varlock 1.0.0 → 1.1.0

package/dist/auto-load.js

@@ -1,7 +1,7 @@
-import './chunk-UUDTMOJS.js';
+import './chunk-JUPAI2X4.js';
 import './chunk-F6RTQ5QX.js';
 import './chunk-5DUWGI2N.js';
-import './chunk-YHOWSHVH.js';
+import './chunk-F5H5MJ6U.js';
 import './chunk-R73FENLU.js';
 import './chunk-MGWUDHT5.js';
 import './chunk-XLYSNOR3.js';

package/dist/{chunk-VODQDF4Q.js → chunk-6RF54KKR.js}

@@ -1,11 +1,11 @@
 import { define } from './chunk-4A54P4EM.js';
-import { checkForSchemaErrors, checkForNoEnvFiles, checkForConfigErrors, showPluginWarnings } from './chunk-UKFHSMKY.js';
-import { loadVarlockEnvGraph } from './chunk-V2MTE4J6.js';
+import { checkForSchemaErrors, checkForNoEnvFiles, checkForConfigErrors, showPluginWarnings } from './chunk-7GFD2ATN.js';
+import { loadVarlockEnvGraph } from './chunk-E3F6QKDZ.js';
 import { gracefulExit } from './chunk-CHQDS2PI.js';
-import { getItemSummary } from './chunk-GBCB7Y3B.js';
+import { getItemSummary } from './chunk-QP7TS4SU.js';
 import { __name } from './chunk-6PEHRAEP.js';
+import { writeFileSync } from 'fs';
 
-// src/cli/commands/load.command.ts
 var commandSpec = define({
   name: "load",
   description: "Load env according to schema and resolve values",
@@ -34,6 +34,14 @@ var commandSpec = define({
       short: "p",
       multiple: true,
       description: "Path to a specific .env file or directory to use as the entry point (can be specified multiple times)"
+    },
+    "summary-stderr": {
+      type: "boolean",
+      description: "Also output the pretty (redacted) summary to stderr (useful alongside --format json-full to get both machine-readable output on stdout and a human-readable summary on stderr)"
+    },
+    "summary-file": {
+      type: "string",
+      description: "Also write the pretty (redacted) summary to a file path (useful for CI, e.g. $GITHUB_STEP_SUMMARY)"
     }
   },
   examples: `
@@ -49,6 +57,8 @@ Examples:
   varlock load -p ./envs -p ./overrides  # Load from multiple directories
   varlock load --compact          # Use compact format - skips undefined values, no indentation for json-full
   varlock load --env production   # Load for a specific environment (\u26A0\uFE0F ignored if using @currentEnv!)
+  varlock load --format json-full --summary-stderr   # JSON on stdout + redacted human summary on stderr
+  varlock load --format json-full --summary-file /tmp/summary.txt   # JSON on stdout + redacted human summary written to file
 `.trim()
 });
 function formatShellValue(value) {
@@ -56,7 +66,13 @@ function formatShellValue(value) {
 }
 __name(formatShellValue, "formatShellValue");
 var commandFn = /* @__PURE__ */ __name(async (ctx) => {
-  const { format, compact, "show-all": showAll } = ctx.values;
+  const {
+    format,
+    compact,
+    "show-all": showAll,
+    "summary-stderr": summaryStderr,
+    "summary-file": summaryFile
+  } = ctx.values;
   const envGraph = await loadVarlockEnvGraph({
     currentEnvFallback: ctx.values.env,
     entryFilePaths: ctx.values.path
@@ -73,6 +89,19 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
   } else {
     checkForConfigErrors(envGraph, { showAll });
   }
+  if ((summaryStderr || summaryFile) && format !== "pretty") {
+    const summaryLines = envGraph.sortedConfigKeys.map(
+      (key) => getItemSummary(envGraph.configSchema[key])
+    );
+    const summaryStr = `${summaryLines.join("\n")}
+`;
+    if (summaryStderr) {
+      process.stderr.write(summaryStr);
+    }
+    if (summaryFile) {
+      writeFileSync(summaryFile, summaryStr);
+    }
+  }
   if (format === "pretty") {
     showPluginWarnings(envGraph);
     for (const itemKey of envGraph.sortedConfigKeys) {
@@ -117,5 +146,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 
 export { commandFn, commandSpec, formatShellValue };
-//# sourceMappingURL=chunk-VODQDF4Q.js.map
-//# sourceMappingURL=chunk-VODQDF4Q.js.map
+//# sourceMappingURL=chunk-6RF54KKR.js.map
+//# sourceMappingURL=chunk-6RF54KKR.js.map

package/dist/chunk-6RF54KKR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/load.command.ts"],"names":[],"mappings":";;;;;;;;AAWO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,MAAA;AAAA,EACN,WAAA,EAAa,iDAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,MAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,SAAS,CAAC,QAAA,EAAU,MAAA,EAAQ,KAAA,EAAO,SAAS,WAAW,CAAA;AAAA,MACvD,WAAA,EAAa,kBAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACX;AAAA,IACA,OAAA,EAAS;AAAA,MACP,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,UAAA,EAAY;AAAA,MACV,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,GAAA,EAAK;AAAA,MACH,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACf;AAAA,IACA,gBAAA,EAAkB;AAAA,MAChB,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,cAAA,EAAgB;AAAA,MACd,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAeV,IAAA;AACF,CAAC;AAQM,SAAS,iBAAiB,KAAA,EAAuB;AACtD,EAAA,OAAO,CAAA,CAAA,EAAI,KAAA,CAAM,UAAA,CAAW,GAAA,EAAK,OAAO,CAAC,CAAA,CAAA,CAAA;AAC3C;AAFgB,MAAA,CAAA,gBAAA,EAAA,kBAAA,CAAA;AAIT,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAChF,EAAA,MAAM;AAAA,IACJ,MAAA;AAAA,IAAQ,OAAA;AAAA,IAAS,UAAA,EAAY,OAAA;AAAA,IAAS,gBAAA,EAAkB,aAAA;AAAA,IAAe,cAAA,EAAgB;AAAA,MACrF,GAAA,CAAI,MAAA;AAER,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,CAAoB;AAAA,IACzC,kBAAA,EAAoB,IAAI,MAAA,CAAO,GAAA;AAAA,IAC/B,cAAA,EAAgB,IAAI,MAAA,CAAO;AAAA,GAC5B,CAAA;AAKD,EAAA,IAAI,WAAW,WAAA,EAAa;AAC1B,IAAA,oBAAA,CAAqB,QAAQ,CAAA;AAC7B,IAAA,kBAAA,CAAmB,QAAQ,CAAA;AAAA,EAC7B;AAEA,EAAA,IAAI,CAAC,QAAA,CAAS,cAAA,EAAgB,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAGnF,EAAA,MAAM,SAAS,qBAAA,EAAsB;AAErC,EAAA,MAAM,SAAS,gBAAA,EAAiB;AAEhC,EAAA,IAAI,WAAW,WAAA,EAAa;AAC1B,IAAA,oBAAA,CAAqB,QAAA,EAAU,EAAE,OAAA,EAAS,OAAA,EAAS,MAAM,CAAA;AAAA,EAC3D,CAAA,MAAO;AACL,IAAA,oBAAA,CAAqB,QAAA,EAAU,EAAE,OAAA,EAAS,CAAA;AAAA,EAC5C;AAEA,EAAA,IAAA,CAAK,aAAA,IAAiB,WAAA,KAAgB,MAAA,KAAW,QAAA,EAAU;AACzD,IAAA,MAAM,YAAA,GAAe,SAAS,gBAAA,CAAiB,GAAA;AAAA,MAC7C,CAAC,GAAA,KAAQ,cAAA,CAAe,QAAA,CAAS,YAAA,CAAa,GAAG,CAAC;AAAA,KACpD;AACA,IAAA,MAAM,UAAA,GAAa,CAAA,EAAG,YAAA,CAAa,IAAA,CAAK,IAAI,CAAC;AAAA,CAAA;AAC7C,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,UAAU,CAAA;AAAA,IACjC;AACA,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,aAAA,CAAc,aAAa,UAAU,CAAA;AAAA,IACvC;AAAA,EACF;AAEA,EAAA,IAAI,WAAW,QAAA,EAAU;AACvB,IAAA,kBAAA,CAAmB,QAAQ,CAAA;AAC3B,IAAA,KAAA,MAAW,OAAA,IAAW,SAAS,gBAAA,EAAkB;AAC/C,MAAA,MAAM,IAAA,GAAO,QAAA,CAAS,YAAA,CAAa,OAAO,CAAA;AAC1C,MAAA,OAAA,CAAQ,GAAA,CAAI,cAAA,CAAe,IAAI,CAAC,CAAA;AAAA,IAClC;AAAA,EACF,CAAA,MAAA,IAAW,WAAW,MAAA,EAAQ;AAC5B,IAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,SAAA,CAAU,QAAA,CAAS,sBAAqB,EAAG,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,EACtE,CAAA,MAAA,IAAW,WAAW,WAAA,EAAa;AACjC,IAAA,MAAM,MAAA,GAAS,UAAU,CAAA,GAAI,CAAA;AAC7B,IAAA,MAAM,UAAA,GAAa,SAAS,kBAAA,EAAmB;AAC/C,IAAA,OAAA,CAAQ,IAAI,IAAA,CAAK,SAAA,CAAU,UAAA,EAAY,IAAA,EAAM,MAAM,CAAC,CAAA;AAGpD,IAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,MAAA,YAAA,CAAa,CAAC,CAAA;AAAA,IAChB;AAAA,EACF,CAAA,MAAA,IAAW,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,OAAA,EAAS;AACjD,IAAA,MAAM,WAAA,GAAc,SAAS,oBAAA,EAAqB;AAClD,IAAA,MAAM,gBAAgB,OAAA,KAAY,IAAA;AAClC,IAAA,MAAM,MAAA,GAAS,MAAA,KAAW,OAAA,GAAU,SAAA,GAAY,EAAA;AAEhD,IAAA,KAAA,MAAW,OAAO,WAAA,EAAa;AAC7B,MAAA,MAAM,KAAA,GAAQ,YAAY,GAAG,CAAA;AAE7B,MAAA,IAAI,KAAA,KAAU,UAAa,aAAA,EAAe;AACxC,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,QAAA;AACJ,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,QAAA,GAAW,EAAA;AAAA,MACb,CAAA,MAAA,IAAW,OAAO,KAAA,KAAU,QAAA,EAAU;AACpC,QAAA,IAAI,WAAW,OAAA,EAAS;AACtB,UAAA,QAAA,GAAW,iBAAiB,KAAK,CAAA;AAAA,QACnC,CAAA,MAAO;AACL,UAAA,QAAA,GAAW,CAAA,CAAA,EAAI,MAAM,UAAA,CAAW,GAAA,EAAK,KAAK,CAAA,CAAE,UAAA,CAAW,IAAA,EAAM,KAAK,CAAC,CAAA,CAAA,CAAA;AAAA,QACrE;AAAA,MACF,CAAA,MAAO;AACL,QAAA,QAAA,GAAW,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,MACjC;AACA,MAAA,OAAA,CAAQ,IAAI,CAAA,EAAG,MAAM,GAAG,GAAG,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAE,CAAA;AAAA,IAC3C;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,MAAM,CAAA,CAAE,CAAA;AAAA,EAC7C;AACF,CAAA,EA1FmE,WAAA","file":"chunk-6RF54KKR.js","sourcesContent":["import { writeFileSync } from 'node:fs';\nimport { define } from 'gunshi';\nimport { gracefulExit } from 'exit-hook';\n\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { getItemSummary } from '../../lib/formatting';\nimport {\n  checkForConfigErrors, checkForNoEnvFiles, checkForSchemaErrors, showPluginWarnings,\n} from '../helpers/error-checks';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\n\nexport const commandSpec = define({\n  name: 'load',\n  description: 'Load env according to schema and resolve values',\n  args: {\n    format: {\n      type: 'enum',\n      short: 'f',\n      choices: ['pretty', 'json', 'env', 'shell', 'json-full'],\n      description: 'Format of output',\n      default: 'pretty',\n    },\n    compact: {\n      type: 'boolean',\n      description: 'Use compact format (for json-full: no indentation, for env/shell: skip undefined values)',\n    },\n    'show-all': {\n      type: 'boolean',\n      description: 'When load is failing, show all items rather than only failing items',\n    },\n    env: {\n      type: 'string',\n      description: 'Set the environment (e.g., production, development, etc) - will be overridden by @currentEnv in the schema if present',\n    },\n    path: {\n      type: 'string',\n      short: 'p',\n      multiple: true,\n      description: 'Path to a specific .env file or directory to use as the entry point (can be specified multiple times)',\n    },\n    'summary-stderr': {\n      type: 'boolean',\n      description: 'Also output the pretty (redacted) summary to stderr (useful alongside --format json-full to get both machine-readable output on stdout and a human-readable summary on stderr)',\n    },\n    'summary-file': {\n      type: 'string',\n      description: 'Also write the pretty (redacted) summary to a file path (useful for CI, e.g. $GITHUB_STEP_SUMMARY)',\n    },\n  },\n  examples: `\nLoads and validates environment variables according to your .env files, and prints the results.\nUseful for debugging locally, and in CI to print out a summary of env vars.\n\nExamples:\n  varlock load                    # Load and validate with pretty output\n  varlock load --format json      # Output in JSON format\n  eval \"$(varlock load --format shell)\"  # Load vars into current shell (useful with direnv)\n  varlock load --show-all         # Show all items when validation fails\n  varlock load --path .env.prod   # Load from a specific .env file\n  varlock load -p ./envs -p ./overrides  # Load from multiple directories\n  varlock load --compact          # Use compact format - skips undefined values, no indentation for json-full\n  varlock load --env production   # Load for a specific environment (⚠️ ignored if using @currentEnv!)\n  varlock load --format json-full --summary-stderr   # JSON on stdout + redacted human summary on stderr\n  varlock load --format json-full --summary-file /tmp/summary.txt   # JSON on stdout + redacted human summary written to file\n`.trim(),\n});\n\n\n/**\n * Formats a string value for safe use in a shell export statement.\n * Uses single-quoted strings to prevent shell injection via backticks, `$`, etc.\n * Single quotes within the value are escaped using the `'\\''` sequence.\n */\nexport function formatShellValue(value: string): string {\n  return `'${value.replaceAll(\"'\", \"'\\\\''\")}'`;\n}\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  const {\n    format, compact, 'show-all': showAll, 'summary-stderr': summaryStderr, 'summary-file': summaryFile,\n  } = ctx.values;\n\n  const envGraph = await loadVarlockEnvGraph({\n    currentEnvFallback: ctx.values.env,\n    entryFilePaths: ctx.values.path,\n  });\n\n  // For json-full, always output the serialized graph — it includes `errors` and\n  // `configErrors` fields so consumers can handle failures gracefully.\n  // For all other formats, exit on errors as before.\n  if (format !== 'json-full') {\n    checkForSchemaErrors(envGraph);\n    checkForNoEnvFiles(envGraph);\n  }\n\n  if (!envGraph.rootDataSource) throw new Error('expected root data source to be set');\n\n  // Generate types before resolving values — uses only non-env-specific schema info\n  await envGraph.generateTypesIfNeeded();\n\n  await envGraph.resolveEnvValues();\n\n  if (format === 'json-full') {\n    checkForConfigErrors(envGraph, { showAll, noThrow: true });\n  } else {\n    checkForConfigErrors(envGraph, { showAll });\n  }\n\n  if ((summaryStderr || summaryFile) && format !== 'pretty') {\n    const summaryLines = envGraph.sortedConfigKeys.map(\n      (key) => getItemSummary(envGraph.configSchema[key]),\n    );\n    const summaryStr = `${summaryLines.join('\\n')}\\n`;\n    if (summaryStderr) {\n      process.stderr.write(summaryStr);\n    }\n    if (summaryFile) {\n      writeFileSync(summaryFile, summaryStr);\n    }\n  }\n\n  if (format === 'pretty') {\n    showPluginWarnings(envGraph);\n    for (const itemKey of envGraph.sortedConfigKeys) {\n      const item = envGraph.configSchema[itemKey];\n      console.log(getItemSummary(item));\n    }\n  } else if (format === 'json') {\n    console.log(JSON.stringify(envGraph.getResolvedEnvObject(), null, 2));\n  } else if (format === 'json-full') {\n    const indent = compact ? 0 : 2;\n    const serialized = envGraph.getSerializedGraph();\n    console.log(JSON.stringify(serialized, null, indent));\n    // Output JSON to stdout even on failure (so consumers can parse err.stdout),\n    // but still exit non-zero so execSync callers know something is wrong\n    if (serialized.errors) {\n      gracefulExit(1);\n    }\n  } else if (format === 'env' || format === 'shell') {\n    const resolvedEnv = envGraph.getResolvedEnvObject();\n    const skipUndefined = compact === true;\n    const prefix = format === 'shell' ? 'export ' : '';\n\n    for (const key in resolvedEnv) {\n      const value = resolvedEnv[key];\n\n      if (value === undefined && skipUndefined) {\n        continue;\n      }\n\n      let strValue: string;\n      if (value === undefined) {\n        strValue = '';\n      } else if (typeof value === 'string') {\n        if (format === 'shell') {\n          strValue = formatShellValue(value);\n        } else {\n          strValue = `\"${value.replaceAll('\"', '\\\\\"').replaceAll('\\n', '\\\\n')}\"`;\n        }\n      } else {\n        strValue = JSON.stringify(value);\n      }\n      console.log(`${prefix}${key}=${strValue}`);\n    }\n  } else {\n    throw new Error(`Unknown format: ${format}`);\n  }\n};\n"]}

package/dist/{chunk-UKFHSMKY.js → chunk-7GFD2ATN.js}

@@ -1,6 +1,6 @@
 import { gracefulExit } from './chunk-CHQDS2PI.js';
-import { getItemSummary, joinAndCompact } from './chunk-GBCB7Y3B.js';
-import { ansis_default, FileBasedDataSource } from './chunk-U7RQPX5K.js';
+import { getItemSummary, joinAndCompact } from './chunk-QP7TS4SU.js';
+import { ansis_default, FileBasedDataSource } from './chunk-XWYFSG46.js';
 import { VarlockError, my_dash_default } from './chunk-2PFIYNFA.js';
 import { __name } from './chunk-6PEHRAEP.js';
 
@@ -132,5 +132,5 @@ function checkForConfigErrors(envGraph, opts) {
 __name(checkForConfigErrors, "checkForConfigErrors");
 
 export { InvalidEnvError, checkForConfigErrors, checkForNoEnvFiles, checkForSchemaErrors, showPluginWarnings };
-//# sourceMappingURL=chunk-UKFHSMKY.js.map
-//# sourceMappingURL=chunk-UKFHSMKY.js.map
+//# sourceMappingURL=chunk-7GFD2ATN.js.map
+//# sourceMappingURL=chunk-7GFD2ATN.js.map

package/dist/{chunk-UKFHSMKY.js.map → chunk-7GFD2ATN.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/helpers/error-checks.ts"],"names":[],"mappings":";;;;;;;AAQA,SAAS,yBAAyB,GAAA,EAAY;AAC5C,EAAA,IAAI,EAAE,GAAA,YAAe,YAAA,CAAA,IAAiB,CAAC,IAAI,QAAA,EAAU;AACrD,EAAA,MAAM,SAAS,GAAA,CAAI,QAAA;AACnB,EAAA,MAAM,UAAA,GAAa;AAAA,IACjB,MAAA,CAAO,OAAA;AAAA,IACP,CAAA,EAAG,aAAA,CAAM,IAAA,CAAK,GAAA,CAAI,OAAO,MAAA,CAAO,SAAA,GAAY,CAAC,CAAC,CAAC,CAAA,EAAG,aAAA,CAAM,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,GAClE,CAAE,KAAK,IAAI,CAAA;AAEX,EAAA,OAAA,CAAQ,MAAM,EAAE,CAAA;AAChB,EAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,UAAA,EAAM,MAAA,CAAO,EAAE,CAAA,CAAA,EAAI,OAAO,UAAU,CAAA,CAAA,EAAI,MAAA,CAAO,SAAS,CAAA,CAAE,CAAA;AACxE,EAAA,OAAA,CAAQ,MAAM,UAAU,CAAA;AAC1B;AAXS,MAAA,CAAA,wBAAA,EAAA,0BAAA,CAAA;AAaF,SAAS,mBAAmB,QAAA,EAAoB;AACrD,EAAA,IAAI,OAAO,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,CAAE,WAAW,CAAA,EAAG;AACnD,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,GAAA,EAAI;AACrD,IAAA,MAAM,iBAAiB,QAAA,CAAS,iBAAA,CAAkB,KAAK,CAAC,CAAA,KAAM,aAAa,mBAAmB,CAAA;AAC9F,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,OAAA,CAAQ,KAAA,CAAM,oCAA6B,WAAW;AAAA,CAAI,CAAA;AAC1D,MAAA,OAAA,CAAQ,MAAM,kGAAkG,CAAA;AAAA,IAClH,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,KAAA,CAAM,wCAAiC,WAAW;AAAA,CAAI,CAAA;AAC9D,MAAA,OAAA,CAAQ,MAAM,oDAAoD,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,aAAa,CAAC,CAAA;AAAA,EACvB;AACF;AAbgB,MAAA,CAAA,kBAAA,EAAA,oBAAA,CAAA;AAeT,SAAS,qBAAqB,QAAA,EAAoB;AAEvD,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,iBAAA,EAAmB;AAI/C,IAAA,IAAI,OAAO,YAAA,EAAc;AACvB,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,0CAAA,EAAsC,MAAA,CAAO,KAAK;AAAA,CAAI,CAAA;AAEpE,MAAA,OAAA,CAAQ,KAAA,CAAM,MAAA,CAAO,YAAA,CAAa,OAAO,CAAA;AACzC,MAAA,wBAAA,CAAyB,OAAO,YAAY,CAAA;AAI5C,MAAA,IAAI,OAAO,YAAA,CAAa,KAAA,IAAS,EAAE,MAAA,CAAO,wBAAwB,YAAA,CAAA,EAAe;AAC/E,QAAA,OAAA,CAAQ,KAAA,CAAM;AAAA,EAAK,aAAA,CAAM,GAAA,CAAI,cAAc,CAAC,CAAA,CAAE,CAAA;AAC9C,QAAA,OAAA,CAAQ,MAAM,aAAA,CAAM,GAAA,CAAI,MAAA,CAAO,YAAA,CAAa,KAAK,CAAC,CAAA;AAAA,MACpD;AAEA,MAAA,OAAO,aAAa,CAAC,CAAA;AAAA,IACvB;AAEA,IAAA,IAAI,MAAA,CAAO,aAAa,MAAA,EAAQ;AAC9B,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,kCAAA,EAA8B,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAE1D,MAAA,KAAA,MAAW,SAAA,IAAa,OAAO,YAAA,EAAc;AAC3C,QAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAA,EAAK,SAAA,CAAU,OAAO,CAAA,CAAE,CAAA;AACtC,QAAA,wBAAA,CAAyB,SAAS,CAAA;AAAA,MACpC;AACA,MAAA,OAAO,aAAa,CAAC,CAAA;AAAA,IACvB;AAAA,EACF;AASF;AAxCgB,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AA2CT,SAAS,mBAAmB,QAAA,EAAoB;AACrD,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,OAAA,EAAS;AACrC,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,EAAQ;AAC7B,IAAA,KAAA,MAAW,OAAA,IAAW,OAAO,QAAA,EAAU;AACrC,MAAA,OAAA,CAAQ,MAAM,aAAA,CAAM,MAAA,CAAO,aAAa,OAAA,CAAQ,OAAO,EAAE,CAAC,CAAA;AAC1D,MAAA,IAAI,QAAQ,GAAA,EAAK;AACf,QAAA,KAAA,MAAW,IAAA,IAAQ,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,EAAG;AAC1C,UAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAA,EAAK,IAAI,CAAA,CAAE,CAAA;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAZgB,MAAA,CAAA,kBAAA,EAAA,oBAAA,CAAA;AAcT,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EA7F3C;AA6F2C,IAAA,MAAA,CAAA,IAAA,EAAA,iBAAA,CAAA;AAAA;AAAA,EACzC,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,6CAA6C,CAAA;AAAA,EACrD;AAAA,EACA,kBAAA,GAAqB;AACnB,IAAA,OAAO;AAAA,UAAA,EAAQ,aAAA,CAAM,GAAA,CAAI,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,CAAA;AAAA,EACxC;AACF;AAEO,SAAS,oBAAA,CAAqB,UAAoB,IAAA,EAItD;AAED,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,iBAAA,EAAmB;AAC/C,IAAA,IAAI,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAClC,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,qCAAA,EAAiC,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAE7D,MAAA,KAAA,MAAW,GAAA,IAAO,OAAO,gBAAA,EAAkB;AACzC,QAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAA,EAAK,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAChC,QAAA,IAAI,GAAA,YAAe,YAAA,IAAgB,GAAA,CAAI,GAAA,EAAK;AAC1C,UAAA,KAAA,MAAW,IAAA,IAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,EAAG;AACtC,YAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAA,EAAK,IAAI,CAAA,CAAE,CAAA;AAAA,UAC3B;AAAA,QACF;AACA,QAAA,wBAAA,CAAyB,GAAG,CAAA;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAIA,EAAA,MAAM,eAAe,QAAA,CAAS,gBAAA,CAC3B,GAAA,CAAI,CAAC,MAAM,QAAA,CAAS,YAAA,CAAa,CAAC,CAAC,EACnC,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,oBAAoB,OAAO,CAAA;AAGpD,EAAA,IAAI,YAAA,CAAa,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAA,CAAQ,KAAA,CAAM;AAAA,+BAAA,EAAe,aAAA,CAAM,IAAA,CAAK,SAAA,CAAU,qCAAqC,CAAC,CAAA;AAAA,CAAc,CAAA;AACtG,IAAA,OAAA,CAAQ,MAAM,kBAAkB,CAAA;AAEhC,IAAA,eAAA,CAAE,IAAA,CAAK,YAAA,EAAc,CAAC,IAAA,KAAqB;AACzC,MAAA,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,IAAI,CAAC,CAAA;AAClC,MAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,IAChB,CAAC,CAAA;AACD,IAAA,IAAI,MAAM,OAAA,EAAS;AACjB,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,OAAA,CAAQ,MAAM,cAAA,CAAe;AAAA,QAC3B,cAAA;AAAA,QACA,aAAA,CAAM,MAAA,CAAO,IAAA,CAAK,oCAAoC;AAAA,OACvD,CAAC,CAAA;AACF,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,MAAM,aAAa,QAAA,CAAS,gBAAA,CACzB,GAAA,CAAI,CAAC,MAAM,QAAA,CAAS,YAAA,CAAa,CAAC,CAAC,EACnC,MAAA,CAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAA;AAC5B,MAAA,eAAA,CAAE,IAAA,CAAK,UAAA,EAAY,CAAC,IAAA,KAAqB;AACvC,QAAA,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,IAAI,CAAC,CAAA;AAAA,MACpC,CAAC,CAAA;AAAA,IACH;AAEA,IAAA,kBAAA,CAAmB,QAAQ,CAAA;AAC3B,IAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,MAAA,MAAM,IAAI,eAAA,EAAgB;AAAA,IAC5B;AAAA,EACF;AACF;AAzDgB,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA","file":"chunk-UKFHSMKY.js","sourcesContent":["import ansis from 'ansis';\nimport { gracefulExit } from 'exit-hook';\nimport _ from '@env-spec/utils/my-dash';\nimport { EnvGraph, ConfigItem, FileBasedDataSource } from '../../env-graph';\nimport { getItemSummary, joinAndCompact } from '../../lib/formatting';\nimport { VarlockError } from '../../env-graph/lib/errors';\n\n\nfunction showErrorLocationDetails(err: Error) {\n  if (!(err instanceof VarlockError) || !err.location) return;\n  const errLoc = err.location;\n  const errPreview = [\n    errLoc.lineStr,\n    `${ansis.gray('-'.repeat(errLoc.colNumber - 1))}${ansis.red('^')}`,\n  ].join('\\n');\n\n  console.error('');\n  console.error(`📂 ${errLoc.id}:${errLoc.lineNumber}:${errLoc.colNumber}`);\n  console.error(errPreview);\n}\n\nexport function checkForNoEnvFiles(envGraph: EnvGraph) {\n  if (Object.keys(envGraph.configSchema).length === 0) {\n    const displayPath = envGraph.basePath ?? process.cwd();\n    const hasLoadedFiles = envGraph.sortedDataSources.some((s) => s instanceof FileBasedDataSource);\n    if (!hasLoadedFiles) {\n      console.error(`🚨 No .env files found in ${displayPath}\\n`);\n      console.error('Run `varlock init` to create a .env.schema file, or use `--path` to specify a file or directory.');\n    } else {\n      console.error(`🚨 No config items defined in ${displayPath}\\n`);\n      console.error('Add items to your .env.schema file to get started.');\n    }\n    return gracefulExit(1);\n  }\n}\n\nexport function checkForSchemaErrors(envGraph: EnvGraph) {\n  // first we check for loading/parse errors - some cases we may want to let it fail silently?\n  for (const source of envGraph.sortedDataSources) {\n    // do we care about loading errors from disabled sources?\n    // if (source.disabled) continue;\n\n    if (source.loadingError) {\n      console.error(`🚨 Error encountered while loading ${source.label}\\n`);\n\n      console.error(source.loadingError.message);\n      showErrorLocationDetails(source.loadingError);\n\n      // For plugin loading errors, show the full stack trace since it's usually\n      // a runtime error from executing the plugin code\n      if (source.loadingError.stack && !(source.loadingError instanceof VarlockError)) {\n        console.error(`\\n${ansis.dim('Stack trace:')}`);\n        console.error(ansis.dim(source.loadingError.stack));\n      }\n\n      return gracefulExit(1);\n    }\n    // TODO: unify this with the above!\n    if (source.schemaErrors.length) {\n      console.error(`🚨 Error(s) encountered in ${source.label}`);\n\n      for (const schemaErr of source.schemaErrors) {\n        console.error(`- ${schemaErr.message}`);\n        showErrorLocationDetails(schemaErr);\n      }\n      return gracefulExit(1);\n    }\n  }\n\n  // now we check for any schema errors - where something about how things are wired up is invalid\n  // NOTE - we should not have run any resolution yet\n  // TODO: make sure we are calling this before attempting to resolve values\n  // const failingItems = _.filter(_.values(envGraph.configSchema), (item) => item.validationState === 'error');\n  // if (failingItems.length > 0) {\n  //   throw new CliExitError('Schema is currently invalid');\n  // }\n}\n\n\nexport function showPluginWarnings(envGraph: EnvGraph) {\n  for (const plugin of envGraph.plugins) {\n    if (!plugin.warnings.length) continue;\n    for (const warning of plugin.warnings) {\n      console.error(ansis.yellow(`[WARNING] ${warning.message}`));\n      if (warning.tip) {\n        for (const line of warning.tip.split('\\n')) {\n          console.error(`  ${line}`);\n        }\n      }\n    }\n  }\n}\n\nexport class InvalidEnvError extends Error {\n  constructor() {\n    super('Resolved config/env did not pass validation');\n  }\n  getFormattedOutput() {\n    return `\\n💥 ${ansis.red(this.message)} 💥\\n`;\n  }\n}\n\nexport function checkForConfigErrors(envGraph: EnvGraph, opts?: {\n  showAll?: boolean;\n  /** Log errors to stderr but don't throw — used when the caller will handle errors itself (e.g. json-full output) */\n  noThrow?: boolean;\n}) {\n  // check for root decorator \"execution\"\n  for (const source of envGraph.sortedDataSources) {\n    if (source.resolutionErrors.length) {\n      console.error(`🚨 Root decorator error(s) in ${source.label}`);\n\n      for (const err of source.resolutionErrors) {\n        console.error(`- ${err.message}`);\n        if (err instanceof VarlockError && err.tip) {\n          for (const line of err.tip.split('\\n')) {\n            console.error(`  ${line}`);\n          }\n        }\n        showErrorLocationDetails(err);\n      }\n    }\n  }\n\n\n\n  const failingItems = envGraph.sortedConfigKeys\n    .map((k) => envGraph.configSchema[k])\n    .filter((item) => item.validationState === 'error');\n\n  // TODO: use service.isValid?\n  if (failingItems.length > 0) {\n    console.error(`\\n🚨 🚨 🚨  ${ansis.bold.underline('Configuration is currently invalid ')}  🚨 🚨 🚨\\n`);\n    console.error('Invalid items:\\n');\n\n    _.each(failingItems, (item: ConfigItem) => {\n      console.error(getItemSummary(item));\n      console.error();\n    });\n    if (opts?.showAll) {\n      console.error();\n      console.error(joinAndCompact([\n        'Valid items:',\n        ansis.italic.gray('(remove `--show-all` flag to hide)'),\n      ]));\n      console.error();\n      const validItems = envGraph.sortedConfigKeys\n        .map((k) => envGraph.configSchema[k])\n        .filter((i) => !!i.isValid);\n      _.each(validItems, (item: ConfigItem) => {\n        console.error(getItemSummary(item));\n      });\n    }\n\n    showPluginWarnings(envGraph);\n    if (!opts?.noThrow) {\n      throw new InvalidEnvError();\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../src/cli/helpers/error-checks.ts"],"names":[],"mappings":";;;;;;;AAQA,SAAS,yBAAyB,GAAA,EAAY;AAC5C,EAAA,IAAI,EAAE,GAAA,YAAe,YAAA,CAAA,IAAiB,CAAC,IAAI,QAAA,EAAU;AACrD,EAAA,MAAM,SAAS,GAAA,CAAI,QAAA;AACnB,EAAA,MAAM,UAAA,GAAa;AAAA,IACjB,MAAA,CAAO,OAAA;AAAA,IACP,CAAA,EAAG,aAAA,CAAM,IAAA,CAAK,GAAA,CAAI,OAAO,MAAA,CAAO,SAAA,GAAY,CAAC,CAAC,CAAC,CAAA,EAAG,aAAA,CAAM,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,GAClE,CAAE,KAAK,IAAI,CAAA;AAEX,EAAA,OAAA,CAAQ,MAAM,EAAE,CAAA;AAChB,EAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,UAAA,EAAM,MAAA,CAAO,EAAE,CAAA,CAAA,EAAI,OAAO,UAAU,CAAA,CAAA,EAAI,MAAA,CAAO,SAAS,CAAA,CAAE,CAAA;AACxE,EAAA,OAAA,CAAQ,MAAM,UAAU,CAAA;AAC1B;AAXS,MAAA,CAAA,wBAAA,EAAA,0BAAA,CAAA;AAaF,SAAS,mBAAmB,QAAA,EAAoB;AACrD,EAAA,IAAI,OAAO,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,CAAE,WAAW,CAAA,EAAG;AACnD,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,GAAA,EAAI;AACrD,IAAA,MAAM,iBAAiB,QAAA,CAAS,iBAAA,CAAkB,KAAK,CAAC,CAAA,KAAM,aAAa,mBAAmB,CAAA;AAC9F,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,OAAA,CAAQ,KAAA,CAAM,oCAA6B,WAAW;AAAA,CAAI,CAAA;AAC1D,MAAA,OAAA,CAAQ,MAAM,kGAAkG,CAAA;AAAA,IAClH,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,KAAA,CAAM,wCAAiC,WAAW;AAAA,CAAI,CAAA;AAC9D,MAAA,OAAA,CAAQ,MAAM,oDAAoD,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,aAAa,CAAC,CAAA;AAAA,EACvB;AACF;AAbgB,MAAA,CAAA,kBAAA,EAAA,oBAAA,CAAA;AAeT,SAAS,qBAAqB,QAAA,EAAoB;AAEvD,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,iBAAA,EAAmB;AAI/C,IAAA,IAAI,OAAO,YAAA,EAAc;AACvB,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,0CAAA,EAAsC,MAAA,CAAO,KAAK;AAAA,CAAI,CAAA;AAEpE,MAAA,OAAA,CAAQ,KAAA,CAAM,MAAA,CAAO,YAAA,CAAa,OAAO,CAAA;AACzC,MAAA,wBAAA,CAAyB,OAAO,YAAY,CAAA;AAI5C,MAAA,IAAI,OAAO,YAAA,CAAa,KAAA,IAAS,EAAE,MAAA,CAAO,wBAAwB,YAAA,CAAA,EAAe;AAC/E,QAAA,OAAA,CAAQ,KAAA,CAAM;AAAA,EAAK,aAAA,CAAM,GAAA,CAAI,cAAc,CAAC,CAAA,CAAE,CAAA;AAC9C,QAAA,OAAA,CAAQ,MAAM,aAAA,CAAM,GAAA,CAAI,MAAA,CAAO,YAAA,CAAa,KAAK,CAAC,CAAA;AAAA,MACpD;AAEA,MAAA,OAAO,aAAa,CAAC,CAAA;AAAA,IACvB;AAEA,IAAA,IAAI,MAAA,CAAO,aAAa,MAAA,EAAQ;AAC9B,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,kCAAA,EAA8B,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAE1D,MAAA,KAAA,MAAW,SAAA,IAAa,OAAO,YAAA,EAAc;AAC3C,QAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAA,EAAK,SAAA,CAAU,OAAO,CAAA,CAAE,CAAA;AACtC,QAAA,wBAAA,CAAyB,SAAS,CAAA;AAAA,MACpC;AACA,MAAA,OAAO,aAAa,CAAC,CAAA;AAAA,IACvB;AAAA,EACF;AASF;AAxCgB,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AA2CT,SAAS,mBAAmB,QAAA,EAAoB;AACrD,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,OAAA,EAAS;AACrC,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,EAAQ;AAC7B,IAAA,KAAA,MAAW,OAAA,IAAW,OAAO,QAAA,EAAU;AACrC,MAAA,OAAA,CAAQ,MAAM,aAAA,CAAM,MAAA,CAAO,aAAa,OAAA,CAAQ,OAAO,EAAE,CAAC,CAAA;AAC1D,MAAA,IAAI,QAAQ,GAAA,EAAK;AACf,QAAA,KAAA,MAAW,IAAA,IAAQ,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,EAAG;AAC1C,UAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAA,EAAK,IAAI,CAAA,CAAE,CAAA;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAZgB,MAAA,CAAA,kBAAA,EAAA,oBAAA,CAAA;AAcT,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EA7F3C;AA6F2C,IAAA,MAAA,CAAA,IAAA,EAAA,iBAAA,CAAA;AAAA;AAAA,EACzC,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,6CAA6C,CAAA;AAAA,EACrD;AAAA,EACA,kBAAA,GAAqB;AACnB,IAAA,OAAO;AAAA,UAAA,EAAQ,aAAA,CAAM,GAAA,CAAI,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,CAAA;AAAA,EACxC;AACF;AAEO,SAAS,oBAAA,CAAqB,UAAoB,IAAA,EAItD;AAED,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,iBAAA,EAAmB;AAC/C,IAAA,IAAI,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAClC,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,qCAAA,EAAiC,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAE7D,MAAA,KAAA,MAAW,GAAA,IAAO,OAAO,gBAAA,EAAkB;AACzC,QAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAA,EAAK,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAChC,QAAA,IAAI,GAAA,YAAe,YAAA,IAAgB,GAAA,CAAI,GAAA,EAAK;AAC1C,UAAA,KAAA,MAAW,IAAA,IAAQ,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,EAAG;AACtC,YAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAA,EAAK,IAAI,CAAA,CAAE,CAAA;AAAA,UAC3B;AAAA,QACF;AACA,QAAA,wBAAA,CAAyB,GAAG,CAAA;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAIA,EAAA,MAAM,eAAe,QAAA,CAAS,gBAAA,CAC3B,GAAA,CAAI,CAAC,MAAM,QAAA,CAAS,YAAA,CAAa,CAAC,CAAC,EACnC,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,oBAAoB,OAAO,CAAA;AAGpD,EAAA,IAAI,YAAA,CAAa,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAA,CAAQ,KAAA,CAAM;AAAA,+BAAA,EAAe,aAAA,CAAM,IAAA,CAAK,SAAA,CAAU,qCAAqC,CAAC,CAAA;AAAA,CAAc,CAAA;AACtG,IAAA,OAAA,CAAQ,MAAM,kBAAkB,CAAA;AAEhC,IAAA,eAAA,CAAE,IAAA,CAAK,YAAA,EAAc,CAAC,IAAA,KAAqB;AACzC,MAAA,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,IAAI,CAAC,CAAA;AAClC,MAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,IAChB,CAAC,CAAA;AACD,IAAA,IAAI,MAAM,OAAA,EAAS;AACjB,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,OAAA,CAAQ,MAAM,cAAA,CAAe;AAAA,QAC3B,cAAA;AAAA,QACA,aAAA,CAAM,MAAA,CAAO,IAAA,CAAK,oCAAoC;AAAA,OACvD,CAAC,CAAA;AACF,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,MAAM,aAAa,QAAA,CAAS,gBAAA,CACzB,GAAA,CAAI,CAAC,MAAM,QAAA,CAAS,YAAA,CAAa,CAAC,CAAC,EACnC,MAAA,CAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAA;AAC5B,MAAA,eAAA,CAAE,IAAA,CAAK,UAAA,EAAY,CAAC,IAAA,KAAqB;AACvC,QAAA,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,IAAI,CAAC,CAAA;AAAA,MACpC,CAAC,CAAA;AAAA,IACH;AAEA,IAAA,kBAAA,CAAmB,QAAQ,CAAA;AAC3B,IAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,MAAA,MAAM,IAAI,eAAA,EAAgB;AAAA,IAC5B;AAAA,EACF;AACF;AAzDgB,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA","file":"chunk-7GFD2ATN.js","sourcesContent":["import ansis from 'ansis';\nimport { gracefulExit } from 'exit-hook';\nimport _ from '@env-spec/utils/my-dash';\nimport { EnvGraph, ConfigItem, FileBasedDataSource } from '../../env-graph';\nimport { getItemSummary, joinAndCompact } from '../../lib/formatting';\nimport { VarlockError } from '../../env-graph/lib/errors';\n\n\nfunction showErrorLocationDetails(err: Error) {\n  if (!(err instanceof VarlockError) || !err.location) return;\n  const errLoc = err.location;\n  const errPreview = [\n    errLoc.lineStr,\n    `${ansis.gray('-'.repeat(errLoc.colNumber - 1))}${ansis.red('^')}`,\n  ].join('\\n');\n\n  console.error('');\n  console.error(`📂 ${errLoc.id}:${errLoc.lineNumber}:${errLoc.colNumber}`);\n  console.error(errPreview);\n}\n\nexport function checkForNoEnvFiles(envGraph: EnvGraph) {\n  if (Object.keys(envGraph.configSchema).length === 0) {\n    const displayPath = envGraph.basePath ?? process.cwd();\n    const hasLoadedFiles = envGraph.sortedDataSources.some((s) => s instanceof FileBasedDataSource);\n    if (!hasLoadedFiles) {\n      console.error(`🚨 No .env files found in ${displayPath}\\n`);\n      console.error('Run `varlock init` to create a .env.schema file, or use `--path` to specify a file or directory.');\n    } else {\n      console.error(`🚨 No config items defined in ${displayPath}\\n`);\n      console.error('Add items to your .env.schema file to get started.');\n    }\n    return gracefulExit(1);\n  }\n}\n\nexport function checkForSchemaErrors(envGraph: EnvGraph) {\n  // first we check for loading/parse errors - some cases we may want to let it fail silently?\n  for (const source of envGraph.sortedDataSources) {\n    // do we care about loading errors from disabled sources?\n    // if (source.disabled) continue;\n\n    if (source.loadingError) {\n      console.error(`🚨 Error encountered while loading ${source.label}\\n`);\n\n      console.error(source.loadingError.message);\n      showErrorLocationDetails(source.loadingError);\n\n      // For plugin loading errors, show the full stack trace since it's usually\n      // a runtime error from executing the plugin code\n      if (source.loadingError.stack && !(source.loadingError instanceof VarlockError)) {\n        console.error(`\\n${ansis.dim('Stack trace:')}`);\n        console.error(ansis.dim(source.loadingError.stack));\n      }\n\n      return gracefulExit(1);\n    }\n    // TODO: unify this with the above!\n    if (source.schemaErrors.length) {\n      console.error(`🚨 Error(s) encountered in ${source.label}`);\n\n      for (const schemaErr of source.schemaErrors) {\n        console.error(`- ${schemaErr.message}`);\n        showErrorLocationDetails(schemaErr);\n      }\n      return gracefulExit(1);\n    }\n  }\n\n  // now we check for any schema errors - where something about how things are wired up is invalid\n  // NOTE - we should not have run any resolution yet\n  // TODO: make sure we are calling this before attempting to resolve values\n  // const failingItems = _.filter(_.values(envGraph.configSchema), (item) => item.validationState === 'error');\n  // if (failingItems.length > 0) {\n  //   throw new CliExitError('Schema is currently invalid');\n  // }\n}\n\n\nexport function showPluginWarnings(envGraph: EnvGraph) {\n  for (const plugin of envGraph.plugins) {\n    if (!plugin.warnings.length) continue;\n    for (const warning of plugin.warnings) {\n      console.error(ansis.yellow(`[WARNING] ${warning.message}`));\n      if (warning.tip) {\n        for (const line of warning.tip.split('\\n')) {\n          console.error(`  ${line}`);\n        }\n      }\n    }\n  }\n}\n\nexport class InvalidEnvError extends Error {\n  constructor() {\n    super('Resolved config/env did not pass validation');\n  }\n  getFormattedOutput() {\n    return `\\n💥 ${ansis.red(this.message)} 💥\\n`;\n  }\n}\n\nexport function checkForConfigErrors(envGraph: EnvGraph, opts?: {\n  showAll?: boolean;\n  /** Log errors to stderr but don't throw — used when the caller will handle errors itself (e.g. json-full output) */\n  noThrow?: boolean;\n}) {\n  // check for root decorator \"execution\"\n  for (const source of envGraph.sortedDataSources) {\n    if (source.resolutionErrors.length) {\n      console.error(`🚨 Root decorator error(s) in ${source.label}`);\n\n      for (const err of source.resolutionErrors) {\n        console.error(`- ${err.message}`);\n        if (err instanceof VarlockError && err.tip) {\n          for (const line of err.tip.split('\\n')) {\n            console.error(`  ${line}`);\n          }\n        }\n        showErrorLocationDetails(err);\n      }\n    }\n  }\n\n\n\n  const failingItems = envGraph.sortedConfigKeys\n    .map((k) => envGraph.configSchema[k])\n    .filter((item) => item.validationState === 'error');\n\n  // TODO: use service.isValid?\n  if (failingItems.length > 0) {\n    console.error(`\\n🚨 🚨 🚨  ${ansis.bold.underline('Configuration is currently invalid ')}  🚨 🚨 🚨\\n`);\n    console.error('Invalid items:\\n');\n\n    _.each(failingItems, (item: ConfigItem) => {\n      console.error(getItemSummary(item));\n      console.error();\n    });\n    if (opts?.showAll) {\n      console.error();\n      console.error(joinAndCompact([\n        'Valid items:',\n        ansis.italic.gray('(remove `--show-all` flag to hide)'),\n      ]));\n      console.error();\n      const validItems = envGraph.sortedConfigKeys\n        .map((k) => envGraph.configSchema[k])\n        .filter((i) => !!i.isValid);\n      _.each(validItems, (item: ConfigItem) => {\n        console.error(getItemSummary(item));\n      });\n    }\n\n    showPluginWarnings(envGraph);\n    if (!opts?.noThrow) {\n      throw new InvalidEnvError();\n    }\n  }\n}\n"]}

package/dist/{chunk-QNTIIXD5.js → chunk-A6THM3IR.js}

@@ -1,8 +1,8 @@
 import { isBundledSEA } from './chunk-GXNQVEXD.js';
-import { fmt } from './chunk-2ABRAKHE.js';
+import { fmt } from './chunk-H6NILU2I.js';
 import { define } from './chunk-4A54P4EM.js';
-import { CliExitError } from './chunk-GBCB7Y3B.js';
-import { require_semver, ansis_default, downloadPluginToCache } from './chunk-U7RQPX5K.js';
+import { CliExitError } from './chunk-QP7TS4SU.js';
+import { require_semver, ansis_default, downloadPluginToCache } from './chunk-XWYFSG46.js';
 import { __toESM, __name } from './chunk-6PEHRAEP.js';
 
 // src/cli/commands/install-plugin.command.ts
@@ -75,5 +75,5 @@ For example: ${fmt.command("add my-plugin", { jsPackageManager: true })}`
 }, "commandFn");
 
 export { commandFn, commandSpec };
-//# sourceMappingURL=chunk-QNTIIXD5.js.map
-//# sourceMappingURL=chunk-QNTIIXD5.js.map
+//# sourceMappingURL=chunk-A6THM3IR.js.map
+//# sourceMappingURL=chunk-A6THM3IR.js.map

package/dist/{chunk-QNTIIXD5.js.map → chunk-A6THM3IR.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/install-plugin.command.ts"],"names":["semver"],"mappings":";;;;;;;;AAEA,IAAA,aAAA,GAAmB,OAAA,CAAA,cAAA,EAAA,EAAA,CAAA,CAAA;AAQZ,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,gBAAA;AAAA,EACN,WAAA,EAAa,yEAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA;AAAA,CAAA,CAUV,IAAA;AACF,CAAC;AAEM,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAChF,EAAA,IAAI,CAAC,cAAa,EAAG;AACnB,IAAA,MAAM,IAAI,aAAa,yEAAA,EAA2E;AAAA,MAChG,UAAA,EAAY,CAAA;AAAA,aAAA,EACQ,IAAI,OAAA,CAAQ,eAAA,EAAiB,EAAE,gBAAA,EAAkB,IAAA,EAAM,CAAC,CAAA;AAAA,KAC7E,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,gBAAA,GAAmB,IAAI,MAAA,CAAO,MAAA;AAEpC,EAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,IAAA,MAAM,IAAI,aAAa,qBAAA,EAAuB;AAAA,MAC5C,UAAA,EAAY;AAAA,KACb,CAAA;AAAA,EACH;AAIA,EAAA,MAAM,UAAA,GAAa,gBAAA,CAAiB,WAAA,CAAY,GAAG,CAAA;AACnD,EAAA,IAAI,eAAe,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,oBAAA,EAAuB,gBAAgB,CAAA,CAAA,CAAA,EAAK;AAAA,MACjE,UAAA,EAAY,2DAA2D,gBAAgB,CAAA,QAAA;AAAA,KACxF,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,UAAA,GAAa,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AACvD,EAAA,MAAM,iBAAA,GAAoB,gBAAA,CAAiB,KAAA,CAAM,UAAA,GAAa,CAAC,CAAA;AAE/D,EAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,oBAAA,EAAuB,gBAAgB,CAAA,CAAA,CAAA,EAAK;AAAA,MACjE,UAAA,EAAY,2DAA2D,UAAU,CAAA,QAAA;AAAA,KAClF,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,CAAC,aAAA,CAAAA,OAAAA,CAAO,KAAA,CAAM,iBAAiB,CAAA,EAAG;AACpC,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,CAAA,EAAI,iBAAiB,CAAA,yBAAA,CAAA,EAA6B;AAAA,MACvE,UAAA,EAAY,2FAA2F,UAAU,CAAA,QAAA;AAAA,KAClH,CAAA;AAAA,EACH;AAEA,EAAA,OAAA,CAAQ,GAAA,CAAI;AAAA,4BAAA,EAA0B,cAAM,IAAA,CAAK,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,iBAAiB,EAAE,CAAC,CAAA;AAAA,CAAwB,CAAA;AAE9G,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,qBAAA,CAAsB,UAAA,EAAY,iBAAiB,CAAA;AAC5E,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,cAAA,EAAY,aAAA,CAAM,IAAA,CAAK,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,iBAAiB,CAAA,CAAE,CAAC,CAAA,uBAAA,CAAyB,CAAA;AACjG,IAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,GAAA,CAAI,CAAA,cAAA,EAAiB,UAAU;AAAA,CAAI,CAAC,CAAA;AAAA,EACxD,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,0BAAA,EAA6B,UAAU,CAAA,CAAA,EAAI,iBAAiB,CAAA,CAAA,CAAA,EAAK;AAAA,MACtF,SAAU,GAAA,CAAc;AAAA,KACzB,CAAA;AAAA,EACH;AACF,CAAA,EAnDmE,WAAA","file":"chunk-QNTIIXD5.js","sourcesContent":["import { define } from 'gunshi';\nimport ansis from 'ansis';\nimport semver from 'semver';\n\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { CliExitError } from '../helpers/exit-error';\nimport { isBundledSEA } from '../helpers/install-detection';\nimport { fmt } from '../helpers/pretty-format';\nimport { downloadPluginToCache } from '../../env-graph/lib/plugins';\n\nexport const commandSpec = define({\n  name: 'install-plugin',\n  description: 'Download and cache a plugin from npm for use with the standalone binary',\n  args: {\n    plugin: {\n      type: 'positional',\n      description: 'Plugin to install, in the format name@version (e.g. my-plugin@1.2.3)',\n    },\n  },\n  examples: `\nPre-downloads a plugin into the local varlock plugin cache so it is available without\nneeding an interactive confirmation prompt. This is useful in CI environments or any\nother non-interactive workflow where the standalone binary is used.\n\nThe plugin must be specified with an exact version number.\n\nExamples:\n  varlock install-plugin my-plugin@1.2.3\n  varlock install-plugin @my-scope/my-plugin@2.0.0\n`.trim(),\n});\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  if (!isBundledSEA()) {\n    throw new CliExitError('This command is only available when using the standalone varlock binary', {\n      suggestion: 'In a JS project, install plugins as regular dependencies using your package manager.\\n'\n        + `For example: ${fmt.command('add my-plugin', { jsPackageManager: true })}`,\n    });\n  }\n\n  const pluginDescriptor = ctx.values.plugin as string | undefined;\n\n  if (!pluginDescriptor) {\n    throw new CliExitError('No plugin specified', {\n      suggestion: 'Usage: varlock install-plugin <name@version>  (e.g. my-plugin@1.2.3)',\n    });\n  }\n\n  // Parse module name and version from descriptor like `some-plugin@1.2.3` or `@scope/pkg@1.2.3`.\n  // Use lastIndexOf to correctly handle scoped packages (e.g. @scope/pkg@1.2.3).\n  const atLocation = pluginDescriptor.lastIndexOf('@');\n  if (atLocation === -1) {\n    throw new CliExitError(`Missing version in \"${pluginDescriptor}\"`, {\n      suggestion: `Specify an exact version, e.g. \\`varlock install-plugin ${pluginDescriptor}@1.2.3\\``,\n    });\n  }\n\n  const moduleName = pluginDescriptor.slice(0, atLocation);\n  const versionDescriptor = pluginDescriptor.slice(atLocation + 1);\n\n  if (!versionDescriptor) {\n    throw new CliExitError(`Missing version in \"${pluginDescriptor}\"`, {\n      suggestion: `Specify an exact version, e.g. \\`varlock install-plugin ${moduleName}@1.2.3\\``,\n    });\n  }\n\n  if (!semver.valid(versionDescriptor)) {\n    throw new CliExitError(`\"${versionDescriptor}\" is not an exact version`, {\n      suggestion: `Use a fixed version number (e.g. 1.2.3), not a range. Example: \\`varlock install-plugin ${moduleName}@1.2.3\\``,\n    });\n  }\n\n  console.log(`\\n📦 Installing plugin ${ansis.bold(`${moduleName}@${versionDescriptor}`)} into local cache...\\n`);\n\n  try {\n    const cachedPath = await downloadPluginToCache(moduleName, versionDescriptor);\n    console.log(`✅ Plugin ${ansis.bold(`${moduleName}@${versionDescriptor}`)} installed successfully`);\n    console.log(ansis.dim(`   Cached at: ${cachedPath}\\n`));\n  } catch (err) {\n    throw new CliExitError(`Failed to install plugin \"${moduleName}@${versionDescriptor}\"`, {\n      details: (err as Error).message,\n    });\n  }\n};\n"]}
+{"version":3,"sources":["../src/cli/commands/install-plugin.command.ts"],"names":["semver"],"mappings":";;;;;;;;AAEA,IAAA,aAAA,GAAmB,OAAA,CAAA,cAAA,EAAA,EAAA,CAAA,CAAA;AAQZ,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,gBAAA;AAAA,EACN,WAAA,EAAa,yEAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA;AAAA,CAAA,CAUV,IAAA;AACF,CAAC;AAEM,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAChF,EAAA,IAAI,CAAC,cAAa,EAAG;AACnB,IAAA,MAAM,IAAI,aAAa,yEAAA,EAA2E;AAAA,MAChG,UAAA,EAAY,CAAA;AAAA,aAAA,EACQ,IAAI,OAAA,CAAQ,eAAA,EAAiB,EAAE,gBAAA,EAAkB,IAAA,EAAM,CAAC,CAAA;AAAA,KAC7E,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,gBAAA,GAAmB,IAAI,MAAA,CAAO,MAAA;AAEpC,EAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,IAAA,MAAM,IAAI,aAAa,qBAAA,EAAuB;AAAA,MAC5C,UAAA,EAAY;AAAA,KACb,CAAA;AAAA,EACH;AAIA,EAAA,MAAM,UAAA,GAAa,gBAAA,CAAiB,WAAA,CAAY,GAAG,CAAA;AACnD,EAAA,IAAI,eAAe,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,oBAAA,EAAuB,gBAAgB,CAAA,CAAA,CAAA,EAAK;AAAA,MACjE,UAAA,EAAY,2DAA2D,gBAAgB,CAAA,QAAA;AAAA,KACxF,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,UAAA,GAAa,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AACvD,EAAA,MAAM,iBAAA,GAAoB,gBAAA,CAAiB,KAAA,CAAM,UAAA,GAAa,CAAC,CAAA;AAE/D,EAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,oBAAA,EAAuB,gBAAgB,CAAA,CAAA,CAAA,EAAK;AAAA,MACjE,UAAA,EAAY,2DAA2D,UAAU,CAAA,QAAA;AAAA,KAClF,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,CAAC,aAAA,CAAAA,OAAAA,CAAO,KAAA,CAAM,iBAAiB,CAAA,EAAG;AACpC,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,CAAA,EAAI,iBAAiB,CAAA,yBAAA,CAAA,EAA6B;AAAA,MACvE,UAAA,EAAY,2FAA2F,UAAU,CAAA,QAAA;AAAA,KAClH,CAAA;AAAA,EACH;AAEA,EAAA,OAAA,CAAQ,GAAA,CAAI;AAAA,4BAAA,EAA0B,cAAM,IAAA,CAAK,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,iBAAiB,EAAE,CAAC,CAAA;AAAA,CAAwB,CAAA;AAE9G,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,qBAAA,CAAsB,UAAA,EAAY,iBAAiB,CAAA;AAC5E,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,cAAA,EAAY,aAAA,CAAM,IAAA,CAAK,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,iBAAiB,CAAA,CAAE,CAAC,CAAA,uBAAA,CAAyB,CAAA;AACjG,IAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,GAAA,CAAI,CAAA,cAAA,EAAiB,UAAU;AAAA,CAAI,CAAC,CAAA;AAAA,EACxD,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,0BAAA,EAA6B,UAAU,CAAA,CAAA,EAAI,iBAAiB,CAAA,CAAA,CAAA,EAAK;AAAA,MACtF,SAAU,GAAA,CAAc;AAAA,KACzB,CAAA;AAAA,EACH;AACF,CAAA,EAnDmE,WAAA","file":"chunk-A6THM3IR.js","sourcesContent":["import { define } from 'gunshi';\nimport ansis from 'ansis';\nimport semver from 'semver';\n\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { CliExitError } from '../helpers/exit-error';\nimport { isBundledSEA } from '../helpers/install-detection';\nimport { fmt } from '../helpers/pretty-format';\nimport { downloadPluginToCache } from '../../env-graph/lib/plugins';\n\nexport const commandSpec = define({\n  name: 'install-plugin',\n  description: 'Download and cache a plugin from npm for use with the standalone binary',\n  args: {\n    plugin: {\n      type: 'positional',\n      description: 'Plugin to install, in the format name@version (e.g. my-plugin@1.2.3)',\n    },\n  },\n  examples: `\nPre-downloads a plugin into the local varlock plugin cache so it is available without\nneeding an interactive confirmation prompt. This is useful in CI environments or any\nother non-interactive workflow where the standalone binary is used.\n\nThe plugin must be specified with an exact version number.\n\nExamples:\n  varlock install-plugin my-plugin@1.2.3\n  varlock install-plugin @my-scope/my-plugin@2.0.0\n`.trim(),\n});\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  if (!isBundledSEA()) {\n    throw new CliExitError('This command is only available when using the standalone varlock binary', {\n      suggestion: 'In a JS project, install plugins as regular dependencies using your package manager.\\n'\n        + `For example: ${fmt.command('add my-plugin', { jsPackageManager: true })}`,\n    });\n  }\n\n  const pluginDescriptor = ctx.values.plugin as string | undefined;\n\n  if (!pluginDescriptor) {\n    throw new CliExitError('No plugin specified', {\n      suggestion: 'Usage: varlock install-plugin <name@version>  (e.g. my-plugin@1.2.3)',\n    });\n  }\n\n  // Parse module name and version from descriptor like `some-plugin@1.2.3` or `@scope/pkg@1.2.3`.\n  // Use lastIndexOf to correctly handle scoped packages (e.g. @scope/pkg@1.2.3).\n  const atLocation = pluginDescriptor.lastIndexOf('@');\n  if (atLocation === -1) {\n    throw new CliExitError(`Missing version in \"${pluginDescriptor}\"`, {\n      suggestion: `Specify an exact version, e.g. \\`varlock install-plugin ${pluginDescriptor}@1.2.3\\``,\n    });\n  }\n\n  const moduleName = pluginDescriptor.slice(0, atLocation);\n  const versionDescriptor = pluginDescriptor.slice(atLocation + 1);\n\n  if (!versionDescriptor) {\n    throw new CliExitError(`Missing version in \"${pluginDescriptor}\"`, {\n      suggestion: `Specify an exact version, e.g. \\`varlock install-plugin ${moduleName}@1.2.3\\``,\n    });\n  }\n\n  if (!semver.valid(versionDescriptor)) {\n    throw new CliExitError(`\"${versionDescriptor}\" is not an exact version`, {\n      suggestion: `Use a fixed version number (e.g. 1.2.3), not a range. Example: \\`varlock install-plugin ${moduleName}@1.2.3\\``,\n    });\n  }\n\n  console.log(`\\n📦 Installing plugin ${ansis.bold(`${moduleName}@${versionDescriptor}`)} into local cache...\\n`);\n\n  try {\n    const cachedPath = await downloadPluginToCache(moduleName, versionDescriptor);\n    console.log(`✅ Plugin ${ansis.bold(`${moduleName}@${versionDescriptor}`)} installed successfully`);\n    console.log(ansis.dim(`   Cached at: ${cachedPath}\\n`));\n  } catch (err) {\n    throw new CliExitError(`Failed to install plugin \"${moduleName}@${versionDescriptor}\"`, {\n      details: (err as Error).message,\n    });\n  }\n};\n"]}

package/dist/{chunk-FTVXXJMG.js → chunk-CDLU5P62.js}

@@ -1,4 +1,4 @@
-import { require_semver } from './chunk-U7RQPX5K.js';
+import { require_semver } from './chunk-XWYFSG46.js';
 import { __toESM, __name } from './chunk-6PEHRAEP.js';
 
 // src/lib/check-bun-version.ts
@@ -18,5 +18,5 @@ Bun ${MIN_BUN_VERSION} introduced the \`--no-env-file\` flag which is required t
 __name(checkBunVersion, "checkBunVersion");
 
 export { checkBunVersion };
-//# sourceMappingURL=chunk-FTVXXJMG.js.map
-//# sourceMappingURL=chunk-FTVXXJMG.js.map
+//# sourceMappingURL=chunk-CDLU5P62.js.map
+//# sourceMappingURL=chunk-CDLU5P62.js.map

package/dist/{chunk-FTVXXJMG.js.map → chunk-CDLU5P62.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/lib/check-bun-version.ts"],"names":["semver"],"mappings":";;;;AAAA,IAAA,aAAA,GAAmB,OAAA,CAAA,cAAA,EAAA,EAAA,CAAA,CAAA;AAQZ,IAAM,eAAA,GAAkB,OAAA;AAMxB,SAAS,eAAA,GAAkB;AAChC,EAAA,MAAM,UAAA,GAAa,QAAQ,QAAA,CAAS,GAAA;AACpC,EAAA,IAAI,CAAC,UAAA,EAAY;AAEjB,EAAA,IAAI,CAAC,aAAA,CAAAA,OAAAA,CAAO,GAAA,CAAI,UAAA,EAAY,eAAe,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,wBAAA,EAA2B,eAAe,CAAA,wBAAA,EAA2B,UAAU,CAAA;AAAA;AAAA,IAAA,EAEtE,eAAe,CAAA,8GAAA;AAAA,KAE1B;AAAA,EACF;AACF;AAZgB,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA","file":"chunk-FTVXXJMG.js","sourcesContent":["import semver from 'semver';\n\n/**\n * Minimum Bun version required for varlock to work correctly.\n * Bun v1.3.3 introduced the ability to disable built-in .env file loading\n * via `--no-env-file` flag or `env = false` in bunfig.toml, which is necessary\n * to prevent conflicts with varlock's own .env loading.\n */\nexport const MIN_BUN_VERSION = '1.3.3';\n\n/**\n * Checks if the current Bun version meets the minimum requirement.\n * Throws an error if running on an unsupported Bun version.\n */\nexport function checkBunVersion() {\n  const bunVersion = process.versions.bun;\n  if (!bunVersion) return;\n\n  if (!semver.gte(bunVersion, MIN_BUN_VERSION)) {\n    throw new Error(\n      `Varlock requires Bun >= ${MIN_BUN_VERSION}, but you are using Bun ${bunVersion}.\\n`\n      + 'Please upgrade Bun by running: `bun upgrade`\\n'\n      + `Bun ${MIN_BUN_VERSION} introduced the \\`--no-env-file\\` flag which is required to prevent `\n      + 'conflicts with varlock\\'s own .env loading.',\n    );\n  }\n}\n"]}
+{"version":3,"sources":["../src/lib/check-bun-version.ts"],"names":["semver"],"mappings":";;;;AAAA,IAAA,aAAA,GAAmB,OAAA,CAAA,cAAA,EAAA,EAAA,CAAA,CAAA;AAQZ,IAAM,eAAA,GAAkB,OAAA;AAMxB,SAAS,eAAA,GAAkB;AAChC,EAAA,MAAM,UAAA,GAAa,QAAQ,QAAA,CAAS,GAAA;AACpC,EAAA,IAAI,CAAC,UAAA,EAAY;AAEjB,EAAA,IAAI,CAAC,aAAA,CAAAA,OAAAA,CAAO,GAAA,CAAI,UAAA,EAAY,eAAe,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,wBAAA,EAA2B,eAAe,CAAA,wBAAA,EAA2B,UAAU,CAAA;AAAA;AAAA,IAAA,EAEtE,eAAe,CAAA,8GAAA;AAAA,KAE1B;AAAA,EACF;AACF;AAZgB,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA","file":"chunk-CDLU5P62.js","sourcesContent":["import semver from 'semver';\n\n/**\n * Minimum Bun version required for varlock to work correctly.\n * Bun v1.3.3 introduced the ability to disable built-in .env file loading\n * via `--no-env-file` flag or `env = false` in bunfig.toml, which is necessary\n * to prevent conflicts with varlock's own .env loading.\n */\nexport const MIN_BUN_VERSION = '1.3.3';\n\n/**\n * Checks if the current Bun version meets the minimum requirement.\n * Throws an error if running on an unsupported Bun version.\n */\nexport function checkBunVersion() {\n  const bunVersion = process.versions.bun;\n  if (!bunVersion) return;\n\n  if (!semver.gte(bunVersion, MIN_BUN_VERSION)) {\n    throw new Error(\n      `Varlock requires Bun >= ${MIN_BUN_VERSION}, but you are using Bun ${bunVersion}.\\n`\n      + 'Please upgrade Bun by running: `bun upgrade`\\n'\n      + `Bun ${MIN_BUN_VERSION} introduced the \\`--no-env-file\\` flag which is required to prevent `\n      + 'conflicts with varlock\\'s own .env loading.',\n    );\n  }\n}\n"]}

package/dist/{chunk-V2MTE4J6.js → chunk-E3F6QKDZ.js}

@@ -1,6 +1,6 @@
-import { getBackendInfo, getDaemonClient, ensureKey, decryptValue, encryptValue } from './chunk-6DXWXIQV.js';
-import { CliExitError, loadEnvGraph } from './chunk-GBCB7Y3B.js';
-import { createResolver, parseEnvSpecDotEnvFile, runWithWorkspaceInfo, prompts_default } from './chunk-U7RQPX5K.js';
+import { getBackendInfo, getDaemonClient, ensureKey, decryptValue, encryptValue } from './chunk-GURKQO4J.js';
+import { CliExitError, loadEnvGraph } from './chunk-QP7TS4SU.js';
+import { createResolver, parseEnvSpecDotEnvFile, runWithWorkspaceInfo, prompts_default } from './chunk-XWYFSG46.js';
 import { ResolutionError, SchemaError, createDebug } from './chunk-2PFIYNFA.js';
 import { __name } from './chunk-6PEHRAEP.js';
 import fs from 'fs';
@@ -422,5 +422,5 @@ function loadVarlockEnvGraph(opts) {
 __name(loadVarlockEnvGraph, "loadVarlockEnvGraph");
 
 export { loadVarlockEnvGraph, writeBackValue };
-//# sourceMappingURL=chunk-V2MTE4J6.js.map
-//# sourceMappingURL=chunk-V2MTE4J6.js.map
+//# sourceMappingURL=chunk-E3F6QKDZ.js.map
+//# sourceMappingURL=chunk-E3F6QKDZ.js.map

package/dist/{chunk-V2MTE4J6.js.map → chunk-E3F6QKDZ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/lib/local-encrypt/write-back.ts","../src/lib/local-encrypt/builtin-resolver.ts","../src/lib/local-encrypt/keychain-resolver.ts","../src/lib/package-json-config.ts","../src/lib/load-graph.ts"],"names":["ciphertext","writeBackResult","fs","path"],"mappings":";;;;;;;;AAcO,SAAS,cAAA,CACd,OAAA,EACA,WAAA,EACA,cAAA,EACiB;AACjB,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,qBAAA,EAAsB;AAAA,EACzD;AAEA,EAAA,MAAM,eAAA,GAAkB,EAAA,CAAG,YAAA,CAAa,cAAA,EAAgB,OAAO,CAAA;AAC/D,EAAA,MAAM,IAAA,GAAO,uBAAuB,eAAe,CAAA;AAEnD,EAAA,MAAM,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,OAAO,CAAA;AAC3D,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACpD;AAGA,EAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,CAAA,EAAA,EAAK,WAAW,CAAA,CAAE,CAAA;AAC3D,EAAA,MAAM,SAAA,GAAY,SAAA,CAAU,WAAA,CAAY,CAAC,CAAA;AACzC,EAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACpD;AAGA,EAAA,IAAA,CAAK,IAAA,CAAK,QAAQ,SAAA,CAAU,KAAA;AAC5B,EAAA,IAAA,CAAK,QAAQ,SAAA,CAAU,KAAA;AAEvB,EAAA,EAAA,CAAG,aAAA,CAAc,cAAA,EAAgB,IAAA,CAAK,QAAA,EAAU,CAAA;AAChD,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AA9BgB,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;;;ACDhB,IAAM,YAAA,GAAe,QAAA;AACrB,IAAM,WAAA,GAAc,iBAAA;AAkBpB,IAAI,YAAA;AAEJ,SAAS,kBAAkB,KAAA,EAA0B;AACnD,EAAA,IAAI,YAAA,GAAe,KAAA;AACnB,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,YAAA,GAAe,EAAC;AAChB,IAAA,YAAA,GAAe,IAAA;AAAA,EACjB;AACA,EAAA,YAAA,CAAa,KAAK,KAAK,CAAA;AAEvB,EAAA,IAAI,YAAA,EAAc;AAEhB,IAAA,YAAA,CAAa,MAAM,cAAc,CAAA;AAAA,EACnC;AACF;AAZS,MAAA,CAAA,iBAAA,EAAA,mBAAA,CAAA;AAcT,SAAS,eAAe,UAAA,EAAqC;AAC3D,EAAA,OAAO,IAAI,OAAA,CAAgB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC9C,IAAA,iBAAA,CAAkB;AAAA,MAChB,IAAA,EAAM,SAAA;AAAA,MAAW,UAAA;AAAA,MAAY,OAAA;AAAA,MAAS;AAAA,KACvC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AANS,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAQT,SAAS,cAAc,OAAA,EAAiD;AACtE,EAAA,OAAO,IAAI,OAAA,CAAgB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC9C,IAAA,iBAAA,CAAkB;AAAA,MAChB,IAAA,EAAM,QAAA;AAAA,MAAU,OAAA;AAAA,MAAS,OAAA;AAAA,MAAS;AAAA,KACnC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AANS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAQT,SAAS,aAAA,CAAc,KAAA,EAAiC,UAAA,EAAoB,KAAA,EAAc;AACxF,EAAA,KAAA,IAAS,CAAA,GAAI,UAAA,EAAY,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AAC9C,IAAA,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,EACvB;AACF;AAJS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAMT,eAAe,YAAA,GAAe;AAC5B,EAAA,MAAM,KAAA,GAAQ,YAAA;AACd,EAAA,YAAA,GAAe,MAAA;AACf,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAGpB,EAAA,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM;AACnB,IAAA,IAAI,CAAA,CAAE,IAAA,KAAS,CAAA,CAAE,IAAA,EAAM,OAAO,CAAA;AAC9B,IAAA,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAA,GAAK,CAAA;AAAA,EACpC,CAAC,CAAA;AAGD,EAAA,MAAmB,SAAA,EAAU;AAE7B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,KAAA,GAAQ,MAAM,CAAC,CAAA;AACrB,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,CAAM,SAAS,SAAA,EAAW;AAC5B,QAAA,MAAM,SAAA,GAAY,MAAmB,YAAA,CAAa,KAAA,CAAM,UAAU,CAAA;AAClE,QAAA,KAAA,CAAM,QAAQ,SAAS,CAAA;AAAA,MACzB,CAAA,MAAO;AACL,QAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,EAAQ;AACnC,QAAA,KAAA,CAAM,QAAQ,MAAM,CAAA;AAAA,MACtB;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAGhB,MAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC3D,MAAA,IACE,GAAA,CAAI,QAAA,CAAS,WAAW,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,UAAU,CAAA,IACjD,GAAA,CAAI,QAAA,CAAS,qBAAqB,CAAA,EACrC;AACA,QAAA,aAAA,CAAc,OAAO,CAAA,GAAI,CAAA,EAAG,IAAI,eAAA,CAAgB,+BAA0B,CAAC,CAAA;AAC3E,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAtCe,MAAA,CAAA,YAAA,EAAA,cAAA,CAAA;AAiDf,SAAS,uBAAA,CACP,OAAA,EACA,UAAA,EACA,cAAA,EACA;AACA,EAAA,MAAM,kBAAA,GAAqB,CAAA,EAAG,YAAY,CAAA,EAAG,UAAU,CAAA,CAAA;AACvD,EAAA,OAAO,cAAA,CAAe,OAAA,EAAS,CAAA,SAAA,EAAY,kBAAkB,MAAM,cAAc,CAAA;AACnF;AAPS,MAAA,CAAA,uBAAA,EAAA,yBAAA,CAAA;AAUF,IAAM,kBAAmC,cAAA,CAAqC;AAAA,EACnF,IAAA,EAAM,SAAA;AAAA,EACN,KAAA,EAAO,iCAAA;AAAA,EACP,IAAA,EAAM,WAAA;AAAA,EACN,gBAAA,EAAkB,IAAA;AAAA,EAClB,UAAA,EAAY;AAAA,IACV,IAAA,EAAM,OAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,OAAA,GAAgC;AAE9B,IAAA,MAAM,SAAA,GAAY,KAAK,OAAA,EAAS,MAAA;AAChC,IAAA,MAAM,kBAAA,GAAqB,IAAA,CAAK,OAAA,EAAS,MAAA,KAAW,KAC/C,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAA,IACjB,IAAA,CAAK,OAAA,CAAQ,CAAC,EAAE,WAAA,KAAgB,QAAA;AACrC,IAAA,IAAI,aAAa,kBAAA,EAAoB;AAEnC,MAAA,MAAM,SAAU,IAAA,CAAa,MAAA;AAC7B,MAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,IAAO,SAAA;AAC/B,MAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,MAAA,MAAM,iBAAiB,UAAA,EAAY,QAAA;AACnC,MAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,cAAA,EAAe;AAAA,IACnD;AAGA,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC9C,MAAA,MAAM,IAAI,YAAY,qFAAqF,CAAA;AAAA,IAC7G;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,CAAQ,CAAC,GAAG,QAAA,EAAU;AAC9B,MAAA,MAAM,IAAI,YAAY,4DAA4D,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,CAAE,WAAA;AAChC,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,YAAY,qCAAqC,CAAA;AAAA,IAC7D;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAQ;AAAA,EACpC,CAAA;AAAA,EACA,MAAM,QAAQ,KAAA,EAA6B;AACzC,IAAA,IAAI,KAAA,CAAM,SAAS,SAAA,EAAW;AAC5B,MAAA,IAAI,aAAa,KAAA,CAAM,OAAA;AACvB,MAAA,IAAI,UAAA,CAAW,UAAA,CAAW,YAAY,CAAA,EAAG;AACvC,QAAA,UAAA,GAAa,UAAA,CAAW,KAAA,CAAM,YAAA,CAAa,MAAM,CAAA;AAAA,MACnD;AACA,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,eAAe,UAAU,CAAA;AAAA,MACxC,SAAS,GAAA,EAAK;AAEZ,QAAA,IAAI,GAAA,YAAe,iBAAiB,MAAM,GAAA;AAE1C,QAAA,MAAM,UAAuB,cAAA,EAAe;AAC5C,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,CAAA,mBAAA,EAAsB,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA,CAAA;AAAA,UAC9D;AAAA,YACE,GAAA,EAAK;AAAA,cACH,YAAY,OAAA,CAAQ,IAAI,KAAK,OAAA,CAAQ,cAAA,GAAiB,oBAAoB,YAAY,CAAA,CAAA,CAAA;AAAA,cACtF,6EAAA;AAAA,cACA;AAAA,aACF,CAAE,KAAK,IAAI;AAAA;AACb,SACF;AAAA,MACF;AAAA,IACF;AAIA,IAAA,MAAM,EAAE,OAAA,EAAS,cAAA,EAAe,GAAI,KAAA;AACpC,IAAA,OAAO,cAAc,YAAY;AAC/B,MAAA,MAAM,UAAuB,cAAA,EAAe;AAG5C,MAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,gBAAA,IAAoB,OAAA,CAAQ,kBAAA,EAAoB;AACnE,QAAA,MAAM,SAAsB,eAAA,EAAgB;AAC5C,QAAA,MAAMA,WAAAA,GAAa,MAAM,MAAA,CAAO,YAAA,CAAa;AAAA,UAC3C,OAAA;AAAA,UACA,OAAA,EAAS,8BAA8B,OAAO,CAAA,CAAA;AAAA,SAC/C,CAAA;AAED,QAAA,IAAI,CAACA,WAAAA,EAAY;AACf,UAAA,MAAM,IAAI,gBAAgB,4BAAA,EAA8B;AAAA,YACtD,GAAA,EAAK;AAAA,WACN,CAAA;AAAA,QACH;AAEA,QAAA,MAAMC,gBAAAA,GAAkB,uBAAA,CAAwB,OAAA,EAASD,WAAAA,EAAY,cAAc,CAAA;AACnF,QAAA,IAAI,CAACC,iBAAgB,OAAA,EAAS;AAC5B,UAAA,IAAIA,gBAAAA,CAAgB,WAAW,qBAAA,EAAuB;AACpD,YAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,cAC5E,GAAA,EAAK;AAAA,aACN,CAAA;AAAA,UACH;AAEA,UAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,YAC5E,GAAA,EAAK,CAAA,4BAAA,EAA+B,OAAO,CAAA,mCAAA,EAAsC,cAAc,CAAA,CAAA;AAAA,WAChG,CAAA;AAAA,QACH;AAEA,QAAA,OAAoB,aAAaD,WAAU,CAAA;AAAA,MAC7C;AAGA,MAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAC,OAAA,CAAQ,MAAM,KAAA,EAAO;AACjD,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,gCAAgC,OAAO,CAAA,CAAA;AAAA,UACvC;AAAA,YACE,GAAA,EAAK,CAAA,6BAAA,EAAgC,cAAA,IAAkB,iBAAiB,CAAA,uCAAA;AAAA;AAC1E,SACF;AAAA,MACF;AAEA,MAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAQ,QAAA,CAAS,EAAE,OAAA,EAAS,CAAA,2BAAA,EAA8B,OAAO,CAAA,CAAA,CAAA,EAAK,IAAA,EAAM,8CAAA,EAAgD,CAAA;AACnJ,MAAA,MAAM,UAAA,GAAa,OAAO,QAAA,KAAa,QAAA;AACvC,MAAA,IAAI,UAAA,IAAc,CAAC,QAAA,EAAU;AAC3B,QAAA,MAAM,IAAI,gBAAgB,4BAAA,EAA8B;AAAA,UACtD,GAAA,EAAK;AAAA,SACN,CAAA;AAAA,MACH;AAEA,MAAA,MAAM,UAAA,GAAa,MAAmB,YAAA,CAAa,QAAQ,CAAA;AAC3D,MAAA,MAAM,eAAA,GAAkB,uBAAA,CAAwB,OAAA,EAAS,UAAA,EAAY,cAAc,CAAA;AAEnF,MAAA,IAAI,CAAC,gBAAgB,OAAA,EAAS;AAC5B,QAAA,IAAI,eAAA,CAAgB,WAAW,qBAAA,EAAuB;AACpD,UAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,YAC5E,GAAA,EAAK;AAAA,WACN,CAAA;AAAA,QACH;AAEA,QAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,UAC5E,GAAA,EAAK,CAAA,4BAAA,EAA+B,OAAO,CAAA,mCAAA,EAAsC,cAAc,CAAA,CAAA;AAAA,SAChG,CAAA;AAAA,MACH;AAEA,MAAA,OAAO,QAAA;AAAA,IACT,CAAC,CAAA;AAAA,EACH;AACF,CAAC,CAAA;;;ACxOD,SAAS,oBAAA,CACP,OAAA,EACA,GAAA,EACA,cAAA,EACA;AAEA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,CAAC,GAAA,CAAI,OAAA,IAAW,CAAC,IAAI,QAAA,EAAU;AACjC,IAAA,OAAA,GAAU,CAAA,CAAA,EAAI,IAAI,OAAO,CAAA,CAAA,CAAA;AAAA,EAC3B,CAAA,MAAO;AACL,IAAA,MAAM,KAAA,GAAuB,CAAC,CAAA,SAAA,EAAY,GAAA,CAAI,OAAO,CAAA,CAAA,CAAG,CAAA;AACxD,IAAA,IAAI,IAAI,OAAA,EAAS,KAAA,CAAM,KAAK,CAAA,SAAA,EAAY,GAAA,CAAI,OAAO,CAAA,CAAA,CAAG,CAAA;AACtD,IAAA,IAAI,IAAI,QAAA,EAAU,KAAA,CAAM,KAAK,CAAA,UAAA,EAAa,GAAA,CAAI,QAAQ,CAAA,CAAA,CAAG,CAAA;AACzD,IAAA,OAAA,GAAU,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EAC3B;AAEA,EAAA,cAAA,CAAe,OAAA,EAAS,CAAA,SAAA,EAAY,OAAO,CAAA,CAAA,CAAA,EAAK,cAAc,CAAA;AAChE;AAjBS,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AAmBF,IAAM,mBAAoC,cAAA,CAAsC;AAAA,EACrF,IAAA,EAAM,UAAA;AAAA,EACN,KAAA,EAAO,0BAAA;AAAA,EACP,IAAA,EAAM,eAAA;AAAA,EACN,gBAAA,EAAkB,IAAA;AAAA,EAClB,UAAA,EAAY;AAAA,IACV,IAAA,EAAM,OAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,OAAA,GAAiC;AAC/B,IAAA,IAAI,OAAA,CAAQ,aAAa,QAAA,EAAU;AACjC,MAAA,MAAM,IAAI,YAAY,uCAAuC,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,SAAA,GAAY,KAAK,OAAA,EAAS,MAAA;AAChC,IAAA,MAAM,kBAAA,GAAqB,IAAA,CAAK,OAAA,EAAS,MAAA,KAAW,KAC/C,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAA,IACjB,IAAA,CAAK,OAAA,CAAQ,CAAC,EAAE,WAAA,KAAgB,QAAA;AAErC,IAAA,IAAI,aAAa,kBAAA,EAAoB;AACnC,MAAA,MAAM,SAAU,IAAA,CAAa,MAAA;AAC7B,MAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,IAAO,SAAA;AAC/B,MAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,MAAA,MAAM,iBAAiB,UAAA,EAAY,QAAA;AACnC,MAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,cAAA,EAAe;AAAA,IACnD;AAGA,IAAA,MAAM,UAAA,GAAa,KAAK,OAAA,EAAS,OAAA;AACjC,IAAA,MAAM,UAAA,GAAa,KAAK,OAAA,EAAS,OAAA;AACjC,IAAA,MAAM,WAAA,GAAc,KAAK,OAAA,EAAS,QAAA;AAClC,IAAA,MAAM,QAAA,GAAW,KAAK,OAAA,EAAS,KAAA;AAE/B,IAAA,MAAM,OAAA,GAAU,UAAA,EAAY,QAAA,GAAW,UAAA,CAAW,WAAA,GAAwB,MAAA;AAC1E,IAAA,MAAM,QAAA,GAAW,WAAA,EAAa,QAAA,GAAW,WAAA,CAAY,WAAA,GAAwB,MAAA;AAC7E,IAAA,MAAM,KAAA,GAAQ,QAAA,EAAU,QAAA,GAAW,QAAA,CAAS,WAAA,GAAwB,MAAA;AAEpE,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,CAAC,UAAA,CAAW,QAAA,IAAY,OAAO,UAAA,CAAW,gBAAgB,QAAA,EAAU;AACtE,QAAA,MAAM,IAAI,YAAY,4CAA4C,CAAA;AAAA,MACpE;AACA,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,KAAA;AAAA,QAAO,SAAS,UAAA,CAAW,WAAA;AAAA,QAAa,OAAA;AAAA,QAAS,QAAA;AAAA,QAAU;AAAA,OACnE;AAAA,IACF;AAGA,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,KAAA;AAAA,QAAO,OAAA;AAAA,QAAS,QAAA;AAAA,QAAU;AAAA,OAClC;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,MAAA,KAAW,CAAA,IAAK,KAAK,OAAA,CAAQ,CAAC,GAAG,QAAA,EAAU;AAC3D,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,CAAE,WAAA;AAC9B,MAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,QAAA,MAAM,IAAI,YAAY,0CAA0C,CAAA;AAAA,MAClE;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,OAAA,EAAS,OAAO,KAAA,EAAM;AAAA,IAC9C;AAEA,IAAA,MAAM,IAAI,WAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF,CAAA;AAAA,EACA,MAAM,QAAQ,KAAA,EAA8B;AAC1C,IAAA,MAAM,SAAS,eAAA,EAAgB;AAE/B,IAAA,IAAI,KAAA,CAAM,SAAS,KAAA,EAAO;AACxB,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,OAAO,WAAA,CAAY;AAAA,UAC9B,SAAS,KAAA,CAAM,OAAA;AAAA,UACf,SAAS,KAAA,CAAM,OAAA;AAAA,UACf,UAAU,KAAA,CAAM,QAAA;AAAA,UAChB,OAAO,KAAA,CAAM;AAAA,SACd,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,CAAA,8BAAA,EAAiC,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA,CAAA;AAAA,UACzE;AAAA,YACE,GAAA,EAAK;AAAA,cACH,KAAA,CAAM,OAAA,GAAU,CAAA,SAAA,EAAY,KAAA,CAAM,OAAO,CAAA,CAAA,GAAK,IAAA;AAAA,cAC9C,KAAA,CAAM,OAAA,GAAU,CAAA,SAAA,EAAY,KAAA,CAAM,OAAO,CAAA,CAAA,GAAK,IAAA;AAAA,cAC9C,KAAA,CAAM,QAAA,GAAW,CAAA,UAAA,EAAa,KAAA,CAAM,QAAQ,CAAA,CAAA,GAAK,IAAA;AAAA,cACjD,KAAA,CAAM,KAAA,GAAQ,CAAA,OAAA,EAAU,KAAA,CAAM,KAAK,CAAA,CAAA,GAAK,IAAA;AAAA,cACxC,2EAAA;AAAA,cACA;AAAA,aACF,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,KAAK,IAAI;AAAA;AAC7B,SACF;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,EAAE,OAAA,EAAS,cAAA,EAAe,GAAI,KAAA;AAEpC,IAAA,MAAM,WAAW,MAAM,MAAA,CAAO,YAAA,CAAa,EAAE,SAAS,CAAA;AACtD,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,gBAAgB,uCAAA,EAAyC;AAAA,QACjE,GAAA,EAAK;AAAA,OACN,CAAA;AAAA,IACH;AAEA,IAAA,oBAAA,CAAqB,OAAA,EAAS,UAAU,cAAc,CAAA;AAGtD,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,OAAO,WAAA,CAAY;AAAA,QAC9B,SAAS,QAAA,CAAS,OAAA;AAAA,QAClB,SAAS,QAAA,CAAS,OAAA;AAAA,QAClB,UAAU,QAAA,CAAS;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,CAAA,iDAAA,EAAoD,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA,CAAA;AAAA,QAC5F;AAAA,UACE,GAAA,EAAK;AAAA;AACP,OACF;AAAA,IACF;AAAA,EACF;AACF,CAAC,CAAA;ACnKM,SAAS,6BAA6B,IAAA,EAA+D;AAC1G,EAAA,MAAM,GAAA,GAAM,IAAA,EAAM,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAI;AACrC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AAC7C,EAAA,IAAI,CAACE,EAAAA,CAAG,UAAA,CAAW,OAAO,GAAG,OAAO,MAAA;AACpC,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAMA,GAAG,YAAA,CAAa,OAAA,EAAS,OAAO,CAAC,CAAA;AACxD,IAAA,IAAI,GAAA,CAAI,OAAA,IAAW,OAAO,GAAA,CAAI,YAAY,QAAA,EAAU;AAClD,MAAA,OAAO,GAAA,CAAI,OAAA;AAAA,IACb;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAA4B;AACpC,EAAA,OAAO,MAAA;AACT;AAXgB,MAAA,CAAA,4BAAA,EAAA,8BAAA,CAAA;;;ACFhB,IAAM,KAAA,GAAQ,YAAY,cAAc,CAAA;AAExC,SAAS,qBAAqB,WAAA,EAAoD;AAChF,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,EAAG,OAAO,WAAA;AACvC,EAAA,OAAO,CAAC,WAAW,CAAA;AACrB;AAHS,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AAKT,SAAS,aAAA,CACP,UACA,MAAA,EAMA;AACA,EAAA,MAAM,aAAA,GAAgB,SAAS,GAAA,CAAI,CAAC,MAAMC,IAAAA,CAAK,OAAA,CAAQ,CAAC,CAAC,CAAA;AAEzD,EAAA,IAAI,aAAA,CAAc,WAAW,CAAA,EAAG;AAC9B,IAAA,KAAA,CAAM,wBAAA,EAA0B,MAAA,CAAO,MAAA,EAAQ,aAAA,CAAc,CAAC,CAAC,CAAA;AAAA,EACjE,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,4BAAA,EAA8B,cAAc,MAAA,EAAQ,MAAA,CAAO,QAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,EACnG;AAEA,EAAA,KAAA,MAAW,gBAAgB,aAAA,EAAe;AACxC,IAAA,IAAI,CAACD,EAAAA,CAAG,UAAA,CAAW,YAAY,CAAA,EAAG;AAChC,MAAA,MAAM,IAAI,YAAA,CAAa,CAAA,EAAG,OAAO,WAAW,CAAA,EAAA,EAAK,YAAY,CAAA,CAAA,EAAI;AAAA,QAC/D,YAAY,MAAA,CAAO;AAAA,OACpB,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,oBAAA,CAAqB,MAAM,YAAA,CAAa;AAAA,IAC7C,oBAAoB,MAAA,CAAO,kBAAA;AAAA,IAC3B,cAAA,EAAgB,aAAA;AAAA,IAChB,SAAA,gCAAkB,CAAA,KAAM;AACtB,MAAA,CAAA,CAAE,iBAAiB,eAAe,CAAA;AAClC,MAAA,CAAA,CAAE,iBAAiB,gBAAgB,CAAA;AAAA,IACrC,CAAA,EAHW,WAAA;AAAA,GAIZ,CAAC,CAAA;AACJ;AAjCS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAmCF,SAAS,oBAAoB,IAAA,EAIjC;AACD,EAAA,MAAM,QAAA,GAAW,IAAA,EAAM,cAAA,EAAgB,MAAA,CAAO,OAAO,CAAA;AAGrD,EAAA,IAAI,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAEnC,IAAA,OAAO,cAAc,QAAA,EAAU;AAAA,MAC7B,MAAA,EAAQ,aAAA;AAAA,MACR,WAAA,EAAa,iCAAA;AAAA,MACb,eAAA,EAAiB,oDAAA;AAAA,MACjB,oBAAoB,IAAA,EAAM;AAAA,KAC3B,CAAA;AAAA,EACH;AAGA,EAAA,MAAM,WAAA,GAAc,8BAA6B,EAAG,QAAA;AACpD,EAAA,MAAM,YAAA,GAAe,WAAA,GAAc,oBAAA,CAAqB,WAAW,CAAA,GAAI,MAAA;AAEvE,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,OAAO,cAAc,YAAA,EAAc;AAAA,MACjC,MAAA,EAAQ,+BAAA;AAAA,MACR,WAAA,EAAa,wEAAA;AAAA,MACb,eAAA,EAAiB,wFAAA;AAAA,MACjB,oBAAoB,IAAA,EAAM;AAAA,KAC3B,CAAA;AAAA,EACH;AAEA,EAAA,KAAA,CAAM,mCAAA,EAAqC,OAAA,CAAQ,GAAA,EAAK,CAAA;AAExD,EAAA,OAAO,oBAAA,CAAqB,MAAM,YAAA,CAAa;AAAA,IAC7C,oBAAoB,IAAA,EAAM,kBAAA;AAAA,IAC1B,SAAA,gCAAkB,CAAA,KAAM;AACtB,MAAA,CAAA,CAAE,iBAAiB,eAAe,CAAA;AAClC,MAAA,CAAA,CAAE,iBAAiB,gBAAgB,CAAA;AAAA,IACrC,CAAA,EAHW,WAAA;AAAA,GAIZ,CAAC,CAAA;AACJ;AAxCgB,MAAA,CAAA,mBAAA,EAAA,qBAAA,CAAA","file":"chunk-V2MTE4J6.js","sourcesContent":["/**\n * Shared utilities for writing back encrypted/resolved values to .env files.\n *\n * Uses the env-spec AST parser to safely update values.\n */\n\nimport fs from 'node:fs';\nimport { parseEnvSpecDotEnvFile } from '@env-spec/parser';\n\ntype WriteBackResult = { updated: boolean; reason?: 'missing-source-file' | 'item-not-found' };\n\n/**\n * Update a config item's value in a .env file using AST-based replacement.\n */\nexport function writeBackValue(\n  itemKey: string,\n  newValueStr: string,\n  sourceFilePath: string | undefined,\n): WriteBackResult {\n  if (!sourceFilePath) {\n    return { updated: false, reason: 'missing-source-file' };\n  }\n\n  const currentContents = fs.readFileSync(sourceFilePath, 'utf-8');\n  const file = parseEnvSpecDotEnvFile(currentContents);\n\n  const item = file.configItems.find((i) => i.key === itemKey);\n  if (!item) {\n    return { updated: false, reason: 'item-not-found' };\n  }\n\n  // Parse a dummy line to get the correct AST value node\n  const dummyFile = parseEnvSpecDotEnvFile(`_=${newValueStr}`);\n  const dummyItem = dummyFile.configItems[0];\n  if (!dummyItem?.value) {\n    return { updated: false, reason: 'item-not-found' };\n  }\n\n  // Replace the value\n  item.data.value = dummyItem.value;\n  item.value = dummyItem.value;\n\n  fs.writeFileSync(sourceFilePath, file.toString());\n  return { updated: true };\n}\n\n","/**\n * Built-in varlock() resolver function.\n *\n * Replaces the plugin-based resolver from @varlock/secure-enclave-plugin.\n * Works cross-platform using the local-encrypt abstraction layer.\n */\n\nimport { createResolver, Resolver } from '../../env-graph/lib/resolver';\nimport { ResolutionError, SchemaError } from '../../env-graph/lib/errors';\nimport prompts from '../../cli/helpers/prompts';\nimport * as localEncrypt from './index';\nimport { writeBackValue } from './write-back';\n\nconst LOCAL_PREFIX = 'local:';\nconst PLUGIN_ICON = 'mdi:fingerprint';\n\n// ── Unified varlock() batch queue ──────────────────────────────\n// Collects all concurrent varlock() calls (both prompt and decrypt) into a\n// single batch using setImmediate, then processes them sequentially.\n// Prompts are sorted first so the user enters values before biometric decrypts.\n// If the user cancels a prompt or biometric auth, all remaining items in the\n// batch are rejected immediately.\n\ntype VarlockBatchEntry = {\n  kind: 'prompt' | 'decrypt';\n  resolve: (value: string) => void;\n  reject: (reason: unknown) => void;\n} & (\n  | { kind: 'decrypt'; ciphertext: string }\n  | { kind: 'prompt'; execute: () => Promise<string> }\n);\n\nlet pendingBatch: Array<VarlockBatchEntry> | undefined;\n\nfunction enqueueBatchEntry(entry: VarlockBatchEntry) {\n  let triggerBatch = false;\n  if (!pendingBatch) {\n    pendingBatch = [];\n    triggerBatch = true;\n  }\n  pendingBatch.push(entry);\n\n  if (triggerBatch) {\n    // eslint-disable-next-line no-use-before-define\n    setImmediate(() => executeBatch());\n  }\n}\n\nfunction enqueueDecrypt(ciphertext: string): Promise<string> {\n  return new Promise<string>((resolve, reject) => {\n    enqueueBatchEntry({\n      kind: 'decrypt', ciphertext, resolve, reject,\n    });\n  });\n}\n\nfunction enqueuePrompt(execute: () => Promise<string>): Promise<string> {\n  return new Promise<string>((resolve, reject) => {\n    enqueueBatchEntry({\n      kind: 'prompt', execute, resolve, reject,\n    });\n  });\n}\n\nfunction bailRemaining(batch: Array<VarlockBatchEntry>, startIndex: number, error: Error) {\n  for (let j = startIndex; j < batch.length; j++) {\n    batch[j].reject(error);\n  }\n}\n\nasync function executeBatch() {\n  const batch = pendingBatch;\n  pendingBatch = undefined;\n  if (!batch?.length) return;\n\n  // Sort prompts before decrypts so the user enters values first\n  batch.sort((a, b) => {\n    if (a.kind === b.kind) return 0;\n    return a.kind === 'prompt' ? -1 : 1;\n  });\n\n  // Ensure encryption key exists before processing any items\n  await localEncrypt.ensureKey();\n\n  for (let i = 0; i < batch.length; i++) {\n    const entry = batch[i];\n    try {\n      if (entry.kind === 'decrypt') {\n        const plaintext = await localEncrypt.decryptValue(entry.ciphertext);\n        entry.resolve(plaintext);\n      } else {\n        const result = await entry.execute();\n        entry.resolve(result);\n      }\n    } catch (err) {\n      entry.reject(err);\n\n      // If this looks like a user cancellation or auth failure, bail on remaining items\n      const msg = err instanceof Error ? err.message : String(err);\n      if (\n        msg.includes('cancelled') || msg.includes('canceled')\n        || msg.includes('verification failed')\n      ) {\n        bailRemaining(batch, i + 1, new ResolutionError('Skipped — user cancelled'));\n        return;\n      }\n    }\n  }\n}\n\ntype VarlockResolverState = {\n  mode: 'decrypt';\n  payload: string;\n} | {\n  mode: 'prompt';\n  itemKey: string;\n  sourceFilePath: string | undefined;\n};\n\nfunction writeBackEncryptedValue(\n  itemKey: string,\n  ciphertext: string,\n  sourceFilePath: string | undefined,\n) {\n  const prefixedCiphertext = `${LOCAL_PREFIX}${ciphertext}`;\n  return writeBackValue(itemKey, `varlock(\"${prefixedCiphertext}\")`, sourceFilePath);\n}\n\n\nexport const VarlockResolver: typeof Resolver = createResolver<VarlockResolverState>({\n  name: 'varlock',\n  label: 'Decrypt locally encrypted value',\n  icon: PLUGIN_ICON,\n  impliesSensitive: true,\n  argsSchema: {\n    type: 'mixed',\n    arrayMinLength: 0,\n  },\n  process(): VarlockResolverState {\n    // Check for prompt mode: varlock(prompt=1) or varlock(prompt)\n    const promptArg = this.objArgs?.prompt;\n    const isPromptPositional = this.arrArgs?.length === 1\n      && this.arrArgs[0]?.isStatic\n      && this.arrArgs[0].staticValue === 'prompt';\n    if (promptArg || isPromptPositional) {\n      // Resolver doesn't expose parent item in its type, but it's available at runtime\n      const parent = (this as any).parent;\n      const itemKey = parent?.key || 'unknown';\n      const dataSource = this.dataSource as any;\n      const sourceFilePath = dataSource?.fullPath as string | undefined;\n      return { mode: 'prompt', itemKey, sourceFilePath };\n    }\n\n    // Normal mode: varlock(\"encrypted-payload\")\n    if (!this.arrArgs || this.arrArgs.length !== 1) {\n      throw new SchemaError('varlock() expects a single encrypted payload string, or prompt to enter a new value');\n    }\n    if (!this.arrArgs[0]?.isStatic) {\n      throw new SchemaError('varlock() expects a single static encrypted payload string');\n    }\n    const payload = this.arrArgs[0].staticValue;\n    if (typeof payload !== 'string') {\n      throw new SchemaError('varlock() expects a string argument');\n    }\n    return { mode: 'decrypt', payload };\n  },\n  async resolve(state: VarlockResolverState) {\n    if (state.mode === 'decrypt') {\n      let ciphertext = state.payload;\n      if (ciphertext.startsWith(LOCAL_PREFIX)) {\n        ciphertext = ciphertext.slice(LOCAL_PREFIX.length);\n      }\n      try {\n        return await enqueueDecrypt(ciphertext);\n      } catch (err) {\n        // Re-throw ResolutionErrors (e.g. batch cancellation) as-is\n        if (err instanceof ResolutionError) throw err;\n\n        const backend = localEncrypt.getBackendInfo();\n        throw new ResolutionError(\n          `Decryption failed: ${err instanceof Error ? err.message : err}`,\n          {\n            tip: [\n              `Backend: ${backend.type} (${backend.hardwareBacked ? 'hardware-backed' : 'file-based'})`,\n              'This usually means the value was encrypted with a different key or backend.',\n              'Set a new value using `varlock encrypt` or `KEY=varlock(prompt)`.',\n            ].join('\\n'),\n          },\n        );\n      }\n    }\n\n    // Prompt mode: enqueued into the unified batch so prompts run before decrypts\n    // and cancellation propagates to all remaining items.\n    const { itemKey, sourceFilePath } = state;\n    return enqueuePrompt(async () => {\n      const backend = localEncrypt.getBackendInfo();\n\n      // Use daemon's native dialog on macOS Secure Enclave\n      if (backend.type === 'secure-enclave' && backend.biometricAvailable) {\n        const client = localEncrypt.getDaemonClient();\n        const ciphertext = await client.promptSecret({\n          itemKey,\n          message: `Enter the secret value for ${itemKey}:`,\n        });\n\n        if (!ciphertext) {\n          throw new ResolutionError('Secret input was cancelled', {\n            tip: 'Run varlock again and enter a value, or replace prompt=1 with an encrypted value',\n          });\n        }\n\n        const writeBackResult = writeBackEncryptedValue(itemKey, ciphertext, sourceFilePath);\n        if (!writeBackResult.updated) {\n          if (writeBackResult.reason === 'missing-source-file') {\n            throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n              tip: 'varlock(prompt=1) can only persist values from file-backed sources. Use `varlock encrypt` to generate an encrypted value manually.',\n            });\n          }\n\n          throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n            tip: `Could not find a writable \\`${itemKey}=varlock(...)\\` entry to update in ${sourceFilePath}.`,\n          });\n        }\n\n        return localEncrypt.decryptValue(ciphertext);\n      }\n\n      // Terminal prompt for file-based backend\n      if (!process.stdout.isTTY || !process.stdin.isTTY) {\n        throw new ResolutionError(\n          `No encrypted value found for ${itemKey}`,\n          {\n            tip: `Run \\`varlock encrypt --file ${sourceFilePath || '<your-env-file>'}\\` to encrypt this value interactively.`,\n          },\n        );\n      }\n\n      const rawValue = await prompts.password({ message: `Enter the secret value for ${itemKey}:`, hint: 'for multi-line values, use `varlock encrypt`' });\n      const isCanceled = typeof rawValue !== 'string';\n      if (isCanceled || !rawValue) {\n        throw new ResolutionError('Secret input was cancelled', {\n          tip: 'Run varlock again and enter a value, or replace prompt=1 with an encrypted value',\n        });\n      }\n\n      const ciphertext = await localEncrypt.encryptValue(rawValue);\n      const writeBackResult = writeBackEncryptedValue(itemKey, ciphertext, sourceFilePath);\n\n      if (!writeBackResult.updated) {\n        if (writeBackResult.reason === 'missing-source-file') {\n          throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n            tip: 'varlock(prompt=1) can only persist values from file-backed sources. Use `varlock encrypt` to generate an encrypted value manually.',\n          });\n        }\n\n        throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n          tip: `Could not find a writable \\`${itemKey}=varlock(...)\\` entry to update in ${sourceFilePath}.`,\n        });\n      }\n\n      return rawValue;\n    });\n  },\n});\n","/**\n * Built-in keychain() resolver function.\n *\n * Reads secrets from the macOS Keychain via the Swift daemon binary.\n * Always goes through the daemon to enforce biometric gating (per-TTY sessions)\n * and to make VarlockEnclave the authorized keychain accessor.\n *\n * Syntax:\n *   keychain(service=\"com.company.db\")\n *   keychain(service=\"com.company.db\", account=\"admin\")\n *   keychain(service=\"com.company.db\", keychain=\"System\")\n *   keychain(\"com.company.db\")          — shorthand for service\n *   keychain(prompt)                     — interactive picker, writes back reference\n */\n\nimport { createResolver, Resolver } from '../../env-graph/lib/resolver';\nimport { ResolutionError, SchemaError } from '../../env-graph/lib/errors';\nimport { getDaemonClient } from './index';\nimport { writeBackValue } from './write-back';\n\ntype KeychainResolverState = {\n  mode: 'get';\n  service?: string;\n  account?: string;\n  keychain?: string;\n  field?: string;\n} | {\n  mode: 'prompt';\n  itemKey: string;\n  sourceFilePath: string | undefined;\n};\n\nfunction writeBackKeychainRef(\n  itemKey: string,\n  ref: { service: string; account?: string; keychain?: string },\n  sourceFilePath: string | undefined,\n) {\n  // Use positional shorthand when only service is needed, named args when disambiguating\n  let argsStr: string;\n  if (!ref.account && !ref.keychain) {\n    argsStr = `\"${ref.service}\"`;\n  } else {\n    const parts: Array<string> = [`service=\"${ref.service}\"`];\n    if (ref.account) parts.push(`account=\"${ref.account}\"`);\n    if (ref.keychain) parts.push(`keychain=\"${ref.keychain}\"`);\n    argsStr = parts.join(', ');\n  }\n\n  writeBackValue(itemKey, `keychain(${argsStr})`, sourceFilePath);\n}\n\nexport const KeychainResolver: typeof Resolver = createResolver<KeychainResolverState>({\n  name: 'keychain',\n  label: 'Read from macOS Keychain',\n  icon: 'mdi:key-chain',\n  impliesSensitive: true,\n  argsSchema: {\n    type: 'mixed',\n    arrayMinLength: 0,\n  },\n  process(): KeychainResolverState {\n    if (process.platform !== 'darwin') {\n      throw new SchemaError('keychain() is only supported on macOS');\n    }\n\n    // Check for prompt mode: keychain(prompt) or keychain(prompt=1)\n    const promptArg = this.objArgs?.prompt;\n    const isPromptPositional = this.arrArgs?.length === 1\n      && this.arrArgs[0]?.isStatic\n      && this.arrArgs[0].staticValue === 'prompt';\n\n    if (promptArg || isPromptPositional) {\n      const parent = (this as any).parent;\n      const itemKey = parent?.key || 'unknown';\n      const dataSource = this.dataSource as any;\n      const sourceFilePath = dataSource?.fullPath as string | undefined;\n      return { mode: 'prompt', itemKey, sourceFilePath };\n    }\n\n    // Named args mode: keychain(service=\"...\", account=\"...\", keychain=\"...\", field=\"...\")\n    const serviceArg = this.objArgs?.service;\n    const accountArg = this.objArgs?.account;\n    const keychainArg = this.objArgs?.keychain;\n    const fieldArg = this.objArgs?.field;\n\n    const account = accountArg?.isStatic ? accountArg.staticValue as string : undefined;\n    const keychain = keychainArg?.isStatic ? keychainArg.staticValue as string : undefined;\n    const field = fieldArg?.isStatic ? fieldArg.staticValue as string : undefined;\n\n    if (serviceArg) {\n      if (!serviceArg.isStatic || typeof serviceArg.staticValue !== 'string') {\n        throw new SchemaError('keychain() service must be a static string');\n      }\n      return {\n        mode: 'get', service: serviceArg.staticValue, account, keychain, field,\n      };\n    }\n\n    // account-only lookup: keychain(account=\"admin@corp.com\", field=\"account\")\n    if (accountArg) {\n      return {\n        mode: 'get', account, keychain, field,\n      };\n    }\n\n    // Positional shorthand: keychain(\"com.company.service\")\n    if (this.arrArgs?.length === 1 && this.arrArgs[0]?.isStatic) {\n      const value = this.arrArgs[0].staticValue;\n      if (typeof value !== 'string') {\n        throw new SchemaError('keychain() expects a string service name');\n      }\n      return { mode: 'get', service: value, field };\n    }\n\n    throw new SchemaError(\n      'keychain() requires service name, account, or prompt mode. '\n      + 'Usage: keychain(service=\"com.example\"), keychain(\"com.example\"), or keychain(prompt)',\n    );\n  },\n  async resolve(state: KeychainResolverState) {\n    const client = getDaemonClient();\n\n    if (state.mode === 'get') {\n      try {\n        return await client.keychainGet({\n          service: state.service,\n          account: state.account,\n          keychain: state.keychain,\n          field: state.field,\n        });\n      } catch (err) {\n        throw new ResolutionError(\n          `Failed to read keychain item: ${err instanceof Error ? err.message : err}`,\n          {\n            tip: [\n              state.service ? `Service: ${state.service}` : null,\n              state.account ? `Account: ${state.account}` : null,\n              state.keychain ? `Keychain: ${state.keychain}` : null,\n              state.field ? `Field: ${state.field}` : null,\n              'Make sure the item exists in your Keychain and VarlockEnclave has access.',\n              'You can grant access via: keychain(prompt)',\n            ].filter(Boolean).join('\\n'),\n          },\n        );\n      }\n    }\n\n    // Prompt mode: show native picker, write back reference\n    const { itemKey, sourceFilePath } = state;\n\n    const selected = await client.keychainPick({ itemKey });\n    if (!selected) {\n      throw new ResolutionError('Keychain item selection was cancelled', {\n        tip: 'Run varlock again and select an item, or use keychain(service=\"...\") with an explicit service name',\n      });\n    }\n\n    writeBackKeychainRef(itemKey, selected, sourceFilePath);\n\n    // Now fetch the actual value\n    try {\n      return await client.keychainGet({\n        service: selected.service,\n        account: selected.account,\n        keychain: selected.keychain,\n      });\n    } catch (err) {\n      throw new ResolutionError(\n        `Selected keychain item but failed to read value: ${err instanceof Error ? err.message : err}`,\n        {\n          tip: 'The item reference has been written to your config. Try running varlock again.',\n        },\n      );\n    }\n  },\n});\n","import path from 'node:path';\nimport fs from 'node:fs';\n\nexport type VarlockPackageJsonConfig = {\n  /** Path (or array of paths) to a specific .env file or directory to use as the entry point for loading */\n  loadPath?: string | Array<string>;\n};\n\n/**\n * Reads varlock configuration from the `package.json` in `cwd`.\n * Returns undefined if no `package.json` exists or it has no `varlock` key.\n */\nexport function readVarlockPackageJsonConfig(opts?: { cwd?: string }): VarlockPackageJsonConfig | undefined {\n  const cwd = opts?.cwd ?? process.cwd();\n  const pkgPath = path.join(cwd, 'package.json');\n  if (!fs.existsSync(pkgPath)) return undefined;\n  try {\n    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));\n    if (pkg.varlock && typeof pkg.varlock === 'object') {\n      return pkg.varlock as VarlockPackageJsonConfig;\n    }\n  } catch { /* ignore parse errors */ }\n  return undefined;\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\nimport { loadEnvGraph } from '../env-graph';\nimport { VarlockResolver } from './local-encrypt/builtin-resolver';\nimport { KeychainResolver } from './local-encrypt/keychain-resolver';\nimport { CliExitError } from '../cli/helpers/exit-error';\nimport { runWithWorkspaceInfo } from './workspace-utils';\nimport { readVarlockPackageJsonConfig } from './package-json-config';\nimport { createDebug } from './debug';\n\nconst debug = createDebug('varlock:load');\n\nfunction normalizePkgLoadPath(pkgLoadPath: string | Array<string>): Array<string> {\n  if (Array.isArray(pkgLoadPath)) return pkgLoadPath;\n  return [pkgLoadPath];\n}\n\nfunction loadFromPaths(\n  rawPaths: Array<string>,\n  config: {\n    source: string,\n    errorPrefix: string,\n    errorSuggestion: string,\n    currentEnvFallback?: string,\n  },\n) {\n  const resolvedPaths = rawPaths.map((p) => path.resolve(p));\n\n  if (resolvedPaths.length === 1) {\n    debug('using path from %s: %s', config.source, resolvedPaths[0]);\n  } else {\n    debug('using %d paths from %s: %s', resolvedPaths.length, config.source, resolvedPaths.join(', '));\n  }\n\n  for (const resolvedPath of resolvedPaths) {\n    if (!fs.existsSync(resolvedPath)) {\n      throw new CliExitError(`${config.errorPrefix}: ${resolvedPath}`, {\n        suggestion: config.errorSuggestion,\n      });\n    }\n  }\n\n  return runWithWorkspaceInfo(() => loadEnvGraph({\n    currentEnvFallback: config.currentEnvFallback,\n    entryFilePaths: resolvedPaths,\n    afterInit: async (g) => {\n      g.registerResolver(VarlockResolver);\n      g.registerResolver(KeychainResolver);\n    },\n  }));\n}\n\nexport function loadVarlockEnvGraph(opts?: {\n  currentEnvFallback?: string,\n  /** Explicit entry file paths from --path flag(s) - overrides package.json config */\n  entryFilePaths?: Array<string>,\n}) {\n  const cliPaths = opts?.entryFilePaths?.filter(Boolean);\n\n  // If --path flag(s) provided, they take precedence over package.json config\n  if (cliPaths && cliPaths.length > 0) {\n    // Return early and ignore pkgLoadPaths\n    return loadFromPaths(cliPaths, {\n      source: '--path flag',\n      errorPrefix: 'The --path value does not exist',\n      errorSuggestion: 'Use `--path` to specify a valid file or directory.',\n      currentEnvFallback: opts?.currentEnvFallback,\n    });\n  }\n\n  // Fall back to package.json varlock.loadPath\n  const pkgLoadPath = readVarlockPackageJsonConfig()?.loadPath;\n  const pkgLoadPaths = pkgLoadPath ? normalizePkgLoadPath(pkgLoadPath) : undefined;\n\n  if (pkgLoadPaths) {\n    return loadFromPaths(pkgLoadPaths, {\n      source: 'package.json varlock.loadPath',\n      errorPrefix: 'A path in `varlock.loadPath` configured in package.json does not exist',\n      errorSuggestion: 'Update `varlock.loadPath` in your package.json to point to valid files or directories.',\n      currentEnvFallback: opts?.currentEnvFallback,\n    });\n  }\n\n  debug('no path configured, using cwd: %s', process.cwd());\n\n  return runWithWorkspaceInfo(() => loadEnvGraph({\n    currentEnvFallback: opts?.currentEnvFallback,\n    afterInit: async (g) => {\n      g.registerResolver(VarlockResolver);\n      g.registerResolver(KeychainResolver);\n    },\n  }));\n}\n"]}
+{"version":3,"sources":["../src/lib/local-encrypt/write-back.ts","../src/lib/local-encrypt/builtin-resolver.ts","../src/lib/local-encrypt/keychain-resolver.ts","../src/lib/package-json-config.ts","../src/lib/load-graph.ts"],"names":["ciphertext","writeBackResult","fs","path"],"mappings":";;;;;;;;AAcO,SAAS,cAAA,CACd,OAAA,EACA,WAAA,EACA,cAAA,EACiB;AACjB,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,qBAAA,EAAsB;AAAA,EACzD;AAEA,EAAA,MAAM,eAAA,GAAkB,EAAA,CAAG,YAAA,CAAa,cAAA,EAAgB,OAAO,CAAA;AAC/D,EAAA,MAAM,IAAA,GAAO,uBAAuB,eAAe,CAAA;AAEnD,EAAA,MAAM,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,OAAO,CAAA;AAC3D,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACpD;AAGA,EAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,CAAA,EAAA,EAAK,WAAW,CAAA,CAAE,CAAA;AAC3D,EAAA,MAAM,SAAA,GAAY,SAAA,CAAU,WAAA,CAAY,CAAC,CAAA;AACzC,EAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACpD;AAGA,EAAA,IAAA,CAAK,IAAA,CAAK,QAAQ,SAAA,CAAU,KAAA;AAC5B,EAAA,IAAA,CAAK,QAAQ,SAAA,CAAU,KAAA;AAEvB,EAAA,EAAA,CAAG,aAAA,CAAc,cAAA,EAAgB,IAAA,CAAK,QAAA,EAAU,CAAA;AAChD,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AA9BgB,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;;;ACDhB,IAAM,YAAA,GAAe,QAAA;AACrB,IAAM,WAAA,GAAc,iBAAA;AAkBpB,IAAI,YAAA;AAEJ,SAAS,kBAAkB,KAAA,EAA0B;AACnD,EAAA,IAAI,YAAA,GAAe,KAAA;AACnB,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,YAAA,GAAe,EAAC;AAChB,IAAA,YAAA,GAAe,IAAA;AAAA,EACjB;AACA,EAAA,YAAA,CAAa,KAAK,KAAK,CAAA;AAEvB,EAAA,IAAI,YAAA,EAAc;AAEhB,IAAA,YAAA,CAAa,MAAM,cAAc,CAAA;AAAA,EACnC;AACF;AAZS,MAAA,CAAA,iBAAA,EAAA,mBAAA,CAAA;AAcT,SAAS,eAAe,UAAA,EAAqC;AAC3D,EAAA,OAAO,IAAI,OAAA,CAAgB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC9C,IAAA,iBAAA,CAAkB;AAAA,MAChB,IAAA,EAAM,SAAA;AAAA,MAAW,UAAA;AAAA,MAAY,OAAA;AAAA,MAAS;AAAA,KACvC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AANS,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAQT,SAAS,cAAc,OAAA,EAAiD;AACtE,EAAA,OAAO,IAAI,OAAA,CAAgB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC9C,IAAA,iBAAA,CAAkB;AAAA,MAChB,IAAA,EAAM,QAAA;AAAA,MAAU,OAAA;AAAA,MAAS,OAAA;AAAA,MAAS;AAAA,KACnC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AANS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAQT,SAAS,aAAA,CAAc,KAAA,EAAiC,UAAA,EAAoB,KAAA,EAAc;AACxF,EAAA,KAAA,IAAS,CAAA,GAAI,UAAA,EAAY,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AAC9C,IAAA,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,EACvB;AACF;AAJS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAMT,eAAe,YAAA,GAAe;AAC5B,EAAA,MAAM,KAAA,GAAQ,YAAA;AACd,EAAA,YAAA,GAAe,MAAA;AACf,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAGpB,EAAA,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM;AACnB,IAAA,IAAI,CAAA,CAAE,IAAA,KAAS,CAAA,CAAE,IAAA,EAAM,OAAO,CAAA;AAC9B,IAAA,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAA,GAAK,CAAA;AAAA,EACpC,CAAC,CAAA;AAGD,EAAA,MAAmB,SAAA,EAAU;AAE7B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,KAAA,GAAQ,MAAM,CAAC,CAAA;AACrB,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,CAAM,SAAS,SAAA,EAAW;AAC5B,QAAA,MAAM,SAAA,GAAY,MAAmB,YAAA,CAAa,KAAA,CAAM,UAAU,CAAA;AAClE,QAAA,KAAA,CAAM,QAAQ,SAAS,CAAA;AAAA,MACzB,CAAA,MAAO;AACL,QAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,EAAQ;AACnC,QAAA,KAAA,CAAM,QAAQ,MAAM,CAAA;AAAA,MACtB;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAGhB,MAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC3D,MAAA,IACE,GAAA,CAAI,QAAA,CAAS,WAAW,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,UAAU,CAAA,IACjD,GAAA,CAAI,QAAA,CAAS,qBAAqB,CAAA,EACrC;AACA,QAAA,aAAA,CAAc,OAAO,CAAA,GAAI,CAAA,EAAG,IAAI,eAAA,CAAgB,+BAA0B,CAAC,CAAA;AAC3E,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAtCe,MAAA,CAAA,YAAA,EAAA,cAAA,CAAA;AAiDf,SAAS,uBAAA,CACP,OAAA,EACA,UAAA,EACA,cAAA,EACA;AACA,EAAA,MAAM,kBAAA,GAAqB,CAAA,EAAG,YAAY,CAAA,EAAG,UAAU,CAAA,CAAA;AACvD,EAAA,OAAO,cAAA,CAAe,OAAA,EAAS,CAAA,SAAA,EAAY,kBAAkB,MAAM,cAAc,CAAA;AACnF;AAPS,MAAA,CAAA,uBAAA,EAAA,yBAAA,CAAA;AAUF,IAAM,kBAAmC,cAAA,CAAqC;AAAA,EACnF,IAAA,EAAM,SAAA;AAAA,EACN,KAAA,EAAO,iCAAA;AAAA,EACP,IAAA,EAAM,WAAA;AAAA,EACN,gBAAA,EAAkB,IAAA;AAAA,EAClB,UAAA,EAAY;AAAA,IACV,IAAA,EAAM,OAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,OAAA,GAAgC;AAE9B,IAAA,MAAM,SAAA,GAAY,KAAK,OAAA,EAAS,MAAA;AAChC,IAAA,MAAM,kBAAA,GAAqB,IAAA,CAAK,OAAA,EAAS,MAAA,KAAW,KAC/C,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAA,IACjB,IAAA,CAAK,OAAA,CAAQ,CAAC,EAAE,WAAA,KAAgB,QAAA;AACrC,IAAA,IAAI,aAAa,kBAAA,EAAoB;AAEnC,MAAA,MAAM,SAAU,IAAA,CAAa,MAAA;AAC7B,MAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,IAAO,SAAA;AAC/B,MAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,MAAA,MAAM,iBAAiB,UAAA,EAAY,QAAA;AACnC,MAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,cAAA,EAAe;AAAA,IACnD;AAGA,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC9C,MAAA,MAAM,IAAI,YAAY,qFAAqF,CAAA;AAAA,IAC7G;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,CAAQ,CAAC,GAAG,QAAA,EAAU;AAC9B,MAAA,MAAM,IAAI,YAAY,4DAA4D,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,CAAE,WAAA;AAChC,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,YAAY,qCAAqC,CAAA;AAAA,IAC7D;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAQ;AAAA,EACpC,CAAA;AAAA,EACA,MAAM,QAAQ,KAAA,EAA6B;AACzC,IAAA,IAAI,KAAA,CAAM,SAAS,SAAA,EAAW;AAC5B,MAAA,IAAI,aAAa,KAAA,CAAM,OAAA;AACvB,MAAA,IAAI,UAAA,CAAW,UAAA,CAAW,YAAY,CAAA,EAAG;AACvC,QAAA,UAAA,GAAa,UAAA,CAAW,KAAA,CAAM,YAAA,CAAa,MAAM,CAAA;AAAA,MACnD;AACA,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,eAAe,UAAU,CAAA;AAAA,MACxC,SAAS,GAAA,EAAK;AAEZ,QAAA,IAAI,GAAA,YAAe,iBAAiB,MAAM,GAAA;AAE1C,QAAA,MAAM,UAAuB,cAAA,EAAe;AAC5C,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,CAAA,mBAAA,EAAsB,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA,CAAA;AAAA,UAC9D;AAAA,YACE,GAAA,EAAK;AAAA,cACH,YAAY,OAAA,CAAQ,IAAI,KAAK,OAAA,CAAQ,cAAA,GAAiB,oBAAoB,YAAY,CAAA,CAAA,CAAA;AAAA,cACtF,6EAAA;AAAA,cACA;AAAA,aACF,CAAE,KAAK,IAAI;AAAA;AACb,SACF;AAAA,MACF;AAAA,IACF;AAIA,IAAA,MAAM,EAAE,OAAA,EAAS,cAAA,EAAe,GAAI,KAAA;AACpC,IAAA,OAAO,cAAc,YAAY;AAC/B,MAAA,MAAM,UAAuB,cAAA,EAAe;AAG5C,MAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,gBAAA,IAAoB,OAAA,CAAQ,kBAAA,EAAoB;AACnE,QAAA,MAAM,SAAsB,eAAA,EAAgB;AAC5C,QAAA,MAAMA,WAAAA,GAAa,MAAM,MAAA,CAAO,YAAA,CAAa;AAAA,UAC3C,OAAA;AAAA,UACA,OAAA,EAAS,8BAA8B,OAAO,CAAA,CAAA;AAAA,SAC/C,CAAA;AAED,QAAA,IAAI,CAACA,WAAAA,EAAY;AACf,UAAA,MAAM,IAAI,gBAAgB,4BAAA,EAA8B;AAAA,YACtD,GAAA,EAAK;AAAA,WACN,CAAA;AAAA,QACH;AAEA,QAAA,MAAMC,gBAAAA,GAAkB,uBAAA,CAAwB,OAAA,EAASD,WAAAA,EAAY,cAAc,CAAA;AACnF,QAAA,IAAI,CAACC,iBAAgB,OAAA,EAAS;AAC5B,UAAA,IAAIA,gBAAAA,CAAgB,WAAW,qBAAA,EAAuB;AACpD,YAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,cAC5E,GAAA,EAAK;AAAA,aACN,CAAA;AAAA,UACH;AAEA,UAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,YAC5E,GAAA,EAAK,CAAA,4BAAA,EAA+B,OAAO,CAAA,mCAAA,EAAsC,cAAc,CAAA,CAAA;AAAA,WAChG,CAAA;AAAA,QACH;AAEA,QAAA,OAAoB,aAAaD,WAAU,CAAA;AAAA,MAC7C;AAGA,MAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAC,OAAA,CAAQ,MAAM,KAAA,EAAO;AACjD,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,gCAAgC,OAAO,CAAA,CAAA;AAAA,UACvC;AAAA,YACE,GAAA,EAAK,CAAA,6BAAA,EAAgC,cAAA,IAAkB,iBAAiB,CAAA,uCAAA;AAAA;AAC1E,SACF;AAAA,MACF;AAEA,MAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAQ,QAAA,CAAS,EAAE,OAAA,EAAS,CAAA,2BAAA,EAA8B,OAAO,CAAA,CAAA,CAAA,EAAK,IAAA,EAAM,8CAAA,EAAgD,CAAA;AACnJ,MAAA,MAAM,UAAA,GAAa,OAAO,QAAA,KAAa,QAAA;AACvC,MAAA,IAAI,UAAA,IAAc,CAAC,QAAA,EAAU;AAC3B,QAAA,MAAM,IAAI,gBAAgB,4BAAA,EAA8B;AAAA,UACtD,GAAA,EAAK;AAAA,SACN,CAAA;AAAA,MACH;AAEA,MAAA,MAAM,UAAA,GAAa,MAAmB,YAAA,CAAa,QAAQ,CAAA;AAC3D,MAAA,MAAM,eAAA,GAAkB,uBAAA,CAAwB,OAAA,EAAS,UAAA,EAAY,cAAc,CAAA;AAEnF,MAAA,IAAI,CAAC,gBAAgB,OAAA,EAAS;AAC5B,QAAA,IAAI,eAAA,CAAgB,WAAW,qBAAA,EAAuB;AACpD,UAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,YAC5E,GAAA,EAAK;AAAA,WACN,CAAA;AAAA,QACH;AAEA,QAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,UAC5E,GAAA,EAAK,CAAA,4BAAA,EAA+B,OAAO,CAAA,mCAAA,EAAsC,cAAc,CAAA,CAAA;AAAA,SAChG,CAAA;AAAA,MACH;AAEA,MAAA,OAAO,QAAA;AAAA,IACT,CAAC,CAAA;AAAA,EACH;AACF,CAAC,CAAA;;;ACxOD,SAAS,oBAAA,CACP,OAAA,EACA,GAAA,EACA,cAAA,EACA;AAEA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,CAAC,GAAA,CAAI,OAAA,IAAW,CAAC,IAAI,QAAA,EAAU;AACjC,IAAA,OAAA,GAAU,CAAA,CAAA,EAAI,IAAI,OAAO,CAAA,CAAA,CAAA;AAAA,EAC3B,CAAA,MAAO;AACL,IAAA,MAAM,KAAA,GAAuB,CAAC,CAAA,SAAA,EAAY,GAAA,CAAI,OAAO,CAAA,CAAA,CAAG,CAAA;AACxD,IAAA,IAAI,IAAI,OAAA,EAAS,KAAA,CAAM,KAAK,CAAA,SAAA,EAAY,GAAA,CAAI,OAAO,CAAA,CAAA,CAAG,CAAA;AACtD,IAAA,IAAI,IAAI,QAAA,EAAU,KAAA,CAAM,KAAK,CAAA,UAAA,EAAa,GAAA,CAAI,QAAQ,CAAA,CAAA,CAAG,CAAA;AACzD,IAAA,OAAA,GAAU,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EAC3B;AAEA,EAAA,cAAA,CAAe,OAAA,EAAS,CAAA,SAAA,EAAY,OAAO,CAAA,CAAA,CAAA,EAAK,cAAc,CAAA;AAChE;AAjBS,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AAmBF,IAAM,mBAAoC,cAAA,CAAsC;AAAA,EACrF,IAAA,EAAM,UAAA;AAAA,EACN,KAAA,EAAO,0BAAA;AAAA,EACP,IAAA,EAAM,eAAA;AAAA,EACN,gBAAA,EAAkB,IAAA;AAAA,EAClB,UAAA,EAAY;AAAA,IACV,IAAA,EAAM,OAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,OAAA,GAAiC;AAC/B,IAAA,IAAI,OAAA,CAAQ,aAAa,QAAA,EAAU;AACjC,MAAA,MAAM,IAAI,YAAY,uCAAuC,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,SAAA,GAAY,KAAK,OAAA,EAAS,MAAA;AAChC,IAAA,MAAM,kBAAA,GAAqB,IAAA,CAAK,OAAA,EAAS,MAAA,KAAW,KAC/C,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAA,IACjB,IAAA,CAAK,OAAA,CAAQ,CAAC,EAAE,WAAA,KAAgB,QAAA;AAErC,IAAA,IAAI,aAAa,kBAAA,EAAoB;AACnC,MAAA,MAAM,SAAU,IAAA,CAAa,MAAA;AAC7B,MAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,IAAO,SAAA;AAC/B,MAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,MAAA,MAAM,iBAAiB,UAAA,EAAY,QAAA;AACnC,MAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,cAAA,EAAe;AAAA,IACnD;AAGA,IAAA,MAAM,UAAA,GAAa,KAAK,OAAA,EAAS,OAAA;AACjC,IAAA,MAAM,UAAA,GAAa,KAAK,OAAA,EAAS,OAAA;AACjC,IAAA,MAAM,WAAA,GAAc,KAAK,OAAA,EAAS,QAAA;AAClC,IAAA,MAAM,QAAA,GAAW,KAAK,OAAA,EAAS,KAAA;AAE/B,IAAA,MAAM,OAAA,GAAU,UAAA,EAAY,QAAA,GAAW,UAAA,CAAW,WAAA,GAAwB,MAAA;AAC1E,IAAA,MAAM,QAAA,GAAW,WAAA,EAAa,QAAA,GAAW,WAAA,CAAY,WAAA,GAAwB,MAAA;AAC7E,IAAA,MAAM,KAAA,GAAQ,QAAA,EAAU,QAAA,GAAW,QAAA,CAAS,WAAA,GAAwB,MAAA;AAEpE,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,CAAC,UAAA,CAAW,QAAA,IAAY,OAAO,UAAA,CAAW,gBAAgB,QAAA,EAAU;AACtE,QAAA,MAAM,IAAI,YAAY,4CAA4C,CAAA;AAAA,MACpE;AACA,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,KAAA;AAAA,QAAO,SAAS,UAAA,CAAW,WAAA;AAAA,QAAa,OAAA;AAAA,QAAS,QAAA;AAAA,QAAU;AAAA,OACnE;AAAA,IACF;AAGA,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,KAAA;AAAA,QAAO,OAAA;AAAA,QAAS,QAAA;AAAA,QAAU;AAAA,OAClC;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,MAAA,KAAW,CAAA,IAAK,KAAK,OAAA,CAAQ,CAAC,GAAG,QAAA,EAAU;AAC3D,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,CAAE,WAAA;AAC9B,MAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,QAAA,MAAM,IAAI,YAAY,0CAA0C,CAAA;AAAA,MAClE;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,OAAA,EAAS,OAAO,KAAA,EAAM;AAAA,IAC9C;AAEA,IAAA,MAAM,IAAI,WAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF,CAAA;AAAA,EACA,MAAM,QAAQ,KAAA,EAA8B;AAC1C,IAAA,MAAM,SAAS,eAAA,EAAgB;AAE/B,IAAA,IAAI,KAAA,CAAM,SAAS,KAAA,EAAO;AACxB,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,OAAO,WAAA,CAAY;AAAA,UAC9B,SAAS,KAAA,CAAM,OAAA;AAAA,UACf,SAAS,KAAA,CAAM,OAAA;AAAA,UACf,UAAU,KAAA,CAAM,QAAA;AAAA,UAChB,OAAO,KAAA,CAAM;AAAA,SACd,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,CAAA,8BAAA,EAAiC,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA,CAAA;AAAA,UACzE;AAAA,YACE,GAAA,EAAK;AAAA,cACH,KAAA,CAAM,OAAA,GAAU,CAAA,SAAA,EAAY,KAAA,CAAM,OAAO,CAAA,CAAA,GAAK,IAAA;AAAA,cAC9C,KAAA,CAAM,OAAA,GAAU,CAAA,SAAA,EAAY,KAAA,CAAM,OAAO,CAAA,CAAA,GAAK,IAAA;AAAA,cAC9C,KAAA,CAAM,QAAA,GAAW,CAAA,UAAA,EAAa,KAAA,CAAM,QAAQ,CAAA,CAAA,GAAK,IAAA;AAAA,cACjD,KAAA,CAAM,KAAA,GAAQ,CAAA,OAAA,EAAU,KAAA,CAAM,KAAK,CAAA,CAAA,GAAK,IAAA;AAAA,cACxC,2EAAA;AAAA,cACA;AAAA,aACF,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,KAAK,IAAI;AAAA;AAC7B,SACF;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,EAAE,OAAA,EAAS,cAAA,EAAe,GAAI,KAAA;AAEpC,IAAA,MAAM,WAAW,MAAM,MAAA,CAAO,YAAA,CAAa,EAAE,SAAS,CAAA;AACtD,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,gBAAgB,uCAAA,EAAyC;AAAA,QACjE,GAAA,EAAK;AAAA,OACN,CAAA;AAAA,IACH;AAEA,IAAA,oBAAA,CAAqB,OAAA,EAAS,UAAU,cAAc,CAAA;AAGtD,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,OAAO,WAAA,CAAY;AAAA,QAC9B,SAAS,QAAA,CAAS,OAAA;AAAA,QAClB,SAAS,QAAA,CAAS,OAAA;AAAA,QAClB,UAAU,QAAA,CAAS;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,CAAA,iDAAA,EAAoD,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA,CAAA;AAAA,QAC5F;AAAA,UACE,GAAA,EAAK;AAAA;AACP,OACF;AAAA,IACF;AAAA,EACF;AACF,CAAC,CAAA;ACnKM,SAAS,6BAA6B,IAAA,EAA+D;AAC1G,EAAA,MAAM,GAAA,GAAM,IAAA,EAAM,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAI;AACrC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AAC7C,EAAA,IAAI,CAACE,EAAAA,CAAG,UAAA,CAAW,OAAO,GAAG,OAAO,MAAA;AACpC,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAMA,GAAG,YAAA,CAAa,OAAA,EAAS,OAAO,CAAC,CAAA;AACxD,IAAA,IAAI,GAAA,CAAI,OAAA,IAAW,OAAO,GAAA,CAAI,YAAY,QAAA,EAAU;AAClD,MAAA,OAAO,GAAA,CAAI,OAAA;AAAA,IACb;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAA4B;AACpC,EAAA,OAAO,MAAA;AACT;AAXgB,MAAA,CAAA,4BAAA,EAAA,8BAAA,CAAA;;;ACFhB,IAAM,KAAA,GAAQ,YAAY,cAAc,CAAA;AAExC,SAAS,qBAAqB,WAAA,EAAoD;AAChF,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,EAAG,OAAO,WAAA;AACvC,EAAA,OAAO,CAAC,WAAW,CAAA;AACrB;AAHS,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AAKT,SAAS,aAAA,CACP,UACA,MAAA,EAMA;AACA,EAAA,MAAM,aAAA,GAAgB,SAAS,GAAA,CAAI,CAAC,MAAMC,IAAAA,CAAK,OAAA,CAAQ,CAAC,CAAC,CAAA;AAEzD,EAAA,IAAI,aAAA,CAAc,WAAW,CAAA,EAAG;AAC9B,IAAA,KAAA,CAAM,wBAAA,EAA0B,MAAA,CAAO,MAAA,EAAQ,aAAA,CAAc,CAAC,CAAC,CAAA;AAAA,EACjE,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,4BAAA,EAA8B,cAAc,MAAA,EAAQ,MAAA,CAAO,QAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,EACnG;AAEA,EAAA,KAAA,MAAW,gBAAgB,aAAA,EAAe;AACxC,IAAA,IAAI,CAACD,EAAAA,CAAG,UAAA,CAAW,YAAY,CAAA,EAAG;AAChC,MAAA,MAAM,IAAI,YAAA,CAAa,CAAA,EAAG,OAAO,WAAW,CAAA,EAAA,EAAK,YAAY,CAAA,CAAA,EAAI;AAAA,QAC/D,YAAY,MAAA,CAAO;AAAA,OACpB,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,oBAAA,CAAqB,MAAM,YAAA,CAAa;AAAA,IAC7C,oBAAoB,MAAA,CAAO,kBAAA;AAAA,IAC3B,cAAA,EAAgB,aAAA;AAAA,IAChB,SAAA,gCAAkB,CAAA,KAAM;AACtB,MAAA,CAAA,CAAE,iBAAiB,eAAe,CAAA;AAClC,MAAA,CAAA,CAAE,iBAAiB,gBAAgB,CAAA;AAAA,IACrC,CAAA,EAHW,WAAA;AAAA,GAIZ,CAAC,CAAA;AACJ;AAjCS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAmCF,SAAS,oBAAoB,IAAA,EAIjC;AACD,EAAA,MAAM,QAAA,GAAW,IAAA,EAAM,cAAA,EAAgB,MAAA,CAAO,OAAO,CAAA;AAGrD,EAAA,IAAI,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAEnC,IAAA,OAAO,cAAc,QAAA,EAAU;AAAA,MAC7B,MAAA,EAAQ,aAAA;AAAA,MACR,WAAA,EAAa,iCAAA;AAAA,MACb,eAAA,EAAiB,oDAAA;AAAA,MACjB,oBAAoB,IAAA,EAAM;AAAA,KAC3B,CAAA;AAAA,EACH;AAGA,EAAA,MAAM,WAAA,GAAc,8BAA6B,EAAG,QAAA;AACpD,EAAA,MAAM,YAAA,GAAe,WAAA,GAAc,oBAAA,CAAqB,WAAW,CAAA,GAAI,MAAA;AAEvE,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,OAAO,cAAc,YAAA,EAAc;AAAA,MACjC,MAAA,EAAQ,+BAAA;AAAA,MACR,WAAA,EAAa,wEAAA;AAAA,MACb,eAAA,EAAiB,wFAAA;AAAA,MACjB,oBAAoB,IAAA,EAAM;AAAA,KAC3B,CAAA;AAAA,EACH;AAEA,EAAA,KAAA,CAAM,mCAAA,EAAqC,OAAA,CAAQ,GAAA,EAAK,CAAA;AAExD,EAAA,OAAO,oBAAA,CAAqB,MAAM,YAAA,CAAa;AAAA,IAC7C,oBAAoB,IAAA,EAAM,kBAAA;AAAA,IAC1B,SAAA,gCAAkB,CAAA,KAAM;AACtB,MAAA,CAAA,CAAE,iBAAiB,eAAe,CAAA;AAClC,MAAA,CAAA,CAAE,iBAAiB,gBAAgB,CAAA;AAAA,IACrC,CAAA,EAHW,WAAA;AAAA,GAIZ,CAAC,CAAA;AACJ;AAxCgB,MAAA,CAAA,mBAAA,EAAA,qBAAA,CAAA","file":"chunk-E3F6QKDZ.js","sourcesContent":["/**\n * Shared utilities for writing back encrypted/resolved values to .env files.\n *\n * Uses the env-spec AST parser to safely update values.\n */\n\nimport fs from 'node:fs';\nimport { parseEnvSpecDotEnvFile } from '@env-spec/parser';\n\ntype WriteBackResult = { updated: boolean; reason?: 'missing-source-file' | 'item-not-found' };\n\n/**\n * Update a config item's value in a .env file using AST-based replacement.\n */\nexport function writeBackValue(\n  itemKey: string,\n  newValueStr: string,\n  sourceFilePath: string | undefined,\n): WriteBackResult {\n  if (!sourceFilePath) {\n    return { updated: false, reason: 'missing-source-file' };\n  }\n\n  const currentContents = fs.readFileSync(sourceFilePath, 'utf-8');\n  const file = parseEnvSpecDotEnvFile(currentContents);\n\n  const item = file.configItems.find((i) => i.key === itemKey);\n  if (!item) {\n    return { updated: false, reason: 'item-not-found' };\n  }\n\n  // Parse a dummy line to get the correct AST value node\n  const dummyFile = parseEnvSpecDotEnvFile(`_=${newValueStr}`);\n  const dummyItem = dummyFile.configItems[0];\n  if (!dummyItem?.value) {\n    return { updated: false, reason: 'item-not-found' };\n  }\n\n  // Replace the value\n  item.data.value = dummyItem.value;\n  item.value = dummyItem.value;\n\n  fs.writeFileSync(sourceFilePath, file.toString());\n  return { updated: true };\n}\n\n","/**\n * Built-in varlock() resolver function.\n *\n * Replaces the plugin-based resolver from @varlock/secure-enclave-plugin.\n * Works cross-platform using the local-encrypt abstraction layer.\n */\n\nimport { createResolver, Resolver } from '../../env-graph/lib/resolver';\nimport { ResolutionError, SchemaError } from '../../env-graph/lib/errors';\nimport prompts from '../../cli/helpers/prompts';\nimport * as localEncrypt from './index';\nimport { writeBackValue } from './write-back';\n\nconst LOCAL_PREFIX = 'local:';\nconst PLUGIN_ICON = 'mdi:fingerprint';\n\n// ── Unified varlock() batch queue ──────────────────────────────\n// Collects all concurrent varlock() calls (both prompt and decrypt) into a\n// single batch using setImmediate, then processes them sequentially.\n// Prompts are sorted first so the user enters values before biometric decrypts.\n// If the user cancels a prompt or biometric auth, all remaining items in the\n// batch are rejected immediately.\n\ntype VarlockBatchEntry = {\n  kind: 'prompt' | 'decrypt';\n  resolve: (value: string) => void;\n  reject: (reason: unknown) => void;\n} & (\n  | { kind: 'decrypt'; ciphertext: string }\n  | { kind: 'prompt'; execute: () => Promise<string> }\n);\n\nlet pendingBatch: Array<VarlockBatchEntry> | undefined;\n\nfunction enqueueBatchEntry(entry: VarlockBatchEntry) {\n  let triggerBatch = false;\n  if (!pendingBatch) {\n    pendingBatch = [];\n    triggerBatch = true;\n  }\n  pendingBatch.push(entry);\n\n  if (triggerBatch) {\n    // eslint-disable-next-line no-use-before-define\n    setImmediate(() => executeBatch());\n  }\n}\n\nfunction enqueueDecrypt(ciphertext: string): Promise<string> {\n  return new Promise<string>((resolve, reject) => {\n    enqueueBatchEntry({\n      kind: 'decrypt', ciphertext, resolve, reject,\n    });\n  });\n}\n\nfunction enqueuePrompt(execute: () => Promise<string>): Promise<string> {\n  return new Promise<string>((resolve, reject) => {\n    enqueueBatchEntry({\n      kind: 'prompt', execute, resolve, reject,\n    });\n  });\n}\n\nfunction bailRemaining(batch: Array<VarlockBatchEntry>, startIndex: number, error: Error) {\n  for (let j = startIndex; j < batch.length; j++) {\n    batch[j].reject(error);\n  }\n}\n\nasync function executeBatch() {\n  const batch = pendingBatch;\n  pendingBatch = undefined;\n  if (!batch?.length) return;\n\n  // Sort prompts before decrypts so the user enters values first\n  batch.sort((a, b) => {\n    if (a.kind === b.kind) return 0;\n    return a.kind === 'prompt' ? -1 : 1;\n  });\n\n  // Ensure encryption key exists before processing any items\n  await localEncrypt.ensureKey();\n\n  for (let i = 0; i < batch.length; i++) {\n    const entry = batch[i];\n    try {\n      if (entry.kind === 'decrypt') {\n        const plaintext = await localEncrypt.decryptValue(entry.ciphertext);\n        entry.resolve(plaintext);\n      } else {\n        const result = await entry.execute();\n        entry.resolve(result);\n      }\n    } catch (err) {\n      entry.reject(err);\n\n      // If this looks like a user cancellation or auth failure, bail on remaining items\n      const msg = err instanceof Error ? err.message : String(err);\n      if (\n        msg.includes('cancelled') || msg.includes('canceled')\n        || msg.includes('verification failed')\n      ) {\n        bailRemaining(batch, i + 1, new ResolutionError('Skipped — user cancelled'));\n        return;\n      }\n    }\n  }\n}\n\ntype VarlockResolverState = {\n  mode: 'decrypt';\n  payload: string;\n} | {\n  mode: 'prompt';\n  itemKey: string;\n  sourceFilePath: string | undefined;\n};\n\nfunction writeBackEncryptedValue(\n  itemKey: string,\n  ciphertext: string,\n  sourceFilePath: string | undefined,\n) {\n  const prefixedCiphertext = `${LOCAL_PREFIX}${ciphertext}`;\n  return writeBackValue(itemKey, `varlock(\"${prefixedCiphertext}\")`, sourceFilePath);\n}\n\n\nexport const VarlockResolver: typeof Resolver = createResolver<VarlockResolverState>({\n  name: 'varlock',\n  label: 'Decrypt locally encrypted value',\n  icon: PLUGIN_ICON,\n  impliesSensitive: true,\n  argsSchema: {\n    type: 'mixed',\n    arrayMinLength: 0,\n  },\n  process(): VarlockResolverState {\n    // Check for prompt mode: varlock(prompt=1) or varlock(prompt)\n    const promptArg = this.objArgs?.prompt;\n    const isPromptPositional = this.arrArgs?.length === 1\n      && this.arrArgs[0]?.isStatic\n      && this.arrArgs[0].staticValue === 'prompt';\n    if (promptArg || isPromptPositional) {\n      // Resolver doesn't expose parent item in its type, but it's available at runtime\n      const parent = (this as any).parent;\n      const itemKey = parent?.key || 'unknown';\n      const dataSource = this.dataSource as any;\n      const sourceFilePath = dataSource?.fullPath as string | undefined;\n      return { mode: 'prompt', itemKey, sourceFilePath };\n    }\n\n    // Normal mode: varlock(\"encrypted-payload\")\n    if (!this.arrArgs || this.arrArgs.length !== 1) {\n      throw new SchemaError('varlock() expects a single encrypted payload string, or prompt to enter a new value');\n    }\n    if (!this.arrArgs[0]?.isStatic) {\n      throw new SchemaError('varlock() expects a single static encrypted payload string');\n    }\n    const payload = this.arrArgs[0].staticValue;\n    if (typeof payload !== 'string') {\n      throw new SchemaError('varlock() expects a string argument');\n    }\n    return { mode: 'decrypt', payload };\n  },\n  async resolve(state: VarlockResolverState) {\n    if (state.mode === 'decrypt') {\n      let ciphertext = state.payload;\n      if (ciphertext.startsWith(LOCAL_PREFIX)) {\n        ciphertext = ciphertext.slice(LOCAL_PREFIX.length);\n      }\n      try {\n        return await enqueueDecrypt(ciphertext);\n      } catch (err) {\n        // Re-throw ResolutionErrors (e.g. batch cancellation) as-is\n        if (err instanceof ResolutionError) throw err;\n\n        const backend = localEncrypt.getBackendInfo();\n        throw new ResolutionError(\n          `Decryption failed: ${err instanceof Error ? err.message : err}`,\n          {\n            tip: [\n              `Backend: ${backend.type} (${backend.hardwareBacked ? 'hardware-backed' : 'file-based'})`,\n              'This usually means the value was encrypted with a different key or backend.',\n              'Set a new value using `varlock encrypt` or `KEY=varlock(prompt)`.',\n            ].join('\\n'),\n          },\n        );\n      }\n    }\n\n    // Prompt mode: enqueued into the unified batch so prompts run before decrypts\n    // and cancellation propagates to all remaining items.\n    const { itemKey, sourceFilePath } = state;\n    return enqueuePrompt(async () => {\n      const backend = localEncrypt.getBackendInfo();\n\n      // Use daemon's native dialog on macOS Secure Enclave\n      if (backend.type === 'secure-enclave' && backend.biometricAvailable) {\n        const client = localEncrypt.getDaemonClient();\n        const ciphertext = await client.promptSecret({\n          itemKey,\n          message: `Enter the secret value for ${itemKey}:`,\n        });\n\n        if (!ciphertext) {\n          throw new ResolutionError('Secret input was cancelled', {\n            tip: 'Run varlock again and enter a value, or replace prompt=1 with an encrypted value',\n          });\n        }\n\n        const writeBackResult = writeBackEncryptedValue(itemKey, ciphertext, sourceFilePath);\n        if (!writeBackResult.updated) {\n          if (writeBackResult.reason === 'missing-source-file') {\n            throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n              tip: 'varlock(prompt=1) can only persist values from file-backed sources. Use `varlock encrypt` to generate an encrypted value manually.',\n            });\n          }\n\n          throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n            tip: `Could not find a writable \\`${itemKey}=varlock(...)\\` entry to update in ${sourceFilePath}.`,\n          });\n        }\n\n        return localEncrypt.decryptValue(ciphertext);\n      }\n\n      // Terminal prompt for file-based backend\n      if (!process.stdout.isTTY || !process.stdin.isTTY) {\n        throw new ResolutionError(\n          `No encrypted value found for ${itemKey}`,\n          {\n            tip: `Run \\`varlock encrypt --file ${sourceFilePath || '<your-env-file>'}\\` to encrypt this value interactively.`,\n          },\n        );\n      }\n\n      const rawValue = await prompts.password({ message: `Enter the secret value for ${itemKey}:`, hint: 'for multi-line values, use `varlock encrypt`' });\n      const isCanceled = typeof rawValue !== 'string';\n      if (isCanceled || !rawValue) {\n        throw new ResolutionError('Secret input was cancelled', {\n          tip: 'Run varlock again and enter a value, or replace prompt=1 with an encrypted value',\n        });\n      }\n\n      const ciphertext = await localEncrypt.encryptValue(rawValue);\n      const writeBackResult = writeBackEncryptedValue(itemKey, ciphertext, sourceFilePath);\n\n      if (!writeBackResult.updated) {\n        if (writeBackResult.reason === 'missing-source-file') {\n          throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n            tip: 'varlock(prompt=1) can only persist values from file-backed sources. Use `varlock encrypt` to generate an encrypted value manually.',\n          });\n        }\n\n        throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n          tip: `Could not find a writable \\`${itemKey}=varlock(...)\\` entry to update in ${sourceFilePath}.`,\n        });\n      }\n\n      return rawValue;\n    });\n  },\n});\n","/**\n * Built-in keychain() resolver function.\n *\n * Reads secrets from the macOS Keychain via the Swift daemon binary.\n * Always goes through the daemon to enforce biometric gating (per-TTY sessions)\n * and to make VarlockEnclave the authorized keychain accessor.\n *\n * Syntax:\n *   keychain(service=\"com.company.db\")\n *   keychain(service=\"com.company.db\", account=\"admin\")\n *   keychain(service=\"com.company.db\", keychain=\"System\")\n *   keychain(\"com.company.db\")          — shorthand for service\n *   keychain(prompt)                     — interactive picker, writes back reference\n */\n\nimport { createResolver, Resolver } from '../../env-graph/lib/resolver';\nimport { ResolutionError, SchemaError } from '../../env-graph/lib/errors';\nimport { getDaemonClient } from './index';\nimport { writeBackValue } from './write-back';\n\ntype KeychainResolverState = {\n  mode: 'get';\n  service?: string;\n  account?: string;\n  keychain?: string;\n  field?: string;\n} | {\n  mode: 'prompt';\n  itemKey: string;\n  sourceFilePath: string | undefined;\n};\n\nfunction writeBackKeychainRef(\n  itemKey: string,\n  ref: { service: string; account?: string; keychain?: string },\n  sourceFilePath: string | undefined,\n) {\n  // Use positional shorthand when only service is needed, named args when disambiguating\n  let argsStr: string;\n  if (!ref.account && !ref.keychain) {\n    argsStr = `\"${ref.service}\"`;\n  } else {\n    const parts: Array<string> = [`service=\"${ref.service}\"`];\n    if (ref.account) parts.push(`account=\"${ref.account}\"`);\n    if (ref.keychain) parts.push(`keychain=\"${ref.keychain}\"`);\n    argsStr = parts.join(', ');\n  }\n\n  writeBackValue(itemKey, `keychain(${argsStr})`, sourceFilePath);\n}\n\nexport const KeychainResolver: typeof Resolver = createResolver<KeychainResolverState>({\n  name: 'keychain',\n  label: 'Read from macOS Keychain',\n  icon: 'mdi:key-chain',\n  impliesSensitive: true,\n  argsSchema: {\n    type: 'mixed',\n    arrayMinLength: 0,\n  },\n  process(): KeychainResolverState {\n    if (process.platform !== 'darwin') {\n      throw new SchemaError('keychain() is only supported on macOS');\n    }\n\n    // Check for prompt mode: keychain(prompt) or keychain(prompt=1)\n    const promptArg = this.objArgs?.prompt;\n    const isPromptPositional = this.arrArgs?.length === 1\n      && this.arrArgs[0]?.isStatic\n      && this.arrArgs[0].staticValue === 'prompt';\n\n    if (promptArg || isPromptPositional) {\n      const parent = (this as any).parent;\n      const itemKey = parent?.key || 'unknown';\n      const dataSource = this.dataSource as any;\n      const sourceFilePath = dataSource?.fullPath as string | undefined;\n      return { mode: 'prompt', itemKey, sourceFilePath };\n    }\n\n    // Named args mode: keychain(service=\"...\", account=\"...\", keychain=\"...\", field=\"...\")\n    const serviceArg = this.objArgs?.service;\n    const accountArg = this.objArgs?.account;\n    const keychainArg = this.objArgs?.keychain;\n    const fieldArg = this.objArgs?.field;\n\n    const account = accountArg?.isStatic ? accountArg.staticValue as string : undefined;\n    const keychain = keychainArg?.isStatic ? keychainArg.staticValue as string : undefined;\n    const field = fieldArg?.isStatic ? fieldArg.staticValue as string : undefined;\n\n    if (serviceArg) {\n      if (!serviceArg.isStatic || typeof serviceArg.staticValue !== 'string') {\n        throw new SchemaError('keychain() service must be a static string');\n      }\n      return {\n        mode: 'get', service: serviceArg.staticValue, account, keychain, field,\n      };\n    }\n\n    // account-only lookup: keychain(account=\"admin@corp.com\", field=\"account\")\n    if (accountArg) {\n      return {\n        mode: 'get', account, keychain, field,\n      };\n    }\n\n    // Positional shorthand: keychain(\"com.company.service\")\n    if (this.arrArgs?.length === 1 && this.arrArgs[0]?.isStatic) {\n      const value = this.arrArgs[0].staticValue;\n      if (typeof value !== 'string') {\n        throw new SchemaError('keychain() expects a string service name');\n      }\n      return { mode: 'get', service: value, field };\n    }\n\n    throw new SchemaError(\n      'keychain() requires service name, account, or prompt mode. '\n      + 'Usage: keychain(service=\"com.example\"), keychain(\"com.example\"), or keychain(prompt)',\n    );\n  },\n  async resolve(state: KeychainResolverState) {\n    const client = getDaemonClient();\n\n    if (state.mode === 'get') {\n      try {\n        return await client.keychainGet({\n          service: state.service,\n          account: state.account,\n          keychain: state.keychain,\n          field: state.field,\n        });\n      } catch (err) {\n        throw new ResolutionError(\n          `Failed to read keychain item: ${err instanceof Error ? err.message : err}`,\n          {\n            tip: [\n              state.service ? `Service: ${state.service}` : null,\n              state.account ? `Account: ${state.account}` : null,\n              state.keychain ? `Keychain: ${state.keychain}` : null,\n              state.field ? `Field: ${state.field}` : null,\n              'Make sure the item exists in your Keychain and VarlockEnclave has access.',\n              'You can grant access via: keychain(prompt)',\n            ].filter(Boolean).join('\\n'),\n          },\n        );\n      }\n    }\n\n    // Prompt mode: show native picker, write back reference\n    const { itemKey, sourceFilePath } = state;\n\n    const selected = await client.keychainPick({ itemKey });\n    if (!selected) {\n      throw new ResolutionError('Keychain item selection was cancelled', {\n        tip: 'Run varlock again and select an item, or use keychain(service=\"...\") with an explicit service name',\n      });\n    }\n\n    writeBackKeychainRef(itemKey, selected, sourceFilePath);\n\n    // Now fetch the actual value\n    try {\n      return await client.keychainGet({\n        service: selected.service,\n        account: selected.account,\n        keychain: selected.keychain,\n      });\n    } catch (err) {\n      throw new ResolutionError(\n        `Selected keychain item but failed to read value: ${err instanceof Error ? err.message : err}`,\n        {\n          tip: 'The item reference has been written to your config. Try running varlock again.',\n        },\n      );\n    }\n  },\n});\n","import path from 'node:path';\nimport fs from 'node:fs';\n\nexport type VarlockPackageJsonConfig = {\n  /** Path (or array of paths) to a specific .env file or directory to use as the entry point for loading */\n  loadPath?: string | Array<string>;\n};\n\n/**\n * Reads varlock configuration from the `package.json` in `cwd`.\n * Returns undefined if no `package.json` exists or it has no `varlock` key.\n */\nexport function readVarlockPackageJsonConfig(opts?: { cwd?: string }): VarlockPackageJsonConfig | undefined {\n  const cwd = opts?.cwd ?? process.cwd();\n  const pkgPath = path.join(cwd, 'package.json');\n  if (!fs.existsSync(pkgPath)) return undefined;\n  try {\n    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));\n    if (pkg.varlock && typeof pkg.varlock === 'object') {\n      return pkg.varlock as VarlockPackageJsonConfig;\n    }\n  } catch { /* ignore parse errors */ }\n  return undefined;\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\nimport { loadEnvGraph } from '../env-graph';\nimport { VarlockResolver } from './local-encrypt/builtin-resolver';\nimport { KeychainResolver } from './local-encrypt/keychain-resolver';\nimport { CliExitError } from '../cli/helpers/exit-error';\nimport { runWithWorkspaceInfo } from './workspace-utils';\nimport { readVarlockPackageJsonConfig } from './package-json-config';\nimport { createDebug } from './debug';\n\nconst debug = createDebug('varlock:load');\n\nfunction normalizePkgLoadPath(pkgLoadPath: string | Array<string>): Array<string> {\n  if (Array.isArray(pkgLoadPath)) return pkgLoadPath;\n  return [pkgLoadPath];\n}\n\nfunction loadFromPaths(\n  rawPaths: Array<string>,\n  config: {\n    source: string,\n    errorPrefix: string,\n    errorSuggestion: string,\n    currentEnvFallback?: string,\n  },\n) {\n  const resolvedPaths = rawPaths.map((p) => path.resolve(p));\n\n  if (resolvedPaths.length === 1) {\n    debug('using path from %s: %s', config.source, resolvedPaths[0]);\n  } else {\n    debug('using %d paths from %s: %s', resolvedPaths.length, config.source, resolvedPaths.join(', '));\n  }\n\n  for (const resolvedPath of resolvedPaths) {\n    if (!fs.existsSync(resolvedPath)) {\n      throw new CliExitError(`${config.errorPrefix}: ${resolvedPath}`, {\n        suggestion: config.errorSuggestion,\n      });\n    }\n  }\n\n  return runWithWorkspaceInfo(() => loadEnvGraph({\n    currentEnvFallback: config.currentEnvFallback,\n    entryFilePaths: resolvedPaths,\n    afterInit: async (g) => {\n      g.registerResolver(VarlockResolver);\n      g.registerResolver(KeychainResolver);\n    },\n  }));\n}\n\nexport function loadVarlockEnvGraph(opts?: {\n  currentEnvFallback?: string,\n  /** Explicit entry file paths from --path flag(s) - overrides package.json config */\n  entryFilePaths?: Array<string>,\n}) {\n  const cliPaths = opts?.entryFilePaths?.filter(Boolean);\n\n  // If --path flag(s) provided, they take precedence over package.json config\n  if (cliPaths && cliPaths.length > 0) {\n    // Return early and ignore pkgLoadPaths\n    return loadFromPaths(cliPaths, {\n      source: '--path flag',\n      errorPrefix: 'The --path value does not exist',\n      errorSuggestion: 'Use `--path` to specify a valid file or directory.',\n      currentEnvFallback: opts?.currentEnvFallback,\n    });\n  }\n\n  // Fall back to package.json varlock.loadPath\n  const pkgLoadPath = readVarlockPackageJsonConfig()?.loadPath;\n  const pkgLoadPaths = pkgLoadPath ? normalizePkgLoadPath(pkgLoadPath) : undefined;\n\n  if (pkgLoadPaths) {\n    return loadFromPaths(pkgLoadPaths, {\n      source: 'package.json varlock.loadPath',\n      errorPrefix: 'A path in `varlock.loadPath` configured in package.json does not exist',\n      errorSuggestion: 'Update `varlock.loadPath` in your package.json to point to valid files or directories.',\n      currentEnvFallback: opts?.currentEnvFallback,\n    });\n  }\n\n  debug('no path configured, using cwd: %s', process.cwd());\n\n  return runWithWorkspaceInfo(() => loadEnvGraph({\n    currentEnvFallback: opts?.currentEnvFallback,\n    afterInit: async (g) => {\n      g.registerResolver(VarlockResolver);\n      g.registerResolver(KeychainResolver);\n    },\n  }));\n}\n"]}

package/dist/{chunk-YHOWSHVH.js → chunk-F5H5MJ6U.js}

@@ -26,6 +26,20 @@ function findVarlockBin(startDir) {
   return null;
 }
 __name(findVarlockBin, "findVarlockBin");
+var VarlockExecError = class extends Error {
+  constructor(message, stdout, stderr, exitCode) {
+    super(message);
+    this.stdout = stdout;
+    this.stderr = stderr;
+    this.exitCode = exitCode;
+  }
+  stdout;
+  stderr;
+  exitCode;
+  static {
+    __name(this, "VarlockExecError");
+  }
+};
 function execSyncVarlock(command, opts) {
   try {
     try {
@@ -34,7 +48,7 @@ function execSyncVarlock(command, opts) {
         ...opts?.cwd && { cwd: opts.cwd },
         stdio: "pipe"
       });
-      return result.toString();
+      return opts?.fullResult ? { stdout: result.toString(), stderr: "" } : result.toString();
     } catch (err) {
       if (!isWindows && err.status !== 127 && err.code !== "ENOENT") throw err;
     }
@@ -53,11 +67,24 @@ function execSyncVarlock(command, opts) {
           stdio: "pipe",
           ...needsShell && { shell: true }
         });
-        return result.toString();
+        return opts?.fullResult ? { stdout: result.toString(), stderr: "" } : result.toString();
       }
     }
     throw new Error("Unable to find varlock executable");
   } catch (err) {
+    if (opts?.fullResult) {
+      if (err instanceof VarlockExecError) throw err;
+      const errAny2 = err;
+      if (errAny2.status != null) {
+        throw new VarlockExecError(
+          `varlock ${command} failed (exit code ${errAny2.status})`,
+          errAny2.stdout?.toString() ?? "",
+          errAny2.stderr?.toString() ?? "",
+          errAny2.status ?? 1
+        );
+      }
+      throw err;
+    }
     const errAny = err;
     if (opts?.showLogsOnError) {
       if (errAny.stdout) console.log(errAny.stdout.toString());
@@ -74,6 +101,6 @@ function execSyncVarlock(command, opts) {
 }
 __name(execSyncVarlock, "execSyncVarlock");
 
-export { execSyncVarlock };
-//# sourceMappingURL=chunk-YHOWSHVH.js.map
-//# sourceMappingURL=chunk-YHOWSHVH.js.map
+export { VarlockExecError, execSyncVarlock };
+//# sourceMappingURL=chunk-F5H5MJ6U.js.map
+//# sourceMappingURL=chunk-F5H5MJ6U.js.map

package/dist/chunk-F5H5MJ6U.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/exec-sync-varlock.ts"],"names":["errAny"],"mappings":";;;;;;AASA,IAAM,QAAA,GAAW,GAAG,QAAA,EAAS;AAC7B,IAAM,SAAA,GAAY,QAAA,CAAS,KAAA,CAAM,OAAO,CAAA;AAOxC,SAAS,eAAe,QAAA,EAAiC;AAGvD,EAAA,MAAM,WAAW,SAAA,GAAY,CAAC,eAAe,aAAa,CAAA,GAAI,CAAC,SAAS,CAAA;AAExE,EAAA,IAAI,UAAA,GAAa,QAAA;AACjB,EAAA,OAAO,UAAA,EAAY;AACjB,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,gBAAgB,MAAM,CAAA;AACpE,IAAA,IAAI,EAAA,CAAG,UAAA,CAAW,eAAe,CAAA,EAAG;AAClC,MAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,QAAA,MAAM,mBAAA,GAAsB,IAAA,CAAK,IAAA,CAAK,eAAA,EAAiB,OAAO,CAAA;AAC9D,QAAA,IAAI,EAAA,CAAG,UAAA,CAAW,mBAAmB,CAAA,EAAG;AACtC,UAAA,OAAO,mBAAA;AAAA,QACT;AAAA,MACF;AAAA,IAIF;AACA,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,CAAQ,UAAU,CAAA;AACzC,IAAA,IAAI,cAAc,UAAA,EAAY;AAC9B,IAAA,UAAA,GAAa,SAAA;AAAA,EACf;AACA,EAAA,OAAO,IAAA;AACT;AAxBS,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AA4BF,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAC1C,WAAA,CACE,OAAA,EACO,MAAA,EACA,MAAA,EACA,QAAA,EACP;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAJN,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAGT;AAAA,EALS,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EAlDX;AA6C4C,IAAA,MAAA,CAAA,IAAA,EAAA,kBAAA,CAAA;AAAA;AAS5C;AAgCO,SAAS,eAAA,CACd,SACA,IAAA,EAC4B;AAC5B,EAAA,IAAI;AAIF,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,CAAA,QAAA,EAAW,OAAO,CAAA,CAAA,EAAI;AAAA,QAC5C,GAAG,IAAA,EAAM,GAAA,IAAO,EAAE,GAAA,EAAK,KAAK,GAAA,EAAI;AAAA,QAChC,GAAG,IAAA,EAAM,GAAA,IAAO,EAAE,GAAA,EAAK,KAAK,GAAA,EAAI;AAAA,QAChC,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,OAAO,IAAA,EAAM,UAAA,GACT,EAAE,MAAA,EAAQ,MAAA,CAAO,QAAA,EAAS,EAAG,MAAA,EAAQ,EAAA,EAAG,GACxC,MAAA,CAAO,QAAA,EAAS;AAAA,IACtB,SAAS,GAAA,EAAK;AAGZ,MAAA,IAAI,CAAC,aAAc,GAAA,CAAY,MAAA,KAAW,OAAQ,GAAA,CAAY,IAAA,KAAS,UAAU,MAAM,GAAA;AAAA,IAEzF;AAQA,IAAA,MAAM,SAAS,IAAA,EAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GAAI,KAAA,CAAA;AAC9C,IAAA,MAAM,UAAA,GAAa;AAAA,MACjB,GAAI,MAAA,GAAS,CAAC,MAAM,IAAI,EAAC;AAAA,MACzB,GAAI,IAAA,EAAM,SAAA,GAAY,CAAC,IAAA,CAAK,SAAS,IAAI,EAAC;AAAA,MAC1C,QAAQ,GAAA;AAAI,KACd;AAEA,IAAA,KAAA,MAAW,YAAY,UAAA,EAAY;AACjC,MAAA,MAAM,WAAA,GAAc,eAAe,QAAQ,CAAA;AAC3C,MAAA,IAAI,WAAA,EAAa;AAEf,QAAA,MAAM,UAAA,GAAa,WAAA,CAAY,QAAA,CAAS,MAAM,CAAA;AAC9C,QAAA,MAAM,SAAS,YAAA,CAAa,WAAA,EAAa,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,EAAG;AAAA,UAC3D,GAAG,IAAA;AAAA,UACH,KAAA,EAAO,MAAA;AAAA,UACP,GAAI,UAAA,IAAc,EAAE,KAAA,EAAO,IAAA;AAAK,SACjC,CAAA;AACD,QAAA,OAAO,IAAA,EAAM,UAAA,GACT,EAAE,MAAA,EAAQ,MAAA,CAAO,QAAA,EAAS,EAAG,MAAA,EAAQ,EAAA,EAAG,GACxC,MAAA,CAAO,QAAA,EAAS;AAAA,MACtB;AAAA,IACF;AACA,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACrD,SAAS,GAAA,EAAK;AAEZ,IAAA,IAAI,MAAM,UAAA,EAAY;AACpB,MAAA,IAAI,GAAA,YAAe,kBAAkB,MAAM,GAAA;AAC3C,MAAA,MAAMA,OAAAA,GAAS,GAAA;AAEf,MAAA,IAAIA,OAAAA,CAAO,UAAU,IAAA,EAAM;AACzB,QAAA,MAAM,IAAI,gBAAA;AAAA,UACR,CAAA,QAAA,EAAW,OAAO,CAAA,mBAAA,EAAsBA,OAAAA,CAAO,MAAM,CAAA,CAAA,CAAA;AAAA,UACrDA,OAAAA,CAAO,MAAA,EAAQ,QAAA,EAAS,IAAK,EAAA;AAAA,UAC7BA,OAAAA,CAAO,MAAA,EAAQ,QAAA,EAAS,IAAK,EAAA;AAAA,UAC7BA,QAAO,MAAA,IAAU;AAAA,SACnB;AAAA,MACF;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AAGA,IAAA,MAAM,MAAA,GAAS,GAAA;AACf,IAAA,IAAI,MAAM,eAAA,EAAiB;AAEzB,MAAA,IAAI,OAAO,MAAA,EAAQ,OAAA,CAAQ,IAAI,MAAA,CAAO,MAAA,CAAO,UAAU,CAAA;AACvD,MAAA,IAAI,OAAO,MAAA,EAAQ,OAAA,CAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,UAAU,CAAA;AAEzD,MAAA,IAAI,CAAC,MAAA,CAAO,MAAA,IAAU,CAAC,OAAO,MAAA,EAAQ;AACpC,QAAA,OAAA,CAAQ,MAAM,MAAM,CAAA;AAAA,MACtB;AAAA,IACF;AACA,IAAA,IAAI,MAAM,WAAA,EAAa;AACrB,MAAA,OAAA,CAAQ,IAAA,CAAM,GAAA,CAAY,MAAA,IAAU,CAAC,CAAA;AAAA,IACvC;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAtFgB,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA","file":"chunk-F5H5MJ6U.js","sourcesContent":["import path from 'node:path';\nimport fs from 'node:fs';\nimport os from 'node:os';\nimport { execFileSync, execSync } from 'node:child_process';\n\n// weird tsup issue using `typeof execSync` from node:child_process\n// see https://github.com/egoist/tsup/issues/1367\nimport type { execSync as execSyncType } from 'child_process';\n\nconst platform = os.platform();\nconst isWindows = platform.match(/^win/i);\n\n\n/**\n * Walk up the directory tree from startDir looking for a node_modules/.bin/varlock binary.\n * Returns the full path to the binary if found, or null if not found.\n */\nfunction findVarlockBin(startDir: string): string | null {\n  // On Windows, npm creates varlock.exe while pnpm only creates varlock.cmd\n  // (and a shell script). Check .exe first, then fall back to .cmd.\n  const binNames = isWindows ? ['varlock.exe', 'varlock.cmd'] : ['varlock'];\n\n  let currentDir = startDir;\n  while (currentDir) {\n    const possibleBinPath = path.join(currentDir, 'node_modules', '.bin');\n    if (fs.existsSync(possibleBinPath)) {\n      for (const binName of binNames) {\n        const possibleVarlockPath = path.join(possibleBinPath, binName);\n        if (fs.existsSync(possibleVarlockPath)) {\n          return possibleVarlockPath;\n        }\n      }\n      // Found a .bin directory but varlock is not in it - keep walking up.\n      // In a monorepo the root node_modules/.bin may exist without varlock,\n      // which is installed only in a sub-package.\n    }\n    const parentDir = path.dirname(currentDir);\n    if (parentDir === currentDir) break;\n    currentDir = parentDir;\n  }\n  return null;\n}\n\n\n/** Error thrown by `execSyncVarlock` when the CLI exits with a non-zero status code and `fullResult` is enabled. */\nexport class VarlockExecError extends Error {\n  constructor(\n    message: string,\n    public stdout: string,\n    public stderr: string,\n    public exitCode: number,\n  ) {\n    super(message);\n  }\n}\n\nexport type ExecVarlockResult = { stdout: string, stderr: string };\n\ntype ExecSyncVarlockOpts = Parameters<typeof execSyncType>[1] & {\n  exitOnError?: boolean,\n  showLogsOnError?: boolean,\n  /**\n   * Additional directory to start searching for the varlock binary from.\n   * Searched before process.cwd(). Pass `import.meta.dirname` from the\n   * call-site so that in monorepos the binary installed next to the\n   * importing package is found even when cwd is an unrelated workspace root.\n   */\n  callerDir?: string,\n  /**\n   * When true, return `{ stdout, stderr }` instead of just the stdout string,\n   * and throw `VarlockExecError` (with `.stdout`, `.stderr`, `.exitCode`) on failure\n   * instead of the raw execSync error.\n   */\n  fullResult?: boolean,\n};\n\n/**\n * Small helper to call execSync and call the varlock cli.\n *\n * When the user runs via a package manager, it will inject node_modules/.bin into PATH\n * but otherwise we may need to try to find that path ourselves.\n *\n * @returns stdout as a string by default, or `{ stdout, stderr }` when `fullResult: true`\n */\nexport function execSyncVarlock(command: string, opts?: ExecSyncVarlockOpts & { fullResult?: false }): string;\nexport function execSyncVarlock(command: string, opts: ExecSyncVarlockOpts & { fullResult: true }): ExecVarlockResult;\nexport function execSyncVarlock(\n  command: string,\n  opts?: ExecSyncVarlockOpts,\n): string | ExecVarlockResult {\n  try {\n    // in most cases, user will be running via their package manager\n    // and a package.json script (ie `pnpm run start`)\n    // which will inject node_modules/.bin into PATH\n    try {\n      const result = execSync(`varlock ${command}`, {\n        ...opts?.env && { env: opts.env },\n        ...opts?.cwd && { cwd: opts.cwd },\n        stdio: 'pipe',\n      });\n      return opts?.fullResult\n        ? { stdout: result.toString(), stderr: '' }\n        : result.toString();\n    } catch (err) {\n      // code 127 means not found (on linux only)\n      // ENOENT from execSync means that a shell was not found\n      if (!isWindows && (err as any).status !== 127 && (err as any).code !== 'ENOENT') throw err;\n      // on windows, we'll just do the extra checks anyway\n    }\n\n    // if varlock was not found, it either means it is not installed\n    // or we must find the path to node_modules/.bin ourselves.\n    // Search from cwd (if provided), callerDir, then process.cwd().\n    // This handles monorepo setups where cwd may be an unrelated workspace\n    // root while varlock is only installed in a sub-package - the callerDir\n    // supplied by auto-load.ts points inside that sub-package's node_modules.\n    const cwdStr = opts?.cwd ? String(opts.cwd) : undefined;\n    const searchDirs = [\n      ...(cwdStr ? [cwdStr] : []),\n      ...(opts?.callerDir ? [opts.callerDir] : []),\n      process.cwd(),\n    ];\n\n    for (const startDir of searchDirs) {\n      const varlockPath = findVarlockBin(startDir);\n      if (varlockPath) {\n        // .cmd files are batch scripts that must be run through cmd.exe\n        const needsShell = varlockPath.endsWith('.cmd');\n        const result = execFileSync(varlockPath, command.split(' '), {\n          ...opts,\n          stdio: 'pipe',\n          ...(needsShell && { shell: true }),\n        });\n        return opts?.fullResult\n          ? { stdout: result.toString(), stderr: '' }\n          : result.toString();\n      }\n    }\n    throw new Error('Unable to find varlock executable');\n  } catch (err) {\n    // In fullResult mode, wrap the error as VarlockExecError with structured fields\n    if (opts?.fullResult) {\n      if (err instanceof VarlockExecError) throw err; // already wrapped\n      const errAny = err as any;\n      // execSync/execFileSync attach stdout/stderr Buffers on the error\n      if (errAny.status != null) {\n        throw new VarlockExecError(\n          `varlock ${command} failed (exit code ${errAny.status})`,\n          errAny.stdout?.toString() ?? '',\n          errAny.stderr?.toString() ?? '',\n          errAny.status ?? 1,\n        );\n      }\n      throw err; // not a process error (e.g. \"Unable to find varlock executable\")\n    }\n\n    // Legacy behavior for non-fullResult callers\n    const errAny = err as any;\n    if (opts?.showLogsOnError) {\n      /* eslint-disable no-console */\n      if (errAny.stdout) console.log(errAny.stdout.toString());\n      if (errAny.stderr) console.error(errAny.stderr.toString());\n\n      if (!errAny.stdout && !errAny.stderr) {\n        console.error(errAny);\n      }\n    }\n    if (opts?.exitOnError) {\n      process.exit((err as any).status ?? 1);\n    }\n    throw err;\n  }\n}\n"]}