varlock 0.5.0 → 0.6.1

package/dist/{chunk-NJ4ZGNLG.js → chunk-4JMFWK65.js}

@@ -1,7 +1,7 @@
-import { CliExitError } from './chunk-PZ7V7FPH.js';
+import { CliExitError } from './chunk-NPPZVF24.js';
 import { define } from './chunk-4A54P4EM.js';
-import { checkForSchemaErrors, checkForNoEnvFiles } from './chunk-PESGXOZ7.js';
-import { loadVarlockEnvGraph } from './chunk-4SXLKBVL.js';
+import { checkForSchemaErrors, checkForNoEnvFiles } from './chunk-FYZ7LKLX.js';
+import { loadVarlockEnvGraph } from './chunk-EXG5VPNZ.js';
 import { __name } from './chunk-6PEHRAEP.js';
 
 // src/cli/commands/typegen.command.ts
@@ -44,5 +44,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 
 export { commandFn, commandSpec };
-//# sourceMappingURL=chunk-NJ4ZGNLG.js.map
-//# sourceMappingURL=chunk-NJ4ZGNLG.js.map
+//# sourceMappingURL=chunk-4JMFWK65.js.map
+//# sourceMappingURL=chunk-4JMFWK65.js.map

package/dist/{chunk-NJ4ZGNLG.js.map → chunk-4JMFWK65.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/typegen.command.ts"],"names":[],"mappings":";;;;;;;AAOO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,SAAA;AAAA,EACN,WAAA,EAAa,gDAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA,CAAA,CAWV,IAAA;AACF,CAAC;AAGM,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAChF,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,CAAoB;AAAA,IACzC,aAAA,EAAe,IAAI,MAAA,CAAO;AAAA,GAC3B,CAAA;AACD,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAC7B,EAAA,kBAAA,CAAmB,QAAQ,CAAA;AAG3B,EAAA,MAAM,iBAAiB,MAAM,QAAA,CAAS,sBAAsB,EAAE,eAAA,EAAiB,MAAM,CAAA;AAErF,EAAA,IAAI,mBAAmB,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,aAAa,kDAAA,EAAoD;AAAA,MACzE,UAAA,EAAY;AAAA,KACb,CAAA;AAAA,EACH;AAEA,EAAA,OAAA,CAAQ,IAAI,qCAAgC,CAAA;AAC9C,CAAA,EAjBmE,WAAA","file":"chunk-NJ4ZGNLG.js","sourcesContent":["import { define } from 'gunshi';\n\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { checkForNoEnvFiles, checkForSchemaErrors } from '../helpers/error-checks';\nimport { CliExitError } from '../helpers/exit-error';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\n\nexport const commandSpec = define({\n  name: 'typegen',\n  description: 'Generate TypeScript types from your env schema',\n  args: {\n    path: {\n      type: 'string',\n      short: 'p',\n      description: 'Path to a specific .env file or directory to use as the entry point',\n    },\n  },\n  examples: `\nGenerates TypeScript type definitions from your .env schema files.\nUses only non-environment-specific schema info, so output is deterministic\nregardless of which environment is active.\n\nThis is useful when you have \\`@generateTypes(lang=ts, path=env.d.ts, auto=false)\\`\nin your schema to disable automatic type generation during \\`varlock load\\` or \\`varlock run\\`.\n\nExamples:\n  varlock typegen                    # Generate types using default schema\n  varlock typegen --path .env.prod   # Generate types from a specific .env file\n`.trim(),\n});\n\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  const envGraph = await loadVarlockEnvGraph({\n    entryFilePath: ctx.values.path as string | undefined,\n  });\n  checkForSchemaErrors(envGraph);\n  checkForNoEnvFiles(envGraph);\n\n  // Force type generation even if auto=false is set\n  const generatedCount = await envGraph.generateTypesIfNeeded({ ignoreAutoFalse: true });\n\n  if (generatedCount === 0) {\n    throw new CliExitError('No @generateTypes decorator found in your schema', {\n      suggestion: 'Add `@generateTypes(lang=ts, path=env.d.ts)` to your .env.schema file.',\n    });\n  }\n\n  console.log('✅ Types generated successfully');\n};\n"]}
+{"version":3,"sources":["../src/cli/commands/typegen.command.ts"],"names":[],"mappings":";;;;;;;AAOO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,SAAA;AAAA,EACN,WAAA,EAAa,gDAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA,CAAA,CAWV,IAAA;AACF,CAAC;AAGM,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAChF,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,CAAoB;AAAA,IACzC,aAAA,EAAe,IAAI,MAAA,CAAO;AAAA,GAC3B,CAAA;AACD,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAC7B,EAAA,kBAAA,CAAmB,QAAQ,CAAA;AAG3B,EAAA,MAAM,iBAAiB,MAAM,QAAA,CAAS,sBAAsB,EAAE,eAAA,EAAiB,MAAM,CAAA;AAErF,EAAA,IAAI,mBAAmB,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,aAAa,kDAAA,EAAoD;AAAA,MACzE,UAAA,EAAY;AAAA,KACb,CAAA;AAAA,EACH;AAEA,EAAA,OAAA,CAAQ,IAAI,qCAAgC,CAAA;AAC9C,CAAA,EAjBmE,WAAA","file":"chunk-4JMFWK65.js","sourcesContent":["import { define } from 'gunshi';\n\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { checkForNoEnvFiles, checkForSchemaErrors } from '../helpers/error-checks';\nimport { CliExitError } from '../helpers/exit-error';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\n\nexport const commandSpec = define({\n  name: 'typegen',\n  description: 'Generate TypeScript types from your env schema',\n  args: {\n    path: {\n      type: 'string',\n      short: 'p',\n      description: 'Path to a specific .env file or directory to use as the entry point',\n    },\n  },\n  examples: `\nGenerates TypeScript type definitions from your .env schema files.\nUses only non-environment-specific schema info, so output is deterministic\nregardless of which environment is active.\n\nThis is useful when you have \\`@generateTypes(lang=ts, path=env.d.ts, auto=false)\\`\nin your schema to disable automatic type generation during \\`varlock load\\` or \\`varlock run\\`.\n\nExamples:\n  varlock typegen                    # Generate types using default schema\n  varlock typegen --path .env.prod   # Generate types from a specific .env file\n`.trim(),\n});\n\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  const envGraph = await loadVarlockEnvGraph({\n    entryFilePath: ctx.values.path as string | undefined,\n  });\n  checkForSchemaErrors(envGraph);\n  checkForNoEnvFiles(envGraph);\n\n  // Force type generation even if auto=false is set\n  const generatedCount = await envGraph.generateTypesIfNeeded({ ignoreAutoFalse: true });\n\n  if (generatedCount === 0) {\n    throw new CliExitError('No @generateTypes decorator found in your schema', {\n      suggestion: 'Add `@generateTypes(lang=ts, path=env.d.ts)` to your .env.schema file.',\n    });\n  }\n\n  console.log('✅ Types generated successfully');\n};\n"]}

package/dist/{chunk-TYIS6T2T.js → chunk-BC7LU4LG.js}

@@ -1,4 +1,4 @@
-import { debug, varlockSettings, redactSensitiveConfig } from './chunk-WAMBVZL2.js';
+import { debug, varlockSettings, redactSensitiveConfig } from './chunk-IMB5QAZS.js';
 import { __name } from './chunk-6PEHRAEP.js';
 
 // src/runtime/patch-console.ts
@@ -40,5 +40,5 @@ function unpatchGlobalConsole() {
 __name(unpatchGlobalConsole, "unpatchGlobalConsole");
 
 export { patchGlobalConsole, unpatchGlobalConsole };
-//# sourceMappingURL=chunk-TYIS6T2T.js.map
-//# sourceMappingURL=chunk-TYIS6T2T.js.map
+//# sourceMappingURL=chunk-BC7LU4LG.js.map
+//# sourceMappingURL=chunk-BC7LU4LG.js.map

package/dist/{chunk-TYIS6T2T.js.map → chunk-BC7LU4LG.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/runtime/patch-console.ts"],"names":[],"mappings":";;;;AAWO,SAAS,kBAAA,GAAqB;AACnC,EAAA,KAAA,CAAM,8CAAoC,CAAA;AAC1C,EAAA,IAAK,OAAA,CAAQ,IAAY,iBAAA,EAAmB;AAC1C,IAAA,KAAA,CAAM,mBAAmB,CAAA;AACzB,IAAA;AAAA,EACF;AACA,EAAA,IAAI,eAAA,CAAgB,eAAe,KAAA,EAAO;AACxC,IAAA,KAAA,CAAM,wBAAwB,CAAA;AAC9B,IAAA;AAAA,EACF;AAQA,EAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,qBAAA,CAAsB,UAAA,CAAW,OAAO,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,KAAgB,iBAAiB,CAAA;AAG9H,EAAC,UAAA,CAAmB,4BAAA,KAAiC,UAAA,CAAW,OAAA,CAAQ,qBAAqB,CAAA;AAE7F,EAAA,UAAA,CAAW,OAAA,CAAQ,qBAAqB,CAAA,GAAI,WAAY;AACtD,IAAC,UAAA,CAAmB,4BAAA,CAA6B,KAAA,CAAM,IAAA,EAAM;AAAA,MAC3D,UAAU,CAAC,CAAA;AAAA,MACX,qBAAA,CAAsB,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,MAClC,UAAU,CAAC;AAAA,KACZ,CAAA;AAAA,EACH,CAAA;AAOA,EAAA,KAAA,MAAW,aAAA,IAAiB,CAAC,OAAA,EAAS,OAAA,EAAS,QAAQ,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAA,EAAG;AAEtF,IAAA,MAAM,iBAAA,GAAoB,UAAA,CAAW,OAAA,CAAQ,aAAa,CAAA;AAE1D,IAAA,MAAM,4BAAY,MAAA,CAAA,WAAY;AAE5B,MAAA,iBAAA,CAAkB,KAAA,CAAM,MAAM,KAAA,CAAM,IAAA,CAAK,SAAS,CAAA,CAAE,GAAA,CAAI,qBAAqB,CAAC,CAAA;AAAA,IAChF,CAAA,EAHkB,WAAA,CAAA;AAIlB,IAAA,SAAA,CAAU,iBAAA,GAAoB,IAAA;AAG9B,IAAA,UAAA,CAAW,OAAA,CAAQ,aAAa,CAAA,GAAI,SAAA;AAAA,EACtC;AACF;AAhDgB,MAAA,CAAA,kBAAA,EAAA,oBAAA,CAAA;AAuDT,SAAS,oBAAA,GAAuB;AAErC,EAAA,IAAI,CAAE,WAAmB,4BAAA,EAA8B;AAEvD,EAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,qBAAA,CAAsB,UAAA,CAAW,OAAO,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,KAAgB,iBAAiB,CAAA;AAE9H,EAAA,UAAA,CAAW,OAAA,CAAQ,qBAAqB,CAAA,GAAK,UAAA,CAAmB,4BAAA;AAChE,EAAA,OAAQ,UAAA,CAAmB,4BAAA;AAC7B;AARgB,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA","file":"chunk-TYIS6T2T.js","sourcesContent":["/* eslint-disable func-names, no-console, prefer-rest-params */\n\nimport { redactSensitiveConfig, varlockSettings } from './env';\nimport { debug } from './lib/debug';\n\n\n/**\n * patches global console methods to redact sensitive config\n *\n * NOTE - this may not be 100% foolproof depending on the platform\n * */\nexport function patchGlobalConsole() {\n  debug('⚡️ PATCHING global console methods');\n  if ((console.log as any)._varlockPatchedFn) {\n    debug('> already patched');\n    return;\n  }\n  if (varlockSettings.redactLogs === false) {\n    debug('> disabled by settings');\n    return;\n  }\n\n  // our method of patching involves replacing an internal node method which may not be called if console.log itself has also been patched\n  // for example AWS lambdas patches this to write the logs to a file which then is pushed to the rest of their system\n\n  // so first we'll just patch the internal method do deal with normal stdout/stderr logs -------------------------------------\n\n  // we need the internal symbol name to access the internal method\n  const kWriteToConsoleSymbol = Object.getOwnPropertySymbols(globalThis.console).find((s) => s.description === 'kWriteToConsole');\n\n  // @ts-ignore\n  (globalThis as any)._varlockOrigWriteToConsoleFn ||= globalThis.console[kWriteToConsoleSymbol];\n  // @ts-ignore\n  globalThis.console[kWriteToConsoleSymbol] = function () {\n    (globalThis as any)._varlockOrigWriteToConsoleFn.apply(this, [\n      arguments[0],\n      redactSensitiveConfig(arguments[1]),\n      arguments[2],\n    ]);\n  };\n\n  // and now we'll wrap console.log (and the other methods) if it looks like they have been patched already ------------------\n  // NOTE - this will not fully redact from everything since we can't safely reach deep into objects\n  // ideally we would only turn this when the above method does not work, but it's not trivial to detect when it that is the case\n  // so we'll turn it on all the time for now...\n\n  for (const logMethodName of ['trace', 'debug', 'info', 'log', 'info', 'warn', 'error']) {\n    // @ts-ignore\n    const originalLogMethod = globalThis.console[logMethodName];\n\n    const patchedFn = function () {\n      // @ts-ignore\n      originalLogMethod.apply(this, Array.from(arguments).map(redactSensitiveConfig));\n    };\n    patchedFn._varlockPatchedFn = true;\n\n    // @ts-ignore\n    globalThis.console[logMethodName] = patchedFn;\n  }\n}\n\n/**\n * restore's original global console methods to stop redacting secrets\n *\n * (only needed during local development when switching settings on/off in a process that does not reload)\n * */\nexport function unpatchGlobalConsole() {\n  // we'll only care about the normal case where console.log has NOT been patched by something else... (see above)\n  if (!(globalThis as any)._varlockOrigWriteToConsoleFn) return;\n\n  const kWriteToConsoleSymbol = Object.getOwnPropertySymbols(globalThis.console).find((s) => s.description === 'kWriteToConsole');\n  // @ts-ignore\n  globalThis.console[kWriteToConsoleSymbol] = (globalThis as any)._varlockOrigWriteToConsoleFn;\n  delete (globalThis as any)._varlockOrigWriteToConsoleFn;\n}\n"]}
+{"version":3,"sources":["../src/runtime/patch-console.ts"],"names":[],"mappings":";;;;AAWO,SAAS,kBAAA,GAAqB;AACnC,EAAA,KAAA,CAAM,8CAAoC,CAAA;AAC1C,EAAA,IAAK,OAAA,CAAQ,IAAY,iBAAA,EAAmB;AAC1C,IAAA,KAAA,CAAM,mBAAmB,CAAA;AACzB,IAAA;AAAA,EACF;AACA,EAAA,IAAI,eAAA,CAAgB,eAAe,KAAA,EAAO;AACxC,IAAA,KAAA,CAAM,wBAAwB,CAAA;AAC9B,IAAA;AAAA,EACF;AAQA,EAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,qBAAA,CAAsB,UAAA,CAAW,OAAO,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,KAAgB,iBAAiB,CAAA;AAG9H,EAAC,UAAA,CAAmB,4BAAA,KAAiC,UAAA,CAAW,OAAA,CAAQ,qBAAqB,CAAA;AAE7F,EAAA,UAAA,CAAW,OAAA,CAAQ,qBAAqB,CAAA,GAAI,WAAY;AACtD,IAAC,UAAA,CAAmB,4BAAA,CAA6B,KAAA,CAAM,IAAA,EAAM;AAAA,MAC3D,UAAU,CAAC,CAAA;AAAA,MACX,qBAAA,CAAsB,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,MAClC,UAAU,CAAC;AAAA,KACZ,CAAA;AAAA,EACH,CAAA;AAOA,EAAA,KAAA,MAAW,aAAA,IAAiB,CAAC,OAAA,EAAS,OAAA,EAAS,QAAQ,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAA,EAAG;AAEtF,IAAA,MAAM,iBAAA,GAAoB,UAAA,CAAW,OAAA,CAAQ,aAAa,CAAA;AAE1D,IAAA,MAAM,4BAAY,MAAA,CAAA,WAAY;AAE5B,MAAA,iBAAA,CAAkB,KAAA,CAAM,MAAM,KAAA,CAAM,IAAA,CAAK,SAAS,CAAA,CAAE,GAAA,CAAI,qBAAqB,CAAC,CAAA;AAAA,IAChF,CAAA,EAHkB,WAAA,CAAA;AAIlB,IAAA,SAAA,CAAU,iBAAA,GAAoB,IAAA;AAG9B,IAAA,UAAA,CAAW,OAAA,CAAQ,aAAa,CAAA,GAAI,SAAA;AAAA,EACtC;AACF;AAhDgB,MAAA,CAAA,kBAAA,EAAA,oBAAA,CAAA;AAuDT,SAAS,oBAAA,GAAuB;AAErC,EAAA,IAAI,CAAE,WAAmB,4BAAA,EAA8B;AAEvD,EAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,qBAAA,CAAsB,UAAA,CAAW,OAAO,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,KAAgB,iBAAiB,CAAA;AAE9H,EAAA,UAAA,CAAW,OAAA,CAAQ,qBAAqB,CAAA,GAAK,UAAA,CAAmB,4BAAA;AAChE,EAAA,OAAQ,UAAA,CAAmB,4BAAA;AAC7B;AARgB,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA","file":"chunk-BC7LU4LG.js","sourcesContent":["/* eslint-disable func-names, no-console, prefer-rest-params */\n\nimport { redactSensitiveConfig, varlockSettings } from './env';\nimport { debug } from './lib/debug';\n\n\n/**\n * patches global console methods to redact sensitive config\n *\n * NOTE - this may not be 100% foolproof depending on the platform\n * */\nexport function patchGlobalConsole() {\n  debug('⚡️ PATCHING global console methods');\n  if ((console.log as any)._varlockPatchedFn) {\n    debug('> already patched');\n    return;\n  }\n  if (varlockSettings.redactLogs === false) {\n    debug('> disabled by settings');\n    return;\n  }\n\n  // our method of patching involves replacing an internal node method which may not be called if console.log itself has also been patched\n  // for example AWS lambdas patches this to write the logs to a file which then is pushed to the rest of their system\n\n  // so first we'll just patch the internal method do deal with normal stdout/stderr logs -------------------------------------\n\n  // we need the internal symbol name to access the internal method\n  const kWriteToConsoleSymbol = Object.getOwnPropertySymbols(globalThis.console).find((s) => s.description === 'kWriteToConsole');\n\n  // @ts-ignore\n  (globalThis as any)._varlockOrigWriteToConsoleFn ||= globalThis.console[kWriteToConsoleSymbol];\n  // @ts-ignore\n  globalThis.console[kWriteToConsoleSymbol] = function () {\n    (globalThis as any)._varlockOrigWriteToConsoleFn.apply(this, [\n      arguments[0],\n      redactSensitiveConfig(arguments[1]),\n      arguments[2],\n    ]);\n  };\n\n  // and now we'll wrap console.log (and the other methods) if it looks like they have been patched already ------------------\n  // NOTE - this will not fully redact from everything since we can't safely reach deep into objects\n  // ideally we would only turn this when the above method does not work, but it's not trivial to detect when it that is the case\n  // so we'll turn it on all the time for now...\n\n  for (const logMethodName of ['trace', 'debug', 'info', 'log', 'info', 'warn', 'error']) {\n    // @ts-ignore\n    const originalLogMethod = globalThis.console[logMethodName];\n\n    const patchedFn = function () {\n      // @ts-ignore\n      originalLogMethod.apply(this, Array.from(arguments).map(redactSensitiveConfig));\n    };\n    patchedFn._varlockPatchedFn = true;\n\n    // @ts-ignore\n    globalThis.console[logMethodName] = patchedFn;\n  }\n}\n\n/**\n * restore's original global console methods to stop redacting secrets\n *\n * (only needed during local development when switching settings on/off in a process that does not reload)\n * */\nexport function unpatchGlobalConsole() {\n  // we'll only care about the normal case where console.log has NOT been patched by something else... (see above)\n  if (!(globalThis as any)._varlockOrigWriteToConsoleFn) return;\n\n  const kWriteToConsoleSymbol = Object.getOwnPropertySymbols(globalThis.console).find((s) => s.description === 'kWriteToConsole');\n  // @ts-ignore\n  globalThis.console[kWriteToConsoleSymbol] = (globalThis as any)._varlockOrigWriteToConsoleFn;\n  delete (globalThis as any)._varlockOrigWriteToConsoleFn;\n}\n"]}

package/dist/chunk-EXG5VPNZ.js

@@ -0,0 +1,17 @@
+import { loadEnvGraph } from './chunk-J7PA7B2U.js';
+import { runWithWorkspaceInfo } from './chunk-2AGKN64R.js';
+import { __name } from './chunk-6PEHRAEP.js';
+
+// src/lib/load-graph.ts
+function loadVarlockEnvGraph(opts) {
+  return runWithWorkspaceInfo(() => loadEnvGraph({
+    ...opts,
+    afterInit: /* @__PURE__ */ __name(async (_g) => {
+    }, "afterInit")
+  }));
+}
+__name(loadVarlockEnvGraph, "loadVarlockEnvGraph");
+
+export { loadVarlockEnvGraph };
+//# sourceMappingURL=chunk-EXG5VPNZ.js.map
+//# sourceMappingURL=chunk-EXG5VPNZ.js.map

package/dist/chunk-EXG5VPNZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/load-graph.ts"],"names":[],"mappings":";;;;;AAGO,SAAS,oBAAoB,IAAA,EAGjC;AACD,EAAA,OAAO,oBAAA,CAAqB,MAAM,YAAA,CAAa;AAAA,IAC7C,GAAG,IAAA;AAAA,IACH,SAAA,gCAAkB,EAAA,KAAO;AAAA,IAEzB,CAAA,EAFW,WAAA;AAAA,GAGZ,CAAC,CAAA;AACJ;AAVgB,MAAA,CAAA,mBAAA,EAAA,qBAAA,CAAA","file":"chunk-EXG5VPNZ.js","sourcesContent":["import { loadEnvGraph } from '../env-graph';\nimport { runWithWorkspaceInfo } from './workspace-utils';\n\nexport function loadVarlockEnvGraph(opts?: {\n  currentEnvFallback?: string,\n  entryFilePath?: string,\n}) {\n  return runWithWorkspaceInfo(() => loadEnvGraph({\n    ...opts,\n    afterInit: async (_g) => {\n      // TODO: register varlock resolver\n    },\n  }));\n}\n"]}

package/dist/{chunk-PESGXOZ7.js → chunk-FYZ7LKLX.js}

@@ -1,5 +1,5 @@
-import { ansis_default, gracefulExit, getItemSummary, joinAndCompact } from './chunk-2VSWBSVA.js';
-import { VarlockError, my_dash_default } from './chunk-FR2ITGSD.js';
+import { gracefulExit, getItemSummary, joinAndCompact } from './chunk-J7PA7B2U.js';
+import { ansis_default, VarlockError, my_dash_default } from './chunk-2AGKN64R.js';
 import { __name } from './chunk-6PEHRAEP.js';
 
 // src/cli/helpers/error-checks.ts
@@ -17,8 +17,13 @@ function showErrorLocationDetails(err) {
 __name(showErrorLocationDetails, "showErrorLocationDetails");
 function checkForNoEnvFiles(envGraph) {
   if (Object.keys(envGraph.configSchema).length === 0) {
-    console.error("\u{1F6A8} No .env or .env.schema files found\n");
-    console.error("Run `varlock init` to create a .env.schema file, or use `--path` to specify a file or directory.");
+    if (!envGraph.rootDataSource) {
+      console.error("\u{1F6A8} No .env or .env.schema files found\n");
+      console.error("Run `varlock init` to create a .env.schema file, or use `--path` to specify a file or directory.");
+    } else {
+      console.error("\u{1F6A8} No items defined in your .env or .env.schema files\n");
+      console.error("Add items to your .env.schema file to get started.");
+    }
     return gracefulExit(1);
   }
 }
@@ -48,6 +53,20 @@ ${ansis_default.dim("Stack trace:")}`);
   }
 }
 __name(checkForSchemaErrors, "checkForSchemaErrors");
+function showPluginWarnings(envGraph) {
+  for (const plugin of envGraph.plugins) {
+    if (!plugin.warnings.length) continue;
+    for (const warning of plugin.warnings) {
+      console.log(ansis_default.yellow(`[WARNING] ${warning.message}`));
+      if (warning.tip) {
+        for (const line of warning.tip.split("\n")) {
+          console.log(`  ${line}`);
+        }
+      }
+    }
+  }
+}
+__name(showPluginWarnings, "showPluginWarnings");
 var InvalidEnvError = class extends Error {
   static {
     __name(this, "InvalidEnvError");
@@ -98,11 +117,12 @@ function checkForConfigErrors(envGraph, opts) {
         console.error(getItemSummary(item));
       });
     }
+    showPluginWarnings(envGraph);
     throw new InvalidEnvError();
   }
 }
 __name(checkForConfigErrors, "checkForConfigErrors");
 
-export { InvalidEnvError, checkForConfigErrors, checkForNoEnvFiles, checkForSchemaErrors };
-//# sourceMappingURL=chunk-PESGXOZ7.js.map
-//# sourceMappingURL=chunk-PESGXOZ7.js.map
+export { InvalidEnvError, checkForConfigErrors, checkForNoEnvFiles, checkForSchemaErrors, showPluginWarnings };
+//# sourceMappingURL=chunk-FYZ7LKLX.js.map
+//# sourceMappingURL=chunk-FYZ7LKLX.js.map

package/dist/chunk-FYZ7LKLX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/helpers/error-checks.ts"],"names":[],"mappings":";;;;;AAQA,SAAS,yBAAyB,GAAA,EAAY;AAC5C,EAAA,IAAI,EAAE,GAAA,YAAe,YAAA,CAAA,IAAiB,CAAC,IAAI,QAAA,EAAU;AACrD,EAAA,MAAM,SAAS,GAAA,CAAI,QAAA;AACnB,EAAA,MAAM,UAAA,GAAa;AAAA,IACjB,MAAA,CAAO,OAAA;AAAA,IACP,CAAA,EAAG,aAAA,CAAM,IAAA,CAAK,GAAA,CAAI,OAAO,MAAA,CAAO,SAAA,GAAY,CAAC,CAAC,CAAC,CAAA,EAAG,aAAA,CAAM,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,GAClE,CAAE,KAAK,IAAI,CAAA;AAEX,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,UAAA,EAAM,MAAA,CAAO,EAAE,CAAA,CAAA,EAAI,OAAO,UAAU,CAAA,CAAA,EAAI,MAAA,CAAO,SAAS,CAAA,CAAE,CAAA;AACtE,EAAA,OAAA,CAAQ,IAAI,UAAU,CAAA;AACxB;AAXS,MAAA,CAAA,wBAAA,EAAA,0BAAA,CAAA;AAaF,SAAS,mBAAmB,QAAA,EAAoB;AACrD,EAAA,IAAI,OAAO,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,CAAE,WAAW,CAAA,EAAG;AACnD,IAAA,IAAI,CAAC,SAAS,cAAA,EAAgB;AAC5B,MAAA,OAAA,CAAQ,MAAM,gDAAyC,CAAA;AACvD,MAAA,OAAA,CAAQ,MAAM,kGAAkG,CAAA;AAAA,IAClH,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,MAAM,gEAAyD,CAAA;AACvE,MAAA,OAAA,CAAQ,MAAM,oDAAoD,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,aAAa,CAAC,CAAA;AAAA,EACvB;AACF;AAXgB,MAAA,CAAA,kBAAA,EAAA,oBAAA,CAAA;AAaT,SAAS,qBAAqB,QAAA,EAAoB;AAEvD,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,iBAAA,EAAmB;AAI/C,IAAA,IAAI,OAAO,YAAA,EAAc;AACvB,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,0CAAA,EAAsC,MAAA,CAAO,KAAK;AAAA,CAAI,CAAA;AAElE,MAAA,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,YAAA,CAAa,OAAO,CAAA;AACvC,MAAA,wBAAA,CAAyB,OAAO,YAAY,CAAA;AAI5C,MAAA,IAAI,OAAO,YAAA,CAAa,KAAA,IAAS,EAAE,MAAA,CAAO,wBAAwB,YAAA,CAAA,EAAe;AAC/E,QAAA,OAAA,CAAQ,GAAA,CAAI;AAAA,EAAK,aAAA,CAAM,GAAA,CAAI,cAAc,CAAC,CAAA,CAAE,CAAA;AAC5C,QAAA,OAAA,CAAQ,IAAI,aAAA,CAAM,GAAA,CAAI,MAAA,CAAO,YAAA,CAAa,KAAK,CAAC,CAAA;AAAA,MAClD;AAEA,MAAA,OAAO,aAAa,CAAC,CAAA;AAAA,IACvB;AAEA,IAAA,IAAI,MAAA,CAAO,aAAa,MAAA,EAAQ;AAC9B,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,kCAAA,EAA8B,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAExD,MAAA,KAAA,MAAW,SAAA,IAAa,OAAO,YAAA,EAAc;AAC3C,QAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAA,EAAK,SAAA,CAAU,OAAO,CAAA,CAAE,CAAA;AACpC,QAAA,wBAAA,CAAyB,SAAS,CAAA;AAAA,MACpC;AACA,MAAA,OAAO,aAAa,CAAC,CAAA;AAAA,IACvB;AAAA,EACF;AASF;AAxCgB,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AA2CT,SAAS,mBAAmB,QAAA,EAAoB;AACrD,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,OAAA,EAAS;AACrC,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,EAAQ;AAC7B,IAAA,KAAA,MAAW,OAAA,IAAW,OAAO,QAAA,EAAU;AACrC,MAAA,OAAA,CAAQ,IAAI,aAAA,CAAM,MAAA,CAAO,aAAa,OAAA,CAAQ,OAAO,EAAE,CAAC,CAAA;AACxD,MAAA,IAAI,QAAQ,GAAA,EAAK;AACf,QAAA,KAAA,MAAW,IAAA,IAAQ,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,EAAG;AAC1C,UAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAA,EAAK,IAAI,CAAA,CAAE,CAAA;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAZgB,MAAA,CAAA,kBAAA,EAAA,oBAAA,CAAA;AAcT,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EA3F3C;AA2F2C,IAAA,MAAA,CAAA,IAAA,EAAA,iBAAA,CAAA;AAAA;AAAA,EACzC,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,6CAA6C,CAAA;AAAA,EACrD;AAAA,EACA,kBAAA,GAAqB;AACnB,IAAA,OAAO;AAAA,UAAA,EAAQ,aAAA,CAAM,GAAA,CAAI,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,CAAA;AAAA,EACxC;AACF;AAEO,SAAS,oBAAA,CAAqB,UAAoB,IAAA,EAEtD;AAED,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,iBAAA,EAAmB;AAC/C,IAAA,IAAI,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAClC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,qCAAA,EAAiC,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAE3D,MAAA,KAAA,MAAW,GAAA,IAAO,OAAO,gBAAA,EAAkB;AACzC,QAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAA,EAAK,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAC9B,QAAA,IAAI,GAAA,YAAe,YAAA,IAAgB,GAAA,CAAI,GAAA,EAAK;AAC1C,UAAA,KAAA,MAAW,IAAA,IAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,EAAG;AACtC,YAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAA,EAAK,IAAI,CAAA,CAAE,CAAA;AAAA,UACzB;AAAA,QACF;AACA,QAAA,wBAAA,CAAyB,GAAG,CAAA;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAIA,EAAA,MAAM,eAAe,QAAA,CAAS,gBAAA,CAC3B,GAAA,CAAI,CAAC,MAAM,QAAA,CAAS,YAAA,CAAa,CAAC,CAAC,EACnC,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,oBAAoB,OAAO,CAAA;AAGpD,EAAA,IAAI,YAAA,CAAa,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAA,CAAQ,KAAA,CAAM;AAAA,+BAAA,EAAe,aAAA,CAAM,IAAA,CAAK,SAAA,CAAU,qCAAqC,CAAC,CAAA;AAAA,CAAc,CAAA;AACtG,IAAA,OAAA,CAAQ,MAAM,kBAAkB,CAAA;AAEhC,IAAA,eAAA,CAAE,IAAA,CAAK,YAAA,EAAc,CAAC,IAAA,KAAqB;AACzC,MAAA,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,IAAI,CAAC,CAAA;AAClC,MAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,IAChB,CAAC,CAAA;AACD,IAAA,IAAI,MAAM,OAAA,EAAS;AACjB,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,OAAA,CAAQ,MAAM,cAAA,CAAe;AAAA,QAC3B,cAAA;AAAA,QACA,aAAA,CAAM,MAAA,CAAO,IAAA,CAAK,oCAAoC;AAAA,OACvD,CAAC,CAAA;AACF,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,MAAM,aAAa,QAAA,CAAS,gBAAA,CACzB,GAAA,CAAI,CAAC,MAAM,QAAA,CAAS,YAAA,CAAa,CAAC,CAAC,EACnC,MAAA,CAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAA;AAC5B,MAAA,eAAA,CAAE,IAAA,CAAK,UAAA,EAAY,CAAC,IAAA,KAAqB;AACvC,QAAA,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,IAAI,CAAC,CAAA;AAAA,MACpC,CAAC,CAAA;AAAA,IACH;AAEA,IAAA,kBAAA,CAAmB,QAAQ,CAAA;AAC3B,IAAA,MAAM,IAAI,eAAA,EAAgB;AAAA,EAC5B;AACF;AArDgB,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA","file":"chunk-FYZ7LKLX.js","sourcesContent":["import ansis from 'ansis';\nimport { gracefulExit } from 'exit-hook';\nimport _ from '@env-spec/utils/my-dash';\nimport { EnvGraph, ConfigItem } from '../../env-graph';\nimport { getItemSummary, joinAndCompact } from '../../lib/formatting';\nimport { VarlockError } from '../../env-graph/lib/errors';\n\n\nfunction showErrorLocationDetails(err: Error) {\n  if (!(err instanceof VarlockError) || !err.location) return;\n  const errLoc = err.location;\n  const errPreview = [\n    errLoc.lineStr,\n    `${ansis.gray('-'.repeat(errLoc.colNumber - 1))}${ansis.red('^')}`,\n  ].join('\\n');\n\n  console.log('');\n  console.log(`📂 ${errLoc.id}:${errLoc.lineNumber}:${errLoc.colNumber}`);\n  console.log(errPreview);\n}\n\nexport function checkForNoEnvFiles(envGraph: EnvGraph) {\n  if (Object.keys(envGraph.configSchema).length === 0) {\n    if (!envGraph.rootDataSource) {\n      console.error('🚨 No .env or .env.schema files found\\n');\n      console.error('Run `varlock init` to create a .env.schema file, or use `--path` to specify a file or directory.');\n    } else {\n      console.error('🚨 No items defined in your .env or .env.schema files\\n');\n      console.error('Add items to your .env.schema file to get started.');\n    }\n    return gracefulExit(1);\n  }\n}\n\nexport function checkForSchemaErrors(envGraph: EnvGraph) {\n  // first we check for loading/parse errors - some cases we may want to let it fail silently?\n  for (const source of envGraph.sortedDataSources) {\n    // do we care about loading errors from disabled sources?\n    // if (source.disabled) continue;\n\n    if (source.loadingError) {\n      console.log(`🚨 Error encountered while loading ${source.label}\\n`);\n\n      console.log(source.loadingError.message);\n      showErrorLocationDetails(source.loadingError);\n\n      // For plugin loading errors, show the full stack trace since it's usually\n      // a runtime error from executing the plugin code\n      if (source.loadingError.stack && !(source.loadingError instanceof VarlockError)) {\n        console.log(`\\n${ansis.dim('Stack trace:')}`);\n        console.log(ansis.dim(source.loadingError.stack));\n      }\n\n      return gracefulExit(1);\n    }\n    // TODO: unify this with the above!\n    if (source.schemaErrors.length) {\n      console.log(`🚨 Error(s) encountered in ${source.label}`);\n\n      for (const schemaErr of source.schemaErrors) {\n        console.log(`- ${schemaErr.message}`);\n        showErrorLocationDetails(schemaErr);\n      }\n      return gracefulExit(1);\n    }\n  }\n\n  // now we check for any schema errors - where something about how things are wired up is invalid\n  // NOTE - we should not have run any resolution yet\n  // TODO: make sure we are calling this before attempting to resolve values\n  // const failingItems = _.filter(_.values(envGraph.configSchema), (item) => item.validationState === 'error');\n  // if (failingItems.length > 0) {\n  //   throw new CliExitError('Schema is currently invalid');\n  // }\n}\n\n\nexport function showPluginWarnings(envGraph: EnvGraph) {\n  for (const plugin of envGraph.plugins) {\n    if (!plugin.warnings.length) continue;\n    for (const warning of plugin.warnings) {\n      console.log(ansis.yellow(`[WARNING] ${warning.message}`));\n      if (warning.tip) {\n        for (const line of warning.tip.split('\\n')) {\n          console.log(`  ${line}`);\n        }\n      }\n    }\n  }\n}\n\nexport class InvalidEnvError extends Error {\n  constructor() {\n    super('Resolved config/env did not pass validation');\n  }\n  getFormattedOutput() {\n    return `\\n💥 ${ansis.red(this.message)} 💥\\n`;\n  }\n}\n\nexport function checkForConfigErrors(envGraph: EnvGraph, opts?: {\n  showAll?: boolean\n}) {\n  // check for root decorator \"execution\"\n  for (const source of envGraph.sortedDataSources) {\n    if (source.resolutionErrors.length) {\n      console.log(`🚨 Root decorator error(s) in ${source.label}`);\n\n      for (const err of source.resolutionErrors) {\n        console.log(`- ${err.message}`);\n        if (err instanceof VarlockError && err.tip) {\n          for (const line of err.tip.split('\\n')) {\n            console.log(`  ${line}`);\n          }\n        }\n        showErrorLocationDetails(err);\n      }\n    }\n  }\n\n\n\n  const failingItems = envGraph.sortedConfigKeys\n    .map((k) => envGraph.configSchema[k])\n    .filter((item) => item.validationState === 'error');\n\n  // TODO: use service.isValid?\n  if (failingItems.length > 0) {\n    console.error(`\\n🚨 🚨 🚨  ${ansis.bold.underline('Configuration is currently invalid ')}  🚨 🚨 🚨\\n`);\n    console.error('Invalid items:\\n');\n\n    _.each(failingItems, (item: ConfigItem) => {\n      console.error(getItemSummary(item));\n      console.error();\n    });\n    if (opts?.showAll) {\n      console.error();\n      console.error(joinAndCompact([\n        'Valid items:',\n        ansis.italic.gray('(remove `--show-all` flag to hide)'),\n      ]));\n      console.error();\n      const validItems = envGraph.sortedConfigKeys\n        .map((k) => envGraph.configSchema[k])\n        .filter((i) => !!i.isValid);\n      _.each(validItems, (item: ConfigItem) => {\n        console.error(getItemSummary(item));\n      });\n    }\n\n    showPluginWarnings(envGraph);\n    throw new InvalidEnvError();\n  }\n}\n"]}

package/dist/{chunk-BMTZBDMN.js → chunk-G7FDCTNA.js}

@@ -1,11 +1,11 @@
 import { spawnAsync } from './chunk-Y3ITSQA4.js';
-import { detectJsPackageManager, logLines, fmt } from './chunk-UHUZMCOL.js';
-import { CliExitError } from './chunk-PZ7V7FPH.js';
+import { detectJsPackageManager, logLines, fmt } from './chunk-TLEEAUD7.js';
+import { CliExitError } from './chunk-NPPZVF24.js';
 import { define } from './chunk-4A54P4EM.js';
-import { loadVarlockEnvGraph } from './chunk-4SXLKBVL.js';
-import { ansis_default, gracefulExit } from './chunk-2VSWBSVA.js';
-import { pathExists, my_dash_default } from './chunk-FR2ITGSD.js';
-import { redactString } from './chunk-MIBOBKI4.js';
+import { loadVarlockEnvGraph } from './chunk-EXG5VPNZ.js';
+import { gracefulExit } from './chunk-J7PA7B2U.js';
+import { pathExists, ansis_default, my_dash_default } from './chunk-2AGKN64R.js';
+import { redactString } from './chunk-XLYSNOR3.js';
 import { __name } from './chunk-6PEHRAEP.js';
 import path from 'path';
 import fs from 'fs/promises';
@@ -401,5 +401,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 
 export { commandFn, commandSpec, getGitFiles, scanFileForValues, walkDirectory };
-//# sourceMappingURL=chunk-BMTZBDMN.js.map
-//# sourceMappingURL=chunk-BMTZBDMN.js.map
+//# sourceMappingURL=chunk-G7FDCTNA.js.map
+//# sourceMappingURL=chunk-G7FDCTNA.js.map

package/dist/{chunk-BMTZBDMN.js.map → chunk-G7FDCTNA.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/helpers/install-detection.ts","../src/cli/commands/scan.command.ts"],"names":[],"mappings":";;;;;;;;;;;;;AACO,SAAS,YAAA,GAAe;AAC7B,EAAA,IAAI;AACF,IAAA,OAAO,KAAA;AAAA,EACT,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AANgB,MAAA,CAAA,YAAA,EAAA,cAAA,CAAA;;;ACiBhB,IAAM,SAAA,uBAAgB,GAAA,CAAI;AAAA,EACxB,MAAA;AAAA,EACA,cAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,IAAM,iBAAA,uBAAwB,GAAA,CAAI;AAAA,EAChC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,MAAA;AAAA,EACN,WAAA,EAAa,wEAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,iBAAA,EAAmB;AAAA,MACjB,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,cAAA,EAAgB;AAAA,MACd,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA,CAUR,IAAA;AACJ,CAAC;AAWD,eAAsB,WAAA,CAAY,KAAa,UAAA,EAAoD;AACjG,EAAA,IAAI;AACF,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAA,GAAS,MAAM,UAAA;AAAA,QACb,KAAA;AAAA,QACA,CAAC,MAAA,EAAQ,UAAA,EAAY,aAAA,EAAe,MAAM,oBAAoB,CAAA;AAAA,QAC9D,EAAE,GAAA;AAAI,OACR;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAA,GAAS,MAAM,UAAA;AAAA,QACb,KAAA;AAAA,QACA,CAAC,UAAA,EAAY,UAAA,EAAY,UAAA,EAAY,sBAAsB,IAAI,CAAA;AAAA,QAC/D,EAAE,GAAA;AAAI,OACR;AAAA,IACF;AACA,IAAA,OAAO,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CACrC,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,iBAAA,CAAkB,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,CAAE,WAAA,EAAa,CAAC,CAAA,CACnE,GAAA,CAAI,CAAC,CAAA,KAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,CAAC,CAAC,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAtBsB,MAAA,CAAA,WAAA,EAAA,aAAA,CAAA;AAwBtB,eAAsB,cAAc,GAAA,EAAqC;AACvE,EAAA,MAAM,QAAuB,EAAC;AAC9B,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,EAAA,CAAG,OAAA,CAAQ,KAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAM,IAAI,CAAA;AAC1C,IAAA,IAAI,KAAA,CAAM,aAAY,EAAG;AACvB,MAAA,IAAI,SAAA,CAAU,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,EAAG;AAC/B,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,MAAM,aAAA,CAAc,QAAQ,CAAC,CAAA;AAAA,IAC7C,CAAA,MAAA,IAAW,KAAA,CAAM,MAAA,EAAO,EAAG;AACzB,MAAA,MAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,IAAI,EAAE,WAAA,EAAY;AACjD,MAAA,IAAI,iBAAA,CAAkB,GAAA,CAAI,GAAG,CAAA,EAAG;AAChC,MAAA,KAAA,CAAM,KAAK,QAAQ,CAAA;AAAA,IACrB;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AApBsB,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AA0BtB,eAAsB,iBAAA,CACpB,UACA,eAAA,EAC6B;AAC7B,EAAA,MAAM,WAA+B,EAAC;AACtC,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,EAAA,CAAG,QAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,EAC/C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,QAAA;AAAA,EACT;AAGA,EAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,IAAI,CAAA,EAAG,OAAO,QAAA;AAGnC,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,KAAA,MAAW,GAAA,IAAO,eAAA,CAAgB,MAAA,EAAO,EAAG;AAC1C,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AACzB,MAAA,QAAA,GAAW,IAAA;AACX,MAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,QAAA;AAEtB,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,IAAI,CAAA;AAChC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,IAAA,KAAA,MAAW,CAAC,OAAA,EAAS,GAAG,CAAA,IAAK,eAAA,EAAiB;AAC5C,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC/B,MAAA,IAAI,WAAW,EAAA,EAAI;AACjB,QAAA,QAAA,CAAS,IAAA,CAAK;AAAA,UACZ,QAAA;AAAA,UACA,YAAY,CAAA,GAAI,CAAA;AAAA,UAChB,cAAc,MAAA,GAAS,CAAA;AAAA,UACvB,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,UAChB,gBAAA,EAAkB,OAAA;AAAA,UAClB,cAAA,EAAgB;AAAA,SACjB,CAAA;AACD,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AA5CsB,MAAA,CAAA,iBAAA,EAAA,mBAAA,CAAA;AA8CtB,IAAM,YAAA,GAAe,cAAA;AAOrB,SAAS,cAAA,GAAyB;AAChC,EAAA,IAAI,YAAA,IAAgB,OAAO,YAAA;AAC3B,EAAA,MAAM,KAAK,sBAAA,EAAuB;AAClC,EAAA,IAAI,IAAI,OAAO,CAAA,EAAG,EAAA,CAAG,IAAI,IAAI,YAAY,CAAA,CAAA;AAEzC,EAAA,OAAO,YAAA;AACT;AANS,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAUT,eAAe,kBAAkB,GAAA,EAA8C;AAE7E,EAAA,IAAI,MAAM,WAAW,IAAA,CAAK,IAAA,CAAK,KAAK,QAAQ,CAAC,GAAG,OAAO,OAAA;AAGvD,EAAA,MAAM,aAAA,GAAgB,CAAC,cAAA,EAAgB,eAAA,EAAiB,iBAAiB,gBAAgB,CAAA;AACzF,EAAA,KAAA,MAAW,QAAQ,aAAA,EAAe;AAChC,IAAA,IAAI,MAAM,WAAW,IAAA,CAAK,IAAA,CAAK,KAAK,IAAI,CAAC,GAAG,OAAO,UAAA;AAAA,EACrD;AAGA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACjD,EAAA,IAAI,MAAM,UAAA,CAAW,WAAW,CAAA,EAAG;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,KAAK,KAAA,CAAM,MAAM,GAAG,QAAA,CAAS,WAAA,EAAa,OAAO,CAAC,CAAA;AAClE,MAAA,IAAI,OAAA,CAAQ,kBAAkB,CAAA,EAAG,OAAO,kBAAA;AAAA,IAC1C,CAAA,CAAA,MAAQ;AAAA,IAA4B;AAAA,EACtC;AAEA,EAAA,OAAO,IAAA;AACT;AApBe,MAAA,CAAA,iBAAA,EAAA,mBAAA,CAAA;AAsBf,eAAe,YAAY,GAAA,EAAqC;AAC9D,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,KAAA,EAAO,CAAC,aAAa,iBAAiB,CAAA,EAAG,EAAE,GAAA,EAAK,CAAA;AAC9E,IAAA,OAAO,KAAK,IAAA,EAAK;AAAA,EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAPe,MAAA,CAAA,WAAA,EAAA,aAAA,CAAA;AASf,eAAe,YAAY,GAAA,EAA4B;AACrD,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,CAAY,GAAG,CAAA;AACrC,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,aAAa,6BAAA,EAA+B;AAAA,MACpD,UAAA,EAAY;AAAA,KACb,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,cAAc,cAAA,EAAe;AACnC,EAAA,MAAM,UAAA,GAAa,CAAA;AAAA,EAAc,WAAW;AAAA,CAAA;AAC5C,EAAA,MAAM,WAAA,GAAc,MAAM,iBAAA,CAAkB,OAAO,CAAA;AAEnD,EAAA,IAAI,gBAAgB,OAAA,EAAS;AAC3B,IAAA,QAAA,CAAS;AAAA,MACP,EAAA;AAAA,MACA,CAAA,SAAA,EAAY,aAAA,CAAM,IAAA,CAAK,OAAO,CAAC,CAAA,0BAAA,CAAA;AAAA,MAC/B,EAAA;AAAA,MACA,CAAA,IAAA,EAAO,aAAA,CAAM,IAAA,CAAK,WAAW,CAAC,CAAA,yBAAA,CAAA;AAAA,MAC9B,EAAA;AAAA,MACA,aAAA,CAAM,GAAA,CAAI,CAAA,QAAA,EAAW,WAAW,CAAA,sBAAA,CAAwB,CAAA;AAAA,MACxD,EAAA;AAAA,MACA,4BAAA;AAAA,MACA,EAAA;AAAA,MACA,aAAA,CAAM,GAAA,CAAI,CAAA,QAAA,EAAW,WAAW,CAAA,qBAAA,CAAuB,CAAA;AAAA,MACvD;AAAA,KACD,CAAA;AACD,IAAA;AAAA,EACF;AAEA,EAAA,IAAI,gBAAgB,UAAA,EAAY;AAC9B,IAAA,QAAA,CAAS;AAAA,MACP,EAAA;AAAA,MACA,CAAA,SAAA,EAAY,aAAA,CAAM,IAAA,CAAK,UAAU,CAAC,CAAA,0BAAA,CAAA;AAAA,MAClC,EAAA;AAAA,MACA,4CAAA;AAAA,MACA,EAAA;AAAA,MACA,aAAA,CAAM,IAAI,eAAe,CAAA;AAAA,MACzB,aAAA,CAAM,IAAI,eAAe,CAAA;AAAA,MACzB,aAAA,CAAM,IAAI,qBAAqB,CAAA;AAAA,MAC/B,aAAA,CAAM,GAAA,CAAI,CAAA,aAAA,EAAgB,WAAW,CAAA,CAAE,CAAA;AAAA,MACvC;AAAA,KACD,CAAA;AACD,IAAA;AAAA,EACF;AAEA,EAAA,IAAI,gBAAgB,kBAAA,EAAoB;AACtC,IAAA,QAAA,CAAS;AAAA,MACP,EAAA;AAAA,MACA,CAAA,SAAA,EAAY,aAAA,CAAM,IAAA,CAAK,kBAAkB,CAAC,CAAA,sBAAA,CAAA;AAAA,MAC1C,EAAA;AAAA,MACA,yCAAA;AAAA,MACA,EAAA;AAAA,MACA,aAAA,CAAM,IAAI,yBAAyB,CAAA;AAAA,MACnC,aAAA,CAAM,GAAA,CAAI,CAAA,mBAAA,EAAsB,WAAW,CAAA,CAAA,CAAG,CAAA;AAAA,MAC9C,aAAA,CAAM,IAAI,KAAK,CAAA;AAAA,MACf,EAAA;AAAA,MACA,CAAA,SAAA,EAAY,aAAA,CAAM,GAAA,CAAI,sBAAsB,CAAC,CAAA,qBAAA,CAAA;AAAA,MAC7C;AAAA,KACD,CAAA;AACD,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,QAAQ,OAAO,CAAA;AACnD,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,QAAA,EAAU,YAAY,CAAA;AAGjD,EAAA,MAAM,GAAG,KAAA,CAAM,QAAA,EAAU,EAAE,SAAA,EAAW,MAAM,CAAA;AAG5C,EAAA,IAAI,MAAM,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC9B,IAAA,MAAM,eAAA,GAAkB,MAAM,EAAA,CAAG,QAAA,CAAS,UAAU,OAAO,CAAA;AAC3D,IAAA,IAAI,eAAA,CAAgB,QAAA,CAAS,YAAY,CAAA,EAAG;AAC1C,MAAA,QAAA,CAAS;AAAA,QACP,EAAA;AAAA,QACA,cAAM,KAAA,CAAM,CAAA,qCAAA,EAAwC,cAAM,IAAA,CAAK,YAAY,CAAC,CAAA,iBAAA,CAAmB,CAAA;AAAA,QAC/F;AAAA,OACD,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,cAAA,GAAiB,CAAA,EAAG,eAAA,CAAgB,OAAA,EAAS;AAAA,EAAK,WAAW;AAAA,CAAA;AACnE,IAAA,MAAM,EAAA,CAAG,SAAA,CAAU,QAAA,EAAU,cAAc,CAAA;AAC3C,IAAA,MAAM,EAAA,CAAG,KAAA,CAAM,QAAA,EAAU,GAAK,CAAA;AAC9B,IAAA,QAAA,CAAS;AAAA,MACP,EAAA;AAAA,MACA,cAAM,KAAA,CAAM,CAAA,MAAA,EAAS,cAAM,IAAA,CAAK,WAAW,CAAC,CAAA,6BAAA,CAA+B,CAAA;AAAA,MAC3E,GAAA,CAAI,SAAS,QAAQ,CAAA;AAAA,MACrB;AAAA,KACD,CAAA;AACD,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,EAAA,CAAG,SAAA,CAAU,QAAA,EAAU,UAAU,CAAA;AACvC,EAAA,MAAM,EAAA,CAAG,KAAA,CAAM,QAAA,EAAU,GAAK,CAAA;AAC9B,EAAA,QAAA,CAAS;AAAA,IACP,EAAA;AAAA,IACA,cAAM,KAAA,CAAM,CAAA,2BAAA,EAA8B,IAAI,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAE,CAAA;AAAA,IAClE,aAAA,CAAM,IAAI,gFAAgF,CAAA;AAAA,IAC1F;AAAA,GACD,CAAA;AACH;AAtGe,MAAA,CAAA,WAAA,EAAA,aAAA,CAAA;AAwGR,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAEhF,EAAA,IAAI,GAAA,CAAI,MAAA,CAAO,cAAc,CAAA,EAAG;AAC9B,IAAA,MAAM,WAAA,CAAY,OAAA,CAAQ,GAAA,EAAK,CAAA;AAC/B,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,MAAA,CAAO,MAAA,IAAU,KAAA;AACxC,EAAA,MAAM,cAAA,GAAiB,GAAA,CAAI,MAAA,CAAO,iBAAiB,CAAA,IAAK,KAAA;AAGxD,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,CAAoB;AAAA,IACzC,aAAA,EAAe,IAAI,MAAA,CAAO;AAAA,GAC3B,CAAA;AAGD,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,iBAAA,EAAmB;AAC/C,IAAA,IAAI,OAAO,YAAA,EAAc;AACvB,MAAA,MAAM,IAAI,YAAA,CAAa,CAAA,sBAAA,EAAyB,MAAA,CAAO,YAAA,CAAa,OAAO,CAAA,CAAA,EAAI;AAAA,QAC7E,UAAA,EAAY;AAAA,OACb,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,gBAAA,EAAiB;AAGhC,EAAA,MAAM,eAAA,uBAAsB,GAAA,EAAoB;AAChD,EAAA,KAAA,MAAW,OAAA,IAAW,SAAS,YAAA,EAAc;AAC3C,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,YAAA,CAAa,OAAO,CAAA;AAC1C,IAAA,IAAI,IAAA,CAAK,eAAe,eAAA,CAAE,QAAA,CAAS,KAAK,aAAa,CAAA,IAAK,IAAA,CAAK,aAAA,KAAkB,EAAA,EAAI;AACnF,MAAA,eAAA,CAAgB,GAAA,CAAI,OAAA,EAAS,IAAA,CAAK,aAAa,CAAA;AAAA,IACjD;AAAA,EACF;AAEA,EAAA,IAAI,eAAA,CAAgB,SAAS,CAAA,EAAG;AAC9B,IAAA,QAAA,CAAS,CAAC,aAAA,CAAM,KAAA,CAAM,mEAA8D,CAAC,CAAC,CAAA;AACtF,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,EAAI;AACxB,EAAA,IAAI,KAAA;AAEJ,EAAA,IAAI,cAAA,EAAgB;AAElB,IAAA,KAAA,GAAQ,MAAM,cAAc,GAAG,CAAA;AAAA,EACjC,CAAA,MAAO;AAEL,IAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,GAAA,EAAK,UAAU,CAAA;AAClD,IAAA,IAAI,aAAa,IAAA,EAAM;AACrB,MAAA,KAAA,GAAQ,QAAA;AAAA,IACV,CAAA,MAAO;AAEL,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,MAAM,IAAI,aAAa,wCAAA,EAA0C;AAAA,UAC/D,UAAA,EAAY;AAAA,SACb,CAAA;AAAA,MACH;AACA,MAAA,KAAA,GAAQ,MAAM,cAAc,GAAG,CAAA;AAAA,IACjC;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,OAAA,CAAQ,IAAI,0BAA0B,CAAA;AAAA,IACxC,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,KAAA,CAAM,gCAA2B,CAAC,CAAA;AAAA,IACtD;AACA,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,cAAkC,EAAC;AACzC,EAAA,KAAA,MAAW,YAAY,KAAA,EAAO;AAC5B,IAAA,MAAM,QAAA,GAAW,MAAM,iBAAA,CAAkB,QAAA,EAAU,eAAe,CAAA;AAClE,IAAA,WAAA,CAAY,IAAA,CAAK,GAAG,QAAQ,CAAA;AAAA,EAC9B;AAEA,EAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,IAAA,QAAA,CAAS,CAAC,aAAA,CAAM,KAAA,CAAM,CAAA,wDAAA,EAAsD,MAAM,MAAM,CAAA,KAAA,EAAQ,KAAA,CAAM,MAAA,KAAW,CAAA,GAAI,EAAA,GAAK,GAAG,CAAA,CAAA,CAAG,CAAC,CAAC,CAAA;AAClI,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,cAAA,uBAAqB,GAAA,EAAgC;AAC3D,EAAA,KAAA,MAAW,WAAW,WAAA,EAAa;AACjC,IAAA,MAAM,WAAW,cAAA,CAAe,GAAA,CAAI,OAAA,CAAQ,QAAQ,KAAK,EAAC;AAC1D,IAAA,QAAA,CAAS,KAAK,OAAO,CAAA;AACrB,IAAA,cAAA,CAAe,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,QAAQ,CAAA;AAAA,EAC/C;AAEA,EAAA,OAAA,CAAQ,KAAA,CAAM,cAAM,GAAA,CAAI;AAAA,gBAAA,EAAc,WAAA,CAAY,MAAM,CAAA,wCAAA,EAA2C,cAAA,CAAe,IAAI,CAAA;AAAA,CAAa,CAAC,CAAA;AACpI,EAAA,KAAA,MAAW,CAAC,QAAA,EAAU,QAAQ,CAAA,IAAK,cAAA,EAAgB;AACjD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,QAAQ,CAAA;AAC3C,IAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAE9B,MAAA,MAAM,YAAA,GAAe,QAAQ,IAAA,CAAK,UAAA,CAAW,QAAQ,cAAA,EAAgB,YAAA,CAAa,OAAA,CAAQ,cAAc,CAAE,CAAA;AAC1G,MAAA,MAAM,aAAA,GAAgB,YAAA,CAAa,MAAA,GAAS,GAAA,GACxC,CAAA,EAAG,aAAa,SAAA,CAAU,CAAA,EAAG,GAAG,CAAC,CAAA,MAAA,CAAA,GACjC,YAAA;AACJ,MAAA,OAAA,CAAQ,KAAA,CAAM,KAAK,GAAA,CAAI,QAAA,CAAS,GAAG,OAAO,CAAA,CAAA,EAAI,QAAQ,UAAU,CAAA,CAAA,EAAI,QAAQ,YAAY,CAAA,CAAE,CAAC,CAAA,CAAA,EAAI,aAAA,CAAM,OAAO,OAAA,CAAQ,gBAAgB,CAAC,CAAA,CAAE,CAAA;AACvI,MAAA,OAAA,CAAQ,MAAM,CAAA,IAAA,EAAO,aAAA,CAAM,GAAA,CAAI,aAAa,CAAC,CAAA,CAAE,CAAA;AAAA,IACjD;AACA,IAAA,OAAA,CAAQ,MAAM,EAAE,CAAA;AAAA,EAClB;AAEA,EAAA,YAAA,CAAa,CAAC,CAAA;AAChB,CAAA,EA1GmE,WAAA","file":"chunk-BMTZBDMN.js","sourcesContent":["\nexport function isBundledSEA() {\n  try {\n    return __VARLOCK_SEA_BUILD__;\n  } catch (e) {\n    return false;\n  }\n}\n","import path from 'node:path';\nimport fs from 'node:fs/promises';\nimport { define } from 'gunshi';\nimport ansis from 'ansis';\nimport { gracefulExit } from 'exit-hook';\nimport _ from '@env-spec/utils/my-dash';\n\nimport { spawnAsync } from '@env-spec/utils/exec-helpers';\nimport { pathExists } from '@env-spec/utils/fs-utils';\nimport { redactString } from '../../runtime/lib/redaction';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { CliExitError } from '../helpers/exit-error';\nimport { fmt, logLines } from '../helpers/pretty-format';\nimport { detectJsPackageManager } from '../helpers/js-package-manager-utils';\nimport { isBundledSEA } from '../helpers/install-detection';\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\n\n// Directories to always skip when walking the file tree\nconst SKIP_DIRS = new Set([\n  '.git',\n  'node_modules',\n  'dist',\n  'build',\n  '.next',\n  '.nuxt',\n  'vendor',\n  '.venv',\n  'venv',\n  '__pycache__',\n  '.turbo',\n  'coverage',\n]);\n\n// File extensions that are binary and should be skipped\nconst BINARY_EXTENSIONS = new Set([\n  '.png',\n  '.jpg',\n  '.jpeg',\n  '.gif',\n  '.bmp',\n  '.ico',\n  '.mp3',\n  '.mp4',\n  '.wav',\n  '.avi',\n  '.mov',\n  '.zip',\n  '.tar',\n  '.gz',\n  '.rar',\n  '.7z',\n  '.exe',\n  '.dll',\n  '.so',\n  '.dylib',\n  '.bin',\n  '.pdf',\n  '.doc',\n  '.docx',\n  '.xls',\n  '.xlsx',\n  '.woff',\n  '.woff2',\n  '.ttf',\n  '.eot',\n  '.pyc',\n  '.class',\n  '.o',\n]);\n\nexport const commandSpec = define({\n  name: 'scan',\n  description: 'Scan files for sensitive config values that should not be in plaintext',\n  args: {\n    staged: {\n      type: 'boolean',\n      description: 'Only scan staged git files',\n    },\n    'include-ignored': {\n      type: 'boolean',\n      description: 'Include git-ignored files in the scan',\n    },\n    'install-hook': {\n      type: 'boolean',\n      description: 'Set up varlock scan as a git pre-commit hook',\n    },\n    path: {\n      type: 'string',\n      short: 'p',\n      description: 'Path to a specific .env file (e.g. .env.prod) or directory ending with \"/\" to use as the schema entry point (default: current directory)',\n    },\n  },\n  examples: `\nLoads your varlock config, resolves all sensitive values, then scans files to\nensure none of those sensitive values appear in plaintext.\n\nExamples:\n  varlock scan                    # Scan non-git-ignored files in current directory\n  varlock scan --staged           # Only scan staged git files\n  varlock scan --include-ignored  # Scan all files, including git-ignored ones\n  varlock scan --path .env.prod   # Use a specific .env file as the schema entry point\n  varlock scan --install-hook     # Set up as a git pre-commit hook\n  `.trim(),\n});\n\nexport interface ScanFinding {\n  filePath: string;\n  lineNumber: number;\n  columnNumber: number;\n  line: string;\n  sensitiveKeyName: string;\n  sensitiveValue: string;\n}\n\nexport async function getGitFiles(cwd: string, onlyStaged: boolean): Promise<Array<string> | null> {\n  try {\n    let output: string;\n    if (onlyStaged) {\n      output = await spawnAsync(\n        'git',\n        ['diff', '--cached', '--name-only', '-z', '--diff-filter=ACMR'],\n        { cwd },\n      );\n    } else {\n      output = await spawnAsync(\n        'git',\n        ['ls-files', '--cached', '--others', '--exclude-standard', '-z'],\n        { cwd },\n      );\n    }\n    return output.split('\\0').filter(Boolean)\n      .filter((f) => !BINARY_EXTENSIONS.has(path.extname(f).toLowerCase()))\n      .map((f) => path.resolve(cwd, f));\n  } catch {\n    return null;\n  }\n}\n\nexport async function walkDirectory(dir: string): Promise<Array<string>> {\n  const files: Array<string> = [];\n  let entries;\n  try {\n    entries = await fs.readdir(dir, { withFileTypes: true });\n  } catch {\n    return files;\n  }\n  for (const entry of entries) {\n    const fullPath = path.join(dir, entry.name);\n    if (entry.isDirectory()) {\n      if (SKIP_DIRS.has(entry.name)) continue;\n      files.push(...await walkDirectory(fullPath));\n    } else if (entry.isFile()) {\n      const ext = path.extname(entry.name).toLowerCase();\n      if (BINARY_EXTENSIONS.has(ext)) continue;\n      files.push(fullPath);\n    }\n  }\n  return files;\n}\n\n/**\n * Scans a single file for occurrences of any of the provided sensitive values.\n * sensitiveValues is a map from env key name to its resolved string value.\n */\nexport async function scanFileForValues(\n  filePath: string,\n  sensitiveValues: Map<string, string>,\n): Promise<Array<ScanFinding>> {\n  const findings: Array<ScanFinding> = [];\n  let content: string;\n  try {\n    content = await fs.readFile(filePath, 'utf-8');\n  } catch {\n    return findings;\n  }\n\n  // Skip binary files (contain null bytes)\n  if (content.includes('\\0')) return findings;\n\n  // Quick pre-check: skip the file entirely if none of the values appear\n  let anyMatch = false;\n  for (const val of sensitiveValues.values()) {\n    if (content.includes(val)) {\n      anyMatch = true;\n      break;\n    }\n  }\n  if (!anyMatch) return findings;\n\n  const lines = content.split('\\n');\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i];\n    for (const [keyName, val] of sensitiveValues) {\n      const colIdx = line.indexOf(val);\n      if (colIdx !== -1) {\n        findings.push({\n          filePath,\n          lineNumber: i + 1,\n          columnNumber: colIdx + 1,\n          line: line.trim(),\n          sensitiveKeyName: keyName,\n          sensitiveValue: val,\n        });\n        break; // one finding per line is enough\n      }\n    }\n  }\n  return findings;\n}\n\nconst SCAN_COMMAND = 'varlock scan';\n\n/**\n * Determines the correct command to use in a git hook script.\n * If varlock is installed as a standalone binary, uses `varlock` directly.\n * Otherwise, prefixes with the detected JS package manager's exec command.\n */\nfunction getHookCommand(): string {\n  if (isBundledSEA()) return SCAN_COMMAND;\n  const pm = detectJsPackageManager();\n  if (pm) return `${pm.exec} ${SCAN_COMMAND}`;\n  // fallback - assume varlock is available on PATH\n  return SCAN_COMMAND;\n}\n\ntype HookManagerKind = 'husky' | 'lefthook' | 'simple-git-hooks';\n\nasync function detectHookManager(cwd: string): Promise<HookManagerKind | null> {\n  // Check for husky\n  if (await pathExists(path.join(cwd, '.husky'))) return 'husky';\n\n  // Check for lefthook config files\n  const lefthookFiles = ['lefthook.yml', 'lefthook.yaml', '.lefthook.yml', '.lefthook.yaml'];\n  for (const file of lefthookFiles) {\n    if (await pathExists(path.join(cwd, file))) return 'lefthook';\n  }\n\n  // Check for simple-git-hooks in package.json\n  const pkgJsonPath = path.join(cwd, 'package.json');\n  if (await pathExists(pkgJsonPath)) {\n    try {\n      const pkgJson = JSON.parse(await fs.readFile(pkgJsonPath, 'utf-8'));\n      if (pkgJson['simple-git-hooks']) return 'simple-git-hooks';\n    } catch { /* ignore parse errors */ }\n  }\n\n  return null;\n}\n\nasync function findGitRoot(cwd: string): Promise<string | null> {\n  try {\n    const root = await spawnAsync('git', ['rev-parse', '--show-toplevel'], { cwd });\n    return root.trim();\n  } catch {\n    return null;\n  }\n}\n\nasync function installHook(cwd: string): Promise<void> {\n  const gitRoot = await findGitRoot(cwd);\n  if (!gitRoot) {\n    throw new CliExitError('Not inside a git repository', {\n      suggestion: 'Run `git init` first, or make sure you are inside a git repository.',\n    });\n  }\n\n  const hookCommand = getHookCommand();\n  const hookScript = `#!/bin/sh\\n${hookCommand}\\n`;\n  const hookManager = await detectHookManager(gitRoot);\n\n  if (hookManager === 'husky') {\n    logLines([\n      '',\n      `Detected ${ansis.bold('husky')} as your git hook manager.`,\n      '',\n      `Add ${ansis.bold(hookCommand)} to your pre-commit hook:`,\n      '',\n      ansis.dim(`  echo \"${hookCommand}\" >> .husky/pre-commit`),\n      '',\n      'Or if creating a new hook:',\n      '',\n      ansis.dim(`  echo \"${hookCommand}\" > .husky/pre-commit`),\n      '',\n    ]);\n    return;\n  }\n\n  if (hookManager === 'lefthook') {\n    logLines([\n      '',\n      `Detected ${ansis.bold('lefthook')} as your git hook manager.`,\n      '',\n      'Add the following to your lefthook config:',\n      '',\n      ansis.dim('  pre-commit:'),\n      ansis.dim('    commands:'),\n      ansis.dim('      varlock-scan:'),\n      ansis.dim(`        run: ${hookCommand}`),\n      '',\n    ]);\n    return;\n  }\n\n  if (hookManager === 'simple-git-hooks') {\n    logLines([\n      '',\n      `Detected ${ansis.bold('simple-git-hooks')} in your package.json.`,\n      '',\n      'Add the following to your package.json:',\n      '',\n      ansis.dim('  \"simple-git-hooks\": {'),\n      ansis.dim(`    \"pre-commit\": \"${hookCommand}\"`),\n      ansis.dim('  }'),\n      '',\n      `Then run ${ansis.dim('npx simple-git-hooks')} to update the hooks.`,\n      '',\n    ]);\n    return;\n  }\n\n  // No hook manager detected -- install directly to .git/hooks/pre-commit\n  const hooksDir = path.join(gitRoot, '.git', 'hooks');\n  const hookPath = path.join(hooksDir, 'pre-commit');\n\n  // Ensure hooks directory exists\n  await fs.mkdir(hooksDir, { recursive: true });\n\n  // Check if a pre-commit hook already exists\n  if (await pathExists(hookPath)) {\n    const existingContent = await fs.readFile(hookPath, 'utf-8');\n    if (existingContent.includes(SCAN_COMMAND)) {\n      logLines([\n        '',\n        ansis.green(`The pre-commit hook already includes ${ansis.bold(SCAN_COMMAND)} - nothing to do!`),\n        '',\n      ]);\n      return;\n    }\n    // Append to existing hook\n    const updatedContent = `${existingContent.trimEnd()}\\n${hookCommand}\\n`;\n    await fs.writeFile(hookPath, updatedContent);\n    await fs.chmod(hookPath, 0o755);\n    logLines([\n      '',\n      ansis.green(`Added ${ansis.bold(hookCommand)} to existing pre-commit hook.`),\n      fmt.filePath(hookPath),\n      '',\n    ]);\n    return;\n  }\n\n  // Create new hook\n  await fs.writeFile(hookPath, hookScript);\n  await fs.chmod(hookPath, 0o755);\n  logLines([\n    '',\n    ansis.green(`Created pre-commit hook at ${fmt.filePath(hookPath)}`),\n    ansis.dim('Your staged files will now be scanned for sensitive values before each commit.'),\n    '',\n  ]);\n}\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  // Handle --install-hook before doing any scanning\n  if (ctx.values['install-hook']) {\n    await installHook(process.cwd());\n    return;\n  }\n\n  const onlyStaged = ctx.values.staged ?? false;\n  const includeIgnored = ctx.values['include-ignored'] ?? false;\n\n  // Load the varlock env graph to get the actual sensitive values\n  const envGraph = await loadVarlockEnvGraph({\n    entryFilePath: ctx.values.path,\n  });\n\n  // Check for loading/schema errors\n  for (const source of envGraph.sortedDataSources) {\n    if (source.loadingError) {\n      throw new CliExitError(`Error loading config: ${source.loadingError.message}`, {\n        suggestion: 'Make sure your .env.schema file is valid.',\n      });\n    }\n  }\n\n  await envGraph.resolveEnvValues();\n\n  // Collect all sensitive string values that are non-empty\n  const sensitiveValues = new Map<string, string>();\n  for (const itemKey in envGraph.configSchema) {\n    const item = envGraph.configSchema[itemKey];\n    if (item.isSensitive && _.isString(item.resolvedValue) && item.resolvedValue !== '') {\n      sensitiveValues.set(itemKey, item.resolvedValue);\n    }\n  }\n\n  if (sensitiveValues.size === 0) {\n    logLines([ansis.green('✅ No sensitive values found in config - nothing to scan for.')]);\n    return;\n  }\n\n  const cwd = process.cwd();\n  let files: Array<string>;\n\n  if (includeIgnored) {\n    // Walk the full directory tree, no git filtering\n    files = await walkDirectory(cwd);\n  } else {\n    // Try to use git to get non-ignored files\n    const gitFiles = await getGitFiles(cwd, onlyStaged);\n    if (gitFiles !== null) {\n      files = gitFiles;\n    } else {\n      // Git not available - fall back to walking directory\n      if (onlyStaged) {\n        throw new CliExitError('Could not run git to find staged files', {\n          suggestion: 'Make sure git is installed and you are inside a git repository.',\n        });\n      }\n      files = await walkDirectory(cwd);\n    }\n  }\n\n  if (files.length === 0) {\n    if (onlyStaged) {\n      console.log('No staged files to scan.');\n    } else {\n      console.log(ansis.green('✅ No files found to scan.'));\n    }\n    return;\n  }\n\n  const allFindings: Array<ScanFinding> = [];\n  for (const filePath of files) {\n    const findings = await scanFileForValues(filePath, sensitiveValues);\n    allFindings.push(...findings);\n  }\n\n  if (allFindings.length === 0) {\n    logLines([ansis.green(`✅ No sensitive values found in plaintext. (scanned ${files.length} file${files.length === 1 ? '' : 's'})`)]);\n    return;\n  }\n\n  // Group findings by file for display\n  const findingsByFile = new Map<string, Array<ScanFinding>>();\n  for (const finding of allFindings) {\n    const existing = findingsByFile.get(finding.filePath) ?? [];\n    existing.push(finding);\n    findingsByFile.set(finding.filePath, existing);\n  }\n\n  console.error(ansis.red(`\\n🚨 Found ${allFindings.length} sensitive value(s) in plaintext across ${findingsByFile.size} file(s):\\n`));\n  for (const [filePath, findings] of findingsByFile) {\n    const relPath = path.relative(cwd, filePath);\n    for (const finding of findings) {\n      // Redact the actual secret value in the displayed line\n      const redactedLine = finding.line.replaceAll(finding.sensitiveValue, redactString(finding.sensitiveValue)!);\n      const truncatedLine = redactedLine.length > 100\n        ? `${redactedLine.substring(0, 100)}…`\n        : redactedLine;\n      console.error(`  ${fmt.fileName(`${relPath}:${finding.lineNumber}:${finding.columnNumber}`)} ${ansis.yellow(finding.sensitiveKeyName)}`);\n      console.error(`    ${ansis.dim(truncatedLine)}`);\n    }\n    console.error('');\n  }\n\n  gracefulExit(1);\n};\n"]}
+{"version":3,"sources":["../src/cli/helpers/install-detection.ts","../src/cli/commands/scan.command.ts"],"names":[],"mappings":";;;;;;;;;;;;;AACO,SAAS,YAAA,GAAe;AAC7B,EAAA,IAAI;AACF,IAAA,OAAO,KAAA;AAAA,EACT,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AANgB,MAAA,CAAA,YAAA,EAAA,cAAA,CAAA;;;ACiBhB,IAAM,SAAA,uBAAgB,GAAA,CAAI;AAAA,EACxB,MAAA;AAAA,EACA,cAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,IAAM,iBAAA,uBAAwB,GAAA,CAAI;AAAA,EAChC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,MAAA;AAAA,EACN,WAAA,EAAa,wEAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,iBAAA,EAAmB;AAAA,MACjB,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,cAAA,EAAgB;AAAA,MACd,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA,CAUR,IAAA;AACJ,CAAC;AAWD,eAAsB,WAAA,CAAY,KAAa,UAAA,EAAoD;AACjG,EAAA,IAAI;AACF,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAA,GAAS,MAAM,UAAA;AAAA,QACb,KAAA;AAAA,QACA,CAAC,MAAA,EAAQ,UAAA,EAAY,aAAA,EAAe,MAAM,oBAAoB,CAAA;AAAA,QAC9D,EAAE,GAAA;AAAI,OACR;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAA,GAAS,MAAM,UAAA;AAAA,QACb,KAAA;AAAA,QACA,CAAC,UAAA,EAAY,UAAA,EAAY,UAAA,EAAY,sBAAsB,IAAI,CAAA;AAAA,QAC/D,EAAE,GAAA;AAAI,OACR;AAAA,IACF;AACA,IAAA,OAAO,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CACrC,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,iBAAA,CAAkB,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,CAAE,WAAA,EAAa,CAAC,CAAA,CACnE,GAAA,CAAI,CAAC,CAAA,KAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,CAAC,CAAC,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAtBsB,MAAA,CAAA,WAAA,EAAA,aAAA,CAAA;AAwBtB,eAAsB,cAAc,GAAA,EAAqC;AACvE,EAAA,MAAM,QAAuB,EAAC;AAC9B,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,EAAA,CAAG,OAAA,CAAQ,KAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAM,IAAI,CAAA;AAC1C,IAAA,IAAI,KAAA,CAAM,aAAY,EAAG;AACvB,MAAA,IAAI,SAAA,CAAU,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,EAAG;AAC/B,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,MAAM,aAAA,CAAc,QAAQ,CAAC,CAAA;AAAA,IAC7C,CAAA,MAAA,IAAW,KAAA,CAAM,MAAA,EAAO,EAAG;AACzB,MAAA,MAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,IAAI,EAAE,WAAA,EAAY;AACjD,MAAA,IAAI,iBAAA,CAAkB,GAAA,CAAI,GAAG,CAAA,EAAG;AAChC,MAAA,KAAA,CAAM,KAAK,QAAQ,CAAA;AAAA,IACrB;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AApBsB,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AA0BtB,eAAsB,iBAAA,CACpB,UACA,eAAA,EAC6B;AAC7B,EAAA,MAAM,WAA+B,EAAC;AACtC,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,EAAA,CAAG,QAAA,CAAS,QAAA,EAAU,OAAO,CAAA;AAAA,EAC/C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,QAAA;AAAA,EACT;AAGA,EAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,IAAI,CAAA,EAAG,OAAO,QAAA;AAGnC,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,KAAA,MAAW,GAAA,IAAO,eAAA,CAAgB,MAAA,EAAO,EAAG;AAC1C,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AACzB,MAAA,QAAA,GAAW,IAAA;AACX,MAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,QAAA;AAEtB,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,IAAI,CAAA;AAChC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,IAAA,KAAA,MAAW,CAAC,OAAA,EAAS,GAAG,CAAA,IAAK,eAAA,EAAiB;AAC5C,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC/B,MAAA,IAAI,WAAW,EAAA,EAAI;AACjB,QAAA,QAAA,CAAS,IAAA,CAAK;AAAA,UACZ,QAAA;AAAA,UACA,YAAY,CAAA,GAAI,CAAA;AAAA,UAChB,cAAc,MAAA,GAAS,CAAA;AAAA,UACvB,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,UAChB,gBAAA,EAAkB,OAAA;AAAA,UAClB,cAAA,EAAgB;AAAA,SACjB,CAAA;AACD,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AA5CsB,MAAA,CAAA,iBAAA,EAAA,mBAAA,CAAA;AA8CtB,IAAM,YAAA,GAAe,cAAA;AAOrB,SAAS,cAAA,GAAyB;AAChC,EAAA,IAAI,YAAA,IAAgB,OAAO,YAAA;AAC3B,EAAA,MAAM,KAAK,sBAAA,EAAuB;AAClC,EAAA,IAAI,IAAI,OAAO,CAAA,EAAG,EAAA,CAAG,IAAI,IAAI,YAAY,CAAA,CAAA;AAEzC,EAAA,OAAO,YAAA;AACT;AANS,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAUT,eAAe,kBAAkB,GAAA,EAA8C;AAE7E,EAAA,IAAI,MAAM,WAAW,IAAA,CAAK,IAAA,CAAK,KAAK,QAAQ,CAAC,GAAG,OAAO,OAAA;AAGvD,EAAA,MAAM,aAAA,GAAgB,CAAC,cAAA,EAAgB,eAAA,EAAiB,iBAAiB,gBAAgB,CAAA;AACzF,EAAA,KAAA,MAAW,QAAQ,aAAA,EAAe;AAChC,IAAA,IAAI,MAAM,WAAW,IAAA,CAAK,IAAA,CAAK,KAAK,IAAI,CAAC,GAAG,OAAO,UAAA;AAAA,EACrD;AAGA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AACjD,EAAA,IAAI,MAAM,UAAA,CAAW,WAAW,CAAA,EAAG;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,KAAK,KAAA,CAAM,MAAM,GAAG,QAAA,CAAS,WAAA,EAAa,OAAO,CAAC,CAAA;AAClE,MAAA,IAAI,OAAA,CAAQ,kBAAkB,CAAA,EAAG,OAAO,kBAAA;AAAA,IAC1C,CAAA,CAAA,MAAQ;AAAA,IAA4B;AAAA,EACtC;AAEA,EAAA,OAAO,IAAA;AACT;AApBe,MAAA,CAAA,iBAAA,EAAA,mBAAA,CAAA;AAsBf,eAAe,YAAY,GAAA,EAAqC;AAC9D,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,KAAA,EAAO,CAAC,aAAa,iBAAiB,CAAA,EAAG,EAAE,GAAA,EAAK,CAAA;AAC9E,IAAA,OAAO,KAAK,IAAA,EAAK;AAAA,EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAPe,MAAA,CAAA,WAAA,EAAA,aAAA,CAAA;AASf,eAAe,YAAY,GAAA,EAA4B;AACrD,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,CAAY,GAAG,CAAA;AACrC,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,aAAa,6BAAA,EAA+B;AAAA,MACpD,UAAA,EAAY;AAAA,KACb,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,cAAc,cAAA,EAAe;AACnC,EAAA,MAAM,UAAA,GAAa,CAAA;AAAA,EAAc,WAAW;AAAA,CAAA;AAC5C,EAAA,MAAM,WAAA,GAAc,MAAM,iBAAA,CAAkB,OAAO,CAAA;AAEnD,EAAA,IAAI,gBAAgB,OAAA,EAAS;AAC3B,IAAA,QAAA,CAAS;AAAA,MACP,EAAA;AAAA,MACA,CAAA,SAAA,EAAY,aAAA,CAAM,IAAA,CAAK,OAAO,CAAC,CAAA,0BAAA,CAAA;AAAA,MAC/B,EAAA;AAAA,MACA,CAAA,IAAA,EAAO,aAAA,CAAM,IAAA,CAAK,WAAW,CAAC,CAAA,yBAAA,CAAA;AAAA,MAC9B,EAAA;AAAA,MACA,aAAA,CAAM,GAAA,CAAI,CAAA,QAAA,EAAW,WAAW,CAAA,sBAAA,CAAwB,CAAA;AAAA,MACxD,EAAA;AAAA,MACA,4BAAA;AAAA,MACA,EAAA;AAAA,MACA,aAAA,CAAM,GAAA,CAAI,CAAA,QAAA,EAAW,WAAW,CAAA,qBAAA,CAAuB,CAAA;AAAA,MACvD;AAAA,KACD,CAAA;AACD,IAAA;AAAA,EACF;AAEA,EAAA,IAAI,gBAAgB,UAAA,EAAY;AAC9B,IAAA,QAAA,CAAS;AAAA,MACP,EAAA;AAAA,MACA,CAAA,SAAA,EAAY,aAAA,CAAM,IAAA,CAAK,UAAU,CAAC,CAAA,0BAAA,CAAA;AAAA,MAClC,EAAA;AAAA,MACA,4CAAA;AAAA,MACA,EAAA;AAAA,MACA,aAAA,CAAM,IAAI,eAAe,CAAA;AAAA,MACzB,aAAA,CAAM,IAAI,eAAe,CAAA;AAAA,MACzB,aAAA,CAAM,IAAI,qBAAqB,CAAA;AAAA,MAC/B,aAAA,CAAM,GAAA,CAAI,CAAA,aAAA,EAAgB,WAAW,CAAA,CAAE,CAAA;AAAA,MACvC;AAAA,KACD,CAAA;AACD,IAAA;AAAA,EACF;AAEA,EAAA,IAAI,gBAAgB,kBAAA,EAAoB;AACtC,IAAA,QAAA,CAAS;AAAA,MACP,EAAA;AAAA,MACA,CAAA,SAAA,EAAY,aAAA,CAAM,IAAA,CAAK,kBAAkB,CAAC,CAAA,sBAAA,CAAA;AAAA,MAC1C,EAAA;AAAA,MACA,yCAAA;AAAA,MACA,EAAA;AAAA,MACA,aAAA,CAAM,IAAI,yBAAyB,CAAA;AAAA,MACnC,aAAA,CAAM,GAAA,CAAI,CAAA,mBAAA,EAAsB,WAAW,CAAA,CAAA,CAAG,CAAA;AAAA,MAC9C,aAAA,CAAM,IAAI,KAAK,CAAA;AAAA,MACf,EAAA;AAAA,MACA,CAAA,SAAA,EAAY,aAAA,CAAM,GAAA,CAAI,sBAAsB,CAAC,CAAA,qBAAA,CAAA;AAAA,MAC7C;AAAA,KACD,CAAA;AACD,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,QAAQ,OAAO,CAAA;AACnD,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,QAAA,EAAU,YAAY,CAAA;AAGjD,EAAA,MAAM,GAAG,KAAA,CAAM,QAAA,EAAU,EAAE,SAAA,EAAW,MAAM,CAAA;AAG5C,EAAA,IAAI,MAAM,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC9B,IAAA,MAAM,eAAA,GAAkB,MAAM,EAAA,CAAG,QAAA,CAAS,UAAU,OAAO,CAAA;AAC3D,IAAA,IAAI,eAAA,CAAgB,QAAA,CAAS,YAAY,CAAA,EAAG;AAC1C,MAAA,QAAA,CAAS;AAAA,QACP,EAAA;AAAA,QACA,cAAM,KAAA,CAAM,CAAA,qCAAA,EAAwC,cAAM,IAAA,CAAK,YAAY,CAAC,CAAA,iBAAA,CAAmB,CAAA;AAAA,QAC/F;AAAA,OACD,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,cAAA,GAAiB,CAAA,EAAG,eAAA,CAAgB,OAAA,EAAS;AAAA,EAAK,WAAW;AAAA,CAAA;AACnE,IAAA,MAAM,EAAA,CAAG,SAAA,CAAU,QAAA,EAAU,cAAc,CAAA;AAC3C,IAAA,MAAM,EAAA,CAAG,KAAA,CAAM,QAAA,EAAU,GAAK,CAAA;AAC9B,IAAA,QAAA,CAAS;AAAA,MACP,EAAA;AAAA,MACA,cAAM,KAAA,CAAM,CAAA,MAAA,EAAS,cAAM,IAAA,CAAK,WAAW,CAAC,CAAA,6BAAA,CAA+B,CAAA;AAAA,MAC3E,GAAA,CAAI,SAAS,QAAQ,CAAA;AAAA,MACrB;AAAA,KACD,CAAA;AACD,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,EAAA,CAAG,SAAA,CAAU,QAAA,EAAU,UAAU,CAAA;AACvC,EAAA,MAAM,EAAA,CAAG,KAAA,CAAM,QAAA,EAAU,GAAK,CAAA;AAC9B,EAAA,QAAA,CAAS;AAAA,IACP,EAAA;AAAA,IACA,cAAM,KAAA,CAAM,CAAA,2BAAA,EAA8B,IAAI,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAE,CAAA;AAAA,IAClE,aAAA,CAAM,IAAI,gFAAgF,CAAA;AAAA,IAC1F;AAAA,GACD,CAAA;AACH;AAtGe,MAAA,CAAA,WAAA,EAAA,aAAA,CAAA;AAwGR,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAEhF,EAAA,IAAI,GAAA,CAAI,MAAA,CAAO,cAAc,CAAA,EAAG;AAC9B,IAAA,MAAM,WAAA,CAAY,OAAA,CAAQ,GAAA,EAAK,CAAA;AAC/B,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,MAAA,CAAO,MAAA,IAAU,KAAA;AACxC,EAAA,MAAM,cAAA,GAAiB,GAAA,CAAI,MAAA,CAAO,iBAAiB,CAAA,IAAK,KAAA;AAGxD,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,CAAoB;AAAA,IACzC,aAAA,EAAe,IAAI,MAAA,CAAO;AAAA,GAC3B,CAAA;AAGD,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,iBAAA,EAAmB;AAC/C,IAAA,IAAI,OAAO,YAAA,EAAc;AACvB,MAAA,MAAM,IAAI,YAAA,CAAa,CAAA,sBAAA,EAAyB,MAAA,CAAO,YAAA,CAAa,OAAO,CAAA,CAAA,EAAI;AAAA,QAC7E,UAAA,EAAY;AAAA,OACb,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,gBAAA,EAAiB;AAGhC,EAAA,MAAM,eAAA,uBAAsB,GAAA,EAAoB;AAChD,EAAA,KAAA,MAAW,OAAA,IAAW,SAAS,YAAA,EAAc;AAC3C,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,YAAA,CAAa,OAAO,CAAA;AAC1C,IAAA,IAAI,IAAA,CAAK,eAAe,eAAA,CAAE,QAAA,CAAS,KAAK,aAAa,CAAA,IAAK,IAAA,CAAK,aAAA,KAAkB,EAAA,EAAI;AACnF,MAAA,eAAA,CAAgB,GAAA,CAAI,OAAA,EAAS,IAAA,CAAK,aAAa,CAAA;AAAA,IACjD;AAAA,EACF;AAEA,EAAA,IAAI,eAAA,CAAgB,SAAS,CAAA,EAAG;AAC9B,IAAA,QAAA,CAAS,CAAC,aAAA,CAAM,KAAA,CAAM,mEAA8D,CAAC,CAAC,CAAA;AACtF,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,EAAI;AACxB,EAAA,IAAI,KAAA;AAEJ,EAAA,IAAI,cAAA,EAAgB;AAElB,IAAA,KAAA,GAAQ,MAAM,cAAc,GAAG,CAAA;AAAA,EACjC,CAAA,MAAO;AAEL,IAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,GAAA,EAAK,UAAU,CAAA;AAClD,IAAA,IAAI,aAAa,IAAA,EAAM;AACrB,MAAA,KAAA,GAAQ,QAAA;AAAA,IACV,CAAA,MAAO;AAEL,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,MAAM,IAAI,aAAa,wCAAA,EAA0C;AAAA,UAC/D,UAAA,EAAY;AAAA,SACb,CAAA;AAAA,MACH;AACA,MAAA,KAAA,GAAQ,MAAM,cAAc,GAAG,CAAA;AAAA,IACjC;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,OAAA,CAAQ,IAAI,0BAA0B,CAAA;AAAA,IACxC,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,KAAA,CAAM,gCAA2B,CAAC,CAAA;AAAA,IACtD;AACA,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,cAAkC,EAAC;AACzC,EAAA,KAAA,MAAW,YAAY,KAAA,EAAO;AAC5B,IAAA,MAAM,QAAA,GAAW,MAAM,iBAAA,CAAkB,QAAA,EAAU,eAAe,CAAA;AAClE,IAAA,WAAA,CAAY,IAAA,CAAK,GAAG,QAAQ,CAAA;AAAA,EAC9B;AAEA,EAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,IAAA,QAAA,CAAS,CAAC,aAAA,CAAM,KAAA,CAAM,CAAA,wDAAA,EAAsD,MAAM,MAAM,CAAA,KAAA,EAAQ,KAAA,CAAM,MAAA,KAAW,CAAA,GAAI,EAAA,GAAK,GAAG,CAAA,CAAA,CAAG,CAAC,CAAC,CAAA;AAClI,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,cAAA,uBAAqB,GAAA,EAAgC;AAC3D,EAAA,KAAA,MAAW,WAAW,WAAA,EAAa;AACjC,IAAA,MAAM,WAAW,cAAA,CAAe,GAAA,CAAI,OAAA,CAAQ,QAAQ,KAAK,EAAC;AAC1D,IAAA,QAAA,CAAS,KAAK,OAAO,CAAA;AACrB,IAAA,cAAA,CAAe,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,QAAQ,CAAA;AAAA,EAC/C;AAEA,EAAA,OAAA,CAAQ,KAAA,CAAM,cAAM,GAAA,CAAI;AAAA,gBAAA,EAAc,WAAA,CAAY,MAAM,CAAA,wCAAA,EAA2C,cAAA,CAAe,IAAI,CAAA;AAAA,CAAa,CAAC,CAAA;AACpI,EAAA,KAAA,MAAW,CAAC,QAAA,EAAU,QAAQ,CAAA,IAAK,cAAA,EAAgB;AACjD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,QAAQ,CAAA;AAC3C,IAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAE9B,MAAA,MAAM,YAAA,GAAe,QAAQ,IAAA,CAAK,UAAA,CAAW,QAAQ,cAAA,EAAgB,YAAA,CAAa,OAAA,CAAQ,cAAc,CAAE,CAAA;AAC1G,MAAA,MAAM,aAAA,GAAgB,YAAA,CAAa,MAAA,GAAS,GAAA,GACxC,CAAA,EAAG,aAAa,SAAA,CAAU,CAAA,EAAG,GAAG,CAAC,CAAA,MAAA,CAAA,GACjC,YAAA;AACJ,MAAA,OAAA,CAAQ,KAAA,CAAM,KAAK,GAAA,CAAI,QAAA,CAAS,GAAG,OAAO,CAAA,CAAA,EAAI,QAAQ,UAAU,CAAA,CAAA,EAAI,QAAQ,YAAY,CAAA,CAAE,CAAC,CAAA,CAAA,EAAI,aAAA,CAAM,OAAO,OAAA,CAAQ,gBAAgB,CAAC,CAAA,CAAE,CAAA;AACvI,MAAA,OAAA,CAAQ,MAAM,CAAA,IAAA,EAAO,aAAA,CAAM,GAAA,CAAI,aAAa,CAAC,CAAA,CAAE,CAAA;AAAA,IACjD;AACA,IAAA,OAAA,CAAQ,MAAM,EAAE,CAAA;AAAA,EAClB;AAEA,EAAA,YAAA,CAAa,CAAC,CAAA;AAChB,CAAA,EA1GmE,WAAA","file":"chunk-G7FDCTNA.js","sourcesContent":["\nexport function isBundledSEA() {\n  try {\n    return __VARLOCK_SEA_BUILD__;\n  } catch (e) {\n    return false;\n  }\n}\n","import path from 'node:path';\nimport fs from 'node:fs/promises';\nimport { define } from 'gunshi';\nimport ansis from 'ansis';\nimport { gracefulExit } from 'exit-hook';\nimport _ from '@env-spec/utils/my-dash';\n\nimport { spawnAsync } from '@env-spec/utils/exec-helpers';\nimport { pathExists } from '@env-spec/utils/fs-utils';\nimport { redactString } from '../../runtime/lib/redaction';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { CliExitError } from '../helpers/exit-error';\nimport { fmt, logLines } from '../helpers/pretty-format';\nimport { detectJsPackageManager } from '../helpers/js-package-manager-utils';\nimport { isBundledSEA } from '../helpers/install-detection';\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\n\n// Directories to always skip when walking the file tree\nconst SKIP_DIRS = new Set([\n  '.git',\n  'node_modules',\n  'dist',\n  'build',\n  '.next',\n  '.nuxt',\n  'vendor',\n  '.venv',\n  'venv',\n  '__pycache__',\n  '.turbo',\n  'coverage',\n]);\n\n// File extensions that are binary and should be skipped\nconst BINARY_EXTENSIONS = new Set([\n  '.png',\n  '.jpg',\n  '.jpeg',\n  '.gif',\n  '.bmp',\n  '.ico',\n  '.mp3',\n  '.mp4',\n  '.wav',\n  '.avi',\n  '.mov',\n  '.zip',\n  '.tar',\n  '.gz',\n  '.rar',\n  '.7z',\n  '.exe',\n  '.dll',\n  '.so',\n  '.dylib',\n  '.bin',\n  '.pdf',\n  '.doc',\n  '.docx',\n  '.xls',\n  '.xlsx',\n  '.woff',\n  '.woff2',\n  '.ttf',\n  '.eot',\n  '.pyc',\n  '.class',\n  '.o',\n]);\n\nexport const commandSpec = define({\n  name: 'scan',\n  description: 'Scan files for sensitive config values that should not be in plaintext',\n  args: {\n    staged: {\n      type: 'boolean',\n      description: 'Only scan staged git files',\n    },\n    'include-ignored': {\n      type: 'boolean',\n      description: 'Include git-ignored files in the scan',\n    },\n    'install-hook': {\n      type: 'boolean',\n      description: 'Set up varlock scan as a git pre-commit hook',\n    },\n    path: {\n      type: 'string',\n      short: 'p',\n      description: 'Path to a specific .env file (e.g. .env.prod) or directory ending with \"/\" to use as the schema entry point (default: current directory)',\n    },\n  },\n  examples: `\nLoads your varlock config, resolves all sensitive values, then scans files to\nensure none of those sensitive values appear in plaintext.\n\nExamples:\n  varlock scan                    # Scan non-git-ignored files in current directory\n  varlock scan --staged           # Only scan staged git files\n  varlock scan --include-ignored  # Scan all files, including git-ignored ones\n  varlock scan --path .env.prod   # Use a specific .env file as the schema entry point\n  varlock scan --install-hook     # Set up as a git pre-commit hook\n  `.trim(),\n});\n\nexport interface ScanFinding {\n  filePath: string;\n  lineNumber: number;\n  columnNumber: number;\n  line: string;\n  sensitiveKeyName: string;\n  sensitiveValue: string;\n}\n\nexport async function getGitFiles(cwd: string, onlyStaged: boolean): Promise<Array<string> | null> {\n  try {\n    let output: string;\n    if (onlyStaged) {\n      output = await spawnAsync(\n        'git',\n        ['diff', '--cached', '--name-only', '-z', '--diff-filter=ACMR'],\n        { cwd },\n      );\n    } else {\n      output = await spawnAsync(\n        'git',\n        ['ls-files', '--cached', '--others', '--exclude-standard', '-z'],\n        { cwd },\n      );\n    }\n    return output.split('\\0').filter(Boolean)\n      .filter((f) => !BINARY_EXTENSIONS.has(path.extname(f).toLowerCase()))\n      .map((f) => path.resolve(cwd, f));\n  } catch {\n    return null;\n  }\n}\n\nexport async function walkDirectory(dir: string): Promise<Array<string>> {\n  const files: Array<string> = [];\n  let entries;\n  try {\n    entries = await fs.readdir(dir, { withFileTypes: true });\n  } catch {\n    return files;\n  }\n  for (const entry of entries) {\n    const fullPath = path.join(dir, entry.name);\n    if (entry.isDirectory()) {\n      if (SKIP_DIRS.has(entry.name)) continue;\n      files.push(...await walkDirectory(fullPath));\n    } else if (entry.isFile()) {\n      const ext = path.extname(entry.name).toLowerCase();\n      if (BINARY_EXTENSIONS.has(ext)) continue;\n      files.push(fullPath);\n    }\n  }\n  return files;\n}\n\n/**\n * Scans a single file for occurrences of any of the provided sensitive values.\n * sensitiveValues is a map from env key name to its resolved string value.\n */\nexport async function scanFileForValues(\n  filePath: string,\n  sensitiveValues: Map<string, string>,\n): Promise<Array<ScanFinding>> {\n  const findings: Array<ScanFinding> = [];\n  let content: string;\n  try {\n    content = await fs.readFile(filePath, 'utf-8');\n  } catch {\n    return findings;\n  }\n\n  // Skip binary files (contain null bytes)\n  if (content.includes('\\0')) return findings;\n\n  // Quick pre-check: skip the file entirely if none of the values appear\n  let anyMatch = false;\n  for (const val of sensitiveValues.values()) {\n    if (content.includes(val)) {\n      anyMatch = true;\n      break;\n    }\n  }\n  if (!anyMatch) return findings;\n\n  const lines = content.split('\\n');\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i];\n    for (const [keyName, val] of sensitiveValues) {\n      const colIdx = line.indexOf(val);\n      if (colIdx !== -1) {\n        findings.push({\n          filePath,\n          lineNumber: i + 1,\n          columnNumber: colIdx + 1,\n          line: line.trim(),\n          sensitiveKeyName: keyName,\n          sensitiveValue: val,\n        });\n        break; // one finding per line is enough\n      }\n    }\n  }\n  return findings;\n}\n\nconst SCAN_COMMAND = 'varlock scan';\n\n/**\n * Determines the correct command to use in a git hook script.\n * If varlock is installed as a standalone binary, uses `varlock` directly.\n * Otherwise, prefixes with the detected JS package manager's exec command.\n */\nfunction getHookCommand(): string {\n  if (isBundledSEA()) return SCAN_COMMAND;\n  const pm = detectJsPackageManager();\n  if (pm) return `${pm.exec} ${SCAN_COMMAND}`;\n  // fallback - assume varlock is available on PATH\n  return SCAN_COMMAND;\n}\n\ntype HookManagerKind = 'husky' | 'lefthook' | 'simple-git-hooks';\n\nasync function detectHookManager(cwd: string): Promise<HookManagerKind | null> {\n  // Check for husky\n  if (await pathExists(path.join(cwd, '.husky'))) return 'husky';\n\n  // Check for lefthook config files\n  const lefthookFiles = ['lefthook.yml', 'lefthook.yaml', '.lefthook.yml', '.lefthook.yaml'];\n  for (const file of lefthookFiles) {\n    if (await pathExists(path.join(cwd, file))) return 'lefthook';\n  }\n\n  // Check for simple-git-hooks in package.json\n  const pkgJsonPath = path.join(cwd, 'package.json');\n  if (await pathExists(pkgJsonPath)) {\n    try {\n      const pkgJson = JSON.parse(await fs.readFile(pkgJsonPath, 'utf-8'));\n      if (pkgJson['simple-git-hooks']) return 'simple-git-hooks';\n    } catch { /* ignore parse errors */ }\n  }\n\n  return null;\n}\n\nasync function findGitRoot(cwd: string): Promise<string | null> {\n  try {\n    const root = await spawnAsync('git', ['rev-parse', '--show-toplevel'], { cwd });\n    return root.trim();\n  } catch {\n    return null;\n  }\n}\n\nasync function installHook(cwd: string): Promise<void> {\n  const gitRoot = await findGitRoot(cwd);\n  if (!gitRoot) {\n    throw new CliExitError('Not inside a git repository', {\n      suggestion: 'Run `git init` first, or make sure you are inside a git repository.',\n    });\n  }\n\n  const hookCommand = getHookCommand();\n  const hookScript = `#!/bin/sh\\n${hookCommand}\\n`;\n  const hookManager = await detectHookManager(gitRoot);\n\n  if (hookManager === 'husky') {\n    logLines([\n      '',\n      `Detected ${ansis.bold('husky')} as your git hook manager.`,\n      '',\n      `Add ${ansis.bold(hookCommand)} to your pre-commit hook:`,\n      '',\n      ansis.dim(`  echo \"${hookCommand}\" >> .husky/pre-commit`),\n      '',\n      'Or if creating a new hook:',\n      '',\n      ansis.dim(`  echo \"${hookCommand}\" > .husky/pre-commit`),\n      '',\n    ]);\n    return;\n  }\n\n  if (hookManager === 'lefthook') {\n    logLines([\n      '',\n      `Detected ${ansis.bold('lefthook')} as your git hook manager.`,\n      '',\n      'Add the following to your lefthook config:',\n      '',\n      ansis.dim('  pre-commit:'),\n      ansis.dim('    commands:'),\n      ansis.dim('      varlock-scan:'),\n      ansis.dim(`        run: ${hookCommand}`),\n      '',\n    ]);\n    return;\n  }\n\n  if (hookManager === 'simple-git-hooks') {\n    logLines([\n      '',\n      `Detected ${ansis.bold('simple-git-hooks')} in your package.json.`,\n      '',\n      'Add the following to your package.json:',\n      '',\n      ansis.dim('  \"simple-git-hooks\": {'),\n      ansis.dim(`    \"pre-commit\": \"${hookCommand}\"`),\n      ansis.dim('  }'),\n      '',\n      `Then run ${ansis.dim('npx simple-git-hooks')} to update the hooks.`,\n      '',\n    ]);\n    return;\n  }\n\n  // No hook manager detected -- install directly to .git/hooks/pre-commit\n  const hooksDir = path.join(gitRoot, '.git', 'hooks');\n  const hookPath = path.join(hooksDir, 'pre-commit');\n\n  // Ensure hooks directory exists\n  await fs.mkdir(hooksDir, { recursive: true });\n\n  // Check if a pre-commit hook already exists\n  if (await pathExists(hookPath)) {\n    const existingContent = await fs.readFile(hookPath, 'utf-8');\n    if (existingContent.includes(SCAN_COMMAND)) {\n      logLines([\n        '',\n        ansis.green(`The pre-commit hook already includes ${ansis.bold(SCAN_COMMAND)} - nothing to do!`),\n        '',\n      ]);\n      return;\n    }\n    // Append to existing hook\n    const updatedContent = `${existingContent.trimEnd()}\\n${hookCommand}\\n`;\n    await fs.writeFile(hookPath, updatedContent);\n    await fs.chmod(hookPath, 0o755);\n    logLines([\n      '',\n      ansis.green(`Added ${ansis.bold(hookCommand)} to existing pre-commit hook.`),\n      fmt.filePath(hookPath),\n      '',\n    ]);\n    return;\n  }\n\n  // Create new hook\n  await fs.writeFile(hookPath, hookScript);\n  await fs.chmod(hookPath, 0o755);\n  logLines([\n    '',\n    ansis.green(`Created pre-commit hook at ${fmt.filePath(hookPath)}`),\n    ansis.dim('Your staged files will now be scanned for sensitive values before each commit.'),\n    '',\n  ]);\n}\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  // Handle --install-hook before doing any scanning\n  if (ctx.values['install-hook']) {\n    await installHook(process.cwd());\n    return;\n  }\n\n  const onlyStaged = ctx.values.staged ?? false;\n  const includeIgnored = ctx.values['include-ignored'] ?? false;\n\n  // Load the varlock env graph to get the actual sensitive values\n  const envGraph = await loadVarlockEnvGraph({\n    entryFilePath: ctx.values.path,\n  });\n\n  // Check for loading/schema errors\n  for (const source of envGraph.sortedDataSources) {\n    if (source.loadingError) {\n      throw new CliExitError(`Error loading config: ${source.loadingError.message}`, {\n        suggestion: 'Make sure your .env.schema file is valid.',\n      });\n    }\n  }\n\n  await envGraph.resolveEnvValues();\n\n  // Collect all sensitive string values that are non-empty\n  const sensitiveValues = new Map<string, string>();\n  for (const itemKey in envGraph.configSchema) {\n    const item = envGraph.configSchema[itemKey];\n    if (item.isSensitive && _.isString(item.resolvedValue) && item.resolvedValue !== '') {\n      sensitiveValues.set(itemKey, item.resolvedValue);\n    }\n  }\n\n  if (sensitiveValues.size === 0) {\n    logLines([ansis.green('✅ No sensitive values found in config - nothing to scan for.')]);\n    return;\n  }\n\n  const cwd = process.cwd();\n  let files: Array<string>;\n\n  if (includeIgnored) {\n    // Walk the full directory tree, no git filtering\n    files = await walkDirectory(cwd);\n  } else {\n    // Try to use git to get non-ignored files\n    const gitFiles = await getGitFiles(cwd, onlyStaged);\n    if (gitFiles !== null) {\n      files = gitFiles;\n    } else {\n      // Git not available - fall back to walking directory\n      if (onlyStaged) {\n        throw new CliExitError('Could not run git to find staged files', {\n          suggestion: 'Make sure git is installed and you are inside a git repository.',\n        });\n      }\n      files = await walkDirectory(cwd);\n    }\n  }\n\n  if (files.length === 0) {\n    if (onlyStaged) {\n      console.log('No staged files to scan.');\n    } else {\n      console.log(ansis.green('✅ No files found to scan.'));\n    }\n    return;\n  }\n\n  const allFindings: Array<ScanFinding> = [];\n  for (const filePath of files) {\n    const findings = await scanFileForValues(filePath, sensitiveValues);\n    allFindings.push(...findings);\n  }\n\n  if (allFindings.length === 0) {\n    logLines([ansis.green(`✅ No sensitive values found in plaintext. (scanned ${files.length} file${files.length === 1 ? '' : 's'})`)]);\n    return;\n  }\n\n  // Group findings by file for display\n  const findingsByFile = new Map<string, Array<ScanFinding>>();\n  for (const finding of allFindings) {\n    const existing = findingsByFile.get(finding.filePath) ?? [];\n    existing.push(finding);\n    findingsByFile.set(finding.filePath, existing);\n  }\n\n  console.error(ansis.red(`\\n🚨 Found ${allFindings.length} sensitive value(s) in plaintext across ${findingsByFile.size} file(s):\\n`));\n  for (const [filePath, findings] of findingsByFile) {\n    const relPath = path.relative(cwd, filePath);\n    for (const finding of findings) {\n      // Redact the actual secret value in the displayed line\n      const redactedLine = finding.line.replaceAll(finding.sensitiveValue, redactString(finding.sensitiveValue)!);\n      const truncatedLine = redactedLine.length > 100\n        ? `${redactedLine.substring(0, 100)}…`\n        : redactedLine;\n      console.error(`  ${fmt.fileName(`${relPath}:${finding.lineNumber}:${finding.columnNumber}`)} ${ansis.yellow(finding.sensitiveKeyName)}`);\n      console.error(`    ${ansis.dim(truncatedLine)}`);\n    }\n    console.error('');\n  }\n\n  gracefulExit(1);\n};\n"]}

package/dist/{chunk-WAMBVZL2.js → chunk-IMB5QAZS.js}

@@ -1,11 +1,13 @@
-import { redactString } from './chunk-MIBOBKI4.js';
+import { redactString } from './chunk-XLYSNOR3.js';
 import { __name } from './chunk-6PEHRAEP.js';
 
 // src/lib/detect-runtime.ts
-typeof process !== "undefined" && process.versions != null && process.versions.node != null;
+var versionsStr = "versions";
+var processVersions = typeof process !== "undefined" && process[versionsStr];
+processVersions && processVersions.node != null;
 typeof window !== "undefined" && window.name === "nodejs" || typeof navigator !== "undefined" && "userAgent" in navigator && typeof navigator.userAgent === "string" && (navigator.userAgent.includes("Node.js") || navigator.userAgent.includes("jsdom"));
 typeof Deno !== "undefined" && typeof Deno.version !== "undefined" && typeof Deno.version.deno !== "undefined";
-typeof process !== "undefined" && process.versions != null && process.versions.bun != null;
+processVersions && processVersions.bun != null;
 var isBrowser = typeof window !== "undefined" && typeof window.document !== "undefined" && typeof window.document.createElement === "function" && typeof navigator !== "undefined" && typeof navigator.userAgent === "string";
 
 // src/runtime/lib/debug.ts
@@ -21,26 +23,36 @@ function isString(s) {
 }
 __name(isString, "isString");
 var UNMASK_STR = "\u{1F441}";
-var sensitiveSecretsMap = {};
-var redactorFindReplace;
+var REDACTION_STATE_KEY = "__varlockRedactionState";
+function getRedactionState() {
+  if (!globalThis[REDACTION_STATE_KEY]) {
+    globalThis[REDACTION_STATE_KEY] = {
+      sensitiveSecretsMap: {},
+      redactorFindReplace: void 0
+    };
+  }
+  return globalThis[REDACTION_STATE_KEY];
+}
+__name(getRedactionState, "getRedactionState");
 function resetRedactionMap(graph) {
-  sensitiveSecretsMap = {};
+  const state = getRedactionState();
+  state.sensitiveSecretsMap = {};
   for (const itemKey in graph.config) {
     const item = graph.config[itemKey];
     if (item.isSensitive && item.value && isString(item.value)) {
       const redacted = redactString(item.value);
-      if (redacted) sensitiveSecretsMap[item.value] = { key: itemKey, redacted };
+      if (redacted) state.sensitiveSecretsMap[item.value] = { key: itemKey, redacted };
     }
   }
-  if (!Object.keys(sensitiveSecretsMap).length) {
-    redactorFindReplace = void 0;
+  if (!Object.keys(state.sensitiveSecretsMap).length) {
+    state.redactorFindReplace = void 0;
     return;
   }
   const findRegex = new RegExp(
     [
       `(${UNMASK_STR} )?`,
       "(",
-      Object.keys(sensitiveSecretsMap).map((s) => s.replace(/[()[\]{}*+?^$|#.,/\\\s-]/g, "\\$&")).sort((a, b) => b.length - a.length).join("|"),
+      Object.keys(state.sensitiveSecretsMap).map((s) => s.replace(/[()[\]{}*+?^$|#.,/\\\s-]/g, "\\$&")).sort((a, b) => b.length - a.length).join("|"),
       ")",
       `( ${UNMASK_STR})?`
     ].join(""),
@@ -48,12 +60,21 @@ function resetRedactionMap(graph) {
   );
   const replaceFn = /* @__PURE__ */ __name((match, pre, val, post) => {
     if (pre && post) return match;
-    return sensitiveSecretsMap[val].redacted;
+    return state.sensitiveSecretsMap[val].redacted;
   }, "replaceFn");
-  redactorFindReplace = { find: findRegex, replace: replaceFn };
+  state.redactorFindReplace = { find: findRegex, replace: replaceFn };
 }
 __name(resetRedactionMap, "resetRedactionMap");
+function getRedactionMapInfo() {
+  const state = getRedactionState();
+  return {
+    sensitiveItemCount: Object.keys(state.sensitiveSecretsMap).length,
+    hasRedactorRegex: !!state.redactorFindReplace
+  };
+}
+__name(getRedactionMapInfo, "getRedactionMapInfo");
 function redactSensitiveConfig(o) {
+  const { redactorFindReplace } = getRedactionState();
   if (!redactorFindReplace) return o;
   if (!o) return o;
   if (Array.isArray(o)) {
@@ -82,6 +103,7 @@ function scanForLeaks(toScan, meta) {
   debug("\u26A1\uFE0F varlock scanning for leaks");
   if (!toScan) return toScan;
   function scanStrForLeaks(strToScan) {
+    const { sensitiveSecretsMap } = getRedactionState();
     for (const sensitiveValue in sensitiveSecretsMap) {
       if (strToScan.includes(sensitiveValue)) {
         const itemKey = sensitiveSecretsMap[sensitiveValue].key;
@@ -101,7 +123,7 @@ function scanForLeaks(toScan, meta) {
   if (isString(toScan)) {
     scanStrForLeaks(toScan);
     return toScan;
-  } else if (toScan instanceof Buffer) {
+  } else if (typeof Buffer !== "undefined" && toScan instanceof Buffer) {
     scanStrForLeaks(toScan.toString());
     return toScan;
   } else if (toScan instanceof ReadableStream) {
@@ -200,6 +222,6 @@ var EnvProxy = new Proxy({}, {
 });
 var ENV = EnvProxy;
 
-export { ENV, debug, initVarlockEnv, redactSensitiveConfig, resetRedactionMap, revealSensitiveConfig, scanForLeaks, varlockSettings };
-//# sourceMappingURL=chunk-WAMBVZL2.js.map
-//# sourceMappingURL=chunk-WAMBVZL2.js.map
+export { ENV, debug, getRedactionMapInfo, initVarlockEnv, redactSensitiveConfig, resetRedactionMap, revealSensitiveConfig, scanForLeaks, varlockSettings };
+//# sourceMappingURL=chunk-IMB5QAZS.js.map
+//# sourceMappingURL=chunk-IMB5QAZS.js.map

package/dist/chunk-IMB5QAZS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/detect-runtime.ts","../src/runtime/lib/debug.ts","../src/runtime/env.ts"],"names":[],"mappings":";;;;AAOA,IAAI,WAAA,GAAc,UAAA;AAElB,IAAM,eAAA,GAAkB,OAAO,OAAA,KAAY,WAAA,IAAgB,QAAgB,WAAkB,CAAA;AAE9D,eAAA,IAAmB,eAAA,CAAgB,IAAA,IAAQ;AAOzC,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,SAAS,QAAA,IAC5E,OAAO,SAAA,KAAc,WAAA,IACpB,WAAA,IAAe,SAAA,IACf,OAAO,SAAA,CAAU,SAAA,KAAc,QAAA,KAC9B,SAAA,CAAU,SAAA,CAAU,QAAA,CAAS,SAAS,CAAA,IACrC,SAAA,CAAU,SAAA,CAAU,QAAA,CAAS,OAAO,CAAA;AAEd,OAAO,IAAA,KAAS,WAAA,IAC1C,OAAO,IAAA,CAAK,OAAA,KAAY,WAAA,IACxB,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,KAAS;AAGb,eAAA,IAAmB,eAAA,CAAgB,GAAA,IAAO;AAIxD,IAAM,YAAY,OAAO,MAAA,KAAW,eACtC,OAAO,MAAA,CAAO,aAAa,WAAA,IAC3B,OAAO,MAAA,CAAO,QAAA,CAAS,kBAAkB,UAAA,IACzC,OAAO,cAAc,WAAA,IACrB,OAAO,UAAU,SAAA,KAAc,QAAA;;;ACrC7B,SAAS,SAAS,IAAA,EAAkB;AACzC,EAAA,IAAI,CAAC,UAAA,CAAW,OAAA,EAAS,GAAA,CAAI,aAAA,EAAe;AAC5C,EAAA,OAAA,CAAQ,GAAA,CAAI,GAAG,IAAI,CAAA;AACrB;AAHgB,MAAA,CAAA,KAAA,EAAA,OAAA,CAAA;;;ACUhB,SAAS,SAAS,CAAA,EAAQ;AACxB,EAAA,OAAO,MAAA,CAAO,SAAA,CAAU,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,iBAAA;AAC/C;AAFS,MAAA,CAAA,QAAA,EAAA,UAAA,CAAA;AAIT,IAAM,UAAA,GAAa,WAAA;AAanB,IAAM,mBAAA,GAAsB,yBAAA;AAC5B,SAAS,iBAAA,GAAoC;AAC3C,EAAA,IAAI,CAAE,UAAA,CAAmB,mBAAmB,CAAA,EAAG;AAC7C,IAAC,UAAA,CAAmB,mBAAmB,CAAA,GAAI;AAAA,MACzC,qBAAqB,EAAC;AAAA,MACtB,mBAAA,EAAqB;AAAA,KACvB;AAAA,EACF;AACA,EAAA,OAAQ,WAAmB,mBAAmB,CAAA;AAChD;AARS,MAAA,CAAA,iBAAA,EAAA,mBAAA,CAAA;AAUF,SAAS,kBAAkB,KAAA,EAA2B;AAC3D,EAAA,MAAM,QAAQ,iBAAA,EAAkB;AAEhC,EAAA,KAAA,CAAM,sBAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,OAAA,IAAW,MAAM,MAAA,EAAQ;AAClC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA;AACjC,IAAA,IAAI,KAAK,WAAA,IAAe,IAAA,CAAK,SAAS,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,EAAG;AAE1D,MAAA,MAAM,QAAA,GAAW,YAAA,CAAa,IAAA,CAAK,KAAK,CAAA;AACxC,MAAA,IAAI,QAAA,QAAgB,mBAAA,CAAoB,IAAA,CAAK,KAAK,CAAA,GAAI,EAAE,GAAA,EAAK,OAAA,EAAS,QAAA,EAAS;AAAA,IACjF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,mBAAmB,EAAE,MAAA,EAAQ;AAClD,IAAA,KAAA,CAAM,mBAAA,GAAsB,MAAA;AAC5B,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,YAAY,IAAI,MAAA;AAAA,IACpB;AAAA,MACE,IAAI,UAAU,CAAA,GAAA,CAAA;AAAA,MACd,GAAA;AAAA,MACA,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,mBAAmB,CAAA,CAElC,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,OAAA,CAAQ,2BAAA,EAA6B,MAAM,CAAC,CAAA,CAEzD,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,SAAS,CAAA,CAAE,MAAM,CAAA,CAClC,IAAA,CAAK,GAAG,CAAA;AAAA,MACX,GAAA;AAAA,MACA,KAAK,UAAU,CAAA,EAAA;AAAA,KACjB,CAAE,KAAK,EAAE,CAAA;AAAA,IACT;AAAA,GACF;AAEA,EAAA,MAAM,SAAA,mBAAuB,MAAA,CAAA,CAAC,KAAA,EAAO,GAAA,EAAK,KAAK,IAAA,KAAS;AAGtD,IAAA,IAAI,GAAA,IAAO,MAAM,OAAO,KAAA;AACxB,IAAA,OAAO,KAAA,CAAM,mBAAA,CAAoB,GAAG,CAAA,CAAE,QAAA;AAAA,EACxC,CAAA,EAL6B,WAAA,CAAA;AAM7B,EAAA,KAAA,CAAM,mBAAA,GAAsB,EAAE,IAAA,EAAM,SAAA,EAAW,SAAS,SAAA,EAAU;AACpE;AA1CgB,MAAA,CAAA,iBAAA,EAAA,mBAAA,CAAA;AA6CT,SAAS,mBAAA,GAAsB;AACpC,EAAA,MAAM,QAAQ,iBAAA,EAAkB;AAChC,EAAA,OAAO;AAAA,IACL,kBAAA,EAAoB,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,mBAAmB,CAAA,CAAE,MAAA;AAAA,IAC3D,gBAAA,EAAkB,CAAC,CAAC,KAAA,CAAM;AAAA,GAC5B;AACF;AANgB,MAAA,CAAA,mBAAA,EAAA,qBAAA,CAAA;AAkBT,SAAS,sBAAsB,CAAA,EAAa;AACjD,EAAA,MAAM,EAAE,mBAAA,EAAoB,GAAI,iBAAA,EAAkB;AAClD,EAAA,IAAI,CAAC,qBAAqB,OAAO,CAAA;AACjC,EAAA,IAAI,CAAC,GAAG,OAAO,CAAA;AAKf,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,EAAG;AACpB,IAAA,OAAO,CAAA,CAAE,IAAI,qBAAqB,CAAA;AAAA,EACpC;AAEA,EAAA,IAAI,CAAA,IAAK,OAAQ,CAAA,KAAO,QAAA,IAAY,OAAO,cAAA,CAAe,CAAC,CAAA,KAAM,MAAA,CAAO,SAAA,EAAW;AACjF,IAAA,IAAI;AACF,MAAA,OAAO,KAAK,KAAA,CAAM,qBAAA,CAAsB,KAAK,SAAA,CAAU,CAAC,CAAC,CAAC,CAAA;AAAA,IAC5D,SAAS,GAAA,EAAK;AACZ,MAAA,OAAO,CAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,OAAO,OAAO,CAAA;AACpB,EAAA,IAAI,IAAA,KAAS,QAAA,IAAa,IAAA,KAAS,QAAA,IAAY,MAAA,CAAO,UAAU,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,iBAAA,EAAoB;AACvG,IAAA,OAAQ,CAAA,CAAa,UAAA,CAAW,mBAAA,CAAoB,IAAA,EAAM,oBAAoB,OAAO,CAAA;AAAA,EACvF;AAEA,EAAA,OAAO,CAAA;AACT;AA1BgB,MAAA,CAAA,qBAAA,EAAA,uBAAA,CAAA;AAgCT,SAAS,sBAAsB,SAAA,EAAmB;AAEvD,EAAA,IAAI,CAAE,UAAA,CAAmB,4BAAA,EAA8B,OAAO,SAAA;AAE9D,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,SAAS,IAAI,UAAU,CAAA,CAAA;AACjD;AALgB,MAAA,CAAA,qBAAA,EAAA,uBAAA,CAAA;AAYT,SAAS,YAAA,CACd,QAEA,IAAA,EAIA;AACA,EAAA,KAAA,CAAM,yCAA+B,CAAA;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,MAAA;AAEpB,EAAA,SAAS,gBAAgB,SAAA,EAAmB;AAC1C,IAAA,MAAM,EAAE,mBAAA,EAAoB,GAAI,iBAAA,EAAkB;AAGlD,IAAA,KAAA,MAAW,kBAAkB,mBAAA,EAAqB;AAChD,MAAA,IAAI,SAAA,CAAU,QAAA,CAAS,cAAc,CAAA,EAAG;AACtC,QAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,cAAc,CAAA,CAAE,GAAA;AAKpD,QAAA,OAAA,CAAQ,KAAA,CAAM;AAAA,UACZ,EAAA;AAAA,UACA,aAAM,kCAAkC,CAAA,UAAA,CAAA;AAAA,UACxC,sBAAsB,OAAO,CAAA,CAAA;AAAA,UAC7B,GAAG,MAAM,MAAA,GAAS,CAAC,kBAAkB,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA,GAAI,EAAC;AAAA,UACvD,GAAG,MAAM,IAAA,GAAO,CAAC,WAAW,IAAA,CAAK,IAAI,CAAA,CAAE,CAAA,GAAI,EAAC;AAAA,UAC5C;AAAA,SACF,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAEZ,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6CAAA,EAAyC,OAAO,CAAA,CAAE,CAAA;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAvBS,EAAA,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA;AA0BT,EAAA,IAAI,QAAA,CAAS,MAAM,CAAA,EAAG;AACpB,IAAA,eAAA,CAAgB,MAAgB,CAAA;AAChC,IAAA,OAAO,MAAA;AAAA,EAIT,CAAA,MAAA,IAAW,OAAO,MAAA,KAAW,WAAA,IAAe,kBAAkB,MAAA,EAAQ;AACpE,IAAA,eAAA,CAAgB,MAAA,CAAO,UAAU,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EAET,CAAA,MAAA,IAAW,kBAAkB,cAAA,EAAgB;AAC3C,IAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY;AACrC,IAAA,OAAO,MAAA,CAAO,WAAA;AAAA,MACZ,IAAI,eAAA,CAAgB;AAAA,QAClB,SAAA,CAAU,OAAO,UAAA,EAAY;AAC3B,UAAA,MAAM,QAAA,GAAW,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AAC1C,UAAA,eAAA,CAAgB,QAAQ,CAAA;AACxB,UAAA,UAAA,CAAW,QAAQ,KAAK,CAAA;AAAA,QAC1B;AAAA,OACD;AAAA,KACH;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAhEgB,MAAA,CAAA,YAAA,EAAA,cAAA,CAAA;AAyEhB,IAAI,cAAA,GAAiB,KAAA;AACrB,IAAM,YAAY,EAAC;AACZ,IAAM,kBAAkB;AAE/B,IAAM,aAAA,GAAgB,CAAC,CAAC,UAAA,CAAW,OAAA;AACnC,IAAM,kBAAA,GAAqB,EAAE,GAAG,aAAA,IAAiB,QAAQ,GAAA,EAAI;AAC7D,IAAI,6BAAA;AAEG,SAAS,eAAe,IAAA,EAE5B;AACD,EAAA,KAAA,CAAM,gCAAA,EAAwB,cAAA,EAAgB,CAAC,CAAE,UAAA,CAAmB,kBAAA,EAAoB,CAAC,CAAC,UAAA,CAAW,OAAA,EAAS,GAAA,CAAI,aAAa,CAAA;AAK/H,EAAA,IAAI,SAAA,IAAa,CAAC,UAAA,CAAW,OAAA,EAAS,IAAI,aAAA,EAAe;AACvD,IAAA,cAAA,GAAiB,IAAA;AACjB,IAAA;AAAA,EACF;AAGA,EAAA,IAAI,iBAAA;AAEJ,EAAA,IAAK,WAAmB,kBAAA,EAAoB;AAC1C,IAAA,iBAAA,GAAqB,UAAA,CAAmB,kBAAA;AAAA,EAG1C,CAAA,MAAA,IAAW,aAAA,IAAiB,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe;AACrD,IAAA,iBAAA,GAAoB,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AAAA,EAC1D,CAAA,MAAO;AACL,IAAA,IAAI,MAAM,SAAA,EAAW;AAErB,IAAA,OAAA,CAAQ,KAAA,CAAM;AAAA,MACZ,EAAA;AAAA,MACA,4CAAA;AAAA,MACA,8CAAA;AAAA,MACA;AAAA,KACF,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AACZ,IAAA,MAAM,IAAI,MAAM,uBAAuB,CAAA;AAAA,EACzC;AACA,EAAA,MAAA,CAAO,MAAA,CAAO,eAAA,EAAiB,iBAAA,CAAkB,QAAQ,CAAA;AACzD,EAAA,iBAAA,CAAkB,iBAAiB,CAAA;AAEnC,EAAA,MAAM,aAAA,GAAgB,aAAA;AAGtB,EAAA,IAAI,aAAA,EAAe;AACjB,IAAA,IAAI,6BAAA,EAA+B;AACjC,MAAA,KAAA,MAAW,GAAA,IAAO,6BAAA,EAA+B,OAAO,OAAA,CAAQ,IAAI,GAAG,CAAA;AACvE,MAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,kBAAkB,CAAA,UAAW,GAAA,CAAI,GAAG,CAAA,GAAI,kBAAA,CAAmB,GAAG,CAAA;AAAA,IAC9F;AACA,IAAA,6BAAA,GAAgC,EAAC;AAAA,EACnC;AAEA,EAAA,KAAA,MAAW,OAAA,IAAW,kBAAkB,MAAA,EAAQ;AAC9C,IAAA,MAAM,SAAA,GAAY,iBAAA,CAAkB,MAAA,CAAO,OAAO,CAAA,CAAE,KAAA;AACpD,IAAA,SAAA,CAAU,OAAO,CAAA,GAAI,SAAA;AACrB,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,6BAAA,EAA+B,KAAK,OAAO,CAAA;AAG3C,MAAA,OAAA,CAAQ,IAAI,OAAO,CAAA,GAAI,cAAc,MAAA,GAAY,EAAA,GAAK,OAAO,SAAS,CAAA;AAAA,IACxE;AAAA,EACF;AACA,EAAA,cAAA,GAAiB,IAAA;AACnB;AA1DgB,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AA8DhB,IAAI;AACF,EAAA,IAAI,CAAC,cAAA,EAAgB;AAGnB,IAAA,cAAA,CAAe,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAAA,EACpC;AACF,CAAA,CAAA,OAAS,GAAA,EAAK;AAGd;AAQA,IAAM,kBAAA,GAAqB;AAAA;AAAA,EAEzB;AACF,CAAA;AAUA,IAAM,QAAA,GAAW,IAAI,KAAA,CAAsB,EAAC,EAAG;AAAA,EAC7C,GAAA,CAAI,QAAQ,IAAA,EAAM;AAEhB,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAE9B,IAAA,IAAI,kBAAA,CAAmB,QAAA,CAAS,IAAI,CAAA,EAAG;AAEvC,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,IAC/C;AAEA,IAAA,IAAI,IAAA,IAAQ,SAAA,EAAW,OAAO,SAAA,CAAU,IAAI,CAAA;AAC5C,IAAA,IAAK,WAAmB,2BAAA,EAA6B;AAEnD,MAAA,IAAK,WAAmB,kBAAA,IAAuB,UAAA,CAAmB,kBAAA,CAAmB,QAAA,CAAS,IAAI,CAAA,EAAG;AACnG,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,IAAI,CAAA,mDAAA,CAAqD,CAAA;AAAA,MACpF,CAAA,MAAO;AACL,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,IAAI,CAAA,iBAAA,CAAmB,CAAA;AAAA,MAClD;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACF,CAAC,CAAA;AAEM,IAAM,GAAA,GAAM","file":"chunk-IMB5QAZS.js","sourcesContent":["declare const Deno: any;\ndeclare const navigator: any;\ndeclare const window: any;\ndeclare const self: any;\n// declare const process: any;\n\n\nlet versionsStr = 'versions'; // eslint-disable-line\n// we use a string here so nextjs static analysis doesnt get angry\nconst processVersions = typeof process !== 'undefined' && (process as any)[versionsStr as any]; // @ts-ignore\n\nexport const isNode: boolean = processVersions && processVersions.node != null;\n\nexport const isWebWorker: boolean = typeof self === 'object'\n  && self.constructor\n  && self.constructor.name === 'DedicatedWorkerGlobalScope';\n\n// https://github.com/jsdom/jsdom/issues/1537#issuecomment-229405327\nexport const isJsDom: boolean = (typeof window !== 'undefined' && window.name === 'nodejs')\n  || (typeof navigator !== 'undefined'\n    && 'userAgent' in navigator\n    && typeof navigator.userAgent === 'string'\n    && (navigator.userAgent.includes('Node.js')\n      || navigator.userAgent.includes('jsdom')));\n\nexport const isDeno: boolean = typeof Deno !== 'undefined'\n  && typeof Deno.version !== 'undefined'\n  && typeof Deno.version.deno !== 'undefined';\n\n/** @see {@link https://bun.sh/guides/util/detect-bun} */\nexport const isBun = processVersions && processVersions.bun != null;\n\n\n\nexport const isBrowser = typeof window !== 'undefined'\n  && typeof window.document !== 'undefined'\n  && typeof window.document.createElement === 'function'\n  && typeof navigator !== 'undefined'\n  && typeof navigator.userAgent === 'string';\n","/* eslint-disable no-console */\nexport function debug(...args: Array<any>) {\n  if (!globalThis.process?.env.DEBUG_VARLOCK) return;\n  console.log(...args);\n}\n","import { redactString } from './lib/redaction';\n\nimport type { SerializedEnvGraph } from '../env-graph';\nimport { isBrowser } from '../lib/detect-runtime';\nimport { debug } from './lib/debug';\n\n// TODO: would like to move all of the redaction utils out of this file\n// but its complicated since it is imported by code that may be run in the backend and frontend\n// but the patching code (which only runs in the backend) use these helper functions\n\n// this does not cover all cases, but serves our needs so far for Next.js\nfunction isString(s: any) {\n  return Object.prototype.toString.call(s) === '[object String]';\n}\n\nconst UNMASK_STR = '👁';\n\n\n// Store redaction state on globalThis so all module instances (e.g., multiple CJS bundles\n// in Turbopack's middleware context) share the same redaction map.\n// Without this, the module instance that patches console.log may have an empty map\n// while a different instance has the populated one.\ntype RedactionState = {\n  sensitiveSecretsMap: Record<string, { key: string, redacted: string }>,\n  redactorFindReplace: undefined | { find: RegExp, replace: ReplaceFn },\n};\ntype ReplaceFn = (match: string, pre: string, val: string, post: string) => string;\n\nconst REDACTION_STATE_KEY = '__varlockRedactionState';\nfunction getRedactionState(): RedactionState {\n  if (!(globalThis as any)[REDACTION_STATE_KEY]) {\n    (globalThis as any)[REDACTION_STATE_KEY] = {\n      sensitiveSecretsMap: {},\n      redactorFindReplace: undefined,\n    };\n  }\n  return (globalThis as any)[REDACTION_STATE_KEY];\n}\n\nexport function resetRedactionMap(graph: SerializedEnvGraph) {\n  const state = getRedactionState();\n  // reset map of { [sensitive] => redacted }\n  state.sensitiveSecretsMap = {};\n  for (const itemKey in graph.config) {\n    const item = graph.config[itemKey];\n    if (item.isSensitive && item.value && isString(item.value)) {\n      // TODO: we want to respect masking settings from the schema (once added)\n      const redacted = redactString(item.value);\n      if (redacted) state.sensitiveSecretsMap[item.value] = { key: itemKey, redacted };\n    }\n  }\n  // if no sensitive items exist, we dont need to do any redaction, but the redact fn is checking for undefined\n  if (!Object.keys(state.sensitiveSecretsMap).length) {\n    state.redactorFindReplace = undefined;\n    return;\n  }\n\n  // reset find/replace regex+fn used for redacting secrets in strings\n  const findRegex = new RegExp(\n    [\n      `(${UNMASK_STR} )?`,\n      '(',\n      Object.keys(state.sensitiveSecretsMap)\n        // Escape special characters\n        .map((s) => s.replace(/[()[\\]{}*+?^$|#.,/\\\\\\s-]/g, '\\\\$&'))\n        // Sort for maximal munch\n        .sort((a, b) => b.length - a.length)\n        .join('|'),\n      ')',\n      `( ${UNMASK_STR})?`,\n    ].join(''),\n    'g',\n  );\n\n  const replaceFn: ReplaceFn = (match, pre, val, post) => {\n    // the pre and post matches only will be populated if they were present\n    // and they are used to unmask the secret - so we do not want to replace in this case\n    if (pre && post) return match;\n    return state.sensitiveSecretsMap[val].redacted;\n  };\n  state.redactorFindReplace = { find: findRegex, replace: replaceFn };\n}\n\n/** Returns diagnostic info about the current redaction state (safe to expose — no secrets) */\nexport function getRedactionMapInfo() {\n  const state = getRedactionState();\n  return {\n    sensitiveItemCount: Object.keys(state.sensitiveSecretsMap).length,\n    hasRedactorRegex: !!state.redactorFindReplace,\n  };\n}\n\n\n// While the module itself acts as a singleton to hold the current map of redacted values\n// we expose only the below const to end users\n\n\n/**\n * Redacts senstive config values from any string/array/object/etc\n *\n * NOTE - must be used only after varlock has loaded config\n * */\nexport function redactSensitiveConfig(o: any): any {\n  const { redactorFindReplace } = getRedactionState();\n  if (!redactorFindReplace) return o;\n  if (!o) return o;\n\n  // TODO: handle more cases?\n  // we can probably redact safely from a few other datatypes - like set,map,etc?\n  // objects are a bit tougher\n  if (Array.isArray(o)) {\n    return o.map(redactSensitiveConfig);\n  }\n  // try to redact if it's a plain object - not necessarily great for perf...\n  if (o && typeof (o) === 'object' && Object.getPrototypeOf(o) === Object.prototype) {\n    try {\n      return JSON.parse(redactSensitiveConfig(JSON.stringify(o)));\n    } catch (err) {\n      return o;\n    }\n  }\n\n  const type = typeof o;\n  if (type === 'string' || (type === 'object' && Object.prototype.toString.call(o) === '[object String]')) {\n    return (o as string).replaceAll(redactorFindReplace.find, redactorFindReplace.replace);\n  }\n\n  return o;\n}\n\n/**\n * utility to unmask a secret/sensitive value when logging to the console\n * currently this only works on a single secret, not objects or aggregated strings\n * */\nexport function revealSensitiveConfig(secretStr: string) {\n  // if redaction not enabled, we just return the secret itself\n  if (!(globalThis as any)._varlockOrigWriteToConsoleFn) return secretStr;\n  // otherwise we add some wrapper characters which will be removed by the patched console behaviour\n  return `${UNMASK_STR} ${secretStr} ${UNMASK_STR}`;\n}\n\n\n\n\n\n// reusable leak scanning helper function, used by various integrations\nexport function scanForLeaks(\n  toScan: string | ReadableStream | null,\n  // optional additional information about what is being scanned to be used in error messages\n  meta?: {\n    method?: string,\n    file?: string,\n  },\n) {\n  debug('⚡️ varlock scanning for leaks');\n  if (!toScan) return toScan;\n\n  function scanStrForLeaks(strToScan: string) {\n    const { sensitiveSecretsMap } = getRedactionState();\n\n    // TODO: probably should use a single regex\n    for (const sensitiveValue in sensitiveSecretsMap) {\n      if (strToScan.includes(sensitiveValue)) {\n        const itemKey = sensitiveSecretsMap[sensitiveValue].key;\n\n        // error stack can gets awkwardly buried since we're so deep in the internals\n        // so we'll write a nicer error message to help the user debug\n        // eslint-disable-next-line no-console\n        console.error([\n          '',\n          `🚨 ${'DETECTED LEAKED SENSITIVE CONFIG'} 🚨`,\n          `> Config item key: ${itemKey}`,\n          ...meta?.method ? [`> Scan method: ${meta.method}`] : [],\n          ...meta?.file ? [`> File: ${meta.file}`] : [],\n          '',\n        ].join('\\n'));\n\n        throw new Error(`🚨 DETECTED LEAKED SENSITIVE CONFIG - ${itemKey}`);\n      }\n    }\n  }\n\n  // scan a string\n  if (isString(toScan)) {\n    scanStrForLeaks(toScan as string);\n    return toScan;\n  // typeof guard needed: in edge runtime, this code runs as raw injected JS outside webpack's\n  // module resolution, so bare `Buffer` is a ReferenceError even though edge supports it via\n  // the sandbox's node:buffer module. This branch is unreachable in edge anyway (only strings/streams).\n  } else if (typeof Buffer !== 'undefined' && toScan instanceof Buffer) {\n    scanStrForLeaks(toScan.toString());\n    return toScan;\n  // scan a ReadableStream by piping it through a scanner\n  } else if (toScan instanceof ReadableStream) {\n    if (toScan.locked) {\n      return toScan;\n    }\n    const chunkDecoder = new TextDecoder();\n    return toScan.pipeThrough(\n      new TransformStream({\n        transform(chunk, controller) {\n          const chunkStr = chunkDecoder.decode(chunk);\n          scanStrForLeaks(chunkStr);\n          controller.enqueue(chunk);\n        },\n      }),\n    );\n  }\n  // other things may be passed in like Buffer... but we'll ignore for now\n  return toScan;\n}\n\n// -----------\n\n\n\n\n// --------------\n\nlet initializedEnv = false;\nconst envValues = {} as Record<string, any>;\nexport const varlockSettings = {} as Record<string, any>;\n\nconst processExists = !!globalThis.process;\nconst originalProcessEnv = { ...processExists && process.env };\nlet varlockInjectedProcessEnvKeys: Array<string> | undefined;\n\nexport function initVarlockEnv(opts?: {\n  allowFail?: boolean,\n}) {\n  debug('⚡️ INIT VARLOCK ENV!', initializedEnv, !!(globalThis as any).__varlockLoadedEnv, !!globalThis.process?.env.__VARLOCK_ENV);\n\n  // normally we can just bail if we detect we are in the browser\n  // however when front-end related tests, it may appear that we are in the browser but it is not\n  // also some frameworks inject a process polyfill, others do not\n  if (isBrowser && !globalThis.process?.env.__VARLOCK_ENV) {\n    initializedEnv = true;\n    return;\n  }\n\n\n  let serializedEnvData: SerializedEnvGraph;\n  // when we inject resolved config at build time, we store it here\n  if ((globalThis as any).__varlockLoadedEnv) {\n    serializedEnvData = (globalThis as any).__varlockLoadedEnv;\n\n  // otherwise if we inject via `varlock run` or have already loaded, it will be in process.env\n  } else if (processExists && process.env.__VARLOCK_ENV) {\n    serializedEnvData = JSON.parse(process.env.__VARLOCK_ENV);\n  } else {\n    if (opts?.allowFail) return;\n    // eslint-disable-next-line no-console\n    console.error([\n      '',\n      '🚨 initVarlockEnv failed  🚨',\n      'try rerunning your command via `varlock run`',\n      '',\n    ].join('\\n'));\n    throw new Error('initVarlockEnv failed');\n  }\n  Object.assign(varlockSettings, serializedEnvData.settings);\n  resetRedactionMap(serializedEnvData);\n\n  const setProcessEnv = processExists;\n\n  // if we've already injected process.env vars in the past, we'll reset those now\n  if (setProcessEnv) {\n    if (varlockInjectedProcessEnvKeys) {\n      for (const key of varlockInjectedProcessEnvKeys) delete process.env[key];\n      for (const key of Object.keys(originalProcessEnv)) process.env[key] = originalProcessEnv[key];\n    }\n    varlockInjectedProcessEnvKeys = [];\n  }\n\n  for (const itemKey in serializedEnvData.config) {\n    const itemValue = serializedEnvData.config[itemKey].value;\n    envValues[itemKey] = itemValue;\n    if (setProcessEnv) {\n      varlockInjectedProcessEnvKeys?.push(itemKey);\n      // when re-injecting into process.env, we treat undefined as empty string\n      // this more closely matches expected behaviour from other .env loaders\n      process.env[itemKey] = itemValue === undefined ? '' : String(itemValue);\n    }\n  }\n  initializedEnv = true;\n}\n\n// we will attempt to call initVarlockEnv automatically, but in most cases it should be called explicitly\n// note that if this is being imported in the browser, process.env may not exist, so we do this in a try/catch\ntry {\n  if (!initializedEnv) {\n    // if we are automatically loading because __VARLOCK_ENV is already set\n    // then we assume process.env vars have also already been set (although might not harm anything?)\n    initVarlockEnv({ allowFail: true });\n  }\n} catch (err) {\n  // expected that this will fail when process.env does not exist\n  // but we may want to look for specific errors\n}\n\n\n\n// some object keys are checked by various tools when handling arbitrary data, especially in templates\n// because our proxy objects throw errors when unknown keys are accessed, this causes problems\n// for now we can just filter out a these keys and it should be fairly harmless\n// TODO: ideally this could be customized by the user, and not specific to vue\nconst IGNORED_PROXY_KEYS = [\n  // vue - see https://github.com/vuejs/core/blob/70773d00985135a50556c61fb9855ed6b930cb82/packages/reactivity/src/ref.ts#L101\n  '__v_isRef',\n];\n\n\n// this gets exported and then augmented by our type generation\n// ideally we'd start with a loose type `Record<string,any>` and then override it with the actual schema\n// so that if type generation was disabled, a user could still use `ENV`\n// but TS wont let us, so instead we start with it being empty, which will cause type errors\n// unless type generation is enabled\nexport interface TypedEnvSchema {}\n\nconst EnvProxy = new Proxy<TypedEnvSchema>({}, {\n  get(target, prop) {\n    // ignore symbols, as it likely an external tool checking something\n    if (typeof prop === 'symbol') return;\n    // special cases to avoid throwing on invalid keys\n    if (IGNORED_PROXY_KEYS.includes(prop)) return;\n\n    if (!initializedEnv) {\n      throw new Error('varlock ENV not initialized');\n    }\n\n    if (prop in envValues) return envValues[prop];\n    if ((globalThis as any).__varlockThrowOnMissingKeys) {\n      // during development, we can feed in extra metadata and show more helpful errors\n      if ((globalThis as any).__varlockValidKeys && (globalThis as any).__varlockValidKeys.includes(prop)) {\n        throw new Error(`\\`ENV.${prop}\\` exists, but is not available in this environment`);\n      } else {\n        throw new Error(`\\`ENV.${prop}\\` does not exist`);\n      }\n    }\n    return undefined;\n  },\n});\n\nexport const ENV = EnvProxy;\n"]}