varlock 1.2.0 → 1.4.0

package/dist/audit.command-PXY2ZGU2.js

@@ -0,0 +1,16 @@
+export { commandFn, commandSpec } from './chunk-RTKFINP6.js';
+import './chunk-P33JXOU6.js';
+import './chunk-CHQDS2PI.js';
+import './chunk-MGUGRIW2.js';
+import './chunk-NHNQJTPB.js';
+import './chunk-Q4I7MXFB.js';
+import './chunk-P4HNABAM.js';
+import './chunk-SX2NUZCL.js';
+import './chunk-PBWMMYWL.js';
+import './chunk-O3WTD6L4.js';
+import './chunk-IRXBCLL2.js';
+import './chunk-FA5SNEKN.js';
+import './chunk-XLYSNOR3.js';
+import './chunk-6PEHRAEP.js';
+//# sourceMappingURL=audit.command-PXY2ZGU2.js.map
+//# sourceMappingURL=audit.command-PXY2ZGU2.js.map

package/dist/{audit.command-6TUJY57M.js.map → audit.command-PXY2ZGU2.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"audit.command-6TUJY57M.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"audit.command-PXY2ZGU2.js"}

package/dist/auto-load.js

@@ -1,9 +1,9 @@
-import './chunk-OA6PRICO.js';
-import './chunk-F6RTQ5QX.js';
-import './chunk-5DUWGI2N.js';
+import './chunk-M6QE3D2O.js';
+import './chunk-KFALDUEO.js';
+import './chunk-DIPEXEIL.js';
 import './chunk-ZTFQ7ZVH.js';
-import './chunk-R73FENLU.js';
-import './chunk-MGWUDHT5.js';
+import './chunk-QDEAHBCB.js';
+import './chunk-UUJK65RS.js';
 import './chunk-XLYSNOR3.js';
 import './chunk-6PEHRAEP.js';
 //# sourceMappingURL=auto-load.js.map

package/dist/{chunk-CWC3IAQM.js → chunk-2GZ4APXU.js}

@@ -1,8 +1,9 @@
-import { define } from './chunk-4A54P4EM.js';
-import { checkForSchemaErrors, checkForNoEnvFiles, checkForConfigErrors, showPluginWarnings } from './chunk-45N5EFNL.js';
-import { loadVarlockEnvGraph } from './chunk-H2JVYUHZ.js';
 import { gracefulExit } from './chunk-CHQDS2PI.js';
-import { getItemSummary } from './chunk-LGEHJHB2.js';
+import { define } from './chunk-MGUGRIW2.js';
+import { checkForSchemaErrors, checkForNoEnvFiles, checkForConfigErrors, showPluginWarnings } from './chunk-NHNQJTPB.js';
+import { loadVarlockEnvGraph } from './chunk-Q4I7MXFB.js';
+import { getItemSummary } from './chunk-SX2NUZCL.js';
+import { ansis_default } from './chunk-PBWMMYWL.js';
 import { redactString } from './chunk-XLYSNOR3.js';
 import { __name } from './chunk-6PEHRAEP.js';
 import { writeFileSync } from 'fs';
@@ -88,17 +89,27 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
     currentEnvFallback: ctx.values.env,
     entryFilePaths: ctx.values.path
   });
-  if (outputFormat !== "json-full") {
-    checkForSchemaErrors(envGraph);
+  let hasSchemaErrors = false;
+  let hadSchemaOutput = false;
+  if (outputFormat === "json-full") {
+    const result = checkForSchemaErrors(envGraph, { noThrow: true });
+    hasSchemaErrors = result.hasErrors;
+    hadSchemaOutput = result.hasOutput;
+    checkForNoEnvFiles(envGraph, { noThrow: true });
+  } else {
+    const result = checkForSchemaErrors(envGraph);
+    hadSchemaOutput = result.hasOutput;
     checkForNoEnvFiles(envGraph);
   }
   if (!envGraph.rootDataSource) throw new Error("expected root data source to be set");
-  await envGraph.generateTypesIfNeeded();
-  await envGraph.resolveEnvValues();
-  if (outputFormat === "json-full") {
-    checkForConfigErrors(envGraph, { showAll, noThrow: true });
-  } else {
-    checkForConfigErrors(envGraph, { showAll });
+  if (!hasSchemaErrors) {
+    await envGraph.generateTypesIfNeeded();
+    await envGraph.resolveEnvValues();
+    if (outputFormat === "json-full") {
+      checkForConfigErrors(envGraph, { showAll, noThrow: true });
+    } else {
+      checkForConfigErrors(envGraph, { showAll });
+    }
   }
   if ((summaryStderr || summaryFile) && outputFormat !== "pretty") {
     const summaryLines = envGraph.sortedConfigKeys.map(
@@ -132,6 +143,10 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
   __name(getRedactedEnvObject, "getRedactedEnvObject");
   if (outputFormat === "pretty") {
     showPluginWarnings(envGraph);
+    if (hadSchemaOutput) {
+      console.error();
+    }
+    console.error(ansis_default.bold.green("-- Resolved config --"));
     for (const itemKey of envGraph.sortedConfigKeys) {
       const item = envGraph.configSchema[itemKey];
       console.log(getItemSummary(item));
@@ -185,5 +200,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 
 export { commandFn, commandSpec, formatShellValue };
-//# sourceMappingURL=chunk-CWC3IAQM.js.map
-//# sourceMappingURL=chunk-CWC3IAQM.js.map
+//# sourceMappingURL=chunk-2GZ4APXU.js.map
+//# sourceMappingURL=chunk-2GZ4APXU.js.map

package/dist/chunk-2GZ4APXU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/load.command.ts"],"names":[],"mappings":";;;;;;;;;;AAaO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,MAAA;AAAA,EACN,WAAA,EAAa,iDAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,MAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,SAAS,CAAC,QAAA,EAAU,MAAA,EAAQ,KAAA,EAAO,SAAS,WAAW,CAAA;AAAA,MACvD,WAAA,EAAa,kBAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACX;AAAA,IACA,KAAA,EAAO;AAAA,MACL,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,OAAA,EAAS;AAAA,MACP,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,UAAA,EAAY;AAAA,MACV,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,GAAA,EAAK;AAAA,MACH,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACf;AAAA,IACA,gBAAA,EAAkB;AAAA,MAChB,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,cAAA,EAAgB;AAAA,MACd,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAgBV,IAAA;AACF,CAAC;AAQM,SAAS,iBAAiB,KAAA,EAAuB;AACtD,EAAA,OAAO,CAAA,CAAA,EAAI,KAAA,CAAM,UAAA,CAAW,GAAA,EAAK,OAAO,CAAC,CAAA,CAAA,CAAA;AAC3C;AAFgB,MAAA,CAAA,gBAAA,EAAA,kBAAA,CAAA;AAIT,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAChF,EAAA,MAAM;AAAA,IACJ,MAAA;AAAA,IAAQ,OAAA;AAAA,IAAS,UAAA,EAAY,OAAA;AAAA,IAAS,gBAAA,EAAkB,aAAA;AAAA,IAAe,cAAA,EAAgB,WAAA;AAAA,IAAa;AAAA,MAClG,GAAA,CAAI,MAAA;AAER,EAAA,MAAM,YAAA,GAAe,KAAA,IAAS,MAAA,KAAW,QAAA,GAAW,MAAA,GAAS,MAAA;AAE7D,EAAA,IAAI,KAAA,KAAU,YAAA,KAAiB,KAAA,IAAS,YAAA,KAAiB,OAAA,CAAA,EAAU;AACjE,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wCAAA,EAA2C,YAAY,CAAA,CAAE,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,CAAoB;AAAA,IACzC,kBAAA,EAAoB,IAAI,MAAA,CAAO,GAAA;AAAA,IAC/B,cAAA,EAAgB,IAAI,MAAA,CAAO;AAAA,GAC5B,CAAA;AAKD,EAAA,IAAI,eAAA,GAAkB,KAAA;AACtB,EAAA,IAAI,eAAA,GAAkB,KAAA;AACtB,EAAA,IAAI,iBAAiB,WAAA,EAAa;AAChC,IAAA,MAAM,SAAS,oBAAA,CAAqB,QAAA,EAAU,EAAE,OAAA,EAAS,MAAM,CAAA;AAC/D,IAAA,eAAA,GAAkB,MAAA,CAAO,SAAA;AACzB,IAAA,eAAA,GAAkB,MAAA,CAAO,SAAA;AACzB,IAAA,kBAAA,CAAmB,QAAA,EAAU,EAAE,OAAA,EAAS,IAAA,EAAM,CAAA;AAAA,EAChD,CAAA,MAAO;AACL,IAAA,MAAM,MAAA,GAAS,qBAAqB,QAAQ,CAAA;AAC5C,IAAA,eAAA,GAAkB,MAAA,CAAO,SAAA;AACzB,IAAA,kBAAA,CAAmB,QAAQ,CAAA;AAAA,EAC7B;AAEA,EAAA,IAAI,CAAC,QAAA,CAAS,cAAA,EAAgB,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAInF,EAAA,IAAI,CAAC,eAAA,EAAiB;AAEpB,IAAA,MAAM,SAAS,qBAAA,EAAsB;AAErC,IAAA,MAAM,SAAS,gBAAA,EAAiB;AAEhC,IAAA,IAAI,iBAAiB,WAAA,EAAa;AAChC,MAAA,oBAAA,CAAqB,QAAA,EAAU,EAAE,OAAA,EAAS,OAAA,EAAS,MAAM,CAAA;AAAA,IAC3D,CAAA,MAAO;AACL,MAAA,oBAAA,CAAqB,QAAA,EAAU,EAAE,OAAA,EAAS,CAAA;AAAA,IAC5C;AAAA,EACF;AAEA,EAAA,IAAA,CAAK,aAAA,IAAiB,WAAA,KAAgB,YAAA,KAAiB,QAAA,EAAU;AAC/D,IAAA,MAAM,YAAA,GAAe,SAAS,gBAAA,CAAiB,GAAA;AAAA,MAC7C,CAAC,GAAA,KAAQ,cAAA,CAAe,QAAA,CAAS,YAAA,CAAa,GAAG,CAAC;AAAA,KACpD;AACA,IAAA,MAAM,UAAA,GAAa,CAAA,EAAG,YAAA,CAAa,IAAA,CAAK,IAAI,CAAC;AAAA,CAAA;AAC7C,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,UAAU,CAAA;AAAA,IACjC;AACA,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,aAAA,CAAc,aAAa,UAAU,CAAA;AAAA,IACvC;AAAA,EACF;AAGA,EAAA,SAAS,oBAAA,GAAuB;AAC9B,IAAA,MAAM,cAAuC,EAAC;AAC9C,IAAA,MAAM,WAAA,GAAc,SAAS,oBAAA,EAAqB;AAClD,IAAA,KAAA,MAAW,OAAA,IAAW,SAAS,gBAAA,EAAkB;AAC/C,MAAA,MAAM,IAAA,GAAO,QAAA,CAAS,YAAA,CAAa,OAAO,CAAA;AAC1C,MAAA,MAAM,KAAA,GAAQ,YAAY,OAAO,CAAA;AACjC,MAAA,IAAI,IAAA,CAAK,WAAA,IAAe,OAAO,KAAA,KAAU,QAAA,EAAU;AACjD,QAAA,WAAA,CAAY,OAAO,CAAA,GAAI,YAAA,CAAa,KAAK,CAAA;AAAA,MAC3C,CAAA,MAAA,IAAW,IAAA,CAAK,WAAA,IAAe,KAAA,KAAU,MAAA,EAAW;AAClD,QAAA,WAAA,CAAY,OAAO,CAAA,GAAI,YAAA;AAAA,MACzB,CAAA,MAAO;AACL,QAAA,WAAA,CAAY,OAAO,CAAA,GAAI,KAAA;AAAA,MACzB;AAAA,IACF;AACA,IAAA,OAAO,WAAA;AAAA,EACT;AAfS,EAAA,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AAiBT,EAAA,IAAI,iBAAiB,QAAA,EAAU;AAC7B,IAAA,kBAAA,CAAmB,QAAQ,CAAA;AAC3B,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,IAChB;AACA,IAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAM,IAAA,CAAK,KAAA,CAAM,uBAAuB,CAAC,CAAA;AACvD,IAAA,KAAA,MAAW,OAAA,IAAW,SAAS,gBAAA,EAAkB;AAC/C,MAAA,MAAM,IAAA,GAAO,QAAA,CAAS,YAAA,CAAa,OAAO,CAAA;AAC1C,MAAA,OAAA,CAAQ,GAAA,CAAI,cAAA,CAAe,IAAI,CAAC,CAAA;AAAA,IAClC;AAAA,EACF,CAAA,MAAA,IAAW,iBAAiB,MAAA,EAAQ;AAClC,IAAA,MAAM,GAAA,GAAM,KAAA,GAAQ,oBAAA,EAAqB,GAAI,SAAS,oBAAA,EAAqB;AAC3E,IAAA,OAAA,CAAQ,IAAI,IAAA,CAAK,SAAA,CAAU,GAAA,EAAK,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,EAC1C,CAAA,MAAA,IAAW,iBAAiB,WAAA,EAAa;AACvC,IAAA,MAAM,MAAA,GAAS,UAAU,CAAA,GAAI,CAAA;AAC7B,IAAA,MAAM,UAAA,GAAa,SAAS,kBAAA,EAAmB;AAC/C,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,KAAA,MAAW,GAAA,IAAO,WAAW,MAAA,EAAQ;AACnC,QAAA,MAAM,IAAA,GAAO,UAAA,CAAW,MAAA,CAAO,GAAG,CAAA;AAClC,QAAA,IAAI,IAAA,CAAK,WAAA,IAAe,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AACtD,UAAA,IAAA,CAAK,KAAA,GAAQ,YAAA,CAAa,IAAA,CAAK,KAAK,CAAA;AAAA,QACtC,CAAA,MAAA,IAAW,IAAA,CAAK,WAAA,IAAe,IAAA,CAAK,UAAU,MAAA,EAAW;AACvD,UAAA,IAAA,CAAK,KAAA,GAAQ,YAAA;AAAA,QACf;AAAA,MACF;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,IAAI,IAAA,CAAK,SAAA,CAAU,UAAA,EAAY,IAAA,EAAM,MAAM,CAAC,CAAA;AAGpD,IAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,MAAA,YAAA,CAAa,CAAC,CAAA;AAAA,IAChB;AAAA,EACF,CAAA,MAAA,IAAW,YAAA,KAAiB,KAAA,IAAS,YAAA,KAAiB,OAAA,EAAS;AAC7D,IAAA,MAAM,WAAA,GAAc,SAAS,oBAAA,EAAqB;AAClD,IAAA,MAAM,gBAAgB,OAAA,KAAY,IAAA;AAClC,IAAA,MAAM,MAAA,GAAS,YAAA,KAAiB,OAAA,GAAU,SAAA,GAAY,EAAA;AAEtD,IAAA,KAAA,MAAW,OAAO,WAAA,EAAa;AAC7B,MAAA,MAAM,KAAA,GAAQ,YAAY,GAAG,CAAA;AAE7B,MAAA,IAAI,KAAA,KAAU,UAAa,aAAA,EAAe;AACxC,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,QAAA;AACJ,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,QAAA,GAAW,EAAA;AAAA,MACb,CAAA,MAAA,IAAW,OAAO,KAAA,KAAU,QAAA,EAAU;AACpC,QAAA,IAAI,iBAAiB,OAAA,EAAS;AAC5B,UAAA,QAAA,GAAW,iBAAiB,KAAK,CAAA;AAAA,QACnC,CAAA,MAAO;AACL,UAAA,QAAA,GAAW,CAAA,CAAA,EAAI,MAAM,UAAA,CAAW,GAAA,EAAK,KAAK,CAAA,CAAE,UAAA,CAAW,IAAA,EAAM,KAAK,CAAC,CAAA,CAAA,CAAA;AAAA,QACrE;AAAA,MACF,CAAA,MAAO;AACL,QAAA,QAAA,GAAW,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,MACjC;AACA,MAAA,OAAA,CAAQ,IAAI,CAAA,EAAG,MAAM,GAAG,GAAG,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAE,CAAA;AAAA,IAC3C;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,YAAY,CAAA,CAAE,CAAA;AAAA,EACnD;AACF,CAAA,EA7ImE,WAAA","file":"chunk-2GZ4APXU.js","sourcesContent":["import { writeFileSync } from 'node:fs';\nimport { define } from 'gunshi';\nimport { gracefulExit } from 'exit-hook';\n\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { getItemSummary } from '../../lib/formatting';\nimport { redactString } from '../../runtime/lib/redaction';\nimport {\n  checkForConfigErrors, checkForNoEnvFiles, checkForSchemaErrors, showPluginWarnings,\n} from '../helpers/error-checks';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport ansis from 'ansis';\n\nexport const commandSpec = define({\n  name: 'load',\n  description: 'Load env according to schema and resolve values',\n  args: {\n    format: {\n      type: 'enum',\n      short: 'f',\n      choices: ['pretty', 'json', 'env', 'shell', 'json-full'],\n      description: 'Format of output',\n      default: 'pretty',\n    },\n    agent: {\n      type: 'boolean',\n      description: 'Agent-safe mode: redact sensitive values (defaults to JSON format if --format is not set)',\n    },\n    compact: {\n      type: 'boolean',\n      description: 'Use compact format (for json-full: no indentation, for env/shell: skip undefined values)',\n    },\n    'show-all': {\n      type: 'boolean',\n      description: 'When load is failing, show all items rather than only failing items',\n    },\n    env: {\n      type: 'string',\n      description: 'Set the environment (e.g., production, development, etc) - will be overridden by @currentEnv in the schema if present',\n    },\n    path: {\n      type: 'string',\n      short: 'p',\n      multiple: true,\n      description: 'Path to a specific .env file or directory to use as the entry point (can be specified multiple times)',\n    },\n    'summary-stderr': {\n      type: 'boolean',\n      description: 'Also output the pretty (redacted) summary to stderr (useful alongside --format json-full to get both machine-readable output on stdout and a human-readable summary on stderr)',\n    },\n    'summary-file': {\n      type: 'string',\n      description: 'Also write the pretty (redacted) summary to a file path (useful for CI, e.g. $GITHUB_STEP_SUMMARY)',\n    },\n  },\n  examples: `\nLoads and validates environment variables according to your .env files, and prints the results.\nUseful for debugging locally, and in CI to print out a summary of env vars.\n\nExamples:\n  varlock load                    # Load and validate with pretty output\n  varlock load --format json      # Output in JSON format\n  eval \"$(varlock load --format shell)\"  # Load vars into current shell (useful with direnv)\n  varlock load --show-all         # Show all items when validation fails\n  varlock load --path .env.prod   # Load from a specific .env file\n  varlock load -p ./envs -p ./overrides  # Load from multiple directories\n  varlock load --compact          # Use compact format - skips undefined values, no indentation for json-full\n  varlock load --env production   # Load for a specific environment (⚠️ ignored if using @currentEnv!)\n  varlock load --format json-full --summary-stderr   # JSON on stdout + redacted human summary on stderr\n  varlock load --format json-full --summary-file /tmp/summary.txt   # JSON on stdout + redacted human summary written to file\n  varlock load --agent            # Agent-safe JSON output with sensitive values redacted\n`.trim(),\n});\n\n\n/**\n * Formats a string value for safe use in a shell export statement.\n * Uses single-quoted strings to prevent shell injection via backticks, `$`, etc.\n * Single quotes within the value are escaped using the `'\\''` sequence.\n */\nexport function formatShellValue(value: string): string {\n  return `'${value.replaceAll(\"'\", \"'\\\\''\")}'`;\n}\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  const {\n    format, compact, 'show-all': showAll, 'summary-stderr': summaryStderr, 'summary-file': summaryFile, agent,\n  } = ctx.values;\n  // --agent defaults to json if no explicit --format was set, but respects --format if provided\n  const outputFormat = agent && format === 'pretty' ? 'json' : format;\n\n  if (agent && (outputFormat === 'env' || outputFormat === 'shell')) {\n    throw new Error(`--agent is not compatible with --format ${outputFormat}`);\n  }\n\n  const envGraph = await loadVarlockEnvGraph({\n    currentEnvFallback: ctx.values.env,\n    entryFilePaths: ctx.values.path,\n  });\n\n  // For json-full, still run the checks so their pretty output goes to stderr,\n  // but use noThrow so we can continue to output JSON to stdout.\n  // For all other formats, exit on errors as before.\n  let hasSchemaErrors = false;\n  let hadSchemaOutput = false;\n  if (outputFormat === 'json-full') {\n    const result = checkForSchemaErrors(envGraph, { noThrow: true });\n    hasSchemaErrors = result.hasErrors;\n    hadSchemaOutput = result.hasOutput;\n    checkForNoEnvFiles(envGraph, { noThrow: true });\n  } else {\n    const result = checkForSchemaErrors(envGraph);\n    hadSchemaOutput = result.hasOutput;\n    checkForNoEnvFiles(envGraph);\n  }\n\n  if (!envGraph.rootDataSource) throw new Error('expected root data source to be set');\n\n  // Skip resolution + config checks when schema has errors — the downstream\n  // errors would just be noise caused by the parse/schema failure\n  if (!hasSchemaErrors) {\n    // Generate types before resolving values — uses only non-env-specific schema info\n    await envGraph.generateTypesIfNeeded();\n\n    await envGraph.resolveEnvValues();\n\n    if (outputFormat === 'json-full') {\n      checkForConfigErrors(envGraph, { showAll, noThrow: true });\n    } else {\n      checkForConfigErrors(envGraph, { showAll });\n    }\n  }\n\n  if ((summaryStderr || summaryFile) && outputFormat !== 'pretty') {\n    const summaryLines = envGraph.sortedConfigKeys.map(\n      (key) => getItemSummary(envGraph.configSchema[key]),\n    );\n    const summaryStr = `${summaryLines.join('\\n')}\\n`;\n    if (summaryStderr) {\n      process.stderr.write(summaryStr);\n    }\n    if (summaryFile) {\n      writeFileSync(summaryFile, summaryStr);\n    }\n  }\n\n  /** When --agent is set, return a copy of the resolved env with sensitive values redacted */\n  function getRedactedEnvObject() {\n    const redactedEnv: Record<string, unknown> = {};\n    const resolvedEnv = envGraph.getResolvedEnvObject();\n    for (const itemKey of envGraph.sortedConfigKeys) {\n      const item = envGraph.configSchema[itemKey];\n      const value = resolvedEnv[itemKey];\n      if (item.isSensitive && typeof value === 'string') {\n        redactedEnv[itemKey] = redactString(value);\n      } else if (item.isSensitive && value !== undefined) {\n        redactedEnv[itemKey] = '[REDACTED]';\n      } else {\n        redactedEnv[itemKey] = value;\n      }\n    }\n    return redactedEnv;\n  }\n\n  if (outputFormat === 'pretty') {\n    showPluginWarnings(envGraph);\n    if (hadSchemaOutput) {\n      console.error();\n    }\n    console.error(ansis.bold.green('-- Resolved config --'));\n    for (const itemKey of envGraph.sortedConfigKeys) {\n      const item = envGraph.configSchema[itemKey];\n      console.log(getItemSummary(item));\n    }\n  } else if (outputFormat === 'json') {\n    const env = agent ? getRedactedEnvObject() : envGraph.getResolvedEnvObject();\n    console.log(JSON.stringify(env, null, 2));\n  } else if (outputFormat === 'json-full') {\n    const indent = compact ? 0 : 2;\n    const serialized = envGraph.getSerializedGraph();\n    if (agent) {\n      for (const key in serialized.config) {\n        const item = serialized.config[key];\n        if (item.isSensitive && typeof item.value === 'string') {\n          item.value = redactString(item.value);\n        } else if (item.isSensitive && item.value !== undefined) {\n          item.value = '[REDACTED]';\n        }\n      }\n    }\n    console.log(JSON.stringify(serialized, null, indent));\n    // Output JSON to stdout even on failure (so consumers can parse err.stdout),\n    // but still exit non-zero so execSync callers know something is wrong\n    if (serialized.errors) {\n      gracefulExit(1);\n    }\n  } else if (outputFormat === 'env' || outputFormat === 'shell') {\n    const resolvedEnv = envGraph.getResolvedEnvObject();\n    const skipUndefined = compact === true;\n    const prefix = outputFormat === 'shell' ? 'export ' : '';\n\n    for (const key in resolvedEnv) {\n      const value = resolvedEnv[key];\n\n      if (value === undefined && skipUndefined) {\n        continue;\n      }\n\n      let strValue: string;\n      if (value === undefined) {\n        strValue = '';\n      } else if (typeof value === 'string') {\n        if (outputFormat === 'shell') {\n          strValue = formatShellValue(value);\n        } else {\n          strValue = `\"${value.replaceAll('\"', '\\\\\"').replaceAll('\\n', '\\\\n')}\"`;\n        }\n      } else {\n        strValue = JSON.stringify(value);\n      }\n      console.log(`${prefix}${key}=${strValue}`);\n    }\n  } else {\n    throw new Error(`Unknown format: ${outputFormat}`);\n  }\n};\n"]}

package/dist/{chunk-2OIOYMYO.js → chunk-66VKZYD7.js}

@@ -1,8 +1,8 @@
-import { define } from './chunk-4A54P4EM.js';
-import { checkForSchemaErrors } from './chunk-45N5EFNL.js';
-import { loadVarlockEnvGraph } from './chunk-H2JVYUHZ.js';
 import { gracefulExit } from './chunk-CHQDS2PI.js';
-import { CliExitError } from './chunk-LGEHJHB2.js';
+import { define } from './chunk-MGUGRIW2.js';
+import { checkForSchemaErrors } from './chunk-NHNQJTPB.js';
+import { loadVarlockEnvGraph } from './chunk-Q4I7MXFB.js';
+import { CliExitError } from './chunk-SX2NUZCL.js';
 import { __name } from './chunk-6PEHRAEP.js';
 
 // src/cli/commands/printenv.command.ts
@@ -66,5 +66,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 
 export { commandFn, commandSpec };
-//# sourceMappingURL=chunk-2OIOYMYO.js.map
-//# sourceMappingURL=chunk-2OIOYMYO.js.map
+//# sourceMappingURL=chunk-66VKZYD7.js.map
+//# sourceMappingURL=chunk-66VKZYD7.js.map

package/dist/{chunk-2OIOYMYO.js.map → chunk-66VKZYD7.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/printenv.command.ts"],"names":[],"mappings":";;;;;;;;AAQO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,UAAA;AAAA,EACN,WAAA,EAAa,2DAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA,EAAA,CAAA,CAeR,IAAA;AACJ,CAAC;AAEM,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAGhF,EAAA,MAAM,WAAA,GAAA,CAAe,IAAI,WAAA,IAAe,IAAI,KAAA,CAAM,GAAA,CAAI,WAAA,EAAa,MAAA,IAAU,CAAC,CAAA;AAC9E,EAAA,IAAI,CAAC,YAAY,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,aAAa,0CAAA,EAA4C;AAAA,MACjE,UAAA,EAAY;AAAA,KACb,CAAA;AAAA,EACH;AACA,EAAA,MAAM,OAAA,GAAU,YAAY,CAAC,CAAA;AAE7B,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,CAAoB;AAAA,IACzC,cAAA,EAAgB,IAAI,MAAA,CAAO;AAAA,GAC5B,CAAA;AACD,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAE7B,EAAA,IAAI,EAAE,OAAA,IAAW,QAAA,CAAS,YAAA,CAAA,EAAe;AACvC,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,UAAA,EAAa,OAAO,CAAA,qBAAA,CAAuB,CAAA;AAAA,EACpE;AAGA,EAAA,MAAM,QAAA,CAAS,oBAAoB,OAAO,CAAA;AAE1C,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,YAAA,CAAa,OAAO,CAAA;AAC1C,EAAA,IAAI,IAAA,CAAK,oBAAoB,OAAA,EAAS;AACpC,IAAA,KAAA,MAAW,GAAA,IAAO,KAAK,MAAA,EAAQ;AAC7B,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,UAAA,EAAM,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,aAAa,CAAC,CAAA;AAAA,EACvB;AAEA,EAAA,MAAM,QAAQ,IAAA,CAAK,aAAA;AACnB,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,IAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AAAA,EAChB,CAAA,MAAO;AACL,IAAA,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC3B;AACF,CAAA,EArCmE,WAAA","file":"chunk-2OIOYMYO.js","sourcesContent":["import { define } from 'gunshi';\nimport { gracefulExit } from 'exit-hook';\n\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { checkForSchemaErrors } from '../helpers/error-checks';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { CliExitError } from '../helpers/exit-error';\n\nexport const commandSpec = define({\n  name: 'printenv',\n  description: 'Print the resolved value of a single environment variable',\n  args: {\n    path: {\n      type: 'string',\n      short: 'p',\n      multiple: true,\n      description: 'Path to a specific .env file or directory (with trailing slash) to use as the entry point (can be specified multiple times)',\n    },\n  },\n  examples: `\nPrints the resolved value of a single environment variable.\nUseful within larger shell commands where you need a single env var value.\n\nExamples:\n  varlock printenv MY_VAR                    # Print the value of MY_VAR\n  varlock printenv --path .env.prod MY_VAR   # Use a specific .env file\n  varlock printenv --path ./config/ MY_VAR   # Use a specific directory\n  varlock printenv -p ./envs -p ./overrides MY_VAR  # Use multiple directories\n\n📍 Note: Use sh -c to embed this in shell commands, e.g.:\n       sh -c 'do-something --token $(varlock printenv MY_TOKEN)'\n\n💡 Tip: Unlike \\`varlock run -- echo $MY_VAR\\`, this works because the shell\n       expansion happens after varlock has printed the value.\n  `.trim(),\n});\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  // ctx.positionals includes the subcommand name(s) themselves, so we skip them\n  // by slicing off ctx.commandPath.length entries (e.g. skips 'printenv' at index 0)\n  const positionals = (ctx.positionals ?? []).slice(ctx.commandPath?.length ?? 0);\n  if (!positionals.length) {\n    throw new CliExitError('Missing required argument: variable name', {\n      suggestion: 'Run `varlock printenv MY_VAR` to print the value of MY_VAR',\n    });\n  }\n  const varName = positionals[0];\n\n  const envGraph = await loadVarlockEnvGraph({\n    entryFilePaths: ctx.values.path,\n  });\n  checkForSchemaErrors(envGraph);\n\n  if (!(varName in envGraph.configSchema)) {\n    throw new CliExitError(`Variable \"${varName}\" not found in schema`);\n  }\n\n  // Resolve only the requested item and its transitive dependencies\n  await envGraph.resolveItemWithDeps(varName);\n\n  const item = envGraph.configSchema[varName];\n  if (item.validationState === 'error') {\n    for (const err of item.errors) {\n      console.error(`🚨 ${err.message}`);\n    }\n    return gracefulExit(1);\n  }\n\n  const value = item.resolvedValue;\n  if (value === undefined || value === null) {\n    console.log('');\n  } else {\n    console.log(String(value));\n  }\n};\n"]}
+{"version":3,"sources":["../src/cli/commands/printenv.command.ts"],"names":[],"mappings":";;;;;;;;AAQO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,UAAA;AAAA,EACN,WAAA,EAAa,2DAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA,EAAA,CAAA,CAeR,IAAA;AACJ,CAAC;AAEM,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAGhF,EAAA,MAAM,WAAA,GAAA,CAAe,IAAI,WAAA,IAAe,IAAI,KAAA,CAAM,GAAA,CAAI,WAAA,EAAa,MAAA,IAAU,CAAC,CAAA;AAC9E,EAAA,IAAI,CAAC,YAAY,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,aAAa,0CAAA,EAA4C;AAAA,MACjE,UAAA,EAAY;AAAA,KACb,CAAA;AAAA,EACH;AACA,EAAA,MAAM,OAAA,GAAU,YAAY,CAAC,CAAA;AAE7B,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,CAAoB;AAAA,IACzC,cAAA,EAAgB,IAAI,MAAA,CAAO;AAAA,GAC5B,CAAA;AACD,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAE7B,EAAA,IAAI,EAAE,OAAA,IAAW,QAAA,CAAS,YAAA,CAAA,EAAe;AACvC,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,UAAA,EAAa,OAAO,CAAA,qBAAA,CAAuB,CAAA;AAAA,EACpE;AAGA,EAAA,MAAM,QAAA,CAAS,oBAAoB,OAAO,CAAA;AAE1C,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,YAAA,CAAa,OAAO,CAAA;AAC1C,EAAA,IAAI,IAAA,CAAK,oBAAoB,OAAA,EAAS;AACpC,IAAA,KAAA,MAAW,GAAA,IAAO,KAAK,MAAA,EAAQ;AAC7B,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,UAAA,EAAM,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,aAAa,CAAC,CAAA;AAAA,EACvB;AAEA,EAAA,MAAM,QAAQ,IAAA,CAAK,aAAA;AACnB,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,IAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AAAA,EAChB,CAAA,MAAO;AACL,IAAA,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EAC3B;AACF,CAAA,EArCmE,WAAA","file":"chunk-66VKZYD7.js","sourcesContent":["import { define } from 'gunshi';\nimport { gracefulExit } from 'exit-hook';\n\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { checkForSchemaErrors } from '../helpers/error-checks';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { CliExitError } from '../helpers/exit-error';\n\nexport const commandSpec = define({\n  name: 'printenv',\n  description: 'Print the resolved value of a single environment variable',\n  args: {\n    path: {\n      type: 'string',\n      short: 'p',\n      multiple: true,\n      description: 'Path to a specific .env file or directory (with trailing slash) to use as the entry point (can be specified multiple times)',\n    },\n  },\n  examples: `\nPrints the resolved value of a single environment variable.\nUseful within larger shell commands where you need a single env var value.\n\nExamples:\n  varlock printenv MY_VAR                    # Print the value of MY_VAR\n  varlock printenv --path .env.prod MY_VAR   # Use a specific .env file\n  varlock printenv --path ./config/ MY_VAR   # Use a specific directory\n  varlock printenv -p ./envs -p ./overrides MY_VAR  # Use multiple directories\n\n📍 Note: Use sh -c to embed this in shell commands, e.g.:\n       sh -c 'do-something --token $(varlock printenv MY_TOKEN)'\n\n💡 Tip: Unlike \\`varlock run -- echo $MY_VAR\\`, this works because the shell\n       expansion happens after varlock has printed the value.\n  `.trim(),\n});\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  // ctx.positionals includes the subcommand name(s) themselves, so we skip them\n  // by slicing off ctx.commandPath.length entries (e.g. skips 'printenv' at index 0)\n  const positionals = (ctx.positionals ?? []).slice(ctx.commandPath?.length ?? 0);\n  if (!positionals.length) {\n    throw new CliExitError('Missing required argument: variable name', {\n      suggestion: 'Run `varlock printenv MY_VAR` to print the value of MY_VAR',\n    });\n  }\n  const varName = positionals[0];\n\n  const envGraph = await loadVarlockEnvGraph({\n    entryFilePaths: ctx.values.path,\n  });\n  checkForSchemaErrors(envGraph);\n\n  if (!(varName in envGraph.configSchema)) {\n    throw new CliExitError(`Variable \"${varName}\" not found in schema`);\n  }\n\n  // Resolve only the requested item and its transitive dependencies\n  await envGraph.resolveItemWithDeps(varName);\n\n  const item = envGraph.configSchema[varName];\n  if (item.validationState === 'error') {\n    for (const err of item.errors) {\n      console.error(`🚨 ${err.message}`);\n    }\n    return gracefulExit(1);\n  }\n\n  const value = item.resolvedValue;\n  if (value === undefined || value === null) {\n    console.log('');\n  } else {\n    console.log(String(value));\n  }\n};\n"]}

package/dist/{chunk-BR3DT5Z5.js → chunk-7VERU3F7.js}

@@ -1,4 +1,4 @@
-import { require_semver } from './chunk-6CRDPEUT.js';
+import { require_semver } from './chunk-PBWMMYWL.js';
 import { __toESM, __name } from './chunk-6PEHRAEP.js';
 
 // src/lib/check-bun-version.ts
@@ -18,5 +18,5 @@ Bun ${MIN_BUN_VERSION} introduced the \`--no-env-file\` flag which is required t
 __name(checkBunVersion, "checkBunVersion");
 
 export { checkBunVersion };
-//# sourceMappingURL=chunk-BR3DT5Z5.js.map
-//# sourceMappingURL=chunk-BR3DT5Z5.js.map
+//# sourceMappingURL=chunk-7VERU3F7.js.map
+//# sourceMappingURL=chunk-7VERU3F7.js.map

package/dist/{chunk-BR3DT5Z5.js.map → chunk-7VERU3F7.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/lib/check-bun-version.ts"],"names":["semver"],"mappings":";;;;AAAA,IAAA,aAAA,GAAmB,OAAA,CAAA,cAAA,EAAA,EAAA,CAAA,CAAA;AAQZ,IAAM,eAAA,GAAkB,OAAA;AAMxB,SAAS,eAAA,GAAkB;AAChC,EAAA,MAAM,UAAA,GAAa,QAAQ,QAAA,CAAS,GAAA;AACpC,EAAA,IAAI,CAAC,UAAA,EAAY;AAEjB,EAAA,IAAI,CAAC,aAAA,CAAAA,OAAAA,CAAO,GAAA,CAAI,UAAA,EAAY,eAAe,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,wBAAA,EAA2B,eAAe,CAAA,wBAAA,EAA2B,UAAU,CAAA;AAAA;AAAA,IAAA,EAEtE,eAAe,CAAA,8GAAA;AAAA,KAE1B;AAAA,EACF;AACF;AAZgB,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA","file":"chunk-BR3DT5Z5.js","sourcesContent":["import semver from 'semver';\n\n/**\n * Minimum Bun version required for varlock to work correctly.\n * Bun v1.3.3 introduced the ability to disable built-in .env file loading\n * via `--no-env-file` flag or `env = false` in bunfig.toml, which is necessary\n * to prevent conflicts with varlock's own .env loading.\n */\nexport const MIN_BUN_VERSION = '1.3.3';\n\n/**\n * Checks if the current Bun version meets the minimum requirement.\n * Throws an error if running on an unsupported Bun version.\n */\nexport function checkBunVersion() {\n  const bunVersion = process.versions.bun;\n  if (!bunVersion) return;\n\n  if (!semver.gte(bunVersion, MIN_BUN_VERSION)) {\n    throw new Error(\n      `Varlock requires Bun >= ${MIN_BUN_VERSION}, but you are using Bun ${bunVersion}.\\n`\n      + 'Please upgrade Bun by running: `bun upgrade`\\n'\n      + `Bun ${MIN_BUN_VERSION} introduced the \\`--no-env-file\\` flag which is required to prevent `\n      + 'conflicts with varlock\\'s own .env loading.',\n    );\n  }\n}\n"]}
+{"version":3,"sources":["../src/lib/check-bun-version.ts"],"names":["semver"],"mappings":";;;;AAAA,IAAA,aAAA,GAAmB,OAAA,CAAA,cAAA,EAAA,EAAA,CAAA,CAAA;AAQZ,IAAM,eAAA,GAAkB,OAAA;AAMxB,SAAS,eAAA,GAAkB;AAChC,EAAA,MAAM,UAAA,GAAa,QAAQ,QAAA,CAAS,GAAA;AACpC,EAAA,IAAI,CAAC,UAAA,EAAY;AAEjB,EAAA,IAAI,CAAC,aAAA,CAAAA,OAAAA,CAAO,GAAA,CAAI,UAAA,EAAY,eAAe,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,wBAAA,EAA2B,eAAe,CAAA,wBAAA,EAA2B,UAAU,CAAA;AAAA;AAAA,IAAA,EAEtE,eAAe,CAAA,8GAAA;AAAA,KAE1B;AAAA,EACF;AACF;AAZgB,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA","file":"chunk-7VERU3F7.js","sourcesContent":["import semver from 'semver';\n\n/**\n * Minimum Bun version required for varlock to work correctly.\n * Bun v1.3.3 introduced the ability to disable built-in .env file loading\n * via `--no-env-file` flag or `env = false` in bunfig.toml, which is necessary\n * to prevent conflicts with varlock's own .env loading.\n */\nexport const MIN_BUN_VERSION = '1.3.3';\n\n/**\n * Checks if the current Bun version meets the minimum requirement.\n * Throws an error if running on an unsupported Bun version.\n */\nexport function checkBunVersion() {\n  const bunVersion = process.versions.bun;\n  if (!bunVersion) return;\n\n  if (!semver.gte(bunVersion, MIN_BUN_VERSION)) {\n    throw new Error(\n      `Varlock requires Bun >= ${MIN_BUN_VERSION}, but you are using Bun ${bunVersion}.\\n`\n      + 'Please upgrade Bun by running: `bun upgrade`\\n'\n      + `Bun ${MIN_BUN_VERSION} introduced the \\`--no-env-file\\` flag which is required to prevent `\n      + 'conflicts with varlock\\'s own .env loading.',\n    );\n  }\n}\n"]}

package/dist/{chunk-KCUEK4TX.js → chunk-A5L3SRQS.js}

@@ -1,9 +1,9 @@
-import { define } from './chunk-4A54P4EM.js';
-import { checkForSchemaErrors, checkForNoEnvFiles } from './chunk-45N5EFNL.js';
-import { loadVarlockEnvGraph } from './chunk-H2JVYUHZ.js';
 import { gracefulExit } from './chunk-CHQDS2PI.js';
-import { CliExitError } from './chunk-LGEHJHB2.js';
-import { ansis_default, select } from './chunk-6CRDPEUT.js';
+import { define } from './chunk-MGUGRIW2.js';
+import { checkForSchemaErrors, checkForNoEnvFiles } from './chunk-NHNQJTPB.js';
+import { loadVarlockEnvGraph } from './chunk-Q4I7MXFB.js';
+import { CliExitError } from './chunk-SX2NUZCL.js';
+import { ansis_default, select } from './chunk-PBWMMYWL.js';
 import { q } from './chunk-IRXBCLL2.js';
 import { redactString } from './chunk-XLYSNOR3.js';
 import { __name } from './chunk-6PEHRAEP.js';
@@ -195,5 +195,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 
 export { commandFn, commandSpec };
-//# sourceMappingURL=chunk-KCUEK4TX.js.map
-//# sourceMappingURL=chunk-KCUEK4TX.js.map
+//# sourceMappingURL=chunk-A5L3SRQS.js.map
+//# sourceMappingURL=chunk-A5L3SRQS.js.map

package/dist/{chunk-KCUEK4TX.js.map → chunk-A5L3SRQS.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/reveal.command.ts"],"names":["item"],"mappings":";;;;;;;;;;;AAaO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,QAAA;AAAA,EACN,WAAA,EAAa,mEAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACf;AAAA,IACA,GAAA,EAAK;AAAA,MACH,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CASV,IAAA;AACF,CAAC;AAED,IAAM,wBAAA,GAA2B,GAAA;AAEjC,eAAe,gBAAgB,IAAA,EAA6B;AAC1D,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,OAAO,eAAoB,CAAA;AACtD,EAAA,MAAM,WAAW,OAAA,CAAQ,QAAA;AAEzB,EAAA,IAAI,aAAa,QAAA,EAAU;AACzB,IAAA,QAAA,CAAS,QAAA,EAAU,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,EACpC,CAAA,MAAA,IAAW,aAAa,OAAA,EAAS;AAE/B,IAAA,IAAI;AACF,MAAA,QAAA,CAAS,4BAAA,EAA8B,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IACxD,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,CAAS,0BAAA,EAA4B,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IACtD;AAAA,EACF,CAAA,MAAA,IAAW,aAAa,OAAA,EAAS;AAC/B,IAAA,QAAA,CAAS,MAAA,EAAQ,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,EAClC,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,aAAa,0CAA0C,CAAA;AAAA,EACnE;AACF;AAlBe,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA;AAoBf,eAAe,cAAA,GAAgC;AAC7C,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,OAAO,eAAoB,CAAA;AACtD,EAAA,MAAM,WAAW,OAAA,CAAQ,QAAA;AAEzB,EAAA,IAAI;AACF,IAAA,IAAI,aAAa,QAAA,EAAU;AACzB,MAAA,QAAA,CAAS,QAAA,EAAU,EAAE,KAAA,EAAO,EAAA,EAAI,CAAA;AAAA,IAClC,CAAA,MAAA,IAAW,aAAa,OAAA,EAAS;AAC/B,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,4BAAA,EAA8B,EAAE,KAAA,EAAO,EAAA,EAAI,CAAA;AAAA,MACtD,CAAA,CAAA,MAAQ;AACN,QAAA,QAAA,CAAS,0BAAA,EAA4B,EAAE,KAAA,EAAO,EAAA,EAAI,CAAA;AAAA,MACpD;AAAA,IACF,CAAA,MAAA,IAAW,aAAa,OAAA,EAAS;AAC/B,MAAA,QAAA,CAAS,cAAA,EAAgB,EAAE,KAAA,EAAO,SAAA,EAAW,CAAA;AAAA,IAC/C;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAnBe,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAqBf,SAAS,cAAA,GAAiB;AACxB,EAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,aAAa,CAAA;AAClC,EAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,QAAQ,CAAA;AAC/B;AAHS,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAKT,SAAS,aAAA,GAAgB;AACvB,EAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,aAAa,CAAA;AACpC;AAFS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAKT,eAAe,eAAA,GAAmC;AAChD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,MAAM,MAAA,GAAS,QAAQ,KAAA,CAAM,KAAA;AAC7B,IAAA,IAAI,QAAQ,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,WAAW,IAAI,CAAA;AACtD,IAAA,OAAA,CAAQ,MAAM,MAAA,EAAO;AACrB,IAAA,OAAA,CAAQ,KAAA,CAAM,IAAA,CAAK,MAAA,EAAQ,CAAC,IAAA,KAAS;AACnC,MAAA,IAAI,QAAQ,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,WAAW,MAAM,CAAA;AACxD,MAAA,OAAA,CAAQ,MAAM,KAAA,EAAM;AACpB,MAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAAA,IACzB,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAXe,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA;AAaf,SAAS,qBAAqB,IAAA,EAAkB;AAC9C,EAAA,cAAA,EAAe;AAEf,EAAA,MAAM,QAAQ,IAAA,CAAK,aAAA;AACnB,EAAA,MAAM,MAAA,GAAS,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,GAAO,cAAM,IAAA,CAAK,SAAS,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA;AAE3F,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,EAAA,OAAA,CAAQ,GAAA,CAAI,cAAM,IAAA,CAAK,IAAA,CAAK,KAAK,IAAA,CAAK,GAAG,EAAE,CAAC,CAAA;AAC5C,EAAA,IAAI,KAAK,WAAA,EAAa;AACpB,IAAA,OAAA,CAAQ,IAAI,aAAA,CAAM,IAAA,CAAK,KAAK,IAAA,CAAK,WAAW,EAAE,CAAC,CAAA;AAAA,EACjD;AACA,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,CAAA;AACzB,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,EAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,IAAA,CAAK,4BAA4B,CAAC,CAAA;AACtD;AAfS,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AAiBF,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAChF,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAS,GAAI,GAAA,CAAI,MAAA;AAE/B,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,CAAoB;AAAA,IACzC,kBAAA,EAAoB,IAAI,MAAA,CAAO,GAAA;AAAA,IAC/B,cAAA,EAAgB,IAAI,MAAA,CAAO;AAAA,GAC5B,CAAA;AAED,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAC7B,EAAA,kBAAA,CAAmB,QAAQ,CAAA;AAE3B,EAAA,MAAM,SAAS,gBAAA,EAAiB;AAGhC,EAAA,MAAM,iBAAoC,EAAC;AAC3C,EAAA,KAAA,MAAW,OAAA,IAAW,SAAS,gBAAA,EAAkB;AAC/C,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,YAAA,CAAa,OAAO,CAAA;AAC1C,IAAA,IAAI,IAAA,CAAK,WAAA,IAAe,IAAA,CAAK,aAAA,KAAkB,MAAA,EAAW;AACxD,MAAA,cAAA,CAAe,KAAK,IAAI,CAAA;AAAA,IAC1B;AAAA,EACF;AAEA,EAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC/B,IAAA,OAAA,CAAQ,IAAI,sCAAsC,CAAA;AAClD,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,WAAA,GAAA,CAAe,IAAI,WAAA,IAAe,IAAI,KAAA,CAAM,GAAA,CAAI,WAAA,EAAa,MAAA,IAAU,CAAC,CAAA;AAC9E,EAAA,MAAM,YAAA,GAAe,YAAY,CAAC,CAAA;AAElC,EAAA,IAAI,YAAA,EAAc;AAEhB,IAAA,MAAM,OAAO,cAAA,CAAe,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,YAAY,CAAA;AAC9D,IAAA,IAAI,CAAC,IAAA,EAAM;AAET,MAAA,IAAI,YAAA,IAAgB,SAAS,YAAA,EAAc;AACzC,QAAA,MAAM,IAAI,YAAA,CAAa,CAAA,CAAA,EAAI,YAAY,CAAA,4BAAA,CAAA,EAAgC;AAAA,UACrE,UAAA,EAAY;AAAA,SACb,CAAA;AAAA,MACH;AACA,MAAA,MAAM,IAAI,YAAA,CAAa,CAAA,UAAA,EAAa,YAAY,CAAA,qBAAA,CAAuB,CAAA;AAAA,IACzE;AAEA,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,MAAM,eAAA,CAAgB,MAAA,CAAO,IAAA,CAAK,aAAA,IAAiB,EAAE,CAAC,CAAA;AACtD,MAAA,OAAA,CAAQ,GAAA,CAAI;AAAA,SAAA,EAAc,aAAA,CAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA,cAAA,CAAgB,CAAA;AAC9D,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,IAAA,CAAK,CAAA,+BAAA,EAAkC,2BAA2B,GAAI,CAAA;AAAA,CAAM,CAAC,CAAA;AAC/F,MAAA,UAAA,CAAW,YAAY;AACrB,QAAA,MAAM,cAAA,EAAe;AACrB,QAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,IAAA,CAAK,sBAAsB,CAAC,CAAA;AAC9C,QAAA,YAAA,EAAa;AAAA,MACf,GAAG,wBAAwB,CAAA;AAC3B,MAAA;AAAA,IACF;AAEA,IAAA,oBAAA,CAAqB,IAAI,CAAA;AACzB,IAAA,MAAM,eAAA,EAAgB;AACtB,IAAA,aAAA,EAAc;AACd,IAAA;AAAA,EACF;AAGA,EAAA,OAAO,IAAA,EAAM;AACX,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAe;AAAA,MACpC,OAAA,EAAS,CAAA,4BAAA,EAA+B,aAAA,CAAM,IAAA,CAAK,+BAA+B,CAAC,CAAA,CAAA;AAAA,MACnF,OAAA,EAAS,cAAA,CAAe,GAAA,CAAI,CAACA,KAAAA,MAAU;AAAA,QACrC,OAAOA,KAAAA,CAAK,GAAA;AAAA,QACZ,OAAOA,KAAAA,CAAK,GAAA;AAAA,QACZ,MAAM,YAAA,CAAa,MAAA,CAAOA,MAAK,aAAA,IAAiB,EAAE,CAAC,CAAA,IAAK;AAAA,OAC1D,CAAE;AAAA,KACH,CAAA;AAED,IAAA,IAAI,CAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,YAAA,EAAa;AAE5C,IAAA,MAAM,OAAO,cAAA,CAAe,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,QAAQ,CAAA;AAE1D,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,MAAM,eAAA,CAAgB,MAAA,CAAO,IAAA,CAAK,aAAA,IAAiB,EAAE,CAAC,CAAA;AACtD,MAAA,OAAA,CAAQ,GAAA,CAAI;AAAA,SAAA,EAAc,aAAA,CAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA,cAAA,CAAgB,CAAA;AAC9D,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,IAAA,CAAK,CAAA,+BAAA,EAAkC,2BAA2B,GAAI,CAAA;AAAA,CAAM,CAAC,CAAA;AAC/F,MAAA,UAAA,CAAW,YAAY;AACrB,QAAA,MAAM,cAAA,EAAe;AACrB,QAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,IAAA,CAAK,sBAAsB,CAAC,CAAA;AAC9C,QAAA,YAAA,EAAa;AAAA,MACf,GAAG,wBAAwB,CAAA;AAC3B,MAAA;AAAA,IACF;AAEA,IAAA,oBAAA,CAAqB,IAAI,CAAA;AACzB,IAAA,MAAM,eAAA,EAAgB;AACtB,IAAA,aAAA,EAAc;AAAA,EAGhB;AACF,CAAA,EA/FmE,WAAA","file":"chunk-KCUEK4TX.js","sourcesContent":["import ansis from 'ansis';\nimport { define } from 'gunshi';\nimport { isCancel } from '@clack/prompts';\nimport { gracefulExit } from 'exit-hook';\n\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { checkForSchemaErrors, checkForNoEnvFiles } from '../helpers/error-checks';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { CliExitError } from '../helpers/exit-error';\nimport { select } from '../helpers/prompts';\nimport { ConfigItem } from '../../env-graph';\nimport { redactString } from '../../runtime/lib/redaction';\n\nexport const commandSpec = define({\n  name: 'reveal',\n  description: 'Securely view decrypted values of sensitive environment variables',\n  args: {\n    copy: {\n      type: 'boolean',\n      description: 'Copy the value to clipboard instead of displaying (auto-clears after 10s)',\n    },\n    path: {\n      type: 'string',\n      short: 'p',\n      multiple: true,\n      description: 'Path to a specific .env file or directory to use as the entry point (can be specified multiple times)',\n    },\n    env: {\n      type: 'string',\n      description: 'Set the environment (e.g., production, development, etc)',\n    },\n  },\n  examples: `\nSecurely view the plaintext value of sensitive environment variables.\nValues are shown in an alternate screen buffer so they don't persist in\nterminal scrollback history.\n\nExamples:\n  varlock reveal                  # Interactive picker to select and reveal values\n  varlock reveal MY_SECRET        # Reveal a specific variable\n  varlock reveal MY_SECRET --copy # Copy value to clipboard (auto-clears after 10s)\n`.trim(),\n});\n\nconst CLIPBOARD_CLEAR_DELAY_MS = 10_000;\n\nasync function copyToClipboard(text: string): Promise<void> {\n  const { execSync } = await import('node:child_process');\n  const platform = process.platform;\n\n  if (platform === 'darwin') {\n    execSync('pbcopy', { input: text });\n  } else if (platform === 'linux') {\n    // try xclip first, then xsel\n    try {\n      execSync('xclip -selection clipboard', { input: text });\n    } catch {\n      execSync('xsel --clipboard --input', { input: text });\n    }\n  } else if (platform === 'win32') {\n    execSync('clip', { input: text });\n  } else {\n    throw new CliExitError('Clipboard not supported on this platform');\n  }\n}\n\nasync function clearClipboard(): Promise<void> {\n  const { execSync } = await import('node:child_process');\n  const platform = process.platform;\n\n  try {\n    if (platform === 'darwin') {\n      execSync('pbcopy', { input: '' });\n    } else if (platform === 'linux') {\n      try {\n        execSync('xclip -selection clipboard', { input: '' });\n      } catch {\n        execSync('xsel --clipboard --input', { input: '' });\n      }\n    } else if (platform === 'win32') {\n      execSync('echo. | clip', { shell: 'cmd.exe' });\n    }\n  } catch {\n    // best effort\n  }\n}\n\nfunction enterAltScreen() {\n  process.stdout.write('\\x1b[?1049h'); // switch to alternate screen buffer\n  process.stdout.write('\\x1b[H'); // move cursor to top-left\n}\n\nfunction exitAltScreen() {\n  process.stdout.write('\\x1b[?1049l'); // switch back to main screen buffer\n}\n\n/** Wait for a single keypress, returns the key */\nasync function waitForKeypress(): Promise<string> {\n  return new Promise((resolve) => {\n    const wasRaw = process.stdin.isRaw;\n    if (process.stdin.isTTY) process.stdin.setRawMode(true);\n    process.stdin.resume();\n    process.stdin.once('data', (data) => {\n      if (process.stdin.isTTY) process.stdin.setRawMode(wasRaw);\n      process.stdin.pause();\n      resolve(data.toString());\n    });\n  });\n}\n\nfunction displayRevealedValue(item: ConfigItem) {\n  enterAltScreen();\n\n  const value = item.resolvedValue;\n  const valStr = value === undefined || value === null ? ansis.gray('(empty)') : String(value);\n\n  console.log('');\n  console.log(ansis.bold.cyan(`  ${item.key}`));\n  if (item.description) {\n    console.log(ansis.gray(`  ${item.description}`));\n  }\n  console.log('');\n  console.log(`  ${valStr}`);\n  console.log('');\n  console.log(ansis.gray('  Press any key to hide...'));\n}\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  const { copy: copyMode } = ctx.values;\n\n  const envGraph = await loadVarlockEnvGraph({\n    currentEnvFallback: ctx.values.env,\n    entryFilePaths: ctx.values.path,\n  });\n\n  checkForSchemaErrors(envGraph);\n  checkForNoEnvFiles(envGraph);\n\n  await envGraph.resolveEnvValues();\n\n  // Collect sensitive items\n  const sensitiveItems: Array<ConfigItem> = [];\n  for (const itemKey of envGraph.sortedConfigKeys) {\n    const item = envGraph.configSchema[itemKey];\n    if (item.isSensitive && item.resolvedValue !== undefined) {\n      sensitiveItems.push(item);\n    }\n  }\n\n  if (sensitiveItems.length === 0) {\n    console.log('No sensitive values found to reveal.');\n    return;\n  }\n\n  // Check if a specific variable was requested via positional arg\n  const positionals = (ctx.positionals ?? []).slice(ctx.commandPath?.length ?? 0);\n  const requestedVar = positionals[0];\n\n  if (requestedVar) {\n    // Direct reveal of a specific variable\n    const item = sensitiveItems.find((i) => i.key === requestedVar);\n    if (!item) {\n      // Check if it exists but isn't sensitive\n      if (requestedVar in envGraph.configSchema) {\n        throw new CliExitError(`\"${requestedVar}\" is not marked as sensitive`, {\n          suggestion: 'Use `varlock printenv` for non-sensitive values.',\n        });\n      }\n      throw new CliExitError(`Variable \"${requestedVar}\" not found in schema`);\n    }\n\n    if (copyMode) {\n      await copyToClipboard(String(item.resolvedValue ?? ''));\n      console.log(`\\n  Copied ${ansis.cyan(item.key)} to clipboard.`);\n      console.log(ansis.gray(`  Clipboard will be cleared in ${CLIPBOARD_CLEAR_DELAY_MS / 1000}s.\\n`));\n      setTimeout(async () => {\n        await clearClipboard();\n        console.log(ansis.gray('  Clipboard cleared.'));\n        gracefulExit();\n      }, CLIPBOARD_CLEAR_DELAY_MS);\n      return;\n    }\n\n    displayRevealedValue(item);\n    await waitForKeypress();\n    exitAltScreen();\n    return;\n  }\n\n  // Interactive picker loop\n  while (true) {\n    const selected = await select<string>({\n      message: `Select a variable to reveal ${ansis.gray('(use arrows, enter to select)')}`,\n      options: sensitiveItems.map((item) => ({\n        value: item.key,\n        label: item.key,\n        hint: redactString(String(item.resolvedValue ?? '')) ?? undefined,\n      })),\n    });\n\n    if (isCancel(selected)) return gracefulExit();\n\n    const item = sensitiveItems.find((i) => i.key === selected)!;\n\n    if (copyMode) {\n      await copyToClipboard(String(item.resolvedValue ?? ''));\n      console.log(`\\n  Copied ${ansis.cyan(item.key)} to clipboard.`);\n      console.log(ansis.gray(`  Clipboard will be cleared in ${CLIPBOARD_CLEAR_DELAY_MS / 1000}s.\\n`));\n      setTimeout(async () => {\n        await clearClipboard();\n        console.log(ansis.gray('  Clipboard cleared.'));\n        gracefulExit();\n      }, CLIPBOARD_CLEAR_DELAY_MS);\n      return;\n    }\n\n    displayRevealedValue(item);\n    await waitForKeypress();\n    exitAltScreen();\n\n    // Loop back to the picker to reveal another value\n  }\n};\n"]}
+{"version":3,"sources":["../src/cli/commands/reveal.command.ts"],"names":["item"],"mappings":";;;;;;;;;;;AAaO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,QAAA;AAAA,EACN,WAAA,EAAa,mEAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,SAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACf;AAAA,IACA,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACf;AAAA,IACA,GAAA,EAAK;AAAA,MACH,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CASV,IAAA;AACF,CAAC;AAED,IAAM,wBAAA,GAA2B,GAAA;AAEjC,eAAe,gBAAgB,IAAA,EAA6B;AAC1D,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,OAAO,eAAoB,CAAA;AACtD,EAAA,MAAM,WAAW,OAAA,CAAQ,QAAA;AAEzB,EAAA,IAAI,aAAa,QAAA,EAAU;AACzB,IAAA,QAAA,CAAS,QAAA,EAAU,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,EACpC,CAAA,MAAA,IAAW,aAAa,OAAA,EAAS;AAE/B,IAAA,IAAI;AACF,MAAA,QAAA,CAAS,4BAAA,EAA8B,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IACxD,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,CAAS,0BAAA,EAA4B,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IACtD;AAAA,EACF,CAAA,MAAA,IAAW,aAAa,OAAA,EAAS;AAC/B,IAAA,QAAA,CAAS,MAAA,EAAQ,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,EAClC,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,aAAa,0CAA0C,CAAA;AAAA,EACnE;AACF;AAlBe,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA;AAoBf,eAAe,cAAA,GAAgC;AAC7C,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,OAAO,eAAoB,CAAA;AACtD,EAAA,MAAM,WAAW,OAAA,CAAQ,QAAA;AAEzB,EAAA,IAAI;AACF,IAAA,IAAI,aAAa,QAAA,EAAU;AACzB,MAAA,QAAA,CAAS,QAAA,EAAU,EAAE,KAAA,EAAO,EAAA,EAAI,CAAA;AAAA,IAClC,CAAA,MAAA,IAAW,aAAa,OAAA,EAAS;AAC/B,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,4BAAA,EAA8B,EAAE,KAAA,EAAO,EAAA,EAAI,CAAA;AAAA,MACtD,CAAA,CAAA,MAAQ;AACN,QAAA,QAAA,CAAS,0BAAA,EAA4B,EAAE,KAAA,EAAO,EAAA,EAAI,CAAA;AAAA,MACpD;AAAA,IACF,CAAA,MAAA,IAAW,aAAa,OAAA,EAAS;AAC/B,MAAA,QAAA,CAAS,cAAA,EAAgB,EAAE,KAAA,EAAO,SAAA,EAAW,CAAA;AAAA,IAC/C;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAnBe,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAqBf,SAAS,cAAA,GAAiB;AACxB,EAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,aAAa,CAAA;AAClC,EAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,QAAQ,CAAA;AAC/B;AAHS,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAKT,SAAS,aAAA,GAAgB;AACvB,EAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,aAAa,CAAA;AACpC;AAFS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAKT,eAAe,eAAA,GAAmC;AAChD,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,MAAM,MAAA,GAAS,QAAQ,KAAA,CAAM,KAAA;AAC7B,IAAA,IAAI,QAAQ,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,WAAW,IAAI,CAAA;AACtD,IAAA,OAAA,CAAQ,MAAM,MAAA,EAAO;AACrB,IAAA,OAAA,CAAQ,KAAA,CAAM,IAAA,CAAK,MAAA,EAAQ,CAAC,IAAA,KAAS;AACnC,MAAA,IAAI,QAAQ,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,WAAW,MAAM,CAAA;AACxD,MAAA,OAAA,CAAQ,MAAM,KAAA,EAAM;AACpB,MAAA,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAAA,IACzB,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAXe,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA;AAaf,SAAS,qBAAqB,IAAA,EAAkB;AAC9C,EAAA,cAAA,EAAe;AAEf,EAAA,MAAM,QAAQ,IAAA,CAAK,aAAA;AACnB,EAAA,MAAM,MAAA,GAAS,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,GAAO,cAAM,IAAA,CAAK,SAAS,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA;AAE3F,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,EAAA,OAAA,CAAQ,GAAA,CAAI,cAAM,IAAA,CAAK,IAAA,CAAK,KAAK,IAAA,CAAK,GAAG,EAAE,CAAC,CAAA;AAC5C,EAAA,IAAI,KAAK,WAAA,EAAa;AACpB,IAAA,OAAA,CAAQ,IAAI,aAAA,CAAM,IAAA,CAAK,KAAK,IAAA,CAAK,WAAW,EAAE,CAAC,CAAA;AAAA,EACjD;AACA,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,CAAA;AACzB,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,EAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,IAAA,CAAK,4BAA4B,CAAC,CAAA;AACtD;AAfS,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AAiBF,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAChF,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAS,GAAI,GAAA,CAAI,MAAA;AAE/B,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,CAAoB;AAAA,IACzC,kBAAA,EAAoB,IAAI,MAAA,CAAO,GAAA;AAAA,IAC/B,cAAA,EAAgB,IAAI,MAAA,CAAO;AAAA,GAC5B,CAAA;AAED,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAC7B,EAAA,kBAAA,CAAmB,QAAQ,CAAA;AAE3B,EAAA,MAAM,SAAS,gBAAA,EAAiB;AAGhC,EAAA,MAAM,iBAAoC,EAAC;AAC3C,EAAA,KAAA,MAAW,OAAA,IAAW,SAAS,gBAAA,EAAkB;AAC/C,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,YAAA,CAAa,OAAO,CAAA;AAC1C,IAAA,IAAI,IAAA,CAAK,WAAA,IAAe,IAAA,CAAK,aAAA,KAAkB,MAAA,EAAW;AACxD,MAAA,cAAA,CAAe,KAAK,IAAI,CAAA;AAAA,IAC1B;AAAA,EACF;AAEA,EAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC/B,IAAA,OAAA,CAAQ,IAAI,sCAAsC,CAAA;AAClD,IAAA;AAAA,EACF;AAGA,EAAA,MAAM,WAAA,GAAA,CAAe,IAAI,WAAA,IAAe,IAAI,KAAA,CAAM,GAAA,CAAI,WAAA,EAAa,MAAA,IAAU,CAAC,CAAA;AAC9E,EAAA,MAAM,YAAA,GAAe,YAAY,CAAC,CAAA;AAElC,EAAA,IAAI,YAAA,EAAc;AAEhB,IAAA,MAAM,OAAO,cAAA,CAAe,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,YAAY,CAAA;AAC9D,IAAA,IAAI,CAAC,IAAA,EAAM;AAET,MAAA,IAAI,YAAA,IAAgB,SAAS,YAAA,EAAc;AACzC,QAAA,MAAM,IAAI,YAAA,CAAa,CAAA,CAAA,EAAI,YAAY,CAAA,4BAAA,CAAA,EAAgC;AAAA,UACrE,UAAA,EAAY;AAAA,SACb,CAAA;AAAA,MACH;AACA,MAAA,MAAM,IAAI,YAAA,CAAa,CAAA,UAAA,EAAa,YAAY,CAAA,qBAAA,CAAuB,CAAA;AAAA,IACzE;AAEA,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,MAAM,eAAA,CAAgB,MAAA,CAAO,IAAA,CAAK,aAAA,IAAiB,EAAE,CAAC,CAAA;AACtD,MAAA,OAAA,CAAQ,GAAA,CAAI;AAAA,SAAA,EAAc,aAAA,CAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA,cAAA,CAAgB,CAAA;AAC9D,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,IAAA,CAAK,CAAA,+BAAA,EAAkC,2BAA2B,GAAI,CAAA;AAAA,CAAM,CAAC,CAAA;AAC/F,MAAA,UAAA,CAAW,YAAY;AACrB,QAAA,MAAM,cAAA,EAAe;AACrB,QAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,IAAA,CAAK,sBAAsB,CAAC,CAAA;AAC9C,QAAA,YAAA,EAAa;AAAA,MACf,GAAG,wBAAwB,CAAA;AAC3B,MAAA;AAAA,IACF;AAEA,IAAA,oBAAA,CAAqB,IAAI,CAAA;AACzB,IAAA,MAAM,eAAA,EAAgB;AACtB,IAAA,aAAA,EAAc;AACd,IAAA;AAAA,EACF;AAGA,EAAA,OAAO,IAAA,EAAM;AACX,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAe;AAAA,MACpC,OAAA,EAAS,CAAA,4BAAA,EAA+B,aAAA,CAAM,IAAA,CAAK,+BAA+B,CAAC,CAAA,CAAA;AAAA,MACnF,OAAA,EAAS,cAAA,CAAe,GAAA,CAAI,CAACA,KAAAA,MAAU;AAAA,QACrC,OAAOA,KAAAA,CAAK,GAAA;AAAA,QACZ,OAAOA,KAAAA,CAAK,GAAA;AAAA,QACZ,MAAM,YAAA,CAAa,MAAA,CAAOA,MAAK,aAAA,IAAiB,EAAE,CAAC,CAAA,IAAK;AAAA,OAC1D,CAAE;AAAA,KACH,CAAA;AAED,IAAA,IAAI,CAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,YAAA,EAAa;AAE5C,IAAA,MAAM,OAAO,cAAA,CAAe,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,QAAQ,CAAA;AAE1D,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,MAAM,eAAA,CAAgB,MAAA,CAAO,IAAA,CAAK,aAAA,IAAiB,EAAE,CAAC,CAAA;AACtD,MAAA,OAAA,CAAQ,GAAA,CAAI;AAAA,SAAA,EAAc,aAAA,CAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA,cAAA,CAAgB,CAAA;AAC9D,MAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,IAAA,CAAK,CAAA,+BAAA,EAAkC,2BAA2B,GAAI,CAAA;AAAA,CAAM,CAAC,CAAA;AAC/F,MAAA,UAAA,CAAW,YAAY;AACrB,QAAA,MAAM,cAAA,EAAe;AACrB,QAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,IAAA,CAAK,sBAAsB,CAAC,CAAA;AAC9C,QAAA,YAAA,EAAa;AAAA,MACf,GAAG,wBAAwB,CAAA;AAC3B,MAAA;AAAA,IACF;AAEA,IAAA,oBAAA,CAAqB,IAAI,CAAA;AACzB,IAAA,MAAM,eAAA,EAAgB;AACtB,IAAA,aAAA,EAAc;AAAA,EAGhB;AACF,CAAA,EA/FmE,WAAA","file":"chunk-A5L3SRQS.js","sourcesContent":["import ansis from 'ansis';\nimport { define } from 'gunshi';\nimport { isCancel } from '@clack/prompts';\nimport { gracefulExit } from 'exit-hook';\n\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { checkForSchemaErrors, checkForNoEnvFiles } from '../helpers/error-checks';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { CliExitError } from '../helpers/exit-error';\nimport { select } from '../helpers/prompts';\nimport { ConfigItem } from '../../env-graph';\nimport { redactString } from '../../runtime/lib/redaction';\n\nexport const commandSpec = define({\n  name: 'reveal',\n  description: 'Securely view decrypted values of sensitive environment variables',\n  args: {\n    copy: {\n      type: 'boolean',\n      description: 'Copy the value to clipboard instead of displaying (auto-clears after 10s)',\n    },\n    path: {\n      type: 'string',\n      short: 'p',\n      multiple: true,\n      description: 'Path to a specific .env file or directory to use as the entry point (can be specified multiple times)',\n    },\n    env: {\n      type: 'string',\n      description: 'Set the environment (e.g., production, development, etc)',\n    },\n  },\n  examples: `\nSecurely view the plaintext value of sensitive environment variables.\nValues are shown in an alternate screen buffer so they don't persist in\nterminal scrollback history.\n\nExamples:\n  varlock reveal                  # Interactive picker to select and reveal values\n  varlock reveal MY_SECRET        # Reveal a specific variable\n  varlock reveal MY_SECRET --copy # Copy value to clipboard (auto-clears after 10s)\n`.trim(),\n});\n\nconst CLIPBOARD_CLEAR_DELAY_MS = 10_000;\n\nasync function copyToClipboard(text: string): Promise<void> {\n  const { execSync } = await import('node:child_process');\n  const platform = process.platform;\n\n  if (platform === 'darwin') {\n    execSync('pbcopy', { input: text });\n  } else if (platform === 'linux') {\n    // try xclip first, then xsel\n    try {\n      execSync('xclip -selection clipboard', { input: text });\n    } catch {\n      execSync('xsel --clipboard --input', { input: text });\n    }\n  } else if (platform === 'win32') {\n    execSync('clip', { input: text });\n  } else {\n    throw new CliExitError('Clipboard not supported on this platform');\n  }\n}\n\nasync function clearClipboard(): Promise<void> {\n  const { execSync } = await import('node:child_process');\n  const platform = process.platform;\n\n  try {\n    if (platform === 'darwin') {\n      execSync('pbcopy', { input: '' });\n    } else if (platform === 'linux') {\n      try {\n        execSync('xclip -selection clipboard', { input: '' });\n      } catch {\n        execSync('xsel --clipboard --input', { input: '' });\n      }\n    } else if (platform === 'win32') {\n      execSync('echo. | clip', { shell: 'cmd.exe' });\n    }\n  } catch {\n    // best effort\n  }\n}\n\nfunction enterAltScreen() {\n  process.stdout.write('\\x1b[?1049h'); // switch to alternate screen buffer\n  process.stdout.write('\\x1b[H'); // move cursor to top-left\n}\n\nfunction exitAltScreen() {\n  process.stdout.write('\\x1b[?1049l'); // switch back to main screen buffer\n}\n\n/** Wait for a single keypress, returns the key */\nasync function waitForKeypress(): Promise<string> {\n  return new Promise((resolve) => {\n    const wasRaw = process.stdin.isRaw;\n    if (process.stdin.isTTY) process.stdin.setRawMode(true);\n    process.stdin.resume();\n    process.stdin.once('data', (data) => {\n      if (process.stdin.isTTY) process.stdin.setRawMode(wasRaw);\n      process.stdin.pause();\n      resolve(data.toString());\n    });\n  });\n}\n\nfunction displayRevealedValue(item: ConfigItem) {\n  enterAltScreen();\n\n  const value = item.resolvedValue;\n  const valStr = value === undefined || value === null ? ansis.gray('(empty)') : String(value);\n\n  console.log('');\n  console.log(ansis.bold.cyan(`  ${item.key}`));\n  if (item.description) {\n    console.log(ansis.gray(`  ${item.description}`));\n  }\n  console.log('');\n  console.log(`  ${valStr}`);\n  console.log('');\n  console.log(ansis.gray('  Press any key to hide...'));\n}\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  const { copy: copyMode } = ctx.values;\n\n  const envGraph = await loadVarlockEnvGraph({\n    currentEnvFallback: ctx.values.env,\n    entryFilePaths: ctx.values.path,\n  });\n\n  checkForSchemaErrors(envGraph);\n  checkForNoEnvFiles(envGraph);\n\n  await envGraph.resolveEnvValues();\n\n  // Collect sensitive items\n  const sensitiveItems: Array<ConfigItem> = [];\n  for (const itemKey of envGraph.sortedConfigKeys) {\n    const item = envGraph.configSchema[itemKey];\n    if (item.isSensitive && item.resolvedValue !== undefined) {\n      sensitiveItems.push(item);\n    }\n  }\n\n  if (sensitiveItems.length === 0) {\n    console.log('No sensitive values found to reveal.');\n    return;\n  }\n\n  // Check if a specific variable was requested via positional arg\n  const positionals = (ctx.positionals ?? []).slice(ctx.commandPath?.length ?? 0);\n  const requestedVar = positionals[0];\n\n  if (requestedVar) {\n    // Direct reveal of a specific variable\n    const item = sensitiveItems.find((i) => i.key === requestedVar);\n    if (!item) {\n      // Check if it exists but isn't sensitive\n      if (requestedVar in envGraph.configSchema) {\n        throw new CliExitError(`\"${requestedVar}\" is not marked as sensitive`, {\n          suggestion: 'Use `varlock printenv` for non-sensitive values.',\n        });\n      }\n      throw new CliExitError(`Variable \"${requestedVar}\" not found in schema`);\n    }\n\n    if (copyMode) {\n      await copyToClipboard(String(item.resolvedValue ?? ''));\n      console.log(`\\n  Copied ${ansis.cyan(item.key)} to clipboard.`);\n      console.log(ansis.gray(`  Clipboard will be cleared in ${CLIPBOARD_CLEAR_DELAY_MS / 1000}s.\\n`));\n      setTimeout(async () => {\n        await clearClipboard();\n        console.log(ansis.gray('  Clipboard cleared.'));\n        gracefulExit();\n      }, CLIPBOARD_CLEAR_DELAY_MS);\n      return;\n    }\n\n    displayRevealedValue(item);\n    await waitForKeypress();\n    exitAltScreen();\n    return;\n  }\n\n  // Interactive picker loop\n  while (true) {\n    const selected = await select<string>({\n      message: `Select a variable to reveal ${ansis.gray('(use arrows, enter to select)')}`,\n      options: sensitiveItems.map((item) => ({\n        value: item.key,\n        label: item.key,\n        hint: redactString(String(item.resolvedValue ?? '')) ?? undefined,\n      })),\n    });\n\n    if (isCancel(selected)) return gracefulExit();\n\n    const item = sensitiveItems.find((i) => i.key === selected)!;\n\n    if (copyMode) {\n      await copyToClipboard(String(item.resolvedValue ?? ''));\n      console.log(`\\n  Copied ${ansis.cyan(item.key)} to clipboard.`);\n      console.log(ansis.gray(`  Clipboard will be cleared in ${CLIPBOARD_CLEAR_DELAY_MS / 1000}s.\\n`));\n      setTimeout(async () => {\n        await clearClipboard();\n        console.log(ansis.gray('  Clipboard cleared.'));\n        gracefulExit();\n      }, CLIPBOARD_CLEAR_DELAY_MS);\n      return;\n    }\n\n    displayRevealedValue(item);\n    await waitForKeypress();\n    exitAltScreen();\n\n    // Loop back to the picker to reveal another value\n  }\n};\n"]}

package/dist/{chunk-5DUWGI2N.js → chunk-DIPEXEIL.js}

@@ -1,4 +1,4 @@
-import { debug, varlockSettings, scanForLeaks, redactSensitiveConfig } from './chunk-MGWUDHT5.js';
+import { debug, varlockSettings, scanForLeaks, redactSensitiveConfig } from './chunk-UUJK65RS.js';
 import { __name } from './chunk-6PEHRAEP.js';
 import zlib from 'zlib';
 import { ServerResponse } from 'http';
@@ -88,5 +88,5 @@ function patchGlobalServerResponse(opts) {
 __name(patchGlobalServerResponse, "patchGlobalServerResponse");
 
 export { patchGlobalServerResponse };
-//# sourceMappingURL=chunk-5DUWGI2N.js.map
-//# sourceMappingURL=chunk-5DUWGI2N.js.map
+//# sourceMappingURL=chunk-DIPEXEIL.js.map
+//# sourceMappingURL=chunk-DIPEXEIL.js.map

package/dist/{chunk-5DUWGI2N.js.map → chunk-DIPEXEIL.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/runtime/patch-server-response.ts"],"names":[],"mappings":";;;;;AAUA,IAAM,UAAA,GAAa,mBAAA;AACZ,SAAS,0BAA0B,IAAA,EAGvC;AACD,EAAA,KAAA,CAAM,6CAAmC,CAAA;AACzC,EAAA,IAAI,MAAA,CAAO,wBAAA,CAAyB,cAAA,CAAe,SAAA,EAAW,UAAU,CAAA,EAAG;AACzE,IAAA,KAAA,CAAM,mBAAmB,CAAA;AACzB,IAAA;AAAA,EACF;AACA,EAAA,IAAI,eAAA,CAAgB,iBAAiB,KAAA,EAAO;AAC1C,IAAA,KAAA,CAAM,wBAAwB,CAAA;AAC9B,IAAA;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,eAAe,cAAA,CAAe,SAAA,EAAW,YAAY,EAAE,KAAA,EAAO,MAAM,CAAA;AAE3E,EAAA,MAAM,mBAAA,GAAsB,eAAe,SAAA,CAAU,KAAA;AAGrD,EAAA,cAAA,CAAe,SAAA,CAAU,KAAA,mBAAQ,MAAA,CAAA,SAAS,iCAAA,CAAA,GAAqC,IAAA,EAAM;AAGnF,IAAA,MAAM,QAAA,GAAW,KAAK,CAAC,CAAA;AAKvB,IAAA,MAAM,cAAc,IAAA,CAAK,SAAA,CAAU,cAAc,CAAA,EAAG,UAAS,IAAK,EAAA;AAElE,IAAA,IAAI,OAAA,GACF,WAAA,CAAY,UAAA,CAAW,OAAO,CAAA,IAC3B,WAAA,CAAY,UAAA,CAAW,kBAAkB,CAAA,IACxC,CAAC,WAAA,IAAe,OAAO,QAAA,KAAa,QAAA;AAI1C,IAAA,MAAM,MAAA,GAAU,KAAa,GAAA,CAAI,GAAA;AAEjC,IAAA,IAAI,OAAA,IAAW,MAAA,IAAU,IAAA,EAAM,iBAAA,EAAmB,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAC,CAAA,EAAG;AACzF,MAAA,OAAA,GAAU,KAAA;AAAA,IACZ;AAIA,IAAA,IAAI,CAAC,OAAA,EAAS;AAEZ,MAAA,OAAO,mBAAA,CAAoB,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAAA,IAC7C;AAGA,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,SAAA,CAAU,kBAAkB,CAAA;AACzD,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,SAAA,GAAkD,IAAA;AACtD,IAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAChC,MAAA,SAAA,GAAY,QAAA;AACZ,MAAA,QAAA,GAAW,QAAA;AAAA,IACb,CAAA,MAAA,IAAW,CAAC,eAAA,EAAiB;AAC3B,MAAA,SAAA,GAAY,SAAA;AACZ,MAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,MAAA,QAAA,GAAW,OAAA,CAAQ,OAAO,QAAQ,CAAA;AAAA,IACpC,CAAA,MAAA,IAAW,oBAAoB,MAAA,EAAQ;AACrC,MAAA,SAAA,GAAY,MAAA;AAEZ,MAAA,IAAI,CAAE,KAAa,WAAA,EAAa;AAE9B,QAAC,IAAA,CAAa,WAAA,GAAc,CAAC,QAAQ,CAAA;AAAA,MACvC,CAAA,MAAO;AAEL,QAAC,IAAA,CAAa,WAAA,EAAa,IAAA,CAAK,QAAQ,CAAA;AACxC,QAAA,IAAI;AACF,UAAA,MAAM,aAAA,GAAgB,KAAK,SAAA,CAAU,MAAA,CAAO,OAAQ,IAAA,CAAa,WAAA,IAAe,EAAE,CAAA,EAAG;AAAA,YACnF,KAAA,EAAO,KAAK,SAAA,CAAU,YAAA;AAAA,YACtB,WAAA,EAAa,KAAK,SAAA,CAAU;AAAA,WAC7B,CAAA;AACD,UAAA,MAAM,gBAAA,GAAmB,aAAA,CAAc,QAAA,CAAS,OAAO,CAAA;AACvD,UAAA,QAAA,GAAW,gBAAA,CAAiB,SAAA,CAAW,IAAA,CAAa,kBAAA,IAAsB,CAAC,CAAA;AAC3E,UAAC,IAAA,CAAa,qBAAqB,gBAAA,CAAiB,MAAA;AAAA,QACtD,SAAS,GAAA,EAAK;AAAA,QAEd;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,QAAA,EAAU;AAIZ,MAAA,IAAI;AACF,QAAA,YAAA,CAAa,QAAA,EAAU,EAAE,MAAA,EAAQ,8BAAA,EAAgC,MAAO,IAAA,CAAa,GAAA,CAAI,KAAK,CAAA;AAAA,MAChG,SAAS,GAAA,EAAK;AAGZ,QAAA,IAAI,MAAM,oBAAA,EAAsB;AAC9B,UAAA,QAAA,GAAW,sBAAsB,QAAQ,CAAA;AACzC,UAAA,IAAI,cAAc,QAAA,EAAU;AAC1B,YAAA,IAAA,CAAK,CAAC,CAAA,GAAI,QAAA;AAAA,UACZ,CAAA,MAAA,IAAW,cAAc,SAAA,EAAW;AAClC,YAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,YAAA,IAAA,CAAK,CAAC,CAAA,GAAI,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA;AAAA,UACnC,CAAA,MAAA,IAAW,cAAc,MAAA,EAAQ,CAQjC,MAAO;AACL,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qCAAA,EAAwC,SAAS,CAAA,CAAE,CAAA;AAAA,UACrE;AAAA,QACF,CAAA,MAAO;AACL,UAAA,MAAM,GAAA;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,IAAA,OAAO,mBAAA,CAAoB,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EAC7C,CAAA,EAnGiC,mCAAA,CAAA;AAsGjC,EAAA,MAAM,iBAAA,GAAoB,eAAe,SAAA,CAAU,GAAA;AAEnD,EAAA,cAAA,CAAe,SAAA,CAAU,GAAA,mBAAM,MAAA,CAAA,SAAS,wBAAA,CAAA,GAA4B,IAAA,EAAM;AAExE,IAAA,MAAM,QAAA,GAAW,KAAK,CAAC,CAAA;AAEvB,IAAA,IAAI,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAE5C,MAAA,YAAA,CAAa,QAAA,EAAU,EAAE,MAAA,EAAQ,4BAAA,EAA8B,CAAA;AAAA,IACjE;AAEA,IAAA,OAAO,iBAAA,CAAkB,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EAC3C,CAAA,EAV+B,0BAAA,CAAA;AAWjC;AAtIgB,MAAA,CAAA,yBAAA,EAAA,2BAAA,CAAA","file":"chunk-5DUWGI2N.js","sourcesContent":["/*\n  This patches the global ServerResponse object to scan for secret leaks - currently used for next.js and remix\n*/\n\nimport zlib from 'node:zlib';\nimport { ServerResponse } from 'node:http';\nimport { redactSensitiveConfig, scanForLeaks, varlockSettings } from './env';\nimport { debug } from './lib/debug';\n\n// NOTE - previously was using a symbol but got weird because of multiple builds and contexts...\nconst patchedKey = '_patchedByVarlock';\nexport function patchGlobalServerResponse(opts?: {\n  ignoreUrlPatterns?: Array<RegExp>,\n  redactInsteadOfThrow?: boolean,\n}) {\n  debug('⚡️ PATCHING global ServerResponse');\n  if (Object.getOwnPropertyDescriptor(ServerResponse.prototype, patchedKey)) {\n    debug('> already patched');\n    return;\n  }\n  if (varlockSettings.preventLeaks === false) {\n    debug('> disabled by settings');\n    return;\n  }\n\n  Object.defineProperty(ServerResponse.prototype, patchedKey, { value: true });\n\n  const serverResponseWrite = ServerResponse.prototype.write;\n\n  // @ts-ignore\n  ServerResponse.prototype.write = function varlockPatchedServerResponseWrite(...args) {\n    // TODO: do we want to filter out some requests here? maybe based on the file type?\n\n    const rawChunk = args[0];\n    // console.log('⚡️ patched ServerResponse.write', rawChunk);\n\n    // for now, we only scan rendered html... may need to change this though for server components?\n    // so we bail if it looks like this response does not contain html\n    const contentType = this.getHeader('content-type')?.toString() || '';\n    // console.log('patched ServerResponse.write', contentType);\n    let runScan = (\n      contentType.startsWith('text/')\n      || contentType.startsWith('application/json')\n      || (!contentType && typeof rawChunk === 'string')\n      // || contentType.startsWith('application/javascript')\n    );\n\n    const reqUrl = (this as any).req.url;\n    // console.log('> scan ServerResponse.write', contentType, reqUrl);\n    if (runScan && reqUrl && opts?.ignoreUrlPatterns?.some((pattern) => pattern.test(reqUrl))) {\n      runScan = false;\n    }\n\n    // we want to run the scanner on text/html and text/x-component (server actions)\n    // TODO: anything else?\n    if (!runScan) {\n      // @ts-ignore\n      return serverResponseWrite.apply(this, args);\n    }\n\n    // have to deal with compressed data, which is awkward but possible\n    const compressionType = this.getHeader('Content-Encoding');\n    let chunkStr;\n    let chunkType: 'string' | 'encoded' | 'gzip' | null = null;\n    if (typeof rawChunk === 'string') {\n      chunkType = 'string';\n      chunkStr = rawChunk;\n    } else if (!compressionType) {\n      chunkType = 'encoded';\n      const decoder = new TextDecoder();\n      chunkStr = decoder.decode(rawChunk);\n    } else if (compressionType === 'gzip') {\n      chunkType = 'gzip';\n      // first chunk of data contains only compression headers\n      if (!(this as any)._zlibChunks) {\n        // (this as any)._zlibHeadersChunk = rawChunk;\n        (this as any)._zlibChunks = [rawChunk];\n      } else {\n        // TODO: figure out how we can unzip one chunk at a time instead of storing everything\n        (this as any)._zlibChunks?.push(rawChunk);\n        try {\n          const unzippedChunk = zlib.unzipSync(Buffer.concat((this as any)._zlibChunks || []), {\n            flush: zlib.constants.Z_SYNC_FLUSH,\n            finishFlush: zlib.constants.Z_SYNC_FLUSH,\n          });\n          const fullUnzippedData = unzippedChunk.toString('utf-8');\n          chunkStr = fullUnzippedData.substring((this as any)._lastChunkEndIndex || 0);\n          (this as any)._lastChunkEndIndex = fullUnzippedData.length;\n        } catch (err) {\n          // console.log('error unzipping chunk', err);\n        }\n      }\n    }\n    // TODO: we may want to support other compression schemes? but currently only used in nextjs which is using gzip\n    if (chunkStr) {\n      // console.log('scanning!', chunkStr.substring(0, 1000));\n\n\n      try {\n        scanForLeaks(chunkStr, { method: 'patched ServerResponse.write', file: (this as any).req.url });\n      } catch (err) {\n        // console.log('found secret in chunk', chunkType, chunkStr);\n        // console.log(this)\n        if (opts?.redactInsteadOfThrow) {\n          chunkStr = redactSensitiveConfig(chunkStr);\n          if (chunkType === 'string') {\n            args[0] = chunkStr;\n          } else if (chunkType === 'encoded') {\n            const encoder = new TextEncoder();\n            args[0] = encoder.encode(chunkStr);\n          } else if (chunkType === 'gzip') {\n            // currently unable to scrub gzip chunks\n            // this works sometimes, but othertimes causes decoding error\n            // we'll need to pass through chunks from a new gzip stream, because we don't have access to the underlying one\n            // args[0] = zlib.gzipSync(chunkStr, {\n            //   flush: zlib.constants.Z_SYNC_FLUSH,\n            //   finishFlush: zlib.constants.Z_SYNC_FLUSH,\n            // });\n          } else {\n            throw new Error(`unable to scrub - unknown chunk type ${chunkType}`);\n          }\n        } else {\n          throw err;\n        }\n      }\n    }\n\n    // @ts-ignore\n    return serverResponseWrite.apply(this, args);\n  };\n\n  // calling `res.json()` in the api routes on pages router calls `res.end` without called `res.write`\n  const serverResponseEnd = ServerResponse.prototype.end;\n  // @ts-ignore\n  ServerResponse.prototype.end = function patchedServerResponseEnd(...args) {\n    // console.log('⚡️ patched ServerResponse.end');\n    const endChunk = args[0];\n    // this just needs to work (so far) for nextjs sending json bodies, so does not need to handle all cases...\n    if (endChunk && typeof endChunk === 'string') {\n      // TODO: currently this throws the error and then things just hang... do we want to try to return an error type response instead?\n      scanForLeaks(endChunk, { method: 'patched ServerResponse.end' });\n    }\n    // @ts-ignore\n    return serverResponseEnd.apply(this, args);\n  };\n}\n\n"]}
+{"version":3,"sources":["../src/runtime/patch-server-response.ts"],"names":[],"mappings":";;;;;AAUA,IAAM,UAAA,GAAa,mBAAA;AACZ,SAAS,0BAA0B,IAAA,EAGvC;AACD,EAAA,KAAA,CAAM,6CAAmC,CAAA;AACzC,EAAA,IAAI,MAAA,CAAO,wBAAA,CAAyB,cAAA,CAAe,SAAA,EAAW,UAAU,CAAA,EAAG;AACzE,IAAA,KAAA,CAAM,mBAAmB,CAAA;AACzB,IAAA;AAAA,EACF;AACA,EAAA,IAAI,eAAA,CAAgB,iBAAiB,KAAA,EAAO;AAC1C,IAAA,KAAA,CAAM,wBAAwB,CAAA;AAC9B,IAAA;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,eAAe,cAAA,CAAe,SAAA,EAAW,YAAY,EAAE,KAAA,EAAO,MAAM,CAAA;AAE3E,EAAA,MAAM,mBAAA,GAAsB,eAAe,SAAA,CAAU,KAAA;AAGrD,EAAA,cAAA,CAAe,SAAA,CAAU,KAAA,mBAAQ,MAAA,CAAA,SAAS,iCAAA,CAAA,GAAqC,IAAA,EAAM;AAGnF,IAAA,MAAM,QAAA,GAAW,KAAK,CAAC,CAAA;AAKvB,IAAA,MAAM,cAAc,IAAA,CAAK,SAAA,CAAU,cAAc,CAAA,EAAG,UAAS,IAAK,EAAA;AAElE,IAAA,IAAI,OAAA,GACF,WAAA,CAAY,UAAA,CAAW,OAAO,CAAA,IAC3B,WAAA,CAAY,UAAA,CAAW,kBAAkB,CAAA,IACxC,CAAC,WAAA,IAAe,OAAO,QAAA,KAAa,QAAA;AAI1C,IAAA,MAAM,MAAA,GAAU,KAAa,GAAA,CAAI,GAAA;AAEjC,IAAA,IAAI,OAAA,IAAW,MAAA,IAAU,IAAA,EAAM,iBAAA,EAAmB,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAC,CAAA,EAAG;AACzF,MAAA,OAAA,GAAU,KAAA;AAAA,IACZ;AAIA,IAAA,IAAI,CAAC,OAAA,EAAS;AAEZ,MAAA,OAAO,mBAAA,CAAoB,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAAA,IAC7C;AAGA,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,SAAA,CAAU,kBAAkB,CAAA;AACzD,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,SAAA,GAAkD,IAAA;AACtD,IAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAChC,MAAA,SAAA,GAAY,QAAA;AACZ,MAAA,QAAA,GAAW,QAAA;AAAA,IACb,CAAA,MAAA,IAAW,CAAC,eAAA,EAAiB;AAC3B,MAAA,SAAA,GAAY,SAAA;AACZ,MAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,MAAA,QAAA,GAAW,OAAA,CAAQ,OAAO,QAAQ,CAAA;AAAA,IACpC,CAAA,MAAA,IAAW,oBAAoB,MAAA,EAAQ;AACrC,MAAA,SAAA,GAAY,MAAA;AAEZ,MAAA,IAAI,CAAE,KAAa,WAAA,EAAa;AAE9B,QAAC,IAAA,CAAa,WAAA,GAAc,CAAC,QAAQ,CAAA;AAAA,MACvC,CAAA,MAAO;AAEL,QAAC,IAAA,CAAa,WAAA,EAAa,IAAA,CAAK,QAAQ,CAAA;AACxC,QAAA,IAAI;AACF,UAAA,MAAM,aAAA,GAAgB,KAAK,SAAA,CAAU,MAAA,CAAO,OAAQ,IAAA,CAAa,WAAA,IAAe,EAAE,CAAA,EAAG;AAAA,YACnF,KAAA,EAAO,KAAK,SAAA,CAAU,YAAA;AAAA,YACtB,WAAA,EAAa,KAAK,SAAA,CAAU;AAAA,WAC7B,CAAA;AACD,UAAA,MAAM,gBAAA,GAAmB,aAAA,CAAc,QAAA,CAAS,OAAO,CAAA;AACvD,UAAA,QAAA,GAAW,gBAAA,CAAiB,SAAA,CAAW,IAAA,CAAa,kBAAA,IAAsB,CAAC,CAAA;AAC3E,UAAC,IAAA,CAAa,qBAAqB,gBAAA,CAAiB,MAAA;AAAA,QACtD,SAAS,GAAA,EAAK;AAAA,QAEd;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,QAAA,EAAU;AAIZ,MAAA,IAAI;AACF,QAAA,YAAA,CAAa,QAAA,EAAU,EAAE,MAAA,EAAQ,8BAAA,EAAgC,MAAO,IAAA,CAAa,GAAA,CAAI,KAAK,CAAA;AAAA,MAChG,SAAS,GAAA,EAAK;AAGZ,QAAA,IAAI,MAAM,oBAAA,EAAsB;AAC9B,UAAA,QAAA,GAAW,sBAAsB,QAAQ,CAAA;AACzC,UAAA,IAAI,cAAc,QAAA,EAAU;AAC1B,YAAA,IAAA,CAAK,CAAC,CAAA,GAAI,QAAA;AAAA,UACZ,CAAA,MAAA,IAAW,cAAc,SAAA,EAAW;AAClC,YAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,YAAA,IAAA,CAAK,CAAC,CAAA,GAAI,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA;AAAA,UACnC,CAAA,MAAA,IAAW,cAAc,MAAA,EAAQ,CAQjC,MAAO;AACL,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qCAAA,EAAwC,SAAS,CAAA,CAAE,CAAA;AAAA,UACrE;AAAA,QACF,CAAA,MAAO;AACL,UAAA,MAAM,GAAA;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,IAAA,OAAO,mBAAA,CAAoB,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EAC7C,CAAA,EAnGiC,mCAAA,CAAA;AAsGjC,EAAA,MAAM,iBAAA,GAAoB,eAAe,SAAA,CAAU,GAAA;AAEnD,EAAA,cAAA,CAAe,SAAA,CAAU,GAAA,mBAAM,MAAA,CAAA,SAAS,wBAAA,CAAA,GAA4B,IAAA,EAAM;AAExE,IAAA,MAAM,QAAA,GAAW,KAAK,CAAC,CAAA;AAEvB,IAAA,IAAI,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAE5C,MAAA,YAAA,CAAa,QAAA,EAAU,EAAE,MAAA,EAAQ,4BAAA,EAA8B,CAAA;AAAA,IACjE;AAEA,IAAA,OAAO,iBAAA,CAAkB,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EAC3C,CAAA,EAV+B,0BAAA,CAAA;AAWjC;AAtIgB,MAAA,CAAA,yBAAA,EAAA,2BAAA,CAAA","file":"chunk-DIPEXEIL.js","sourcesContent":["/*\n  This patches the global ServerResponse object to scan for secret leaks - currently used for next.js and remix\n*/\n\nimport zlib from 'node:zlib';\nimport { ServerResponse } from 'node:http';\nimport { redactSensitiveConfig, scanForLeaks, varlockSettings } from './env';\nimport { debug } from './lib/debug';\n\n// NOTE - previously was using a symbol but got weird because of multiple builds and contexts...\nconst patchedKey = '_patchedByVarlock';\nexport function patchGlobalServerResponse(opts?: {\n  ignoreUrlPatterns?: Array<RegExp>,\n  redactInsteadOfThrow?: boolean,\n}) {\n  debug('⚡️ PATCHING global ServerResponse');\n  if (Object.getOwnPropertyDescriptor(ServerResponse.prototype, patchedKey)) {\n    debug('> already patched');\n    return;\n  }\n  if (varlockSettings.preventLeaks === false) {\n    debug('> disabled by settings');\n    return;\n  }\n\n  Object.defineProperty(ServerResponse.prototype, patchedKey, { value: true });\n\n  const serverResponseWrite = ServerResponse.prototype.write;\n\n  // @ts-ignore\n  ServerResponse.prototype.write = function varlockPatchedServerResponseWrite(...args) {\n    // TODO: do we want to filter out some requests here? maybe based on the file type?\n\n    const rawChunk = args[0];\n    // console.log('⚡️ patched ServerResponse.write', rawChunk);\n\n    // for now, we only scan rendered html... may need to change this though for server components?\n    // so we bail if it looks like this response does not contain html\n    const contentType = this.getHeader('content-type')?.toString() || '';\n    // console.log('patched ServerResponse.write', contentType);\n    let runScan = (\n      contentType.startsWith('text/')\n      || contentType.startsWith('application/json')\n      || (!contentType && typeof rawChunk === 'string')\n      // || contentType.startsWith('application/javascript')\n    );\n\n    const reqUrl = (this as any).req.url;\n    // console.log('> scan ServerResponse.write', contentType, reqUrl);\n    if (runScan && reqUrl && opts?.ignoreUrlPatterns?.some((pattern) => pattern.test(reqUrl))) {\n      runScan = false;\n    }\n\n    // we want to run the scanner on text/html and text/x-component (server actions)\n    // TODO: anything else?\n    if (!runScan) {\n      // @ts-ignore\n      return serverResponseWrite.apply(this, args);\n    }\n\n    // have to deal with compressed data, which is awkward but possible\n    const compressionType = this.getHeader('Content-Encoding');\n    let chunkStr;\n    let chunkType: 'string' | 'encoded' | 'gzip' | null = null;\n    if (typeof rawChunk === 'string') {\n      chunkType = 'string';\n      chunkStr = rawChunk;\n    } else if (!compressionType) {\n      chunkType = 'encoded';\n      const decoder = new TextDecoder();\n      chunkStr = decoder.decode(rawChunk);\n    } else if (compressionType === 'gzip') {\n      chunkType = 'gzip';\n      // first chunk of data contains only compression headers\n      if (!(this as any)._zlibChunks) {\n        // (this as any)._zlibHeadersChunk = rawChunk;\n        (this as any)._zlibChunks = [rawChunk];\n      } else {\n        // TODO: figure out how we can unzip one chunk at a time instead of storing everything\n        (this as any)._zlibChunks?.push(rawChunk);\n        try {\n          const unzippedChunk = zlib.unzipSync(Buffer.concat((this as any)._zlibChunks || []), {\n            flush: zlib.constants.Z_SYNC_FLUSH,\n            finishFlush: zlib.constants.Z_SYNC_FLUSH,\n          });\n          const fullUnzippedData = unzippedChunk.toString('utf-8');\n          chunkStr = fullUnzippedData.substring((this as any)._lastChunkEndIndex || 0);\n          (this as any)._lastChunkEndIndex = fullUnzippedData.length;\n        } catch (err) {\n          // console.log('error unzipping chunk', err);\n        }\n      }\n    }\n    // TODO: we may want to support other compression schemes? but currently only used in nextjs which is using gzip\n    if (chunkStr) {\n      // console.log('scanning!', chunkStr.substring(0, 1000));\n\n\n      try {\n        scanForLeaks(chunkStr, { method: 'patched ServerResponse.write', file: (this as any).req.url });\n      } catch (err) {\n        // console.log('found secret in chunk', chunkType, chunkStr);\n        // console.log(this)\n        if (opts?.redactInsteadOfThrow) {\n          chunkStr = redactSensitiveConfig(chunkStr);\n          if (chunkType === 'string') {\n            args[0] = chunkStr;\n          } else if (chunkType === 'encoded') {\n            const encoder = new TextEncoder();\n            args[0] = encoder.encode(chunkStr);\n          } else if (chunkType === 'gzip') {\n            // currently unable to scrub gzip chunks\n            // this works sometimes, but othertimes causes decoding error\n            // we'll need to pass through chunks from a new gzip stream, because we don't have access to the underlying one\n            // args[0] = zlib.gzipSync(chunkStr, {\n            //   flush: zlib.constants.Z_SYNC_FLUSH,\n            //   finishFlush: zlib.constants.Z_SYNC_FLUSH,\n            // });\n          } else {\n            throw new Error(`unable to scrub - unknown chunk type ${chunkType}`);\n          }\n        } else {\n          throw err;\n        }\n      }\n    }\n\n    // @ts-ignore\n    return serverResponseWrite.apply(this, args);\n  };\n\n  // calling `res.json()` in the api routes on pages router calls `res.end` without called `res.write`\n  const serverResponseEnd = ServerResponse.prototype.end;\n  // @ts-ignore\n  ServerResponse.prototype.end = function patchedServerResponseEnd(...args) {\n    // console.log('⚡️ patched ServerResponse.end');\n    const endChunk = args[0];\n    // this just needs to work (so far) for nextjs sending json bodies, so does not need to handle all cases...\n    if (endChunk && typeof endChunk === 'string') {\n      // TODO: currently this throws the error and then things just hang... do we want to try to return an error type response instead?\n      scanForLeaks(endChunk, { method: 'patched ServerResponse.end' });\n    }\n    // @ts-ignore\n    return serverResponseEnd.apply(this, args);\n  };\n}\n\n"]}

package/dist/{chunk-2NQLWXPX.js → chunk-DQTUCLA7.js}

@@ -1,7 +1,7 @@
-import { fmt } from './chunk-6PZXN47A.js';
-import { define } from './chunk-4A54P4EM.js';
+import { fmt } from './chunk-NZTQKZND.js';
 import { gracefulExit } from './chunk-CHQDS2PI.js';
-import { CliExitError } from './chunk-LGEHJHB2.js';
+import { define } from './chunk-MGUGRIW2.js';
+import { CliExitError } from './chunk-SX2NUZCL.js';
 import { getUserVarlockDir } from './chunk-O3WTD6L4.js';
 import { __name } from './chunk-6PEHRAEP.js';
 import { join } from 'path';
@@ -63,5 +63,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 
 export { commandFn, commandSpec };
-//# sourceMappingURL=chunk-2NQLWXPX.js.map
-//# sourceMappingURL=chunk-2NQLWXPX.js.map
+//# sourceMappingURL=chunk-DQTUCLA7.js.map
+//# sourceMappingURL=chunk-DQTUCLA7.js.map

package/dist/{chunk-2NQLWXPX.js.map → chunk-DQTUCLA7.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/telemetry.command.ts"],"names":[],"mappings":";;;;;;;;;;AAWO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,WAAA;AAAA,EACN,WAAA,EAAa,0CAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA,EAAA,CAAA,CAWR,IAAA;AACJ,CAAC;AAEM,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAEhF,EAAA,IAAI,CAAC,CAAC,QAAA,EAAU,SAAS,EAAE,QAAA,CAAS,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA,EAAG;AACpD,IAAA,MAAM,IAAI,aAAa,8CAAA,EAAgD;AAAA,MACrE,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,YAAY,iBAAA,EAAkB;AACpC,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,EAAW,aAAa,CAAA;AAEhD,EAAA,IAAI;AAEF,IAAA,IAAI,CAAC,UAAA,CAAW,SAAS,CAAA,EAAG;AAC1B,MAAA,MAAM,KAAA,CAAM,SAAA,EAAW,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,IAC5C;AAGA,IAAA,IAAI,SAA8B,EAAC;AACnC,IAAA,IAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AAC1B,MAAA,MAAM,aAAA,GAAgB,MAAM,QAAA,CAAS,UAAA,EAAY,OAAO,CAAA;AACxD,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,aAAa,CAAA;AAAA,IACnC;AAGA,IAAA,IAAI,GAAA,CAAI,MAAA,CAAO,IAAA,KAAS,SAAA,SAAkB,iBAAA,GAAoB,IAAA;AAAA,gBAClD,MAAA,CAAO,iBAAA;AACnB,IAAA,MAAM,UAAU,UAAA,EAAY,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA;AAE3D,IAAA,IAAI,GAAA,CAAI,MAAA,CAAO,IAAA,KAAS,QAAA,EAAU;AAChC,MAAA,OAAA,CAAQ,IAAI,uDAAkD,CAAA;AAAA,IAChE,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,IAAI,wDAAmD,CAAA;AAAA,IACjE;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,GAAA,CAAI,QAAA,CAAS,UAAU,CAAC,CAAA;AAAA,EACrD,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,mCAAmC,KAAK,CAAA;AACtD,IAAA,OAAO,aAAa,CAAC,CAAA;AAAA,EACvB;AACF,CAAA,EAvCmE,WAAA","file":"chunk-2NQLWXPX.js","sourcesContent":["import { join } from 'node:path';\nimport { mkdir, writeFile, readFile } from 'node:fs/promises';\nimport { existsSync } from 'node:fs';\nimport { define } from 'gunshi';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { gracefulExit } from 'exit-hook';\nimport { fmt } from '../helpers/pretty-format';\nimport { CliExitError } from '../helpers/exit-error';\nimport { getUserVarlockDir } from '../../lib/user-config-dir';\n\n\nexport const commandSpec = define({\n  name: 'telemetry',\n  description: 'Enable/disable anonymous usage analytics',\n  args: {\n    mode: {\n      type: 'positional',\n      description: '\"enable\" or \"disable\"',\n    },\n  },\n  examples: `\nOpts in/out of anonymous usage analytics. This command creates/updates a configuration\nfile at $XDG_CONFIG_HOME/varlock/config.json (or ~/.config/varlock/config.json) saving\nyour preference.\n\nExamples:\n  varlock telemetry disable    # Opt out of telemetry\n  varlock telemetry enable     # Opt in to telemetry\n\n💡 Tip: You can also temporarily opt out by setting VARLOCK_TELEMETRY_DISABLED=1\nFor more information, visit https://varlock.dev/guides/telemetry/\n  `.trim(),\n});\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  // TODO: remove this when gunshi supports types/validation for positional args\n  if (!['enable', 'disable'].includes(ctx.values.mode)) {\n    throw new CliExitError('additional arg must be \"enable\" or \"disable\"', {\n      forceExit: true,\n    });\n  }\n\n  const configDir = getUserVarlockDir();\n  const configPath = join(configDir, 'config.json');\n\n  try {\n    // Create .varlock directory if it doesn't exist\n    if (!existsSync(configDir)) {\n      await mkdir(configDir, { recursive: true });\n    }\n\n    // Read existing config if it exists\n    let config: Record<string, any> = {};\n    if (existsSync(configPath)) {\n      const configContent = await readFile(configPath, 'utf-8');\n      config = JSON.parse(configContent);\n    }\n\n    // update config `telemetryDisabled` setting\n    if (ctx.values.mode === 'disable') config.telemetryDisabled = true;\n    else delete config.telemetryDisabled;\n    await writeFile(configPath, JSON.stringify(config, null, 2));\n\n    if (ctx.values.mode === 'enable') {\n      console.log('✅ Successfully enabled anonymous usage analytics');\n    } else {\n      console.log('✅ Successfully disabled anonymous usage analytics');\n    }\n    console.log('> saved in:', fmt.filePath(configPath));\n  } catch (error) {\n    console.error('Failed to opt out of analytics:', error);\n    return gracefulExit(1);\n  }\n};\n"]}
+{"version":3,"sources":["../src/cli/commands/telemetry.command.ts"],"names":[],"mappings":";;;;;;;;;;AAWO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,WAAA;AAAA,EACN,WAAA,EAAa,0CAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,YAAA;AAAA,MACN,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA,EAAA,CAAA,CAWR,IAAA;AACJ,CAAC;AAEM,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAEhF,EAAA,IAAI,CAAC,CAAC,QAAA,EAAU,SAAS,EAAE,QAAA,CAAS,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA,EAAG;AACpD,IAAA,MAAM,IAAI,aAAa,8CAAA,EAAgD;AAAA,MACrE,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,YAAY,iBAAA,EAAkB;AACpC,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,EAAW,aAAa,CAAA;AAEhD,EAAA,IAAI;AAEF,IAAA,IAAI,CAAC,UAAA,CAAW,SAAS,CAAA,EAAG;AAC1B,MAAA,MAAM,KAAA,CAAM,SAAA,EAAW,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,IAC5C;AAGA,IAAA,IAAI,SAA8B,EAAC;AACnC,IAAA,IAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AAC1B,MAAA,MAAM,aAAA,GAAgB,MAAM,QAAA,CAAS,UAAA,EAAY,OAAO,CAAA;AACxD,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,aAAa,CAAA;AAAA,IACnC;AAGA,IAAA,IAAI,GAAA,CAAI,MAAA,CAAO,IAAA,KAAS,SAAA,SAAkB,iBAAA,GAAoB,IAAA;AAAA,gBAClD,MAAA,CAAO,iBAAA;AACnB,IAAA,MAAM,UAAU,UAAA,EAAY,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA;AAE3D,IAAA,IAAI,GAAA,CAAI,MAAA,CAAO,IAAA,KAAS,QAAA,EAAU;AAChC,MAAA,OAAA,CAAQ,IAAI,uDAAkD,CAAA;AAAA,IAChE,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,IAAI,wDAAmD,CAAA;AAAA,IACjE;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,GAAA,CAAI,QAAA,CAAS,UAAU,CAAC,CAAA;AAAA,EACrD,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,mCAAmC,KAAK,CAAA;AACtD,IAAA,OAAO,aAAa,CAAC,CAAA;AAAA,EACvB;AACF,CAAA,EAvCmE,WAAA","file":"chunk-DQTUCLA7.js","sourcesContent":["import { join } from 'node:path';\nimport { mkdir, writeFile, readFile } from 'node:fs/promises';\nimport { existsSync } from 'node:fs';\nimport { define } from 'gunshi';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { gracefulExit } from 'exit-hook';\nimport { fmt } from '../helpers/pretty-format';\nimport { CliExitError } from '../helpers/exit-error';\nimport { getUserVarlockDir } from '../../lib/user-config-dir';\n\n\nexport const commandSpec = define({\n  name: 'telemetry',\n  description: 'Enable/disable anonymous usage analytics',\n  args: {\n    mode: {\n      type: 'positional',\n      description: '\"enable\" or \"disable\"',\n    },\n  },\n  examples: `\nOpts in/out of anonymous usage analytics. This command creates/updates a configuration\nfile at $XDG_CONFIG_HOME/varlock/config.json (or ~/.config/varlock/config.json) saving\nyour preference.\n\nExamples:\n  varlock telemetry disable    # Opt out of telemetry\n  varlock telemetry enable     # Opt in to telemetry\n\n💡 Tip: You can also temporarily opt out by setting VARLOCK_TELEMETRY_DISABLED=1\nFor more information, visit https://varlock.dev/guides/telemetry/\n  `.trim(),\n});\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n  // TODO: remove this when gunshi supports types/validation for positional args\n  if (!['enable', 'disable'].includes(ctx.values.mode)) {\n    throw new CliExitError('additional arg must be \"enable\" or \"disable\"', {\n      forceExit: true,\n    });\n  }\n\n  const configDir = getUserVarlockDir();\n  const configPath = join(configDir, 'config.json');\n\n  try {\n    // Create .varlock directory if it doesn't exist\n    if (!existsSync(configDir)) {\n      await mkdir(configDir, { recursive: true });\n    }\n\n    // Read existing config if it exists\n    let config: Record<string, any> = {};\n    if (existsSync(configPath)) {\n      const configContent = await readFile(configPath, 'utf-8');\n      config = JSON.parse(configContent);\n    }\n\n    // update config `telemetryDisabled` setting\n    if (ctx.values.mode === 'disable') config.telemetryDisabled = true;\n    else delete config.telemetryDisabled;\n    await writeFile(configPath, JSON.stringify(config, null, 2));\n\n    if (ctx.values.mode === 'enable') {\n      console.log('✅ Successfully enabled anonymous usage analytics');\n    } else {\n      console.log('✅ Successfully disabled anonymous usage analytics');\n    }\n    console.log('> saved in:', fmt.filePath(configPath));\n  } catch (error) {\n    console.error('Failed to opt out of analytics:', error);\n    return gracefulExit(1);\n  }\n};\n"]}

package/dist/{chunk-VIUMRSUR.js → chunk-EGFAEO7L.js}

@@ -1,11 +1,11 @@
 import { isBundledSEA } from './chunk-GXNQVEXD.js';
-import { detectJsPackageManager, logLines, fmt } from './chunk-6PZXN47A.js';
-import { define } from './chunk-4A54P4EM.js';
-import { loadVarlockEnvGraph } from './chunk-H2JVYUHZ.js';
+import { detectJsPackageManager, logLines, fmt } from './chunk-NZTQKZND.js';
 import { gracefulExit } from './chunk-CHQDS2PI.js';
-import { CliExitError } from './chunk-LGEHJHB2.js';
-import { spawnAsync, pathExists, ansis_default } from './chunk-6CRDPEUT.js';
-import { my_dash_default } from './chunk-6CCHLM3U.js';
+import { define } from './chunk-MGUGRIW2.js';
+import { loadVarlockEnvGraph } from './chunk-Q4I7MXFB.js';
+import { CliExitError } from './chunk-SX2NUZCL.js';
+import { spawnAsync, pathExists, ansis_default } from './chunk-PBWMMYWL.js';
+import { my_dash_default } from './chunk-FA5SNEKN.js';
 import { redactString } from './chunk-XLYSNOR3.js';
 import { __name } from './chunk-6PEHRAEP.js';
 import path from 'path';
@@ -463,5 +463,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 
 export { commandFn, commandSpec, getGitFiles, resolveTargetPaths, scanFileForValues, walkDirectory, walkDirectoryAll };
-//# sourceMappingURL=chunk-VIUMRSUR.js.map
-//# sourceMappingURL=chunk-VIUMRSUR.js.map
+//# sourceMappingURL=chunk-EGFAEO7L.js.map
+//# sourceMappingURL=chunk-EGFAEO7L.js.map