varlock 0.1.5 → 0.2.0

package/dist/{chunk-D2V7SDAQ.js → chunk-NDRSG3XS.js}

@@ -1,6 +1,6 @@
 import { define } from './chunk-33ROL4J5.js';
-import { loadVarlockEnvGraph, checkForSchemaErrors, checkForConfigErrors } from './chunk-ARMP7LS5.js';
-import { gracefulExit } from './chunk-OOBWRTIS.js';
+import { loadVarlockEnvGraph, checkForSchemaErrors, checkForConfigErrors } from './chunk-L5REVVXG.js';
+import { gracefulExit } from './chunk-RD44SH5U.js';
 import { resetRedactionMap, redactSensitiveConfig } from './chunk-MSRPV5WH.js';
 import { __name } from './chunk-XN24GZXQ.js';
 import { execa } from 'execa';
@@ -15,7 +15,26 @@ var commandSpec = define({
     //   short: 'w',
     //   description: 'Watch mode',
     // },
-  }
+    "no-redact-stdout": {
+      type: "boolean",
+      description: "Disable stdout/stderr redaction to preserve TTY detection for interactive tools"
+    }
+  },
+  examples: `
+Executes a command in a child process, injecting your resolved and validated environment
+variables from your .env files. Useful when a code-level integration is not possible.
+
+Examples:
+  varlock run -- node app.js                 # Run a Node.js application
+  varlock run -- python script.py            # Run a Python script
+  varlock run -- sh -c 'echo $MY_VAR'        # Use shell expansion for env vars
+  varlock run --no-redact-stdout -- psql     # Preserve TTY for interactive tools
+
+\u{1F4CD} Important: Use -- to separate varlock options from your command
+
+\u{1F4A1} Tip: For shell expansion of env vars, use: sh -c 'your command here'
+\u{1F4A1} Tip: Use --no-redact-stdout for interactive tools (psql, claude, etc.)
+  `.trim()
 });
 var commandProcess;
 var childCommandKilledFromRestart = false;
@@ -47,21 +66,29 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
     __VARLOCK_ENV: JSON.stringify(serializedGraph)
   };
   const redactLogs = serializedGraph.settings?.redactLogs ?? true;
+  const noRedactStdout = ctx.values["no-redact-stdout"] ?? false;
   if (redactLogs) {
     resetRedactionMap(serializedGraph);
   }
-  const writeRedacted = /* @__PURE__ */ __name((stream, chunk) => {
-    const str = chunk.toString();
-    stream.write(redactLogs ? redactSensitiveConfig(str) : str);
-  }, "writeRedacted");
-  commandProcess = execa(pathAwareCommand || rawCommand, commandArgsOnly, {
-    stdin: "inherit",
-    stdout: "pipe",
-    stderr: "pipe",
-    env: fullInjectedEnv
-  });
-  commandProcess.stdout?.on("data", (chunk) => writeRedacted(process.stdout, chunk));
-  commandProcess.stderr?.on("data", (chunk) => writeRedacted(process.stderr, chunk));
+  if (noRedactStdout) {
+    commandProcess = execa(pathAwareCommand || rawCommand, commandArgsOnly, {
+      stdio: "inherit",
+      env: fullInjectedEnv
+    });
+  } else {
+    const writeRedacted = /* @__PURE__ */ __name((stream, chunk) => {
+      const str = chunk.toString();
+      stream.write(redactLogs ? redactSensitiveConfig(str) : str);
+    }, "writeRedacted");
+    commandProcess = execa(pathAwareCommand || rawCommand, commandArgsOnly, {
+      stdin: "inherit",
+      stdout: "pipe",
+      stderr: "pipe",
+      env: fullInjectedEnv
+    });
+    commandProcess.stdout?.on("data", (chunk) => writeRedacted(process.stdout, chunk));
+    commandProcess.stderr?.on("data", (chunk) => writeRedacted(process.stderr, chunk));
+  }
   {
     process.on("exit", (_code, _signal) => {
       commandProcess?.kill(9);
@@ -95,5 +122,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 
 export { commandFn, commandSpec };
-//# sourceMappingURL=chunk-D2V7SDAQ.js.map
-//# sourceMappingURL=chunk-D2V7SDAQ.js.map
+//# sourceMappingURL=chunk-NDRSG3XS.js.map
+//# sourceMappingURL=chunk-NDRSG3XS.js.map

package/dist/chunk-NDRSG3XS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/run.command.ts"],"names":[],"mappings":";;;;;;;;AAWO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,KAAA;AAAA,EACN,WAAA,EAAa,wDAAA;AAAA,EACb,IAAA,EAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMJ,kBAAA,EAAoB;AAAA,MAClB,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA,EAAA,CAAA,CAcR,IAAA;AACJ,CAAC;AAED,IAAI,cAAA;AACJ,IAAI,6BAAA,GAAgC,KAAA;AAG7B,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAEhF,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AACjC,EAAA,IAAI,kBAAiC,EAAC;AACtC,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EAAG;AACvB,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AACzC,IAAA,eAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,eAAA,GAAkB,CAAC,CAAA;AAAA,EAClD,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,MAAM,kFAAkF,CAAA;AAAA,EACpG;AACA,EAAA,MAAM,kBAAA,GAAqB,eAAA;AAC3B,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,IAAA,CAAK,GAAG,CAAA;AAEhD,EAAA,MAAM,UAAA,GAAa,mBAAmB,CAAC,CAAA;AACvC,EAAA,MAAM,eAAA,GAAkB,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAA;AAClD,EAAA,MAAM,mBAAmB,KAAA,CAAM,IAAA,CAAK,YAAY,EAAE,OAAA,EAAS,MAAM,CAAA;AAQjE,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,EAAoB;AAC3C,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAC7B,EAAA,MAAM,SAAS,gBAAA,EAAiB;AAChC,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAI7B,EAAA,MAAM,WAAA,GAAc,SAAS,oBAAA,EAAqB;AAClD,EAAA,MAAM,eAAA,GAAkB,SAAS,kBAAA,EAAmB;AAIpD,EAAA,MAAM,eAAA,GAAkB;AAAA,IACtB,GAAG,OAAA,CAAQ,GAAA;AAAA,IACX,GAAG,WAAA;AAAA,IACH,aAAA,EAAe,GAAA;AAAA;AAAA,IACf,aAAA,EAAe,IAAA,CAAK,SAAA,CAAU,eAAe;AAAA,GAC/C;AAEA,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,QAAA,EAAU,UAAA,IAAc,IAAA;AAC3D,EAAA,MAAM,cAAA,GAAiB,GAAA,CAAI,MAAA,CAAO,kBAAkB,CAAA,IAAK,KAAA;AAGzD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,iBAAA,CAAkB,eAAe,CAAA;AAAA,EACnC;AAIA,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,cAAA,GAAiB,KAAA,CAAM,gBAAA,IAAoB,UAAA,EAAY,eAAA,EAAiB;AAAA,MACtE,KAAA,EAAO,SAAA;AAAA,MACP,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,EACH,CAAA,MAAO;AAEL,IAAA,MAAM,aAAA,mBAAgB,MAAA,CAAA,CAAC,MAAA,EAA4B,KAAA,KAA2B;AAC5E,MAAA,MAAM,GAAA,GAAM,MAAM,QAAA,EAAS;AAC3B,MAAA,MAAA,CAAO,KAAA,CAAM,UAAA,GAAa,qBAAA,CAAsB,GAAG,IAAI,GAAG,CAAA;AAAA,IAC5D,CAAA,EAHsB,eAAA,CAAA;AAKtB,IAAA,cAAA,GAAiB,KAAA,CAAM,gBAAA,IAAoB,UAAA,EAAY,eAAA,EAAiB;AAAA,MACtE,KAAA,EAAO,SAAA;AAAA,MACP,MAAA,EAAQ,MAAA;AAAA,MACR,MAAA,EAAQ,MAAA;AAAA,MACR,GAAA,EAAK;AAAA,KACN,CAAA;AAGD,IAAA,cAAA,CAAe,MAAA,EAAQ,GAAG,MAAA,EAAQ,CAAC,UAAU,aAAA,CAAc,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAC,CAAA;AACjF,IAAA,cAAA,CAAe,MAAA,EAAQ,GAAG,MAAA,EAAQ,CAAC,UAAU,aAAA,CAAc,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAC,CAAA;AAAA,EACnF;AAKA,EAAyB;AAEvB,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,EAAY,OAAA,KAAiB;AAM/C,MAAA,cAAA,EAAgB,KAAK,CAAC,CAAA;AAAA,IACxB,CAAC,CAAA;AAED,IAAA,CAAC,SAAA,EAAW,QAAQ,CAAA,CAAE,OAAA,CAAQ,CAAC,MAAA,KAAW;AACxC,MAAA,OAAA,CAAQ,EAAA,CAAG,QAAQ,MAAM;AAEvB,QAAA,cAAA,EAAgB,KAAK,CAAC,CAAA;AACtB,QAAA,YAAA,CAAa,CAAC,CAAA;AAAA,MAChB,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EAEH;AAGA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,gBAAgB,MAAM,cAAA;AAC5B,IAAA,QAAA,GAAW,aAAA,CAAc,QAAA;AAAA,EAC3B,SAAS,KAAA,EAAO;AAEd,IAAA,IAAK,KAAA,CAAc,MAAA,KAAW,QAAA,IAAY,6BAAA,EAA+B;AAOzE,IAAA,IAAK,KAAA,CAAc,MAAA,KAAW,QAAA,IAAa,KAAA,CAAc,WAAW,SAAA,EAAW;AAC7E,MAAA,YAAA,CAAa,CAAC,CAAA;AAAA,IAChB,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,GAAA,CAAK,MAAgB,OAAO,CAAA;AACpC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,eAAe,CAAA,QAAA,CAAU,CAAA;AACjD,MAAA,OAAA,CAAQ,IAAI,2CAA2C,CAAA;AACvD,MAAA,OAAA,CAAQ,IAAI,2DAA2D,CAAA;AAAA,IAEzE;AACA,IAAA,QAAA,GAAY,MAAc,QAAA,IAAY,CAAA;AAAA,EACxC;AAYA,EAAqB;AACnB,IAAA,OAAO,aAAa,QAAQ,CAAA;AAAA,EAC9B;AAGF,CAAA,EA7ImE,WAAA","file":"chunk-NDRSG3XS.js","sourcesContent":["import { execa, type ResultPromise } from 'execa';\nimport which from 'which';\nimport { define } from 'gunshi';\nimport { gracefulExit } from 'exit-hook';\n\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { checkForConfigErrors, checkForSchemaErrors } from '../helpers/error-checks';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { resetRedactionMap, redactSensitiveConfig } from '../../runtime/env';\n\n\nexport const commandSpec = define({\n  name: 'run',\n  description: 'Run a command with your environment variables injected',\n  args: {\n    // watch: {\n    //   type: 'boolean',\n    //   short: 'w',\n    //   description: 'Watch mode',\n    // },\n    'no-redact-stdout': {\n      type: 'boolean',\n      description: 'Disable stdout/stderr redaction to preserve TTY detection for interactive tools',\n    },\n  },\n  examples: `\nExecutes a command in a child process, injecting your resolved and validated environment\nvariables from your .env files. Useful when a code-level integration is not possible.\n\nExamples:\n  varlock run -- node app.js                 # Run a Node.js application\n  varlock run -- python script.py            # Run a Python script\n  varlock run -- sh -c 'echo $MY_VAR'        # Use shell expansion for env vars\n  varlock run --no-redact-stdout -- psql     # Preserve TTY for interactive tools\n\n📍 Important: Use -- to separate varlock options from your command\n\n💡 Tip: For shell expansion of env vars, use: sh -c 'your command here'\n💡 Tip: Use --no-redact-stdout for interactive tools (psql, claude, etc.)\n  `.trim(),\n});\n\nlet commandProcess: ResultPromise | undefined;\nlet childCommandKilledFromRestart = false;\nconst isWatchModeRestart = false; // TODO: re-enable watch mode\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  // if \"--\" is present, split the args into our command and the rest, which will be another external command\n  const argv = process.argv.slice(2);\n  let restCommandArgs: Array<string> = [];\n  if (argv.includes('--')) {\n    const doubleDashIndex = argv.indexOf('--');\n    restCommandArgs = argv.slice(doubleDashIndex + 1);\n  } else {\n    throw new Error('No command to run! Your command should look like `varlock run -- <your-command>`');\n  }\n  const commandToRunAsArgs = restCommandArgs;\n  const commandToRunStr = restCommandArgs.join(' ');\n\n  const rawCommand = commandToRunAsArgs[0];\n  const commandArgsOnly = commandToRunAsArgs.slice(1);\n  const pathAwareCommand = which.sync(rawCommand, { nothrow: true });\n\n  // const isWatchEnabled = ctx.values.watch;\n  const isWatchEnabled = false;\n\n  // console.log('running command', pathAwareCommand || rawCommand, commandArgsOnly);\n\n\n  const envGraph = await loadVarlockEnvGraph();\n  checkForSchemaErrors(envGraph);\n  await envGraph.resolveEnvValues();\n  checkForConfigErrors(envGraph);\n\n  // will fail above if there are any errors\n\n  const resolvedEnv = envGraph.getResolvedEnvObject();\n  const serializedGraph = envGraph.getSerializedGraph();\n  // console.log(resolvedEnv);\n\n  // needs more thought here\n  const fullInjectedEnv = {\n    ...process.env,\n    ...resolvedEnv,\n    __VARLOCK_RUN: '1', // flag for a child process to detect it is runnign via `varlock run`\n    __VARLOCK_ENV: JSON.stringify(serializedGraph),\n  };\n\n  const redactLogs = serializedGraph.settings?.redactLogs ?? true;\n  const noRedactStdout = ctx.values['no-redact-stdout'] ?? false;\n\n  // Initialize the redaction map if redaction is enabled\n  if (redactLogs) {\n    resetRedactionMap(serializedGraph);\n  }\n\n  // When --no-redact-stdout is set, use stdio: 'inherit' to preserve TTY detection\n  // Otherwise, pipe stdout/stderr through redaction\n  if (noRedactStdout) {\n    commandProcess = execa(pathAwareCommand || rawCommand, commandArgsOnly, {\n      stdio: 'inherit',\n      env: fullInjectedEnv,\n    });\n  } else {\n    // Helper to redact and write output\n    const writeRedacted = (stream: NodeJS.WriteStream, chunk: Buffer | string) => {\n      const str = chunk.toString();\n      stream.write(redactLogs ? redactSensitiveConfig(str) : str);\n    };\n\n    commandProcess = execa(pathAwareCommand || rawCommand, commandArgsOnly, {\n      stdin: 'inherit',\n      stdout: 'pipe',\n      stderr: 'pipe',\n      env: fullInjectedEnv,\n    });\n\n    // Pipe stdout and stderr through redaction\n    commandProcess.stdout?.on('data', (chunk) => writeRedacted(process.stdout, chunk));\n    commandProcess.stderr?.on('data', (chunk) => writeRedacted(process.stderr, chunk));\n  }\n  // console.log('PARENT PID = ', process.pid);\n  // console.log('CHILD PID = ', commandProcess.pid);\n\n  // if first run, we need to attach some extra exit handling\n  if (!isWatchModeRestart) {\n    // try to make sure we shut down cleanly and kill the child process\n    process.on('exit', (_code: any, _signal: any) => {\n      // if (childCommandKilledFromRestart) {\n      //   childCommandKilledFromRestart = false;\n      //   return;\n      // }\n      // console.log('exit!', code, signal);\n      commandProcess?.kill(9);\n    });\n\n    ['SIGTERM', 'SIGINT'].forEach((signal) => {\n      process.on(signal, () => {\n        // console.log('SIGNAL = ', signal);\n        commandProcess?.kill(9);\n        gracefulExit(1);\n      });\n    });\n    // TODO: handle other signals?\n  }\n\n\n  let exitCode: any; // TODO: fix this any\n  try {\n    const commandResult = await commandProcess;\n    exitCode = commandResult.exitCode;\n  } catch (error) {\n    // console.log('child command error!', error);\n    if ((error as any).signal === 'SIGINT' && childCommandKilledFromRestart) {\n      // console.log('child command failed due to being killed form restart');\n      childCommandKilledFromRestart = false;\n      return;\n    }\n\n    // console.log('child command result error', error);\n    if ((error as any).signal === 'SIGINT' || (error as any).signal === 'SIGKILL') {\n      gracefulExit(1);\n    } else {\n      console.log((error as Error).message);\n      console.log(`command [${commandToRunStr}] failed`);\n      console.log('try running the same command without dmno');\n      console.log('if you get a different result, dmno may be the problem...');\n      // console.log(`Please report issue here: <${REPORT_ISSUE_LINK}>`);\n    }\n    exitCode = (error as any).exitCode || 1;\n  }\n\n  if (isWatchEnabled) {\n    if (!childCommandKilledFromRestart) {\n      if (exitCode === 0) {\n        console.log('\\n✅ command completed successfully');\n      } else {\n        console.log(`\\n💥 command failed - exit code = ${exitCode}`);\n      }\n    }\n  }\n\n  if (!isWatchEnabled) {\n    return gracefulExit(exitCode);\n  } else {\n    console.log('... watching for changes ...');\n  }\n};\n"]}

package/dist/{chunk-OOBWRTIS.js → chunk-RD44SH5U.js}

@@ -1,13 +1,13 @@
 import { redactString } from './chunk-FGMXIEFA.js';
 import { __commonJS, __name, __toESM } from './chunk-XN24GZXQ.js';
 import process2 from 'process';
-import { exec } from 'child_process';
-import { promisify } from 'util';
 import fs, { accessSync } from 'fs';
 import fs2, { access } from 'fs/promises';
+import os from 'os';
 import path2 from 'path';
 import { ParsedEnvSpecFunctionCall, ParsedEnvSpecStaticValue, ParsedEnvSpecFunctionArgs, ParsedEnvSpecKeyValuePair, parseEnvSpecDotEnvFile } from '@env-spec/parser';
-import os from 'os';
+import { exec } from 'child_process';
+import { promisify } from 'util';
 import crypto from 'crypto';
 import https from 'https';
 import semver from 'semver';
@@ -1097,30 +1097,6 @@ async function tryCatch(tryFn, catchFn) {
   }
 }
 __name(tryCatch, "tryCatch");
-var asyncExec = promisify(exec);
-
-// ../utils/src/git-utils.ts
-async function checkIsFileGitIgnored(path4, warnIfNotGitRepo = false) {
-  try {
-    await asyncExec(`git check-ignore ${path4} -q`);
-    return true;
-  } catch (err) {
-    const stderr = err.stderr;
-    if (err.status === 127 || stderr.includes("not found") || stderr.includes("not recognized")) {
-      return void 0;
-    }
-    if (err.code === "ENOENT") return void 0;
-    if (stderr === "") return false;
-    if (stderr.includes("not a git repository")) {
-      if (warnIfNotGitRepo) {
-        console.log("\u{1F536} Your code is not currently in a git repository - run `git init` to initialize a new repo.");
-      }
-      return false;
-    }
-    throw err;
-  }
-}
-__name(checkIsFileGitIgnored, "checkIsFileGitIgnored");
 async function pathExists(p) {
   try {
     await access(p);
@@ -1713,6 +1689,10 @@ var builtInItemDecorators = [
   {
     name: "sensitive"
   },
+  {
+    name: "public",
+    incompatibleWith: ["sensitive"]
+  },
   {
     name: "type",
     useFnArgsResolver: true
@@ -2976,17 +2956,19 @@ var ConfigItem = class {
   async processSensitive() {
     const sensitiveFromDataType = this.dataType?.isSensitive;
     for (const def of this.defs) {
-      const sensitiveDec = def.itemDef.decorators?.find((d) => d.name === "sensitive");
+      const sensitiveDecs = def.itemDef.decorators?.filter((d) => d.name === "sensitive" || d.name === "public") || [];
+      const sensitiveDec = sensitiveDecs[0];
       if (sensitiveDec) {
+        const usingPublic = sensitiveDec.name === "public";
         const sensitiveDecValue = await sensitiveDec.resolve();
         if (sensitiveDec.schemaErrors.length) {
           return;
         }
         if (![true, false, void 0].includes(sensitiveDecValue)) {
-          throw new SchemaError("@sensitive must resolve to a boolean or undefined");
+          throw new SchemaError("@sensitive/@public must resolve to a boolean or undefined");
         }
         if (sensitiveDecValue !== void 0) {
-          this._isSensitive = sensitiveDecValue;
+          this._isSensitive = usingPublic ? !sensitiveDecValue : sensitiveDecValue;
           return;
         }
       }
@@ -3301,7 +3283,7 @@ async function registerPluginInGraph(graph, plugin, pluginDecorator) {
 }
 __name(registerPluginInGraph, "registerPluginInGraph");
 async function downloadPlugin(url) {
-  const exec3 = promisify(exec);
+  const exec2 = promisify(exec);
   const cacheDir = path2.join(os.homedir(), ".varlock", "plugins-cache");
   const indexPath = path2.join(cacheDir, "index.json");
   await fs2.mkdir(cacheDir, { recursive: true });
@@ -3332,7 +3314,7 @@ async function downloadPlugin(url) {
   });
   const tmpExtractDir = path2.join(cacheDir, `tmp-extract-${crypto.randomBytes(8).toString("hex")}`);
   await fs2.mkdir(tmpExtractDir);
-  await exec3(`tar -xzf ${tmpTgz} -C ${tmpExtractDir}`);
+  await exec2(`tar -xzf ${tmpTgz} -C ${tmpExtractDir}`);
   let pkgJsonPath = path2.join(tmpExtractDir, "package", "package.json");
   let pluginRoot = path2.join(tmpExtractDir, "package");
   if (!await fs2.stat(pkgJsonPath).then(() => true, () => false)) {
@@ -3594,19 +3576,27 @@ var EnvGraphDataSource4 = class {
       this._loadingError = new Error("Cannot use both @currentEnv and @envFlag decorators");
     }
     let envFlagItemKey;
+    let skipCurrentEnvProcessing = false;
     if (currentEnvDec) {
-      await currentEnvDec.process();
-      if (!currentEnvDec.decValueResolver) {
-        throw new Error("No resolver found for @currentEnv decorator");
-      }
-      if (currentEnvDec.decValueResolver.fnName !== "ref") {
-        throw new Error("Expected @currentEnv decorator to be set to direct reference - ie `$APP_ENV`");
+      const parsedValue = currentEnvDec.parsedDecorator.value;
+      if (parsedValue instanceof ParsedEnvSpecFunctionCall && parsedValue.name === "ref") {
+        const args = parsedValue.simplifiedArgs;
+        if (Array.isArray(args) && args.length > 0 && typeof args[0] === "string") {
+          envFlagItemKey = args[0];
+          if (this.isPartialImport && !this.importKeys?.includes(envFlagItemKey)) {
+            skipCurrentEnvProcessing = true;
+          }
+        }
       }
-      const refArgValue = currentEnvDec.decValueResolver.arrArgs?.[0]?.staticValue;
-      if (!refArgValue || !my_dash_default.isString(refArgValue)) {
-        throw new Error("@currentEnv ref must be set to a string");
+      if (!skipCurrentEnvProcessing) {
+        await currentEnvDec.process();
+        if (!currentEnvDec.decValueResolver) {
+          throw new Error("No resolver found for @currentEnv decorator");
+        }
+        if (currentEnvDec.decValueResolver.fnName !== "ref") {
+          throw new Error("Expected @currentEnv decorator to be set to direct reference - ie `$APP_ENV`");
+        }
       }
-      envFlagItemKey = refArgValue;
     } else if (envFlagDec) {
       await envFlagDec.process();
       if (!envFlagDec.decValueResolver) throw new Error("@envFlag resolver not set");
@@ -3631,74 +3621,112 @@ var EnvGraphDataSource4 = class {
     const importDecs = this.getRootDecFns("import");
     if (importDecs.length) {
       for (const importDec of importDecs) {
-        const importArgs = await importDec.resolve();
-        const importPath = importArgs.arr[0];
-        const importKeys = importArgs.arr.slice(1);
-        if (!importKeys.every(my_dash_default.isString)) {
-          throw new Error("expected @import keys to all be strings");
-        }
-        if (importPath.startsWith("./") || importPath.startsWith("../")) {
-          if (!(this instanceof FileBasedDataSource)) {
-            throw new Error("@import of files can only be used from a file-based data source");
-          }
-          const fullImportPath = path2.resolve(this.fullPath, "..", importPath);
-          const fileName = path2.basename(fullImportPath);
-          if (this.graph.virtualImports) {
-            if (importPath.endsWith("/")) {
-              if (!Object.keys(this.graph.virtualImports).some((p) => p.startsWith(fullImportPath))) {
-                this._loadingError = new Error(`Virtual directory import ${fullImportPath} not found`);
-                return;
-              }
-              await this.addChild(new DirectoryDataSource(fullImportPath), {
-                isImport: true,
-                importKeys
-              });
-            } else {
-              if (!this.graph.virtualImports[fullImportPath]) {
-                this._loadingError = new Error(`Virtual import ${fullImportPath} not found`);
-                return;
+        try {
+          await importDec.process();
+          if (importDec.decValueResolver?.objArgs?.enabled) {
+            const enabledResolver = importDec.decValueResolver.objArgs.enabled;
+            const enabledDeps = enabledResolver.deps;
+            for (const depKey of enabledDeps) {
+              const depItem = this.graph.configSchema[depKey];
+              if (!depItem) {
+                throw new Error(`@import enabled parameter depends on non-existent item: ${depKey}`);
               }
-              const source = new DotEnvFileDataSource(fullImportPath, {
-                overrideContents: this.graph.virtualImports[fullImportPath]
-              });
-              await this.addChild(source, { isImport: true, importKeys });
+              await depItem.earlyResolve();
             }
-          } else {
-            const fsStat = await tryCatch(async () => fs2.stat(fullImportPath), (_err) => {
-            });
-            if (!fsStat) {
-              this._loadingError = new Error(`Import path does not exist: ${fullImportPath}`);
-              return;
+          }
+          const importArgs = await importDec.resolve();
+          const importPath = importArgs.arr[0];
+          const importKeys = importArgs.arr.slice(1);
+          if (!importKeys.every(my_dash_default.isString)) {
+            throw new Error("expected @import keys to all be strings");
+          }
+          let fullImportPath;
+          if (importPath.startsWith("./") || importPath.startsWith("../")) {
+            if (!(this instanceof FileBasedDataSource)) {
+              throw new Error("@import of files can only be used from a file-based data source");
             }
-            if (importPath.endsWith("/")) {
-              if (fsStat.isDirectory()) {
+            fullImportPath = path2.resolve(this.fullPath, "..", importPath);
+          } else if (importPath.startsWith("~/") || importPath === "~") {
+            fullImportPath = path2.join(os.homedir(), importPath.slice(1));
+          } else if (importPath.startsWith("/")) {
+            fullImportPath = importPath;
+          }
+          const enabledValue = importArgs.obj.enabled ?? true;
+          if (!my_dash_default.isBoolean(enabledValue)) {
+            throw new Error("expected @import enabled parameter to be a boolean");
+          }
+          if (!enabledValue) continue;
+          const allowMissing = importArgs.obj.allowMissing ?? false;
+          if (!my_dash_default.isBoolean(allowMissing)) {
+            throw new Error("expected @import allowMissing parameter to be a boolean");
+          }
+          if (fullImportPath) {
+            const fileName = path2.basename(fullImportPath);
+            if (this.graph.virtualImports) {
+              if (importPath.endsWith("/")) {
+                const dirExists = Object.keys(this.graph.virtualImports).some((p) => p.startsWith(fullImportPath));
+                if (!dirExists && allowMissing) continue;
+                if (!dirExists) {
+                  this._loadingError = new Error(`Virtual directory import ${fullImportPath} not found`);
+                  return;
+                }
                 await this.addChild(new DirectoryDataSource(fullImportPath), {
                   isImport: true,
                   importKeys
                 });
               } else {
-                this._loadingError = new Error(`Imported path ending with "/" is not a directory: ${fullImportPath}`);
-                return;
+                const fileExists = this.graph.virtualImports[fullImportPath];
+                if (!fileExists && allowMissing) continue;
+                if (!fileExists) {
+                  this._loadingError = new Error(`Virtual import ${fullImportPath} not found`);
+                  return;
+                }
+                const source = new DotEnvFileDataSource(fullImportPath, {
+                  overrideContents: this.graph.virtualImports[fullImportPath]
+                });
+                await this.addChild(source, { isImport: true, importKeys });
               }
             } else {
-              if (fsStat.isDirectory()) {
-                this._loadingError = new Error('Imported path is a directory, add trailing "/" to import');
-                return;
-              } else if (!fileName.startsWith(".env.")) {
-                this._loadingError = new Error("imported file must be a .env.* file");
+              const fsStat = await tryCatch(async () => fs2.stat(fullImportPath), (_err) => {
+              });
+              if (!fsStat && allowMissing) continue;
+              if (!fsStat) {
+                this._loadingError = new Error(`Import path does not exist: ${fullImportPath}`);
                 return;
               }
-              await this.addChild(new DotEnvFileDataSource(fullImportPath), { isImport: true, importKeys });
+              if (importPath.endsWith("/")) {
+                if (fsStat.isDirectory()) {
+                  await this.addChild(new DirectoryDataSource(fullImportPath), {
+                    isImport: true,
+                    importKeys
+                  });
+                } else {
+                  this._loadingError = new Error(`Imported path ending with "/" is not a directory: ${fullImportPath}`);
+                  return;
+                }
+              } else {
+                if (fsStat.isDirectory()) {
+                  this._loadingError = new Error('Imported path is a directory, add trailing "/" to import');
+                  return;
+                } else if (!fileName.startsWith(".env.")) {
+                  this._loadingError = new Error("imported file must be a .env.* file");
+                  return;
+                }
+                await this.addChild(new DotEnvFileDataSource(fullImportPath), { isImport: true, importKeys });
+              }
             }
+          } else if (importPath.startsWith("http://") || importPath.startsWith("https://")) {
+            this._loadingError = new Error("http imports not supported yet");
+            return;
+          } else if (importPath.startsWith("npm:")) {
+            this._loadingError = new Error("npm imports not supported yet");
+            return;
+          } else {
+            this._loadingError = new Error("unsupported import type");
+            return;
           }
-        } else if (importPath.startsWith("http://") || importPath.startsWith("https://")) {
-          this._loadingError = new Error("http imports not supported yet");
-          return;
-        } else if (importPath.startsWith("npm:")) {
-          this._loadingError = new Error("npm imports not supported yet");
-          return;
-        } else {
-          this._loadingError = new Error("unsupported import type");
+        } catch (err) {
+          this._loadingError = err;
           return;
         }
       }
@@ -3758,7 +3786,6 @@ var FileBasedDataSource = class extends EnvGraphDataSource4 {
   static {
     __name(this, "FileBasedDataSource");
   }
-  isGitIgnored;
   fullPath;
   fileName;
   rawContents;
@@ -3782,7 +3809,6 @@ var FileBasedDataSource = class extends EnvGraphDataSource4 {
     this.relativePath = path2.relative(process.cwd(), fullPath);
     if (opts?.overrideContents) {
       this.rawContents = opts.overrideContents;
-      this.isGitIgnored = opts.overrideGitIgnored;
     }
     if (this.fileName.startsWith(".env")) {
       const fileNameParts = this.fileName.substring(1).split(".");
@@ -3813,7 +3839,6 @@ var FileBasedDataSource = class extends EnvGraphDataSource4 {
         this._loadingError = new Error(`File does not exist: ${this.fullPath}`);
         return;
       }
-      this.isGitIgnored = await checkIsFileGitIgnored(this.fullPath);
       this.rawContents = await fs2.readFile(this.fullPath, "utf8");
     }
     if (this.rawContents) await this._parseContents();
@@ -3894,7 +3919,22 @@ var DirectoryDataSource = class extends EnvGraphDataSource4 {
       this.schemaDataSource = this.children[this.children.length - 1];
     }
     await this.addAutoLoadedFile(".env.local");
-    const currentEnv = await this.resolveCurrentEnv() || this.envFlagValue;
+    let currentEnv;
+    if (this.schemaDataSource?._envFlagKey) {
+      const envFlagKey = this.schemaDataSource._envFlagKey;
+      if (this.isPartialImport && !this.importKeys?.includes(envFlagKey)) {
+        this._loadingError = new Error(
+          `Imported directory has @currentEnv set to $${envFlagKey}, but "${envFlagKey}" is not included in the import list. Add "${envFlagKey}" to the @import() arguments.`
+        );
+        return;
+      }
+      const envFlagItem = this.graph.configSchema[envFlagKey];
+      if (envFlagItem) {
+        if (!envFlagItem.resolvedValue) await envFlagItem.earlyResolve();
+        currentEnv = envFlagItem.resolvedValue?.toString();
+      }
+    }
+    currentEnv ||= (await this.resolveCurrentEnv())?.toString() || this.envFlagValue?.toString();
     if (currentEnv) {
       await this.addAutoLoadedFile(`.env.${currentEnv}`);
       await this.addAutoLoadedFile(`.env.${currentEnv}.local`);
@@ -4007,6 +4047,6 @@ function getItemSummary(item) {
 __name(getItemSummary, "getItemSummary");
 //! these are probably not relevant anymore, or needs to move to a plugin layer?
 
-export { CoercionError, ConfigLoadError, DotEnvFileDataSource, EnvGraph2 as EnvGraph, FileBasedDataSource, ResolutionError, SchemaError, ValidationError, VarlockError, ansis_default, asyncExitHook, checkIsFileGitIgnored, getItemSummary, gracefulExit, joinAndCompact, loadEnvGraph, my_dash_default, pathExists, pathExistsSync, tryCatch };
-//# sourceMappingURL=chunk-OOBWRTIS.js.map
-//# sourceMappingURL=chunk-OOBWRTIS.js.map
+export { CoercionError, ConfigLoadError, DotEnvFileDataSource, EnvGraph2 as EnvGraph, FileBasedDataSource, ResolutionError, SchemaError, ValidationError, VarlockError, ansis_default, asyncExitHook, getItemSummary, gracefulExit, joinAndCompact, loadEnvGraph, my_dash_default, pathExists, pathExistsSync, tryCatch };
+//# sourceMappingURL=chunk-RD44SH5U.js.map
+//# sourceMappingURL=chunk-RD44SH5U.js.map