varlock 0.1.0 → 0.1.2

package/dist/{chunk-7JMYT62X.js → chunk-LP2TZNLG.js}

@@ -1,4 +1,4 @@
-import { debug, varlockSettings, scanForLeaks, redactSensitiveConfig } from './chunk-2SPIWTVE.js';
+import { debug, varlockSettings, scanForLeaks, redactSensitiveConfig } from './chunk-JNQQJ3GM.js';
 import { __name } from './chunk-XN24GZXQ.js';
 import zlib from 'zlib';
 import { ServerResponse } from 'http';
@@ -88,5 +88,5 @@ function patchGlobalServerResponse(opts) {
 __name(patchGlobalServerResponse, "patchGlobalServerResponse");
 
 export { patchGlobalServerResponse };
-//# sourceMappingURL=chunk-7JMYT62X.js.map
-//# sourceMappingURL=chunk-7JMYT62X.js.map
+//# sourceMappingURL=chunk-LP2TZNLG.js.map
+//# sourceMappingURL=chunk-LP2TZNLG.js.map

package/dist/{chunk-7JMYT62X.js.map → chunk-LP2TZNLG.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/runtime/patch-server-response.ts"],"names":[],"mappings":";;;;;AAUA,IAAM,UAAA,GAAa,mBAAA;AACZ,SAAS,0BAA0B,IAAA,EAGvC;AACD,EAAA,KAAA,CAAM,6CAAmC,CAAA;AACzC,EAAA,IAAI,MAAA,CAAO,wBAAA,CAAyB,cAAA,CAAe,SAAA,EAAW,UAAU,CAAA,EAAG;AACzE,IAAA,KAAA,CAAM,mBAAmB,CAAA;AACzB,IAAA;AAAA,EACF;AACA,EAAA,IAAI,eAAA,CAAgB,iBAAiB,KAAA,EAAO;AAC1C,IAAA,KAAA,CAAM,wBAAwB,CAAA;AAC9B,IAAA;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,eAAe,cAAA,CAAe,SAAA,EAAW,YAAY,EAAE,KAAA,EAAO,MAAM,CAAA;AAE3E,EAAA,MAAM,mBAAA,GAAsB,eAAe,SAAA,CAAU,KAAA;AAGrD,EAAA,cAAA,CAAe,SAAA,CAAU,KAAA,mBAAQ,MAAA,CAAA,SAAS,iCAAA,CAAA,GAAqC,IAAA,EAAM;AAGnF,IAAA,MAAM,QAAA,GAAW,KAAK,CAAC,CAAA;AAKvB,IAAA,MAAM,cAAc,IAAA,CAAK,SAAA,CAAU,cAAc,CAAA,EAAG,UAAS,IAAK,EAAA;AAElE,IAAA,IAAI,OAAA,GACF,WAAA,CAAY,UAAA,CAAW,OAAO,CAAA,IAC3B,WAAA,CAAY,UAAA,CAAW,kBAAkB,CAAA,IACxC,CAAC,WAAA,IAAe,OAAO,QAAA,KAAa,QAAA;AAI1C,IAAA,MAAM,MAAA,GAAU,KAAa,GAAA,CAAI,GAAA;AAEjC,IAAA,IAAI,OAAA,IAAW,MAAA,IAAU,IAAA,EAAM,iBAAA,EAAmB,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAC,CAAA,EAAG;AACzF,MAAA,OAAA,GAAU,KAAA;AAAA,IACZ;AAIA,IAAA,IAAI,CAAC,OAAA,EAAS;AAEZ,MAAA,OAAO,mBAAA,CAAoB,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAAA,IAC7C;AAGA,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,SAAA,CAAU,kBAAkB,CAAA;AACzD,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,SAAA,GAAkD,IAAA;AACtD,IAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAChC,MAAA,SAAA,GAAY,QAAA;AACZ,MAAA,QAAA,GAAW,QAAA;AAAA,IACb,CAAA,MAAA,IAAW,CAAC,eAAA,EAAiB;AAC3B,MAAA,SAAA,GAAY,SAAA;AACZ,MAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,MAAA,QAAA,GAAW,OAAA,CAAQ,OAAO,QAAQ,CAAA;AAAA,IACpC,CAAA,MAAA,IAAW,oBAAoB,MAAA,EAAQ;AACrC,MAAA,SAAA,GAAY,MAAA;AAEZ,MAAA,IAAI,CAAE,KAAa,WAAA,EAAa;AAE9B,QAAC,IAAA,CAAa,WAAA,GAAc,CAAC,QAAQ,CAAA;AAAA,MACvC,CAAA,MAAO;AAEL,QAAC,IAAA,CAAa,WAAA,EAAa,IAAA,CAAK,QAAQ,CAAA;AACxC,QAAA,IAAI;AACF,UAAA,MAAM,aAAA,GAAgB,KAAK,SAAA,CAAU,MAAA,CAAO,OAAQ,IAAA,CAAa,WAAA,IAAe,EAAE,CAAA,EAAG;AAAA,YACnF,KAAA,EAAO,KAAK,SAAA,CAAU,YAAA;AAAA,YACtB,WAAA,EAAa,KAAK,SAAA,CAAU;AAAA,WAC7B,CAAA;AACD,UAAA,MAAM,gBAAA,GAAmB,aAAA,CAAc,QAAA,CAAS,OAAO,CAAA;AACvD,UAAA,QAAA,GAAW,gBAAA,CAAiB,SAAA,CAAW,IAAA,CAAa,kBAAA,IAAsB,CAAC,CAAA;AAC3E,UAAC,IAAA,CAAa,qBAAqB,gBAAA,CAAiB,MAAA;AAAA,QACtD,SAAS,GAAA,EAAK;AAAA,QAEd;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,QAAA,EAAU;AAIZ,MAAA,IAAI;AACF,QAAA,YAAA,CAAa,QAAA,EAAU,EAAE,MAAA,EAAQ,8BAAA,EAAgC,MAAO,IAAA,CAAa,GAAA,CAAI,KAAK,CAAA;AAAA,MAChG,SAAS,GAAA,EAAK;AAGZ,QAAA,IAAI,MAAM,oBAAA,EAAsB;AAC9B,UAAA,QAAA,GAAW,sBAAsB,QAAQ,CAAA;AACzC,UAAA,IAAI,cAAc,QAAA,EAAU;AAC1B,YAAA,IAAA,CAAK,CAAC,CAAA,GAAI,QAAA;AAAA,UACZ,CAAA,MAAA,IAAW,cAAc,SAAA,EAAW;AAClC,YAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,YAAA,IAAA,CAAK,CAAC,CAAA,GAAI,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA;AAAA,UACnC,CAAA,MAAA,IAAW,cAAc,MAAA,EAAQ,CAQjC,MAAO;AACL,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qCAAA,EAAwC,SAAS,CAAA,CAAE,CAAA;AAAA,UACrE;AAAA,QACF,CAAA,MAAO;AACL,UAAA,MAAM,GAAA;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,IAAA,OAAO,mBAAA,CAAoB,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EAC7C,CAAA,EAnGiC,mCAAA,CAAA;AAsGjC,EAAA,MAAM,iBAAA,GAAoB,eAAe,SAAA,CAAU,GAAA;AAEnD,EAAA,cAAA,CAAe,SAAA,CAAU,GAAA,mBAAM,MAAA,CAAA,SAAS,wBAAA,CAAA,GAA4B,IAAA,EAAM;AAExE,IAAA,MAAM,QAAA,GAAW,KAAK,CAAC,CAAA;AAEvB,IAAA,IAAI,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAE5C,MAAA,YAAA,CAAa,QAAA,EAAU,EAAE,MAAA,EAAQ,4BAAA,EAA8B,CAAA;AAAA,IACjE;AAEA,IAAA,OAAO,iBAAA,CAAkB,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EAC3C,CAAA,EAV+B,0BAAA,CAAA;AAWjC;AAtIgB,MAAA,CAAA,yBAAA,EAAA,2BAAA,CAAA","file":"chunk-7JMYT62X.js","sourcesContent":["/*\n  This patches the global ServerResponse object to scan for secret leaks - currently used for next.js and remix\n*/\n\nimport zlib from 'node:zlib';\nimport { ServerResponse } from 'node:http';\nimport { redactSensitiveConfig, scanForLeaks, varlockSettings } from './env';\nimport { debug } from './lib/debug';\n\n// NOTE - previously was using a symbol but got weird because of multiple builds and contexts...\nconst patchedKey = '_patchedByVarlock';\nexport function patchGlobalServerResponse(opts?: {\n  ignoreUrlPatterns?: Array<RegExp>,\n  redactInsteadOfThrow?: boolean,\n}) {\n  debug('⚡️ PATCHING global ServerResponse');\n  if (Object.getOwnPropertyDescriptor(ServerResponse.prototype, patchedKey)) {\n    debug('> already patched');\n    return;\n  }\n  if (varlockSettings.preventLeaks === false) {\n    debug('> disabled by settings');\n    return;\n  }\n\n  Object.defineProperty(ServerResponse.prototype, patchedKey, { value: true });\n\n  const serverResponseWrite = ServerResponse.prototype.write;\n\n  // @ts-ignore\n  ServerResponse.prototype.write = function varlockPatchedServerResponseWrite(...args) {\n    // TODO: do we want to filter out some requests here? maybe based on the file type?\n\n    const rawChunk = args[0];\n    // console.log('⚡️ patched ServerResponse.write', rawChunk);\n\n    // for now, we only scan rendered html... may need to change this though for server components?\n    // so we bail if it looks like this response does not contain html\n    const contentType = this.getHeader('content-type')?.toString() || '';\n    // console.log('patched ServerResponse.write', contentType);\n    let runScan = (\n      contentType.startsWith('text/')\n      || contentType.startsWith('application/json')\n      || (!contentType && typeof rawChunk === 'string')\n      // || contentType.startsWith('application/javascript')\n    );\n\n    const reqUrl = (this as any).req.url;\n    // console.log('> scan ServerResponse.write', contentType, reqUrl);\n    if (runScan && reqUrl && opts?.ignoreUrlPatterns?.some((pattern) => pattern.test(reqUrl))) {\n      runScan = false;\n    }\n\n    // we want to run the scanner on text/html and text/x-component (server actions)\n    // TODO: anything else?\n    if (!runScan) {\n      // @ts-ignore\n      return serverResponseWrite.apply(this, args);\n    }\n\n    // have to deal with compressed data, which is awkward but possible\n    const compressionType = this.getHeader('Content-Encoding');\n    let chunkStr;\n    let chunkType: 'string' | 'encoded' | 'gzip' | null = null;\n    if (typeof rawChunk === 'string') {\n      chunkType = 'string';\n      chunkStr = rawChunk;\n    } else if (!compressionType) {\n      chunkType = 'encoded';\n      const decoder = new TextDecoder();\n      chunkStr = decoder.decode(rawChunk);\n    } else if (compressionType === 'gzip') {\n      chunkType = 'gzip';\n      // first chunk of data contains only compression headers\n      if (!(this as any)._zlibChunks) {\n        // (this as any)._zlibHeadersChunk = rawChunk;\n        (this as any)._zlibChunks = [rawChunk];\n      } else {\n        // TODO: figure out how we can unzip one chunk at a time instead of storing everything\n        (this as any)._zlibChunks?.push(rawChunk);\n        try {\n          const unzippedChunk = zlib.unzipSync(Buffer.concat((this as any)._zlibChunks || []), {\n            flush: zlib.constants.Z_SYNC_FLUSH,\n            finishFlush: zlib.constants.Z_SYNC_FLUSH,\n          });\n          const fullUnzippedData = unzippedChunk.toString('utf-8');\n          chunkStr = fullUnzippedData.substring((this as any)._lastChunkEndIndex || 0);\n          (this as any)._lastChunkEndIndex = fullUnzippedData.length;\n        } catch (err) {\n          // console.log('error unzipping chunk', err);\n        }\n      }\n    }\n    // TODO: we may want to support other compression schemes? but currently only used in nextjs which is using gzip\n    if (chunkStr) {\n      // console.log('scanning!', chunkStr.substring(0, 1000));\n\n\n      try {\n        scanForLeaks(chunkStr, { method: 'patched ServerResponse.write', file: (this as any).req.url });\n      } catch (err) {\n        // console.log('found secret in chunk', chunkType, chunkStr);\n        // console.log(this)\n        if (opts?.redactInsteadOfThrow) {\n          chunkStr = redactSensitiveConfig(chunkStr);\n          if (chunkType === 'string') {\n            args[0] = chunkStr;\n          } else if (chunkType === 'encoded') {\n            const encoder = new TextEncoder();\n            args[0] = encoder.encode(chunkStr);\n          } else if (chunkType === 'gzip') {\n            // currently unable to scrub gzip chunks\n            // this works sometimes, but othertimes causes decoding error\n            // we'll need to pass through chunks from a new gzip stream, because we don't have access to the underlying one\n            // args[0] = zlib.gzipSync(chunkStr, {\n            //   flush: zlib.constants.Z_SYNC_FLUSH,\n            //   finishFlush: zlib.constants.Z_SYNC_FLUSH,\n            // });\n          } else {\n            throw new Error(`unable to scrub - unknown chunk type ${chunkType}`);\n          }\n        } else {\n          throw err;\n        }\n      }\n    }\n\n    // @ts-ignore\n    return serverResponseWrite.apply(this, args);\n  };\n\n  // calling `res.json()` in the api routes on pages router calls `res.end` without called `res.write`\n  const serverResponseEnd = ServerResponse.prototype.end;\n  // @ts-ignore\n  ServerResponse.prototype.end = function patchedServerResponseEnd(...args) {\n    // console.log('⚡️ patched ServerResponse.end');\n    const endChunk = args[0];\n    // this just needs to work (so far) for nextjs sending json bodies, so does not need to handle all cases...\n    if (endChunk && typeof endChunk === 'string') {\n      // TODO: currently this throws the error and then things just hang... do we want to try to return an error type response instead?\n      scanForLeaks(endChunk, { method: 'patched ServerResponse.end' });\n    }\n    // @ts-ignore\n    return serverResponseEnd.apply(this, args);\n  };\n}\n\n"]}
+{"version":3,"sources":["../src/runtime/patch-server-response.ts"],"names":[],"mappings":";;;;;AAUA,IAAM,UAAA,GAAa,mBAAA;AACZ,SAAS,0BAA0B,IAAA,EAGvC;AACD,EAAA,KAAA,CAAM,6CAAmC,CAAA;AACzC,EAAA,IAAI,MAAA,CAAO,wBAAA,CAAyB,cAAA,CAAe,SAAA,EAAW,UAAU,CAAA,EAAG;AACzE,IAAA,KAAA,CAAM,mBAAmB,CAAA;AACzB,IAAA;AAAA,EACF;AACA,EAAA,IAAI,eAAA,CAAgB,iBAAiB,KAAA,EAAO;AAC1C,IAAA,KAAA,CAAM,wBAAwB,CAAA;AAC9B,IAAA;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,eAAe,cAAA,CAAe,SAAA,EAAW,YAAY,EAAE,KAAA,EAAO,MAAM,CAAA;AAE3E,EAAA,MAAM,mBAAA,GAAsB,eAAe,SAAA,CAAU,KAAA;AAGrD,EAAA,cAAA,CAAe,SAAA,CAAU,KAAA,mBAAQ,MAAA,CAAA,SAAS,iCAAA,CAAA,GAAqC,IAAA,EAAM;AAGnF,IAAA,MAAM,QAAA,GAAW,KAAK,CAAC,CAAA;AAKvB,IAAA,MAAM,cAAc,IAAA,CAAK,SAAA,CAAU,cAAc,CAAA,EAAG,UAAS,IAAK,EAAA;AAElE,IAAA,IAAI,OAAA,GACF,WAAA,CAAY,UAAA,CAAW,OAAO,CAAA,IAC3B,WAAA,CAAY,UAAA,CAAW,kBAAkB,CAAA,IACxC,CAAC,WAAA,IAAe,OAAO,QAAA,KAAa,QAAA;AAI1C,IAAA,MAAM,MAAA,GAAU,KAAa,GAAA,CAAI,GAAA;AAEjC,IAAA,IAAI,OAAA,IAAW,MAAA,IAAU,IAAA,EAAM,iBAAA,EAAmB,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAC,CAAA,EAAG;AACzF,MAAA,OAAA,GAAU,KAAA;AAAA,IACZ;AAIA,IAAA,IAAI,CAAC,OAAA,EAAS;AAEZ,MAAA,OAAO,mBAAA,CAAoB,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAAA,IAC7C;AAGA,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,SAAA,CAAU,kBAAkB,CAAA;AACzD,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,SAAA,GAAkD,IAAA;AACtD,IAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAChC,MAAA,SAAA,GAAY,QAAA;AACZ,MAAA,QAAA,GAAW,QAAA;AAAA,IACb,CAAA,MAAA,IAAW,CAAC,eAAA,EAAiB;AAC3B,MAAA,SAAA,GAAY,SAAA;AACZ,MAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,MAAA,QAAA,GAAW,OAAA,CAAQ,OAAO,QAAQ,CAAA;AAAA,IACpC,CAAA,MAAA,IAAW,oBAAoB,MAAA,EAAQ;AACrC,MAAA,SAAA,GAAY,MAAA;AAEZ,MAAA,IAAI,CAAE,KAAa,WAAA,EAAa;AAE9B,QAAC,IAAA,CAAa,WAAA,GAAc,CAAC,QAAQ,CAAA;AAAA,MACvC,CAAA,MAAO;AAEL,QAAC,IAAA,CAAa,WAAA,EAAa,IAAA,CAAK,QAAQ,CAAA;AACxC,QAAA,IAAI;AACF,UAAA,MAAM,aAAA,GAAgB,KAAK,SAAA,CAAU,MAAA,CAAO,OAAQ,IAAA,CAAa,WAAA,IAAe,EAAE,CAAA,EAAG;AAAA,YACnF,KAAA,EAAO,KAAK,SAAA,CAAU,YAAA;AAAA,YACtB,WAAA,EAAa,KAAK,SAAA,CAAU;AAAA,WAC7B,CAAA;AACD,UAAA,MAAM,gBAAA,GAAmB,aAAA,CAAc,QAAA,CAAS,OAAO,CAAA;AACvD,UAAA,QAAA,GAAW,gBAAA,CAAiB,SAAA,CAAW,IAAA,CAAa,kBAAA,IAAsB,CAAC,CAAA;AAC3E,UAAC,IAAA,CAAa,qBAAqB,gBAAA,CAAiB,MAAA;AAAA,QACtD,SAAS,GAAA,EAAK;AAAA,QAEd;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,QAAA,EAAU;AAIZ,MAAA,IAAI;AACF,QAAA,YAAA,CAAa,QAAA,EAAU,EAAE,MAAA,EAAQ,8BAAA,EAAgC,MAAO,IAAA,CAAa,GAAA,CAAI,KAAK,CAAA;AAAA,MAChG,SAAS,GAAA,EAAK;AAGZ,QAAA,IAAI,MAAM,oBAAA,EAAsB;AAC9B,UAAA,QAAA,GAAW,sBAAsB,QAAQ,CAAA;AACzC,UAAA,IAAI,cAAc,QAAA,EAAU;AAC1B,YAAA,IAAA,CAAK,CAAC,CAAA,GAAI,QAAA;AAAA,UACZ,CAAA,MAAA,IAAW,cAAc,SAAA,EAAW;AAClC,YAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,YAAA,IAAA,CAAK,CAAC,CAAA,GAAI,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA;AAAA,UACnC,CAAA,MAAA,IAAW,cAAc,MAAA,EAAQ,CAQjC,MAAO;AACL,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qCAAA,EAAwC,SAAS,CAAA,CAAE,CAAA;AAAA,UACrE;AAAA,QACF,CAAA,MAAO;AACL,UAAA,MAAM,GAAA;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,IAAA,OAAO,mBAAA,CAAoB,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EAC7C,CAAA,EAnGiC,mCAAA,CAAA;AAsGjC,EAAA,MAAM,iBAAA,GAAoB,eAAe,SAAA,CAAU,GAAA;AAEnD,EAAA,cAAA,CAAe,SAAA,CAAU,GAAA,mBAAM,MAAA,CAAA,SAAS,wBAAA,CAAA,GAA4B,IAAA,EAAM;AAExE,IAAA,MAAM,QAAA,GAAW,KAAK,CAAC,CAAA;AAEvB,IAAA,IAAI,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAE5C,MAAA,YAAA,CAAa,QAAA,EAAU,EAAE,MAAA,EAAQ,4BAAA,EAA8B,CAAA;AAAA,IACjE;AAEA,IAAA,OAAO,iBAAA,CAAkB,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EAC3C,CAAA,EAV+B,0BAAA,CAAA;AAWjC;AAtIgB,MAAA,CAAA,yBAAA,EAAA,2BAAA,CAAA","file":"chunk-LP2TZNLG.js","sourcesContent":["/*\n  This patches the global ServerResponse object to scan for secret leaks - currently used for next.js and remix\n*/\n\nimport zlib from 'node:zlib';\nimport { ServerResponse } from 'node:http';\nimport { redactSensitiveConfig, scanForLeaks, varlockSettings } from './env';\nimport { debug } from './lib/debug';\n\n// NOTE - previously was using a symbol but got weird because of multiple builds and contexts...\nconst patchedKey = '_patchedByVarlock';\nexport function patchGlobalServerResponse(opts?: {\n  ignoreUrlPatterns?: Array<RegExp>,\n  redactInsteadOfThrow?: boolean,\n}) {\n  debug('⚡️ PATCHING global ServerResponse');\n  if (Object.getOwnPropertyDescriptor(ServerResponse.prototype, patchedKey)) {\n    debug('> already patched');\n    return;\n  }\n  if (varlockSettings.preventLeaks === false) {\n    debug('> disabled by settings');\n    return;\n  }\n\n  Object.defineProperty(ServerResponse.prototype, patchedKey, { value: true });\n\n  const serverResponseWrite = ServerResponse.prototype.write;\n\n  // @ts-ignore\n  ServerResponse.prototype.write = function varlockPatchedServerResponseWrite(...args) {\n    // TODO: do we want to filter out some requests here? maybe based on the file type?\n\n    const rawChunk = args[0];\n    // console.log('⚡️ patched ServerResponse.write', rawChunk);\n\n    // for now, we only scan rendered html... may need to change this though for server components?\n    // so we bail if it looks like this response does not contain html\n    const contentType = this.getHeader('content-type')?.toString() || '';\n    // console.log('patched ServerResponse.write', contentType);\n    let runScan = (\n      contentType.startsWith('text/')\n      || contentType.startsWith('application/json')\n      || (!contentType && typeof rawChunk === 'string')\n      // || contentType.startsWith('application/javascript')\n    );\n\n    const reqUrl = (this as any).req.url;\n    // console.log('> scan ServerResponse.write', contentType, reqUrl);\n    if (runScan && reqUrl && opts?.ignoreUrlPatterns?.some((pattern) => pattern.test(reqUrl))) {\n      runScan = false;\n    }\n\n    // we want to run the scanner on text/html and text/x-component (server actions)\n    // TODO: anything else?\n    if (!runScan) {\n      // @ts-ignore\n      return serverResponseWrite.apply(this, args);\n    }\n\n    // have to deal with compressed data, which is awkward but possible\n    const compressionType = this.getHeader('Content-Encoding');\n    let chunkStr;\n    let chunkType: 'string' | 'encoded' | 'gzip' | null = null;\n    if (typeof rawChunk === 'string') {\n      chunkType = 'string';\n      chunkStr = rawChunk;\n    } else if (!compressionType) {\n      chunkType = 'encoded';\n      const decoder = new TextDecoder();\n      chunkStr = decoder.decode(rawChunk);\n    } else if (compressionType === 'gzip') {\n      chunkType = 'gzip';\n      // first chunk of data contains only compression headers\n      if (!(this as any)._zlibChunks) {\n        // (this as any)._zlibHeadersChunk = rawChunk;\n        (this as any)._zlibChunks = [rawChunk];\n      } else {\n        // TODO: figure out how we can unzip one chunk at a time instead of storing everything\n        (this as any)._zlibChunks?.push(rawChunk);\n        try {\n          const unzippedChunk = zlib.unzipSync(Buffer.concat((this as any)._zlibChunks || []), {\n            flush: zlib.constants.Z_SYNC_FLUSH,\n            finishFlush: zlib.constants.Z_SYNC_FLUSH,\n          });\n          const fullUnzippedData = unzippedChunk.toString('utf-8');\n          chunkStr = fullUnzippedData.substring((this as any)._lastChunkEndIndex || 0);\n          (this as any)._lastChunkEndIndex = fullUnzippedData.length;\n        } catch (err) {\n          // console.log('error unzipping chunk', err);\n        }\n      }\n    }\n    // TODO: we may want to support other compression schemes? but currently only used in nextjs which is using gzip\n    if (chunkStr) {\n      // console.log('scanning!', chunkStr.substring(0, 1000));\n\n\n      try {\n        scanForLeaks(chunkStr, { method: 'patched ServerResponse.write', file: (this as any).req.url });\n      } catch (err) {\n        // console.log('found secret in chunk', chunkType, chunkStr);\n        // console.log(this)\n        if (opts?.redactInsteadOfThrow) {\n          chunkStr = redactSensitiveConfig(chunkStr);\n          if (chunkType === 'string') {\n            args[0] = chunkStr;\n          } else if (chunkType === 'encoded') {\n            const encoder = new TextEncoder();\n            args[0] = encoder.encode(chunkStr);\n          } else if (chunkType === 'gzip') {\n            // currently unable to scrub gzip chunks\n            // this works sometimes, but othertimes causes decoding error\n            // we'll need to pass through chunks from a new gzip stream, because we don't have access to the underlying one\n            // args[0] = zlib.gzipSync(chunkStr, {\n            //   flush: zlib.constants.Z_SYNC_FLUSH,\n            //   finishFlush: zlib.constants.Z_SYNC_FLUSH,\n            // });\n          } else {\n            throw new Error(`unable to scrub - unknown chunk type ${chunkType}`);\n          }\n        } else {\n          throw err;\n        }\n      }\n    }\n\n    // @ts-ignore\n    return serverResponseWrite.apply(this, args);\n  };\n\n  // calling `res.json()` in the api routes on pages router calls `res.end` without called `res.write`\n  const serverResponseEnd = ServerResponse.prototype.end;\n  // @ts-ignore\n  ServerResponse.prototype.end = function patchedServerResponseEnd(...args) {\n    // console.log('⚡️ patched ServerResponse.end');\n    const endChunk = args[0];\n    // this just needs to work (so far) for nextjs sending json bodies, so does not need to handle all cases...\n    if (endChunk && typeof endChunk === 'string') {\n      // TODO: currently this throws the error and then things just hang... do we want to try to return an error type response instead?\n      scanForLeaks(endChunk, { method: 'patched ServerResponse.end' });\n    }\n    // @ts-ignore\n    return serverResponseEnd.apply(this, args);\n  };\n}\n\n"]}

package/dist/{chunk-MITVWKKH.js → chunk-MCI6K4Z5.js}

@@ -1,6 +1,6 @@
 import { define } from './chunk-33ROL4J5.js';
-import { loadVarlockEnvGraph, checkForSchemaErrors, checkForConfigErrors } from './chunk-NGDIT6C3.js';
-import { gracefulExit } from './chunk-MLIGQWID.js';
+import { loadVarlockEnvGraph, checkForSchemaErrors, checkForConfigErrors } from './chunk-AC7XNDNI.js';
+import { gracefulExit } from './chunk-L7EDMUWK.js';
 import { __name } from './chunk-XN24GZXQ.js';
 import { execa } from 'execa';
 import which from 'which';
@@ -81,5 +81,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 
 export { commandFn, commandSpec };
-//# sourceMappingURL=chunk-MITVWKKH.js.map
-//# sourceMappingURL=chunk-MITVWKKH.js.map
+//# sourceMappingURL=chunk-MCI6K4Z5.js.map
+//# sourceMappingURL=chunk-MCI6K4Z5.js.map

package/dist/{chunk-MITVWKKH.js.map → chunk-MCI6K4Z5.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/run.command.ts"],"names":[],"mappings":";;;;;;;AAUO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,KAAA;AAAA,EACN,WAAA,EAAa,wDAAA;AAAA,EACb,IAAA,EAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOR,CAAC;AAED,IAAI,cAAA;AACJ,IAAI,6BAAA,GAAgC,KAAA;AAG7B,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAEhF,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AACjC,EAAA,IAAI,kBAAiC,EAAC;AACtC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EAAG;AACvB,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AACzC,IAAA,eAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,eAAA,GAAkB,CAAC,CAAA;AAAA,EAClD,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,MAAM,kFAAkF,CAAA;AAAA,EACpG;AACA,EAAA,MAAM,kBAAA,GAAqB,eAAA;AAC3B,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,IAAA,CAAK,GAAG,CAAA;AAEhD,EAAA,MAAM,UAAA,GAAa,mBAAmB,CAAC,CAAA;AACvC,EAAA,MAAM,eAAA,GAAkB,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAA;AAClD,EAAA,MAAM,mBAAmB,KAAA,CAAM,IAAA,CAAK,YAAY,EAAE,OAAA,EAAS,MAAM,CAAA;AAQjE,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,EAAoB;AAC3C,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAC7B,EAAA,MAAM,SAAS,gBAAA,EAAiB;AAChC,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAI7B,EAAA,MAAM,WAAA,GAAc,SAAS,oBAAA,EAAqB;AAIlD,EAAA,MAAM,eAAA,GAAkB;AAAA,IACtB,GAAG,OAAA,CAAQ,GAAA;AAAA,IACX,GAAG,WAAA;AAAA,IACH,aAAA,EAAe,GAAA;AAAA;AAAA,IACf,aAAA,EAAe,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,oBAAoB;AAAA,GAC7D;AAEA,EAAA,cAAA,GAAiB,KAAA,CAAM,gBAAA,IAAoB,UAAA,EAAY,eAAA,EAAiB;AAAA,IACtE,KAAA,EAAO,SAAA;AAAA,IACP,GAAA,EAAK;AAAA,GACN,CAAA;AAKD,EAAyB;AAEvB,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,EAAY,OAAA,KAAiB;AAM/C,MAAA,cAAA,EAAgB,KAAK,CAAC,CAAA;AAAA,IACxB,CAAC,CAAA;AAED,IAAA,CAAC,SAAA,EAAW,QAAQ,CAAA,CAAE,OAAA,CAAQ,CAAC,MAAA,KAAW;AACxC,MAAA,OAAA,CAAQ,EAAA,CAAG,QAAQ,MAAM;AAEvB,QAAA,cAAA,EAAgB,KAAK,CAAC,CAAA;AACtB,QAAA,YAAA,CAAa,CAAC,CAAA;AAAA,MAChB,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EAEH;AAGA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,gBAAgB,MAAM,cAAA;AAC5B,IAAA,QAAA,GAAW,aAAA,CAAc,QAAA;AAAA,EAC3B,SAAS,KAAA,EAAO;AAEd,IAAA,IAAK,KAAA,CAAc,MAAA,KAAW,QAAA,IAAY,6BAAA,EAA+B;AAOzE,IAAA,IAAK,KAAA,CAAc,MAAA,KAAW,QAAA,IAAa,KAAA,CAAc,WAAW,SAAA,EAAW;AAC7E,MAAA,YAAA,CAAa,CAAC,CAAA;AAAA,IAChB,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,GAAA,CAAK,MAAgB,OAAO,CAAA;AACpC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,eAAe,CAAA,QAAA,CAAU,CAAA;AACjD,MAAA,OAAA,CAAQ,IAAI,2CAA2C,CAAA;AACvD,MAAA,OAAA,CAAQ,IAAI,2DAA2D,CAAA;AAAA,IAEzE;AACA,IAAA,QAAA,GAAY,MAAc,QAAA,IAAY,CAAA;AAAA,EACxC;AAYA,EAAqB;AACnB,IAAA,OAAO,aAAa,QAAQ,CAAA;AAAA,EAC9B;AAGF,CAAA,EA/GmE,WAAA","file":"chunk-MITVWKKH.js","sourcesContent":["import { execa, type ResultPromise } from 'execa';\nimport which from 'which';\nimport { define } from 'gunshi';\n\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { checkForConfigErrors, checkForSchemaErrors } from '../helpers/error-checks';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { gracefulExit } from 'exit-hook';\n\n\nexport const commandSpec = define({\n  name: 'run',\n  description: 'Run a command with your environment variables injected',\n  args: {\n    // watch: {\n    //   type: 'boolean',\n    //   short: 'w',\n    //   description: 'Watch mode',\n    // },\n  },\n});\n\nlet commandProcess: ResultPromise | undefined;\nlet childCommandKilledFromRestart = false;\nconst isWatchModeRestart = false; // TODO: re-enable watch mode\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  // if \"--\" is present, split the args into our command and the rest, which will be another external command\n  const argv = process.argv.slice(2);\n  let restCommandArgs: Array<string> = [];\n  if (argv.includes('--')) {\n    const doubleDashIndex = argv.indexOf('--');\n    restCommandArgs = argv.slice(doubleDashIndex + 1);\n  } else {\n    throw new Error('No command to run! Your command should look like `varlock run -- <your-command>`');\n  }\n  const commandToRunAsArgs = restCommandArgs;\n  const commandToRunStr = restCommandArgs.join(' ');\n\n  const rawCommand = commandToRunAsArgs[0];\n  const commandArgsOnly = commandToRunAsArgs.slice(1);\n  const pathAwareCommand = which.sync(rawCommand, { nothrow: true });\n\n  // const isWatchEnabled = ctx.values.watch;\n  const isWatchEnabled = false;\n\n  // console.log('running command', pathAwareCommand || rawCommand, commandArgsOnly);\n\n\n  const envGraph = await loadVarlockEnvGraph();\n  checkForSchemaErrors(envGraph);\n  await envGraph.resolveEnvValues();\n  checkForConfigErrors(envGraph);\n\n  // will fail above if there are any errors\n\n  const resolvedEnv = envGraph.getResolvedEnvObject();\n  // console.log(resolvedEnv);\n\n  // needs more thought here\n  const fullInjectedEnv = {\n    ...process.env,\n    ...resolvedEnv,\n    __VARLOCK_RUN: '1', // flag for a child process to detect it is runnign via `varlock run`\n    __VARLOCK_ENV: JSON.stringify(envGraph.getSerializedGraph()),\n  };\n\n  commandProcess = execa(pathAwareCommand || rawCommand, commandArgsOnly, {\n    stdio: 'inherit',\n    env: fullInjectedEnv,\n  });\n  // console.log('PARENT PID = ', process.pid);\n  // console.log('CHILD PID = ', commandProcess.pid);\n\n  // if first run, we need to attach some extra exit handling\n  if (!isWatchModeRestart) {\n    // try to make sure we shut down cleanly and kill the child process\n    process.on('exit', (_code: any, _signal: any) => {\n      // if (childCommandKilledFromRestart) {\n      //   childCommandKilledFromRestart = false;\n      //   return;\n      // }\n      // console.log('exit!', code, signal);\n      commandProcess?.kill(9);\n    });\n\n    ['SIGTERM', 'SIGINT'].forEach((signal) => {\n      process.on(signal, () => {\n        // console.log('SIGNAL = ', signal);\n        commandProcess?.kill(9);\n        gracefulExit(1);\n      });\n    });\n    // TODO: handle other signals?\n  }\n\n\n  let exitCode: any; // TODO: fix this any\n  try {\n    const commandResult = await commandProcess;\n    exitCode = commandResult.exitCode;\n  } catch (error) {\n    // console.log('child command error!', error);\n    if ((error as any).signal === 'SIGINT' && childCommandKilledFromRestart) {\n      // console.log('child command failed due to being killed form restart');\n      childCommandKilledFromRestart = false;\n      return;\n    }\n\n    // console.log('child command result error', error);\n    if ((error as any).signal === 'SIGINT' || (error as any).signal === 'SIGKILL') {\n      gracefulExit(1);\n    } else {\n      console.log((error as Error).message);\n      console.log(`command [${commandToRunStr}] failed`);\n      console.log('try running the same command without dmno');\n      console.log('if you get a different result, dmno may be the problem...');\n      // console.log(`Please report issue here: <${REPORT_ISSUE_LINK}>`);\n    }\n    exitCode = (error as any).exitCode || 1;\n  }\n\n  if (isWatchEnabled) {\n    if (!childCommandKilledFromRestart) {\n      if (exitCode === 0) {\n        console.log('\\n✅ command completed successfully');\n      } else {\n        console.log(`\\n💥 command failed - exit code = ${exitCode}`);\n      }\n    }\n  }\n\n  if (!isWatchEnabled) {\n    return gracefulExit(exitCode);\n  } else {\n    console.log('... watching for changes ...');\n  }\n};\n"]}
+{"version":3,"sources":["../src/cli/commands/run.command.ts"],"names":[],"mappings":";;;;;;;AAUO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,KAAA;AAAA,EACN,WAAA,EAAa,wDAAA;AAAA,EACb,IAAA,EAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOR,CAAC;AAED,IAAI,cAAA;AACJ,IAAI,6BAAA,GAAgC,KAAA;AAG7B,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAEhF,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AACjC,EAAA,IAAI,kBAAiC,EAAC;AACtC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EAAG;AACvB,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AACzC,IAAA,eAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,eAAA,GAAkB,CAAC,CAAA;AAAA,EAClD,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,MAAM,kFAAkF,CAAA;AAAA,EACpG;AACA,EAAA,MAAM,kBAAA,GAAqB,eAAA;AAC3B,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,IAAA,CAAK,GAAG,CAAA;AAEhD,EAAA,MAAM,UAAA,GAAa,mBAAmB,CAAC,CAAA;AACvC,EAAA,MAAM,eAAA,GAAkB,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAA;AAClD,EAAA,MAAM,mBAAmB,KAAA,CAAM,IAAA,CAAK,YAAY,EAAE,OAAA,EAAS,MAAM,CAAA;AAQjE,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,EAAoB;AAC3C,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAC7B,EAAA,MAAM,SAAS,gBAAA,EAAiB;AAChC,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAI7B,EAAA,MAAM,WAAA,GAAc,SAAS,oBAAA,EAAqB;AAIlD,EAAA,MAAM,eAAA,GAAkB;AAAA,IACtB,GAAG,OAAA,CAAQ,GAAA;AAAA,IACX,GAAG,WAAA;AAAA,IACH,aAAA,EAAe,GAAA;AAAA;AAAA,IACf,aAAA,EAAe,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,oBAAoB;AAAA,GAC7D;AAEA,EAAA,cAAA,GAAiB,KAAA,CAAM,gBAAA,IAAoB,UAAA,EAAY,eAAA,EAAiB;AAAA,IACtE,KAAA,EAAO,SAAA;AAAA,IACP,GAAA,EAAK;AAAA,GACN,CAAA;AAKD,EAAyB;AAEvB,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,EAAY,OAAA,KAAiB;AAM/C,MAAA,cAAA,EAAgB,KAAK,CAAC,CAAA;AAAA,IACxB,CAAC,CAAA;AAED,IAAA,CAAC,SAAA,EAAW,QAAQ,CAAA,CAAE,OAAA,CAAQ,CAAC,MAAA,KAAW;AACxC,MAAA,OAAA,CAAQ,EAAA,CAAG,QAAQ,MAAM;AAEvB,QAAA,cAAA,EAAgB,KAAK,CAAC,CAAA;AACtB,QAAA,YAAA,CAAa,CAAC,CAAA;AAAA,MAChB,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EAEH;AAGA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,gBAAgB,MAAM,cAAA;AAC5B,IAAA,QAAA,GAAW,aAAA,CAAc,QAAA;AAAA,EAC3B,SAAS,KAAA,EAAO;AAEd,IAAA,IAAK,KAAA,CAAc,MAAA,KAAW,QAAA,IAAY,6BAAA,EAA+B;AAOzE,IAAA,IAAK,KAAA,CAAc,MAAA,KAAW,QAAA,IAAa,KAAA,CAAc,WAAW,SAAA,EAAW;AAC7E,MAAA,YAAA,CAAa,CAAC,CAAA;AAAA,IAChB,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,GAAA,CAAK,MAAgB,OAAO,CAAA;AACpC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,eAAe,CAAA,QAAA,CAAU,CAAA;AACjD,MAAA,OAAA,CAAQ,IAAI,2CAA2C,CAAA;AACvD,MAAA,OAAA,CAAQ,IAAI,2DAA2D,CAAA;AAAA,IAEzE;AACA,IAAA,QAAA,GAAY,MAAc,QAAA,IAAY,CAAA;AAAA,EACxC;AAYA,EAAqB;AACnB,IAAA,OAAO,aAAa,QAAQ,CAAA;AAAA,EAC9B;AAGF,CAAA,EA/GmE,WAAA","file":"chunk-MCI6K4Z5.js","sourcesContent":["import { execa, type ResultPromise } from 'execa';\nimport which from 'which';\nimport { define } from 'gunshi';\n\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { checkForConfigErrors, checkForSchemaErrors } from '../helpers/error-checks';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { gracefulExit } from 'exit-hook';\n\n\nexport const commandSpec = define({\n  name: 'run',\n  description: 'Run a command with your environment variables injected',\n  args: {\n    // watch: {\n    //   type: 'boolean',\n    //   short: 'w',\n    //   description: 'Watch mode',\n    // },\n  },\n});\n\nlet commandProcess: ResultPromise | undefined;\nlet childCommandKilledFromRestart = false;\nconst isWatchModeRestart = false; // TODO: re-enable watch mode\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  // if \"--\" is present, split the args into our command and the rest, which will be another external command\n  const argv = process.argv.slice(2);\n  let restCommandArgs: Array<string> = [];\n  if (argv.includes('--')) {\n    const doubleDashIndex = argv.indexOf('--');\n    restCommandArgs = argv.slice(doubleDashIndex + 1);\n  } else {\n    throw new Error('No command to run! Your command should look like `varlock run -- <your-command>`');\n  }\n  const commandToRunAsArgs = restCommandArgs;\n  const commandToRunStr = restCommandArgs.join(' ');\n\n  const rawCommand = commandToRunAsArgs[0];\n  const commandArgsOnly = commandToRunAsArgs.slice(1);\n  const pathAwareCommand = which.sync(rawCommand, { nothrow: true });\n\n  // const isWatchEnabled = ctx.values.watch;\n  const isWatchEnabled = false;\n\n  // console.log('running command', pathAwareCommand || rawCommand, commandArgsOnly);\n\n\n  const envGraph = await loadVarlockEnvGraph();\n  checkForSchemaErrors(envGraph);\n  await envGraph.resolveEnvValues();\n  checkForConfigErrors(envGraph);\n\n  // will fail above if there are any errors\n\n  const resolvedEnv = envGraph.getResolvedEnvObject();\n  // console.log(resolvedEnv);\n\n  // needs more thought here\n  const fullInjectedEnv = {\n    ...process.env,\n    ...resolvedEnv,\n    __VARLOCK_RUN: '1', // flag for a child process to detect it is runnign via `varlock run`\n    __VARLOCK_ENV: JSON.stringify(envGraph.getSerializedGraph()),\n  };\n\n  commandProcess = execa(pathAwareCommand || rawCommand, commandArgsOnly, {\n    stdio: 'inherit',\n    env: fullInjectedEnv,\n  });\n  // console.log('PARENT PID = ', process.pid);\n  // console.log('CHILD PID = ', commandProcess.pid);\n\n  // if first run, we need to attach some extra exit handling\n  if (!isWatchModeRestart) {\n    // try to make sure we shut down cleanly and kill the child process\n    process.on('exit', (_code: any, _signal: any) => {\n      // if (childCommandKilledFromRestart) {\n      //   childCommandKilledFromRestart = false;\n      //   return;\n      // }\n      // console.log('exit!', code, signal);\n      commandProcess?.kill(9);\n    });\n\n    ['SIGTERM', 'SIGINT'].forEach((signal) => {\n      process.on(signal, () => {\n        // console.log('SIGNAL = ', signal);\n        commandProcess?.kill(9);\n        gracefulExit(1);\n      });\n    });\n    // TODO: handle other signals?\n  }\n\n\n  let exitCode: any; // TODO: fix this any\n  try {\n    const commandResult = await commandProcess;\n    exitCode = commandResult.exitCode;\n  } catch (error) {\n    // console.log('child command error!', error);\n    if ((error as any).signal === 'SIGINT' && childCommandKilledFromRestart) {\n      // console.log('child command failed due to being killed form restart');\n      childCommandKilledFromRestart = false;\n      return;\n    }\n\n    // console.log('child command result error', error);\n    if ((error as any).signal === 'SIGINT' || (error as any).signal === 'SIGKILL') {\n      gracefulExit(1);\n    } else {\n      console.log((error as Error).message);\n      console.log(`command [${commandToRunStr}] failed`);\n      console.log('try running the same command without dmno');\n      console.log('if you get a different result, dmno may be the problem...');\n      // console.log(`Please report issue here: <${REPORT_ISSUE_LINK}>`);\n    }\n    exitCode = (error as any).exitCode || 1;\n  }\n\n  if (isWatchEnabled) {\n    if (!childCommandKilledFromRestart) {\n      if (exitCode === 0) {\n        console.log('\\n✅ command completed successfully');\n      } else {\n        console.log(`\\n💥 command failed - exit code = ${exitCode}`);\n      }\n    }\n  }\n\n  if (!isWatchEnabled) {\n    return gracefulExit(exitCode);\n  } else {\n    console.log('... watching for changes ...');\n  }\n};\n"]}

package/dist/chunk-N2OUB4BD.js

@@ -0,0 +1,18 @@
+import { patchGlobalResponse } from './chunk-45I4KZVI.js';
+import { patchGlobalServerResponse } from './chunk-LP2TZNLG.js';
+import { execSyncVarlock } from './chunk-FUDH2TTI.js';
+import { patchGlobalConsole } from './chunk-4J42SJDB.js';
+import { initVarlockEnv } from './chunk-JNQQJ3GM.js';
+
+// src/auto-load.ts
+var execResult = execSyncVarlock("load --format json-full-compact", {
+  exitOnError: true,
+  showLogsOnError: true
+});
+process.env.__VARLOCK_ENV = execResult;
+initVarlockEnv();
+patchGlobalConsole();
+patchGlobalServerResponse();
+patchGlobalResponse();
+//# sourceMappingURL=chunk-N2OUB4BD.js.map
+//# sourceMappingURL=chunk-N2OUB4BD.js.map

package/dist/{chunk-NMJ5YL5I.js.map → chunk-N2OUB4BD.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/auto-load.ts"],"names":[],"mappings":";;;;;;;AAaA,IAAM,UAAA,GAAa,gBAAgB,yBAAA,EAA2B;AAAA,EAC5D,WAAA,EAAa,IAAA;AAAA,EACb,eAAA,EAAiB;AACnB,CAAC,CAAA;AACD,OAAA,CAAQ,IAAI,aAAA,GAAgB,UAAA;AAG5B,cAAA,EAAe;AAEf,kBAAA,EAAmB;AACnB,yBAAA,EAA0B;AAC1B,mBAAA,EAAoB","file":"chunk-NMJ5YL5I.js","sourcesContent":["import { execSyncVarlock } from './lib/exec-sync-varlock';\n\nimport { initVarlockEnv } from './runtime/env';\nimport { patchGlobalConsole } from './runtime/patch-console';\nimport { patchGlobalServerResponse } from './runtime/patch-server-response';\nimport { patchGlobalResponse } from './runtime/patch-response';\n\n// The varlock loading process uses async calls, but we need this to run synchronously.\n// because even with top level await, we run into hoisting issues where things happen out of order\n// so we call out to the CLI using execSync\n// this also isolates the varlock loading process from the end user process\n\n\nconst execResult = execSyncVarlock('load --format json-full', {\n  exitOnError: true,\n  showLogsOnError: true,\n});\nprocess.env.__VARLOCK_ENV = execResult;\n\n// initialize varlock and patch globals as necessary\ninitVarlockEnv();\n// these will be no-ops if these are disabled by settings\npatchGlobalConsole();\npatchGlobalServerResponse();\npatchGlobalResponse();\n\n"]}
+{"version":3,"sources":["../src/auto-load.ts"],"names":[],"mappings":";;;;;;;AAaA,IAAM,UAAA,GAAa,gBAAgB,iCAAA,EAAmC;AAAA,EACpE,WAAA,EAAa,IAAA;AAAA,EACb,eAAA,EAAiB;AACnB,CAAC,CAAA;AACD,OAAA,CAAQ,IAAI,aAAA,GAAgB,UAAA;AAG5B,cAAA,EAAe;AAEf,kBAAA,EAAmB;AACnB,yBAAA,EAA0B;AAC1B,mBAAA,EAAoB","file":"chunk-N2OUB4BD.js","sourcesContent":["import { execSyncVarlock } from './lib/exec-sync-varlock';\n\nimport { initVarlockEnv } from './runtime/env';\nimport { patchGlobalConsole } from './runtime/patch-console';\nimport { patchGlobalServerResponse } from './runtime/patch-server-response';\nimport { patchGlobalResponse } from './runtime/patch-response';\n\n// The varlock loading process uses async calls, but we need this to run synchronously.\n// because even with top level await, we run into hoisting issues where things happen out of order\n// so we call out to the CLI using execSync\n// this also isolates the varlock loading process from the end user process\n\n\nconst execResult = execSyncVarlock('load --format json-full-compact', {\n  exitOnError: true,\n  showLogsOnError: true,\n});\nprocess.env.__VARLOCK_ENV = execResult;\n\n// initialize varlock and patch globals as necessary\ninitVarlockEnv();\n// these will be no-ops if these are disabled by settings\npatchGlobalConsole();\npatchGlobalServerResponse();\npatchGlobalResponse();\n\n"]}

package/dist/cli/cli-executable.js

@@ -1,18 +1,18 @@
-import { commandSpec as commandSpec$4 } from '../chunk-LIIRL4NK.js';
-import { commandSpec } from '../chunk-GY623P3W.js';
-import { CliExitError, fmt } from '../chunk-DTNPJJH4.js';
-import { commandSpec as commandSpec$1 } from '../chunk-7L3IF2MK.js';
-import { commandSpec as commandSpec$2 } from '../chunk-MITVWKKH.js';
+import { commandSpec as commandSpec$4 } from '../chunk-22IQ3KIQ.js';
+import { commandSpec } from '../chunk-IE6XJ6ZT.js';
+import { CliExitError, fmt } from '../chunk-JD35HZ4B.js';
+import { commandSpec as commandSpec$1 } from '../chunk-EKBUU5TW.js';
+import { commandSpec as commandSpec$2 } from '../chunk-MCI6K4Z5.js';
 import { commandSpec as commandSpec$3 } from '../chunk-RZT65DRA.js';
 import { cli } from '../chunk-33ROL4J5.js';
-import { InvalidEnvError } from '../chunk-NGDIT6C3.js';
-import { ansis_default, gracefulExit, asyncExitHook } from '../chunk-MLIGQWID.js';
+import { InvalidEnvError } from '../chunk-AC7XNDNI.js';
+import { ansis_default, gracefulExit, asyncExitHook } from '../chunk-L7EDMUWK.js';
 import '../chunk-FGMXIEFA.js';
 import { __commonJS, __name, __toESM } from '../chunk-XN24GZXQ.js';
 import os2 from 'os';
 import crypto, { createHash } from 'crypto';
 import { join, dirname } from 'path';
-import fs, { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
+import fs, { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import Debug from 'debug';
 import process2 from 'process';
 
@@ -572,7 +572,7 @@ var is_wsl_default = process2.env.__IS_WSL_TEST__ ? isWsl : isWsl();
 
 // package.json
 var package_default = {
-  version: "0.1.0"};
+  version: "0.1.2"};
 
 // src/config.ts
 var CONFIG = {
@@ -584,53 +584,130 @@ var CONFIG = {
 // src/cli/helpers/telemetry.ts
 var debug = Debug("varlock:telemetry");
 var TRUE_ENV_VAR_VALUES = ["true", "1", "t"];
-var varlockConfigDirPath = join(os2.homedir(), ".varlock");
-var varlockConfigFilePath = join(varlockConfigDirPath, "config.json");
-var varlockConfigFileContents;
-function getConfigFileContents() {
-  if (varlockConfigFileContents) return varlockConfigFileContents;
+var userVarlockDirPath = join(os2.homedir(), ".varlock");
+var userVarlockConfigFilePath = join(userVarlockDirPath, "config.json");
+var userVarlockConfig;
+var projectVarlockConfig;
+var mergedVarlockConfigFileContents;
+var _gitDirPath;
+var _varlockDirPath;
+var _projectRootDirPath;
+var _foundProjectRoot = false;
+function findProjectDirs() {
+  if (!_foundProjectRoot) {
+    let currentDir = process.cwd();
+    while (currentDir) {
+      const possibleGitDirPath = join(currentDir, ".git");
+      if (!_gitDirPath && existsSync(possibleGitDirPath)) {
+        _gitDirPath = possibleGitDirPath;
+      }
+      const possibleVarlockDirPath = join(currentDir, ".varlock");
+      if (!_varlockDirPath && possibleVarlockDirPath !== userVarlockDirPath && existsSync(possibleVarlockDirPath)) {
+        _varlockDirPath = possibleVarlockDirPath;
+      }
+      const parentDir = dirname(currentDir);
+      if (parentDir === currentDir) break;
+      currentDir = parentDir;
+    }
+    if (_gitDirPath) _projectRootDirPath = dirname(_gitDirPath);
+    else if (_varlockDirPath) _projectRootDirPath = dirname(_varlockDirPath);
+    else _projectRootDirPath = process.cwd();
+    _foundProjectRoot = true;
+  }
+  return {
+    gitDirPath: _gitDirPath,
+    varlockDirPath: _varlockDirPath,
+    projectRootDirPath: _projectRootDirPath
+  };
+}
+__name(findProjectDirs, "findProjectDirs");
+function loadVarlockConfig() {
+  if (mergedVarlockConfigFileContents) return mergedVarlockConfigFileContents;
   try {
-    const configContent = readFileSync(varlockConfigFilePath, "utf-8");
-    varlockConfigFileContents = JSON.parse(configContent);
-    return varlockConfigFileContents;
-  } catch (error) {
-    debug("Failed to read varlock config:", error);
-    return {};
+    const userConfigStr = readFileSync(userVarlockConfigFilePath, "utf-8");
+    userVarlockConfig = userConfigStr.trim() ? JSON.parse(userConfigStr) : void 0;
+  } catch (err) {
+    if (err instanceof Error && "code" in err && err.code === "ENOENT") {
+      debug(`User varlock config file not found - ${userVarlockConfigFilePath}`);
+    } else if (err instanceof SyntaxError) {
+      throw new Error(`Invalid JSON in project varlock config - ${userVarlockConfigFilePath}`, { cause: err });
+    } else {
+      throw new Error(`Problem reading project varlock config - ${userVarlockConfigFilePath}`, { cause: err });
+    }
   }
+  const { varlockDirPath } = findProjectDirs();
+  if (varlockDirPath) {
+    const projectVarlockConfigPath = join(varlockDirPath, "config.json");
+    try {
+      const projectConfigStr = readFileSync(projectVarlockConfigPath, "utf-8");
+      projectVarlockConfig = projectConfigStr.trim() ? JSON.parse(projectConfigStr) : void 0;
+    } catch (err) {
+      if (err instanceof Error && "code" in err && err.code === "ENOENT") {
+        debug(`Project varlock config file not found - ${projectVarlockConfigPath}`);
+      } else if (err instanceof SyntaxError) {
+        throw new Error(`Invalid JSON in project varlock config - ${projectVarlockConfigPath}`, { cause: err });
+      } else {
+        throw new Error(`Problem reading project varlock config - ${projectVarlockConfigPath}`, { cause: err });
+      }
+    }
+    if (projectVarlockConfig?.anonymousId) throw new Error("Anonymous ID should not be set in project varlock config");
+  }
+  mergedVarlockConfigFileContents = {
+    ...userVarlockConfig,
+    ...projectVarlockConfig
+  };
+  return mergedVarlockConfigFileContents;
 }
-__name(getConfigFileContents, "getConfigFileContents");
+__name(loadVarlockConfig, "loadVarlockConfig");
 var cachedAnonymousId;
 function getAnonymousId() {
   if (cachedAnonymousId) return cachedAnonymousId;
-  const configFileContents = getConfigFileContents();
-  if (configFileContents?.anonymousId) {
-    cachedAnonymousId = configFileContents.anonymousId;
-    return configFileContents.anonymousId;
+  const varlockConfig = loadVarlockConfig();
+  if (varlockConfig?.anonymousId) {
+    cachedAnonymousId = varlockConfig.anonymousId;
+    return varlockConfig.anonymousId;
   }
   const newAnonymousId = `${import_ci_info.isCI ? "ci-" : ""}${crypto.randomUUID()}`;
-  if (!existsSync(varlockConfigDirPath)) {
-    mkdirSync(varlockConfigDirPath, { recursive: true });
+  try {
+    if (!existsSync(userVarlockDirPath)) {
+      mkdirSync(userVarlockDirPath, { recursive: true });
+    }
+    writeFileSync(
+      userVarlockConfigFilePath,
+      JSON.stringify({
+        ...userVarlockConfig,
+        anonymousId: newAnonymousId
+      }, null, 2),
+      { flag: "w" }
+    );
+  } catch (err) {
+    if (os2.homedir() === "/dev/null") {
+      console.error([
+        "Your HOME directory is not set - probably because you are running within Docker.",
+        "Please set HOME within your Dockerfile to a writable directory.",
+        "For example: `ENV HOME=/app/.home` (or whatever directory you want to use)."
+      ].join("\n"));
+    } else {
+      console.error([
+        "There was a problem writing to the ~/.varlock folder",
+        err.message,
+        "Please ensure your home folder (or at least the ~/.varlock folder) is writable"
+      ].join("\n"));
+    }
+    gracefulExit(1);
   }
-  writeFileSync(
-    varlockConfigFilePath,
-    JSON.stringify({
-      ...configFileContents,
-      anonymousId: newAnonymousId
-    }, null, 2),
-    { flag: "w" }
-  );
   cachedAnonymousId = newAnonymousId;
   return newAnonymousId;
 }
 __name(getAnonymousId, "getAnonymousId");
 function checkIsOptedOut() {
-  if (process.env.PH_OPT_OUT === "true" || TRUE_ENV_VAR_VALUES.includes((process.env.VARLOCK_TELEMETRY_DISABLED || "").toLowerCase())) {
+  if (process.env.PH_OPT_OUT === "true" || process.env.VARLOCK_TELEMETRY_DISABLED && TRUE_ENV_VAR_VALUES.includes(process.env.VARLOCK_TELEMETRY_DISABLED.toLowerCase())) {
     debug("telemetry opted out - env var");
     return true;
   }
-  const varlockConfigFile = getConfigFileContents();
-  if (varlockConfigFile?.analytics_opt_out || varlockConfigFile?.telemetryDisabled) {
-    debug("telemetry opted out - config file");
+  const varlockConfig = loadVarlockConfig();
+  if (varlockConfig?.analytics_opt_out || varlockConfig?.telemetryDisabled) {
+    debug(`telemetry opted out - config file (${projectVarlockConfig?.telemetryDisabled ? "project" : "user"} config)`);
     return true;
   }
   return false;
@@ -646,21 +723,10 @@ function anonymizeValue(payload) {
 }
 __name(anonymizeValue, "anonymizeValue");
 function getProjectGitRemoteUrl() {
+  findProjectDirs();
+  if (!_gitDirPath) return void 0;
   try {
-    let gitDirPath;
-    let currentDir = process.cwd();
-    while (currentDir) {
-      const possibleGitDirPath = join(currentDir, ".git");
-      if (existsSync(possibleGitDirPath)) {
-        gitDirPath = possibleGitDirPath;
-        break;
-      }
-      const parentDir = dirname(currentDir);
-      if (parentDir === currentDir) break;
-      currentDir = parentDir;
-    }
-    if (!gitDirPath) return void 0;
-    const gitConfigContents = readFileSync(join(gitDirPath, "config"), "utf-8");
+    const gitConfigContents = readFileSync(join(_gitDirPath, "config"), "utf-8");
     const remoteUpstreamPos = gitConfigContents.indexOf('[remote "upstream"]');
     if (remoteUpstreamPos !== -1) {
       const remoteUpstreamUrl = gitConfigContents.slice(remoteUpstreamPos).match(/url = (.+)/)?.[1];
@@ -720,7 +786,7 @@ async function posthogCapture(event, properties) {
       ...telemetryMeta,
       ...properties
     },
-    distinct_id: getAnonymousId()
+    distinct_id: isOptedOut ? "---" : getAnonymousId()
   };
   debug(`track${isOptedOut ? " (disabled)" : ""}`, payload);
   if (isOptedOut) return;
@@ -766,11 +832,11 @@ function buildLazyCommand(commandSpec6, loadCommandFn) {
 }
 __name(buildLazyCommand, "buildLazyCommand");
 var subCommands = /* @__PURE__ */ new Map();
-subCommands.set("init", buildLazyCommand(commandSpec, async () => await import('../init.command-ASK74XBV.js')));
-subCommands.set("load", buildLazyCommand(commandSpec$1, async () => await import('../load.command-VUKBSBEV.js')));
-subCommands.set("run", buildLazyCommand(commandSpec$2, async () => await import('../run.command-XQ64Z2TN.js')));
+subCommands.set("init", buildLazyCommand(commandSpec, async () => await import('../init.command-SN75V3QA.js')));
+subCommands.set("load", buildLazyCommand(commandSpec$1, async () => await import('../load.command-TARAAWET.js')));
+subCommands.set("run", buildLazyCommand(commandSpec$2, async () => await import('../run.command-AINTNA4H.js')));
 subCommands.set("help", buildLazyCommand(commandSpec$3, async () => await import('../help.command-B7VWA53B.js')));
-subCommands.set("telemetry", buildLazyCommand(commandSpec$4, async () => await import('../telemetry.command-HHZVBFC7.js')));
+subCommands.set("telemetry", buildLazyCommand(commandSpec$4, async () => await import('../telemetry.command-KRV5EY2Z.js')));
 (/* @__PURE__ */ __name(async function go() {
   try {
     let args = process.argv.slice(2);