBAAA,GAAsB,MAAA;AACtB,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,YAAY,IAAI,MAAA;AAAA,IACpB;AAAA,MACE,IAAI,UAAU,CAAA,GAAA,CAAA;AAAA,MACd,GAAA;AAAA,MACA,MAAA,CAAO,KAAK,mBAAmB,CAAA,CAE5B,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,OAAA,CAAQ,2BAAA,EAA6B,MAAM,CAAC,CAAA,CAEzD,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,SAAS,CAAA,CAAE,MAAM,CAAA,CAClC,IAAA,CAAK,GAAG,CAAA;AAAA,MACX,GAAA;AAAA,MACA,KAAK,UAAU,CAAA,EAAA;AAAA,KACjB,CAAE,KAAK,EAAE,CAAA;AAAA,IACT;AAAA,GACF;AAEA,EAAA,MAAM,SAAA,mBAAuB,MAAA,CAAA,CAAC,KAAA,EAAO,GAAA,EAAK,KAAK,IAAA,KAAS;AAGtD,IAAA,IAAI,GAAA,IAAO,MAAM,OAAO,KAAA;AACxB,IAAA,OAAO,mBAAA,CAAoB,GAAG,CAAA,CAAE,QAAA;AAAA,EAClC,CAAA,EAL6B,WAAA,CAAA;AAM7B,EAAA,mBAAA,GAAsB,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAS,SAAA,EAAU;AAC9D;AAzCgB,MAAA,CAAA,iBAAA,EAAA,mBAAA,CAAA;AAqDT,SAAS,sBAAsB,CAAA,EAAa;AACjD,EAAA,IAAI,CAAC,qBAAqB,OAAO,CAAA;AACjC,EAAA,IAAI,CAAC,GAAG,OAAO,CAAA;AAKf,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,EAAG;AACpB,IAAA,OAAO,CAAA,CAAE,IAAI,qBAAqB,CAAA;AAAA,EACpC;AAEA,EAAA,IAAI,CAAA,IAAK,OAAQ,CAAA,KAAO,QAAA,IAAY,OAAO,cAAA,CAAe,CAAC,CAAA,KAAM,MAAA,CAAO,SAAA,EAAW;AACjF,IAAA,IAAI;AACF,MAAA,OAAO,KAAK,KAAA,CAAM,qBAAA,CAAsB,KAAK,SAAA,CAAU,CAAC,CAAC,CAAC,CAAA;AAAA,IAC5D,SAAS,GAAA,EAAK;AACZ,MAAA,OAAO,CAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,OAAO,OAAO,CAAA;AACpB,EAAA,IAAI,IAAA,KAAS,QAAA,IAAa,IAAA,KAAS,QAAA,IAAY,MAAA,CAAO,UAAU,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,iBAAA,EAAoB;AACvG,IAAA,OAAQ,CAAA,CAAa,UAAA,CAAW,mBAAA,CAAoB,IAAA,EAAM,oBAAoB,OAAO,CAAA;AAAA,EACvF;AAEA,EAAA,OAAO,CAAA;AACT;AAzBgB,MAAA,CAAA,qBAAA,EAAA,uBAAA,CAAA;AA+BT,SAAS,sBAAsB,SAAA,EAAmB;AAEvD,EAAA,IAAI,CAAE,UAAA,CAAmB,4BAAA,EAA8B,OAAO,SAAA;AAE9D,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,SAAS,IAAI,UAAU,CAAA,CAAA;AACjD;AALgB,MAAA,CAAA,qBAAA,EAAA,uBAAA,CAAA;AAYT,SAAS,YAAA,CACd,QAEA,IAAA,EAIA;AACA,EAAA,KAAA,CAAM,yCAA+B,CAAA;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,MAAA;AAEpB,EAAA,SAAS,gBAAgB,SAAA,EAAmB;AAI1C,IAAA,KAAA,MAAW,kBAAkB,mBAAA,EAAqB;AAChD,MAAA,IAAI,SAAA,CAAU,QAAA,CAAS,cAAc,CAAA,EAAG;AACtC,QAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,cAAc,CAAA,CAAE,GAAA;AAKpD,QAAA,OAAA,CAAQ,KAAA,CAAM;AAAA,UACZ,EAAA;AAAA,UACA,aAAM,kCAAkC,CAAA,UAAA,CAAA;AAAA,UACxC,sBAAsB,OAAO,CAAA,CAAA;AAAA,UAC7B,GAAG,MAAM,MAAA,GAAS,CAAC,kBAAkB,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA,GAAI,EAAC;AAAA,UACvD,GAAG,MAAM,IAAA,GAAO,CAAC,WAAW,IAAA,CAAK,IAAI,CAAA,CAAE,CAAA,GAAI,EAAC;AAAA,UAC5C;AAAA,SACF,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAEZ,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6CAAA,EAAyC,OAAO,CAAA,CAAE,CAAA;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAvBS,EAAA,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA;AA0BT,EAAA,IAAI,QAAA,CAAS,MAAM,CAAA,EAAG;AACpB,IAAA,eAAA,CAAgB,MAAgB,CAAA;AAChC,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,MAAA,IAAW,kBAAkB,MAAA,EAAQ;AACnC,IAAA,eAAA,CAAgB,MAAA,CAAO,UAAU,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EAET,CAAA,MAAA,IAAW,kBAAkB,cAAA,EAAgB;AAC3C,IAAA,IAAI,OAAO,MAAA,EAAQ;AAEjB,MAAA,OAAO,MAAA;AAAA,IACT;AAGA,IAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY;AACrC,IAAA,OAAO,MAAA,CAAO,WAAA;AAAA,MACZ,IAAI,eAAA,CAAgB;AAAA,QAClB,SAAA,CAAU,OAAO,UAAA,EAAY;AAC3B,UAAA,MAAM,QAAA,GAAW,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AAC1C,UAAA,eAAA,CAAgB,QAAQ,CAAA;AACxB,UAAA,UAAA,CAAW,QAAQ,KAAK,CAAA;AAAA,QAC1B;AAAA,OACD;AAAA,KACH;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAhEgB,MAAA,CAAA,YAAA,EAAA,cAAA,CAAA;AAyEhB,IAAI,cAAA,GAAiB,KAAA;AACrB,IAAM,YAAY,EAAC;AACZ,IAAM,kBAAkB;AAE/B,IAAM,aAAA,GAAgB,CAAC,CAAC,UAAA,CAAW,OAAA;AACnC,IAAM,kBAAA,GAAqB,EAAE,GAAG,aAAA,IAAiB,QAAQ,GAAA,EAAI;AAC7D,IAAI,6BAAA;AAEG,SAAS,eAAe,IAAA,EAE5B;AACD,EAAA,KAAA,CAAM,gCAAA,EAAwB,cAAA,EAAgB,CAAC,CAAE,UAAA,CAAmB,kBAAA,EAAoB,aAAA,IAAiB,CAAC,CAAC,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AAEpI,EAAA,IAAI,SAAA,EAAW;AACb,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,iBAAA;AAEJ,EAAA,IAAK,WAAmB,kBAAA,EAAoB;AAC1C,IAAA,iBAAA,GAAqB,UAAA,CAAmB,kBAAA;AAAA,EAG1C,CAAA,MAAA,IAAW,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe;AACrD,IAAA,iBAAA,GAAoB,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AAAA,EAC1D,CAAA,MAAO;AACL,IAAA,IAAI,MAAM,SAAA,EAAW;AAErB,IAAA,OAAA,CAAQ,KAAA,CAAM;AAAA,MACZ,EAAA;AAAA,MACA,4CAAA;AAAA,MACA,8CAAA;AAAA,MACA;AAAA,KACF,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AACZ,IAAA,MAAM,IAAI,MAAM,uBAAuB,CAAA;AAAA,EACzC;AACA,EAAA,MAAA,CAAO,MAAA,CAAO,eAAA,EAAiB,iBAAA,CAAkB,QAAQ,CAAA;AACzD,EAAA,iBAAA,CAAkB,iBAAiB,CAAA;AAEnC,EAAA,MAAM,aAAA,GAAgB,aAAA;AAGtB,EAAA,IAAI,aAAA,EAAe;AACjB,IAAA,IAAI,6BAAA,EAA+B;AACjC,MAAA,KAAA,MAAW,GAAA,IAAO,6BAAA,EAA+B,OAAO,OAAA,CAAQ,IAAI,GAAG,CAAA;AACvE,MAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,kBAAkB,CAAA,UAAW,GAAA,CAAI,GAAG,CAAA,GAAI,kBAAA,CAAmB,GAAG,CAAA;AAAA,IAC9F;AACA,IAAA,6BAAA,GAAgC,EAAC;AAAA,EACnC;AAEA,EAAA,KAAA,MAAW,OAAA,IAAW,kBAAkB,MAAA,EAAQ;AAC9C,IAAA,MAAM,SAAA,GAAY,iBAAA,CAAkB,MAAA,CAAO,OAAO,CAAA,CAAE,KAAA;AACpD,IAAA,SAAA,CAAU,OAAO,CAAA,GAAI,SAAA;AACrB,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,6BAAA,EAA+B,KAAK,OAAO,CAAA;AAG3C,MAAA,OAAA,CAAQ,IAAI,OAAO,CAAA,GAAI,cAAc,MAAA,GAAY,EAAA,GAAK,OAAO,SAAS,CAAA;AAAA,IACxE;AAAA,EACF;AACA,EAAA,cAAA,GAAiB,IAAA;AACnB;AAtDgB,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AA0DhB,IAAI;AACF,EAAA,IAAI,CAAC,cAAA,EAAgB;AAGnB,IAAA,cAAA,CAAe,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAAA,EACpC;AACF,CAAA,CAAA,OAAS,GAAA,EAAK;AAGd;AAQA,IAAM,kBAAA,GAAqB;AAAA;AAAA,EAEzB;AACF,CAAA;AAUA,IAAM,QAAA,GAAW,IAAI,KAAA,CAAsB,EAAC,EAAG;AAAA,EAC7C,GAAA,CAAI,QAAQ,IAAA,EAAM;AAEhB,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAE9B,IAAA,IAAI,kBAAA,CAAmB,QAAA,CAAS,IAAI,CAAA,EAAG;AAEvC,IAAA,IAAI,CAAC,SAAA,IAAa,CAAC,cAAA,EAAgB;AACjC,MAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,IAC/C;AAEA,IAAA,IAAI,IAAA,IAAQ,SAAA,EAAW,OAAO,SAAA,CAAU,IAAI,CAAA;AAC5C,IAAA,IAAK,WAAmB,2BAAA,EAA6B;AAEnD,MAAA,IAAK,WAAmB,kBAAA,IAAuB,UAAA,CAAmB,kBAAA,CAAmB,QAAA,CAAS,IAAI,CAAA,EAAG;AACnG,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,IAAI,CAAA,mDAAA,CAAqD,CAAA;AAAA,MACpF,CAAA,MAAO;AACL,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,IAAI,CAAA,iBAAA,CAAmB,CAAA;AAAA,MAClD;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACF,CAAC,CAAA;AAEM,IAAM,GAAA,GAAM","file":"chunk-2JGPOSVQ.js","sourcesContent":["declare const Deno: any;\ndeclare const navigator: any;\ndeclare const window: any;\ndeclare const self: any;\n// declare const process: any;\n\n\nexport const isNode: boolean = typeof process !== 'undefined'\n  && process.versions != null\n  && process.versions.node != null;\n\nexport const isWebWorker: boolean = typeof self === 'object'\n  && self.constructor\n  && self.constructor.name === 'DedicatedWorkerGlobalScope';\n\n// https://github.com/jsdom/jsdom/issues/1537#issuecomment-229405327\nexport const isJsDom: boolean = (typeof window !== 'undefined' && window.name === 'nodejs')\n  || (typeof navigator !== 'undefined'\n    && 'userAgent' in navigator\n    && typeof navigator.userAgent === 'string'\n    && (navigator.userAgent.includes('Node.js')\n      || navigator.userAgent.includes('jsdom')));\n\nexport const isDeno: boolean = typeof Deno !== 'undefined'\n  && typeof Deno.version !== 'undefined'\n  && typeof Deno.version.deno !== 'undefined';\n\n/** @see {@link https://bun.sh/guides/util/detect-bun} */\nexport const isBun = typeof process !== 'undefined' && process.versions != null && process.versions.bun != null;\n\n\n\nexport const isBrowser = typeof window !== 'undefined'\n  && typeof window.document !== 'undefined'\n  && typeof window.document.createElement === 'function'\n  && typeof navigator !== 'undefined'\n  && typeof navigator.userAgent === 'string';\n","/* eslint-disable no-console */\nexport function debug(...args: Array<any>) {\n  if (!process.env.DEBUG_VARLOCK) return;\n  console.log(...args);\n}\n","import { redactString } from './lib/redaction';\n\nimport type { SerializedEnvGraph } from '../env-graph';\nimport { isBrowser } from '../lib/detect-runtime';\nimport { debug } from './lib/debug';\n\n// TODO: would like to move all of the redaction utils out of this file\n// but its complicated since it is imported by code that may be run in the backend and frontend\n// but the patching code (which only runs in the backend) use these helper functions\n\n// this does not cover all cases, but serves our needs so far for Next.js\nfunction isString(s: any) {\n  return Object.prototype.toString.call(s) === '[object String]';\n}\n\nconst UNMASK_STR = '👁';\n\n\n/** key value lookup of sensitive values to their redacted version */\nlet sensitiveSecretsMap: Record<string, { key: string, redacted: string }> = {};\n\ntype ReplaceFn = (match: string, pre: string, val: string, post: string) => string;\nlet redactorFindReplace: undefined | { find: RegExp, replace: ReplaceFn };\n\nexport function resetRedactionMap(graph: SerializedEnvGraph) {\n  // reset map of { [sensitive] => redacted }\n  sensitiveSecretsMap = {};\n  for (const itemKey in graph.config) {\n    const item = graph.config[itemKey];\n    if (item.isSensitive && item.value && isString(item.value)) {\n      // TODO: we want to respect masking settings from the schema (once added)\n      const redacted = redactString(item.value);\n      if (redacted) sensitiveSecretsMap[item.value] = { key: itemKey, redacted };\n    }\n  }\n  // if no sensitive items exist, we dont need to do any redaction, but the redact fn is checking for undefined\n  if (!Object.keys(sensitiveSecretsMap).length) {\n    redactorFindReplace = undefined;\n    return;\n  }\n\n  // reset find/replace regex+fn used for redacting secrets in strings\n  const findRegex = new RegExp(\n    [\n      `(${UNMASK_STR} )?`,\n      '(',\n      Object.keys(sensitiveSecretsMap)\n        // Escape special characters\n        .map((s) => s.replace(/[()[\\]{}*+?^$|#.,/\\\\\\s-]/g, '\\\\$&'))\n        // Sort for maximal munch\n        .sort((a, b) => b.length - a.length)\n        .join('|'),\n      ')',\n      `( ${UNMASK_STR})?`,\n    ].join(''),\n    'g',\n  );\n\n  const replaceFn: ReplaceFn = (match, pre, val, post) => {\n    // the pre and post matches only will be populated if they were present\n    // and they are used to unmask the secret - so we do not want to replace in this case\n    if (pre && post) return match;\n    return sensitiveSecretsMap[val].redacted;\n  };\n  redactorFindReplace = { find: findRegex, replace: replaceFn };\n}\n\n\n// While the module itself acts as a singleton to hold the current map of redacted values\n// we expose only the below const to end users\n\n\n/**\n * Redacts senstive config values from any string/array/object/etc\n *\n * NOTE - must be used only after varlock has loaded config\n * */\nexport function redactSensitiveConfig(o: any): any {\n  if (!redactorFindReplace) return o;\n  if (!o) return o;\n\n  // TODO: handle more cases?\n  // we can probably redact safely from a few other datatypes - like set,map,etc?\n  // objects are a bit tougher\n  if (Array.isArray(o)) {\n    return o.map(redactSensitiveConfig);\n  }\n  // try to redact if it's a plain object - not necessarily great for perf...\n  if (o && typeof (o) === 'object' && Object.getPrototypeOf(o) === Object.prototype) {\n    try {\n      return JSON.parse(redactSensitiveConfig(JSON.stringify(o)));\n    } catch (err) {\n      return o;\n    }\n  }\n\n  const type = typeof o;\n  if (type === 'string' || (type === 'object' && Object.prototype.toString.call(o) === '[object String]')) {\n    return (o as string).replaceAll(redactorFindReplace.find, redactorFindReplace.replace);\n  }\n\n  return o;\n}\n\n/**\n * utility to unmask a secret/sensitive value when logging to the console\n * currently this only works on a single secret, not objects or aggregated strings\n * */\nexport function revealSensitiveConfig(secretStr: string) {\n  // if redaction not enabled, we just return the secret itself\n  if (!(globalThis as any)._varlockOrigWriteToConsoleFn) return secretStr;\n  // otherwise we add some wrapper characters which will be removed by the patched console behaviour\n  return `${UNMASK_STR} ${secretStr} ${UNMASK_STR}`;\n}\n\n\n\n\n\n// reusable leak scanning helper function, used by various integrations\nexport function scanForLeaks(\n  toScan: string | ReadableStream | null,\n  // optional additional information about what is being scanned to be used in error messages\n  meta?: {\n    method?: string,\n    file?: string,\n  },\n) {\n  debug('⚡️ varlock scanning for leaks');\n  if (!toScan) return toScan;\n\n  function scanStrForLeaks(strToScan: string) {\n    // console.log('[varlock leak scanner] ', strToScan.substr(0, 100));\n\n    // TODO: probably should use a single regex\n    for (const sensitiveValue in sensitiveSecretsMap) {\n      if (strToScan.includes(sensitiveValue)) {\n        const itemKey = sensitiveSecretsMap[sensitiveValue].key;\n\n        // error stack can gets awkwardly buried since we're so deep in the internals\n        // so we'll write a nicer error message to help the user debug\n        // eslint-disable-next-line no-console\n        console.error([\n          '',\n          `🚨 ${'DETECTED LEAKED SENSITIVE CONFIG'} 🚨`,\n          `> Config item key: ${itemKey}`,\n          ...meta?.method ? [`> Scan method: ${meta.method}`] : [],\n          ...meta?.file ? [`> File: ${meta.file}`] : [],\n          '',\n        ].join('\\n'));\n\n        throw new Error(`🚨 DETECTED LEAKED SENSITIVE CONFIG - ${itemKey}`);\n      }\n    }\n  }\n\n  // scan a string\n  if (isString(toScan)) {\n    scanStrForLeaks(toScan as string);\n    return toScan;\n  } else if (toScan instanceof Buffer) {\n    scanStrForLeaks(toScan.toString());\n    return toScan;\n  // scan a ReadableStream by piping it through a scanner\n  } else if (toScan instanceof ReadableStream) {\n    if (toScan.locked) {\n      // console.log('> stream already locked');\n      return toScan;\n    } else {\n      // console.log('> stream will be scanned!');\n    }\n    const chunkDecoder = new TextDecoder();\n    return toScan.pipeThrough(\n      new TransformStream({\n        transform(chunk, controller) {\n          const chunkStr = chunkDecoder.decode(chunk);\n          scanStrForLeaks(chunkStr);\n          controller.enqueue(chunk);\n        },\n      }),\n    );\n  }\n  // other things may be passed in like Buffer... but we'll ignore for now\n  return toScan;\n}\n\n// -----------\n\n\n\n\n// --------------\n\nlet initializedEnv = false;\nconst envValues = {} as Record<string, any>;\nexport const varlockSettings = {} as Record<string, any>;\n\nconst processExists = !!globalThis.process;\nconst originalProcessEnv = { ...processExists && process.env };\nlet varlockInjectedProcessEnvKeys: Array<string> | undefined;\n\nexport function initVarlockEnv(opts?: {\n  allowFail?: boolean,\n}) {\n  debug('⚡️ INIT VARLOCK ENV!', initializedEnv, !!(globalThis as any).__varlockLoadedEnv, processExists && !!process.env.__VARLOCK_ENV);\n\n  if (isBrowser) {\n    return;\n  }\n\n\n  let serializedEnvData: SerializedEnvGraph;\n  // when we inject resolved config at build time, we store it here\n  if ((globalThis as any).__varlockLoadedEnv) {\n    serializedEnvData = (globalThis as any).__varlockLoadedEnv;\n\n  // otherwise if we inject via `varlock run` or have already loaded, it will be in process.env\n  } else if (processExists && process.env.__VARLOCK_ENV) {\n    serializedEnvData = JSON.parse(process.env.__VARLOCK_ENV);\n  } else {\n    if (opts?.allowFail) return;\n    // eslint-disable-next-line no-console\n    console.error([\n      '',\n      '🚨 initVarlockEnv failed  🚨',\n      'try rerunning your command via `varlock run`',\n      '',\n    ].join('\\n'));\n    throw new Error('initVarlockEnv failed');\n  }\n  Object.assign(varlockSettings, serializedEnvData.settings);\n  resetRedactionMap(serializedEnvData);\n\n  const setProcessEnv = processExists;\n\n  // if we've already injected process.env vars in the past, we'll reset those now\n  if (setProcessEnv) {\n    if (varlockInjectedProcessEnvKeys) {\n      for (const key of varlockInjectedProcessEnvKeys) delete process.env[key];\n      for (const key of Object.keys(originalProcessEnv)) process.env[key] = originalProcessEnv[key];\n    }\n    varlockInjectedProcessEnvKeys = [];\n  }\n\n  for (const itemKey in serializedEnvData.config) {\n    const itemValue = serializedEnvData.config[itemKey].value;\n    envValues[itemKey] = itemValue;\n    if (setProcessEnv) {\n      varlockInjectedProcessEnvKeys?.push(itemKey);\n      // when re-injecting into process.env, we treat undefined as empty string\n      // this more closely matches expected behaviour from other .env loaders\n      process.env[itemKey] = itemValue === undefined ? '' : String(itemValue);\n    }\n  }\n  initializedEnv = true;\n}\n\n// we will attempt to call initVarlockEnv automatically, but in most cases it should be called explicitly\n// note that if this is being imported in the browser, process.env may not exist, so we do this in a try/catch\ntry {\n  if (!initializedEnv) {\n    // if we are automatically loading because __VARLOCK_ENV is already set\n    // then we assume process.env vars have also already been set (although might not harm anything?)\n    initVarlockEnv({ allowFail: true });\n  }\n} catch (err) {\n  // expected that this will fail when process.env does not exist\n  // but we may want to look for specific errors\n}\n\n\n\n// some object keys are checked by various tools when handling arbitrary data, especially in templates\n// because our proxy objects throw errors when unknown keys are accessed, this causes problems\n// for now we can just filter out a these keys and it should be fairly harmless\n// TODO: ideally this could be customized by the user, and not specific to vue\nconst IGNORED_PROXY_KEYS = [\n  // vue - see https://github.com/vuejs/core/blob/70773d00985135a50556c61fb9855ed6b930cb82/packages/reactivity/src/ref.ts#L101\n  '__v_isRef',\n];\n\n\n// this gets exported and then augmented by our type generation\n// ideally we'd start with a loose type `Record<string,any>` and then override it with the actual schema\n// so that if type generation was disabled, a user could still use `ENV`\n// but TS wont let us, so instead we start with it being empty, which will cause type errors\n// unless type generation is enabled\nexport interface TypedEnvSchema {}\n\nconst EnvProxy = new Proxy<TypedEnvSchema>({}, {\n  get(target, prop) {\n    // ignore symbols, as it likely an external tool checking something\n    if (typeof prop === 'symbol') return;\n    // special cases to avoid throwing on invalid keys\n    if (IGNORED_PROXY_KEYS.includes(prop)) return;\n\n    if (!isBrowser && !initializedEnv) {\n      throw new Error('varlock ENV not initialized');\n    }\n\n    if (prop in envValues) return envValues[prop];\n    if ((globalThis as any).__varlockThrowOnMissingKeys) {\n      // during development, we can feed in extra metadata and show more helpful errors\n      if ((globalThis as any).__varlockValidKeys && (globalThis as any).__varlockValidKeys.includes(prop)) {\n        throw new Error(`\\`ENV.${prop}\\` exists, but is not available in this environment`);\n      } else {\n        throw new Error(`\\`ENV.${prop}\\` does not exist`);\n      }\n    }\n    return undefined;\n  },\n});\n\nexport const ENV = EnvProxy;\n"]}

package/dist/{chunk-LIIRL4NK.js → chunk-2VZORH2Y.js}

@@ -1,6 +1,6 @@
-import { CliExitError, fmt } from './chunk-DTNPJJH4.js';
+import { CliExitError, fmt } from './chunk-IBAUYNXV.js';
 import { define } from './chunk-33ROL4J5.js';
-import { gracefulExit } from './chunk-MLIGQWID.js';
+import { gracefulExit } from './chunk-7UWLKQXP.js';
 import { __name } from './chunk-XN24GZXQ.js';
 import { homedir } from 'os';
 import { join } from 'path';
@@ -50,5 +50,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 
 export { commandFn, commandSpec };
-//# sourceMappingURL=chunk-LIIRL4NK.js.map
-//# sourceMappingURL=chunk-LIIRL4NK.js.map
+//# sourceMappingURL=chunk-2VZORH2Y.js.map
+//# sourceMappingURL=chunk-2VZORH2Y.js.map

package/dist/{chunk-LIIRL4NK.js.map → chunk-2VZORH2Y.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/telemetry.command.ts"],"names":[],"mappings":";;;;;;;;;AAWO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,WAAA;AAAA,EACN,WAAA,EAAa,0CAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa;AAAA;AACf;AAEJ,CAAC;AAEM,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAEhF,EAAA,IAAI,CAAC,CAAC,QAAA,EAAU,SAAS,EAAE,QAAA,CAAS,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA,EAAG;AACpD,IAAA,MAAM,IAAI,aAAa,8CAAA,EAAgD;AAAA,MACrE,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,EAAQ,EAAG,UAAU,CAAA;AAC5C,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,EAAW,aAAa,CAAA;AAEhD,EAAA,IAAI;AAEF,IAAA,IAAI,CAAC,UAAA,CAAW,SAAS,CAAA,EAAG;AAC1B,MAAA,MAAM,KAAA,CAAM,SAAA,EAAW,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,IAC5C;AAGA,IAAA,IAAI,SAA8B,EAAC;AACnC,IAAA,IAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AAC1B,MAAA,MAAM,aAAA,GAAgB,MAAM,QAAA,CAAS,UAAA,EAAY,OAAO,CAAA;AACxD,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,aAAa,CAAA;AAAA,IACnC;AAGA,IAAA,IAAI,GAAA,CAAI,MAAA,CAAO,IAAA,KAAS,SAAA,SAAkB,iBAAA,GAAoB,IAAA;AAAA,gBAClD,MAAA,CAAO,iBAAA;AACnB,IAAA,MAAM,UAAU,UAAA,EAAY,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA;AAE3D,IAAA,IAAI,GAAA,CAAI,OAAO,IAAA,EAAM;AACnB,MAAA,OAAA,CAAQ,IAAI,uDAAkD,CAAA;AAAA,IAChE,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,IAAI,wDAAmD,CAAA;AAAA,IACjE;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,GAAA,CAAI,QAAA,CAAS,UAAU,CAAC,CAAA;AAAA,EACrD,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,mCAAmC,KAAK,CAAA;AACtD,IAAA,OAAO,aAAa,CAAC,CAAA;AAAA,EACvB;AACF,CAAA,EAvCmE,WAAA","file":"chunk-LIIRL4NK.js","sourcesContent":["import { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { mkdir, writeFile, readFile } from 'node:fs/promises';\nimport { existsSync } from 'node:fs';\nimport { define } from 'gunshi';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { gracefulExit } from 'exit-hook';\nimport { fmt } from '../helpers/pretty-format';\nimport { CliExitError } from '../helpers/exit-error';\n\n\nexport const commandSpec = define({\n  name: 'telemetry',\n  description: 'Enable/disable anonymous usage analytics',\n  args: {\n    mode: {\n      type: 'positional',\n      description: '\"enable\" or \"disable\"',\n    },\n  },\n});\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  // TODO: remove this when gunshi supports types/validation for positional args\n  if (!['enable', 'disable'].includes(ctx.values.mode)) {\n    throw new CliExitError('additional arg must be \"enable\" or \"disable\"', {\n      forceExit: true,\n    });\n  }\n\n  const configDir = join(homedir(), '.varlock');\n  const configPath = join(configDir, 'config.json');\n\n  try {\n    // Create .varlock directory if it doesn't exist\n    if (!existsSync(configDir)) {\n      await mkdir(configDir, { recursive: true });\n    }\n\n    // Read existing config if it exists\n    let config: Record<string, any> = {};\n    if (existsSync(configPath)) {\n      const configContent = await readFile(configPath, 'utf-8');\n      config = JSON.parse(configContent);\n    }\n\n    // update config `telemetryDisabled` setting\n    if (ctx.values.mode === 'disable') config.telemetryDisabled = true;\n    else delete config.telemetryDisabled;\n    await writeFile(configPath, JSON.stringify(config, null, 2));\n\n    if (ctx.values.mode) {\n      console.log('✅ Successfully enabled anonymous usage analytics');\n    } else {\n      console.log('✅ Successfully disabled anonymous usage analytics');\n    }\n    console.log('> saved in:', fmt.filePath(configPath));\n  } catch (error) {\n    console.error('Failed to opt out of analytics:', error);\n    return gracefulExit(1);\n  }\n};\n"]}
+{"version":3,"sources":["../src/cli/commands/telemetry.command.ts"],"names":[],"mappings":";;;;;;;;;AAWO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,WAAA;AAAA,EACN,WAAA,EAAa,0CAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa;AAAA;AACf;AAEJ,CAAC;AAEM,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAEhF,EAAA,IAAI,CAAC,CAAC,QAAA,EAAU,SAAS,EAAE,QAAA,CAAS,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA,EAAG;AACpD,IAAA,MAAM,IAAI,aAAa,8CAAA,EAAgD;AAAA,MACrE,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,EAAQ,EAAG,UAAU,CAAA;AAC5C,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,EAAW,aAAa,CAAA;AAEhD,EAAA,IAAI;AAEF,IAAA,IAAI,CAAC,UAAA,CAAW,SAAS,CAAA,EAAG;AAC1B,MAAA,MAAM,KAAA,CAAM,SAAA,EAAW,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,IAC5C;AAGA,IAAA,IAAI,SAA8B,EAAC;AACnC,IAAA,IAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AAC1B,MAAA,MAAM,aAAA,GAAgB,MAAM,QAAA,CAAS,UAAA,EAAY,OAAO,CAAA;AACxD,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,aAAa,CAAA;AAAA,IACnC;AAGA,IAAA,IAAI,GAAA,CAAI,MAAA,CAAO,IAAA,KAAS,SAAA,SAAkB,iBAAA,GAAoB,IAAA;AAAA,gBAClD,MAAA,CAAO,iBAAA;AACnB,IAAA,MAAM,UAAU,UAAA,EAAY,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA;AAE3D,IAAA,IAAI,GAAA,CAAI,OAAO,IAAA,EAAM;AACnB,MAAA,OAAA,CAAQ,IAAI,uDAAkD,CAAA;AAAA,IAChE,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,IAAI,wDAAmD,CAAA;AAAA,IACjE;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,GAAA,CAAI,QAAA,CAAS,UAAU,CAAC,CAAA;AAAA,EACrD,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,mCAAmC,KAAK,CAAA;AACtD,IAAA,OAAO,aAAa,CAAC,CAAA;AAAA,EACvB;AACF,CAAA,EAvCmE,WAAA","file":"chunk-2VZORH2Y.js","sourcesContent":["import { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { mkdir, writeFile, readFile } from 'node:fs/promises';\nimport { existsSync } from 'node:fs';\nimport { define } from 'gunshi';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { gracefulExit } from 'exit-hook';\nimport { fmt } from '../helpers/pretty-format';\nimport { CliExitError } from '../helpers/exit-error';\n\n\nexport const commandSpec = define({\n  name: 'telemetry',\n  description: 'Enable/disable anonymous usage analytics',\n  args: {\n    mode: {\n      type: 'positional',\n      description: '\"enable\" or \"disable\"',\n    },\n  },\n});\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  // TODO: remove this when gunshi supports types/validation for positional args\n  if (!['enable', 'disable'].includes(ctx.values.mode)) {\n    throw new CliExitError('additional arg must be \"enable\" or \"disable\"', {\n      forceExit: true,\n    });\n  }\n\n  const configDir = join(homedir(), '.varlock');\n  const configPath = join(configDir, 'config.json');\n\n  try {\n    // Create .varlock directory if it doesn't exist\n    if (!existsSync(configDir)) {\n      await mkdir(configDir, { recursive: true });\n    }\n\n    // Read existing config if it exists\n    let config: Record<string, any> = {};\n    if (existsSync(configPath)) {\n      const configContent = await readFile(configPath, 'utf-8');\n      config = JSON.parse(configContent);\n    }\n\n    // update config `telemetryDisabled` setting\n    if (ctx.values.mode === 'disable') config.telemetryDisabled = true;\n    else delete config.telemetryDisabled;\n    await writeFile(configPath, JSON.stringify(config, null, 2));\n\n    if (ctx.values.mode) {\n      console.log('✅ Successfully enabled anonymous usage analytics');\n    } else {\n      console.log('✅ Successfully disabled anonymous usage analytics');\n    }\n    console.log('> saved in:', fmt.filePath(configPath));\n  } catch (error) {\n    console.error('Failed to opt out of analytics:', error);\n    return gracefulExit(1);\n  }\n};\n"]}

package/dist/{chunk-NMJ5YL5I.js → chunk-5NNVZXCM.js}

@@ -1,8 +1,8 @@
-import { patchGlobalResponse } from './chunk-OM3JCP4E.js';
-import { patchGlobalServerResponse } from './chunk-7JMYT62X.js';
+import { patchGlobalResponse } from './chunk-7FI2PPMC.js';
+import { patchGlobalServerResponse } from './chunk-WDC67GVB.js';
 import { execSyncVarlock } from './chunk-QT5E2RY6.js';
-import { patchGlobalConsole } from './chunk-C5BEZMSO.js';
-import { initVarlockEnv } from './chunk-2SPIWTVE.js';
+import { patchGlobalConsole } from './chunk-RWBSXJV6.js';
+import { initVarlockEnv } from './chunk-2JGPOSVQ.js';
 
 // src/auto-load.ts
 var execResult = execSyncVarlock("load --format json-full", {
@@ -14,5 +14,5 @@ initVarlockEnv();
 patchGlobalConsole();
 patchGlobalServerResponse();
 patchGlobalResponse();
-//# sourceMappingURL=chunk-NMJ5YL5I.js.map
-//# sourceMappingURL=chunk-NMJ5YL5I.js.map
+//# sourceMappingURL=chunk-5NNVZXCM.js.map
+//# sourceMappingURL=chunk-5NNVZXCM.js.map

package/dist/{chunk-NMJ5YL5I.js.map → chunk-5NNVZXCM.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/auto-load.ts"],"names":[],"mappings":";;;;;;;AAaA,IAAM,UAAA,GAAa,gBAAgB,yBAAA,EAA2B;AAAA,EAC5D,WAAA,EAAa,IAAA;AAAA,EACb,eAAA,EAAiB;AACnB,CAAC,CAAA;AACD,OAAA,CAAQ,IAAI,aAAA,GAAgB,UAAA;AAG5B,cAAA,EAAe;AAEf,kBAAA,EAAmB;AACnB,yBAAA,EAA0B;AAC1B,mBAAA,EAAoB","file":"chunk-NMJ5YL5I.js","sourcesContent":["import { execSyncVarlock } from './lib/exec-sync-varlock';\n\nimport { initVarlockEnv } from './runtime/env';\nimport { patchGlobalConsole } from './runtime/patch-console';\nimport { patchGlobalServerResponse } from './runtime/patch-server-response';\nimport { patchGlobalResponse } from './runtime/patch-response';\n\n// The varlock loading process uses async calls, but we need this to run synchronously.\n// because even with top level await, we run into hoisting issues where things happen out of order\n// so we call out to the CLI using execSync\n// this also isolates the varlock loading process from the end user process\n\n\nconst execResult = execSyncVarlock('load --format json-full', {\n  exitOnError: true,\n  showLogsOnError: true,\n});\nprocess.env.__VARLOCK_ENV = execResult;\n\n// initialize varlock and patch globals as necessary\ninitVarlockEnv();\n// these will be no-ops if these are disabled by settings\npatchGlobalConsole();\npatchGlobalServerResponse();\npatchGlobalResponse();\n\n"]}
+{"version":3,"sources":["../src/auto-load.ts"],"names":[],"mappings":";;;;;;;AAaA,IAAM,UAAA,GAAa,gBAAgB,yBAAA,EAA2B;AAAA,EAC5D,WAAA,EAAa,IAAA;AAAA,EACb,eAAA,EAAiB;AACnB,CAAC,CAAA;AACD,OAAA,CAAQ,IAAI,aAAA,GAAgB,UAAA;AAG5B,cAAA,EAAe;AAEf,kBAAA,EAAmB;AACnB,yBAAA,EAA0B;AAC1B,mBAAA,EAAoB","file":"chunk-5NNVZXCM.js","sourcesContent":["import { execSyncVarlock } from './lib/exec-sync-varlock';\n\nimport { initVarlockEnv } from './runtime/env';\nimport { patchGlobalConsole } from './runtime/patch-console';\nimport { patchGlobalServerResponse } from './runtime/patch-server-response';\nimport { patchGlobalResponse } from './runtime/patch-response';\n\n// The varlock loading process uses async calls, but we need this to run synchronously.\n// because even with top level await, we run into hoisting issues where things happen out of order\n// so we call out to the CLI using execSync\n// this also isolates the varlock loading process from the end user process\n\n\nconst execResult = execSyncVarlock('load --format json-full', {\n  exitOnError: true,\n  showLogsOnError: true,\n});\nprocess.env.__VARLOCK_ENV = execResult;\n\n// initialize varlock and patch globals as necessary\ninitVarlockEnv();\n// these will be no-ops if these are disabled by settings\npatchGlobalConsole();\npatchGlobalServerResponse();\npatchGlobalResponse();\n\n"]}

package/dist/{chunk-OM3JCP4E.js → chunk-7FI2PPMC.js}

@@ -1,4 +1,4 @@
-import { debug, varlockSettings, scanForLeaks } from './chunk-2SPIWTVE.js';
+import { debug, varlockSettings, scanForLeaks } from './chunk-2JGPOSVQ.js';
 import { __name } from './chunk-XN24GZXQ.js';
 
 // src/runtime/patch-response.ts
@@ -34,5 +34,5 @@ function patchGlobalResponse() {
 __name(patchGlobalResponse, "patchGlobalResponse");
 
 export { patchGlobalResponse };
-//# sourceMappingURL=chunk-OM3JCP4E.js.map
-//# sourceMappingURL=chunk-OM3JCP4E.js.map
+//# sourceMappingURL=chunk-7FI2PPMC.js.map
+//# sourceMappingURL=chunk-7FI2PPMC.js.map

package/dist/{chunk-OM3JCP4E.js.map → chunk-7FI2PPMC.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/runtime/patch-response.ts"],"names":[],"mappings":";;;;AAGO,SAAS,mBAAA,GAAsB;AACpC,EAAA,KAAA,CAAM,uCAA6B,CAAA;AACnC,EAAA,IAAK,UAAA,CAAW,SAAiB,iBAAA,EAAmB;AAClD,IAAA,KAAA,CAAM,mBAAmB,CAAA;AACzB,IAAA;AAAA,EACF;AACA,EAAA,IAAI,eAAA,CAAgB,iBAAiB,KAAA,EAAO;AAC1C,IAAA,KAAA,CAAM,wBAAwB,CAAA;AAC9B,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,qBAAqB,UAAA,CAAW,QAAA;AACtC,EAAA,UAAA,CAAW,QAAA,GAAW,MAAM,sBAAA,SAA+B,kBAAA,CAAmB;AAAA,IAfhF;AAegF,MAAA,MAAA,CAAA,IAAA,EAAA,wBAAA,CAAA;AAAA;AAAA,IAC5E,OAAO,iBAAA,GAAoB,IAAA;AAAA,IAC3B,WAAA,CAAY,MAAW,IAAA,EAAW;AAChC,MAAA,KAAA,CAAM,2CAAiC,CAAA;AACvC,MAAA,KAAA,CAAM,aAAa,IAAA,EAAM,EAAE,QAAQ,8BAAA,EAAgC,GAAU,IAAI,CAAA;AAAA,IACnF;AAAA,IACA,OAAO,IAAA,CAAK,IAAA,EAAW,IAAA,EAAW;AAChC,MAAA,KAAA,CAAM,oCAA0B,CAAA;AAChC,MAAA,YAAA,CAAa,KAAK,SAAA,CAAU,IAAI,GAAG,EAAE,MAAA,EAAQ,yBAAyB,CAAA;AACtE,MAAA,MAAM,CAAA,GAAI,kBAAA,CAAmB,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAC5C,MAAA,MAAA,CAAO,cAAA,CAAe,CAAA,EAAG,QAAA,CAAS,SAAS,CAAA;AAC3C,MAAA,OAAO,CAAA;AAAA,IACT;AAAA,GACF;AACF;AA1BgB,MAAA,CAAA,mBAAA,EAAA,qBAAA,CAAA","file":"chunk-OM3JCP4E.js","sourcesContent":["import { scanForLeaks, varlockSettings } from './env';\nimport { debug } from './lib/debug';\n\nexport function patchGlobalResponse() {\n  debug('⚡️ PATCHING global Response');\n  if ((globalThis.Response as any)._patchedByVarlock) {\n    debug('> already patched');\n    return;\n  }\n  if (varlockSettings.preventLeaks === false) {\n    debug('> disabled by settings');\n    return;\n  }\n\n  const _UnpatchedResponse = globalThis.Response;\n  globalThis.Response = class VarlockPatchedResponse extends _UnpatchedResponse {\n    static _patchedByVarlock = true;\n    constructor(body: any, init: any) {\n      debug('⚡️ patched Response constructor');\n      super(scanForLeaks(body, { method: 'patched Response constructor' }) as any, init);\n    }\n    static json(data: any, init: any) {\n      debug('⚡️ patched Response.json');\n      scanForLeaks(JSON.stringify(data), { method: 'patched Response.json' });\n      const r = _UnpatchedResponse.json(data, init);\n      Object.setPrototypeOf(r, Response.prototype);\n      return r;\n    }\n  };\n}\n"]}
+{"version":3,"sources":["../src/runtime/patch-response.ts"],"names":[],"mappings":";;;;AAGO,SAAS,mBAAA,GAAsB;AACpC,EAAA,KAAA,CAAM,uCAA6B,CAAA;AACnC,EAAA,IAAK,UAAA,CAAW,SAAiB,iBAAA,EAAmB;AAClD,IAAA,KAAA,CAAM,mBAAmB,CAAA;AACzB,IAAA;AAAA,EACF;AACA,EAAA,IAAI,eAAA,CAAgB,iBAAiB,KAAA,EAAO;AAC1C,IAAA,KAAA,CAAM,wBAAwB,CAAA;AAC9B,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,qBAAqB,UAAA,CAAW,QAAA;AACtC,EAAA,UAAA,CAAW,QAAA,GAAW,MAAM,sBAAA,SAA+B,kBAAA,CAAmB;AAAA,IAfhF;AAegF,MAAA,MAAA,CAAA,IAAA,EAAA,wBAAA,CAAA;AAAA;AAAA,IAC5E,OAAO,iBAAA,GAAoB,IAAA;AAAA,IAC3B,WAAA,CAAY,MAAW,IAAA,EAAW;AAChC,MAAA,KAAA,CAAM,2CAAiC,CAAA;AACvC,MAAA,KAAA,CAAM,aAAa,IAAA,EAAM,EAAE,QAAQ,8BAAA,EAAgC,GAAU,IAAI,CAAA;AAAA,IACnF;AAAA,IACA,OAAO,IAAA,CAAK,IAAA,EAAW,IAAA,EAAW;AAChC,MAAA,KAAA,CAAM,oCAA0B,CAAA;AAChC,MAAA,YAAA,CAAa,KAAK,SAAA,CAAU,IAAI,GAAG,EAAE,MAAA,EAAQ,yBAAyB,CAAA;AACtE,MAAA,MAAM,CAAA,GAAI,kBAAA,CAAmB,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAC5C,MAAA,MAAA,CAAO,cAAA,CAAe,CAAA,EAAG,QAAA,CAAS,SAAS,CAAA;AAC3C,MAAA,OAAO,CAAA;AAAA,IACT;AAAA,GACF;AACF;AA1BgB,MAAA,CAAA,mBAAA,EAAA,qBAAA,CAAA","file":"chunk-7FI2PPMC.js","sourcesContent":["import { scanForLeaks, varlockSettings } from './env';\nimport { debug } from './lib/debug';\n\nexport function patchGlobalResponse() {\n  debug('⚡️ PATCHING global Response');\n  if ((globalThis.Response as any)._patchedByVarlock) {\n    debug('> already patched');\n    return;\n  }\n  if (varlockSettings.preventLeaks === false) {\n    debug('> disabled by settings');\n    return;\n  }\n\n  const _UnpatchedResponse = globalThis.Response;\n  globalThis.Response = class VarlockPatchedResponse extends _UnpatchedResponse {\n    static _patchedByVarlock = true;\n    constructor(body: any, init: any) {\n      debug('⚡️ patched Response constructor');\n      super(scanForLeaks(body, { method: 'patched Response constructor' }) as any, init);\n    }\n    static json(data: any, init: any) {\n      debug('⚡️ patched Response.json');\n      scanForLeaks(JSON.stringify(data), { method: 'patched Response.json' });\n      const r = _UnpatchedResponse.json(data, init);\n      Object.setPrototypeOf(r, Response.prototype);\n      return r;\n    }\n  };\n}\n"]}

package/dist/{chunk-MLIGQWID.js → chunk-7UWLKQXP.js}

@@ -945,7 +945,7 @@ var _ = {
 };
 var my_dash_default = _;
 
-// env-graph/lib/errors.ts
+// src/env-graph/lib/errors.ts
 var VarlockError = class extends Error {
   constructor(errOrMessage, more) {
     super(my_dash_default.isError(errOrMessage) ? errOrMessage.message : errOrMessage);
@@ -1138,7 +1138,7 @@ function pathExistsSync(p) {
 }
 __name(pathExistsSync, "pathExistsSync");
 
-// env-graph/lib/data-types.ts
+// src/env-graph/lib/data-types.ts
 var EnvGraphDataType = class {
   constructor(def, factory) {
     this.def = def;
@@ -1499,7 +1499,7 @@ var BaseDataTypes = [
   Md5DataType
 ];
 
-// env-graph/lib/simple-queue.ts
+// src/env-graph/lib/simple-queue.ts
 var SimpleQueue = class {
   static {
     __name(this, "SimpleQueue");
@@ -1730,7 +1730,7 @@ var builtInItemDecorators = [
   }
 ];
 
-// env-graph/lib/resolver.ts
+// src/env-graph/lib/resolver.ts
 var execAsync = promisify(exec);
 var Resolver = class {
   constructor(arrArgs, objArgs, dataSource) {
@@ -2233,7 +2233,7 @@ function convertParsedValueToResolvers(value, dataSource, registeredResolvers) {
 }
 __name(convertParsedValueToResolvers, "convertParsedValueToResolvers");
 
-// env-graph/lib/graph-utils.ts
+// src/env-graph/lib/graph-utils.ts
 function findGraphCycles(graph) {
   const visited = /* @__PURE__ */ new Set();
   const recursionStack = /* @__PURE__ */ new Set();
@@ -2416,7 +2416,7 @@ async function generateTypes(graph, lang, typesPath) {
 }
 __name(generateTypes, "generateTypes");
 
-// env-graph/lib/error-location.ts
+// src/env-graph/lib/error-location.ts
 function getErrorLocation(source, parserNode) {
   if (!(source instanceof FileBasedDataSource)) return;
   if (!parserNode.data || !parserNode.data._location || !my_dash_default.isNumber(parserNode.data._location.start.line)) return;
@@ -2431,7 +2431,7 @@ function getErrorLocation(source, parserNode) {
 }
 __name(getErrorLocation, "getErrorLocation");
 
-// env-graph/lib/env-graph.ts
+// src/env-graph/lib/env-graph.ts
 var processExists = !!globalThis.process;
 var originalProcessEnv = { ...processExists && process.env };
 var EnvGraph2 = class {
@@ -2689,7 +2689,7 @@ var EnvGraph2 = class {
   plugins = [];
 };
 
-// env-graph/lib/config-item.ts
+// src/env-graph/lib/config-item.ts
 var ConfigItem = class {
   constructor(envGraph, key) {
     this.envGraph = envGraph;
@@ -3422,7 +3422,7 @@ async function processPluginInstallDecorators(dataSource) {
 }
 __name(processPluginInstallDecorators, "processPluginInstallDecorators");
 
-// env-graph/lib/data-source.ts
+// src/env-graph/lib/data-source.ts
 var DATA_SOURCE_TYPES = Object.freeze({
   schema: {
     fileSuffixes: ["schema"]
@@ -3855,18 +3855,10 @@ var DirectoryDataSource = class extends EnvGraphDataSource4 {
   }
 };
 
-// env-graph/lib/loader.ts
-function autoDetectBasePath() {
-  const PWD = process.env.PWD;
-  if (!PWD) {
-    throw new Error("PWD is not set");
-  }
-  return PWD;
-}
-__name(autoDetectBasePath, "autoDetectBasePath");
+// src/env-graph/lib/loader.ts
 async function loadEnvGraph(opts) {
   const graph = new EnvGraph2();
-  graph.basePath = opts?.basePath ?? autoDetectBasePath();
+  graph.basePath = opts?.basePath ?? process.cwd();
   if (opts?.afterInit) {
     await opts.afterInit(graph);
   }
@@ -3969,5 +3961,5 @@ __name(getItemSummary, "getItemSummary");
 //! these are probably not relevant anymore, or needs to move to a plugin layer?
 
 export { CoercionError, ConfigLoadError, DotEnvFileDataSource, EnvGraph2 as EnvGraph, FileBasedDataSource, ResolutionError, SchemaError, ValidationError, VarlockError, ansis_default, asyncExitHook, checkIsFileGitIgnored, getItemSummary, gracefulExit, joinAndCompact, loadEnvGraph, my_dash_default, pathExists, pathExistsSync, tryCatch };
-//# sourceMappingURL=chunk-MLIGQWID.js.map
-//# sourceMappingURL=chunk-MLIGQWID.js.map
+//# sourceMappingURL=chunk-7UWLKQXP.js.map
+//# sourceMappingURL=chunk-7UWLKQXP.js.map