npm - varlock - Versions diffs - 1.2.0 → 1.4.0 - Mend

varlock 1.2.0 → 1.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (134) hide show

package/dist/{chunk-H2JVYUHZ.js → chunk-Q4I7MXFB.js} RENAMED Viewed

@@ -1,7 +1,7 @@
-import { getBackendInfo, getDaemonClient, ensureKey, decryptValue, encryptValue } from './chunk-GURKQO4J.js';
-import { CliExitError, loadEnvGraph } from './chunk-LGEHJHB2.js';
-import { createResolver, parseEnvSpecDotEnvFile, runWithWorkspaceInfo, prompts_default } from './chunk-6CRDPEUT.js';
-import { ResolutionError, SchemaError, createDebug } from './chunk-6CCHLM3U.js';
+import { getBackendInfo, getDaemonClient, ensureKey, decryptValue, encryptValue } from './chunk-P4HNABAM.js';
+import { CliExitError, loadEnvGraph } from './chunk-SX2NUZCL.js';
+import { createResolver, parseEnvSpecDotEnvFile, runWithWorkspaceInfo, prompts_default } from './chunk-PBWMMYWL.js';
+import { ResolutionError, SchemaError, createDebug } from './chunk-FA5SNEKN.js';
 import { __name } from './chunk-6PEHRAEP.js';
 import fs from 'fs';
 import path from 'path';
@@ -422,5 +422,5 @@ function loadVarlockEnvGraph(opts) {
 __name(loadVarlockEnvGraph, "loadVarlockEnvGraph");
 export { loadVarlockEnvGraph, writeBackValue };
-//# sourceMappingURL=chunk-H2JVYUHZ.js.map
-//# sourceMappingURL=chunk-H2JVYUHZ.js.map
+//# sourceMappingURL=chunk-Q4I7MXFB.js.map
+//# sourceMappingURL=chunk-Q4I7MXFB.js.map

package/dist/{chunk-H2JVYUHZ.js.map → chunk-Q4I7MXFB.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/lib/local-encrypt/write-back.ts","../src/lib/local-encrypt/builtin-resolver.ts","../src/lib/local-encrypt/keychain-resolver.ts","../src/lib/package-json-config.ts","../src/lib/load-graph.ts"],"names":["ciphertext","writeBackResult","fs","path"],"mappings":";;;;;;;;AAcO,SAAS,cAAA,CACd,OAAA,EACA,WAAA,EACA,cAAA,EACiB;AACjB,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,qBAAA,EAAsB;AAAA,EACzD;AAEA,EAAA,MAAM,eAAA,GAAkB,EAAA,CAAG,YAAA,CAAa,cAAA,EAAgB,OAAO,CAAA;AAC/D,EAAA,MAAM,IAAA,GAAO,uBAAuB,eAAe,CAAA;AAEnD,EAAA,MAAM,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,OAAO,CAAA;AAC3D,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACpD;AAGA,EAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,CAAA,EAAA,EAAK,WAAW,CAAA,CAAE,CAAA;AAC3D,EAAA,MAAM,SAAA,GAAY,SAAA,CAAU,WAAA,CAAY,CAAC,CAAA;AACzC,EAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACpD;AAGA,EAAA,IAAA,CAAK,IAAA,CAAK,QAAQ,SAAA,CAAU,KAAA;AAC5B,EAAA,IAAA,CAAK,QAAQ,SAAA,CAAU,KAAA;AAEvB,EAAA,EAAA,CAAG,aAAA,CAAc,cAAA,EAAgB,IAAA,CAAK,QAAA,EAAU,CAAA;AAChD,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AA9BgB,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;;;ACDhB,IAAM,YAAA,GAAe,QAAA;AACrB,IAAM,WAAA,GAAc,iBAAA;AAkBpB,IAAI,YAAA;AAEJ,SAAS,kBAAkB,KAAA,EAA0B;AACnD,EAAA,IAAI,YAAA,GAAe,KAAA;AACnB,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,YAAA,GAAe,EAAC;AAChB,IAAA,YAAA,GAAe,IAAA;AAAA,EACjB;AACA,EAAA,YAAA,CAAa,KAAK,KAAK,CAAA;AAEvB,EAAA,IAAI,YAAA,EAAc;AAEhB,IAAA,YAAA,CAAa,MAAM,cAAc,CAAA;AAAA,EACnC;AACF;AAZS,MAAA,CAAA,iBAAA,EAAA,mBAAA,CAAA;AAcT,SAAS,eAAe,UAAA,EAAqC;AAC3D,EAAA,OAAO,IAAI,OAAA,CAAgB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC9C,IAAA,iBAAA,CAAkB;AAAA,MAChB,IAAA,EAAM,SAAA;AAAA,MAAW,UAAA;AAAA,MAAY,OAAA;AAAA,MAAS;AAAA,KACvC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AANS,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAQT,SAAS,cAAc,OAAA,EAAiD;AACtE,EAAA,OAAO,IAAI,OAAA,CAAgB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC9C,IAAA,iBAAA,CAAkB;AAAA,MAChB,IAAA,EAAM,QAAA;AAAA,MAAU,OAAA;AAAA,MAAS,OAAA;AAAA,MAAS;AAAA,KACnC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AANS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAQT,SAAS,aAAA,CAAc,KAAA,EAAiC,UAAA,EAAoB,KAAA,EAAc;AACxF,EAAA,KAAA,IAAS,CAAA,GAAI,UAAA,EAAY,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AAC9C,IAAA,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,EACvB;AACF;AAJS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAMT,eAAe,YAAA,GAAe;AAC5B,EAAA,MAAM,KAAA,GAAQ,YAAA;AACd,EAAA,YAAA,GAAe,MAAA;AACf,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAGpB,EAAA,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM;AACnB,IAAA,IAAI,CAAA,CAAE,IAAA,KAAS,CAAA,CAAE,IAAA,EAAM,OAAO,CAAA;AAC9B,IAAA,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAA,GAAK,CAAA;AAAA,EACpC,CAAC,CAAA;AAGD,EAAA,MAAmB,SAAA,EAAU;AAE7B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,KAAA,GAAQ,MAAM,CAAC,CAAA;AACrB,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,CAAM,SAAS,SAAA,EAAW;AAC5B,QAAA,MAAM,SAAA,GAAY,MAAmB,YAAA,CAAa,KAAA,CAAM,UAAU,CAAA;AAClE,QAAA,KAAA,CAAM,QAAQ,SAAS,CAAA;AAAA,MACzB,CAAA,MAAO;AACL,QAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,EAAQ;AACnC,QAAA,KAAA,CAAM,QAAQ,MAAM,CAAA;AAAA,MACtB;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAGhB,MAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC3D,MAAA,IACE,GAAA,CAAI,QAAA,CAAS,WAAW,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,UAAU,CAAA,IACjD,GAAA,CAAI,QAAA,CAAS,qBAAqB,CAAA,EACrC;AACA,QAAA,aAAA,CAAc,OAAO,CAAA,GAAI,CAAA,EAAG,IAAI,eAAA,CAAgB,+BAA0B,CAAC,CAAA;AAC3E,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAtCe,MAAA,CAAA,YAAA,EAAA,cAAA,CAAA;AAiDf,SAAS,uBAAA,CACP,OAAA,EACA,UAAA,EACA,cAAA,EACA;AACA,EAAA,MAAM,kBAAA,GAAqB,CAAA,EAAG,YAAY,CAAA,EAAG,UAAU,CAAA,CAAA;AACvD,EAAA,OAAO,cAAA,CAAe,OAAA,EAAS,CAAA,SAAA,EAAY,kBAAkB,MAAM,cAAc,CAAA;AACnF;AAPS,MAAA,CAAA,uBAAA,EAAA,yBAAA,CAAA;AAUF,IAAM,kBAAmC,cAAA,CAAqC;AAAA,EACnF,IAAA,EAAM,SAAA;AAAA,EACN,KAAA,EAAO,iCAAA;AAAA,EACP,IAAA,EAAM,WAAA;AAAA,EACN,gBAAA,EAAkB,IAAA;AAAA,EAClB,UAAA,EAAY;AAAA,IACV,IAAA,EAAM,OAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,OAAA,GAAgC;AAE9B,IAAA,MAAM,SAAA,GAAY,KAAK,OAAA,EAAS,MAAA;AAChC,IAAA,MAAM,kBAAA,GAAqB,IAAA,CAAK,OAAA,EAAS,MAAA,KAAW,KAC/C,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAA,IACjB,IAAA,CAAK,OAAA,CAAQ,CAAC,EAAE,WAAA,KAAgB,QAAA;AACrC,IAAA,IAAI,aAAa,kBAAA,EAAoB;AAEnC,MAAA,MAAM,SAAU,IAAA,CAAa,MAAA;AAC7B,MAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,IAAO,SAAA;AAC/B,MAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,MAAA,MAAM,iBAAiB,UAAA,EAAY,QAAA;AACnC,MAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,cAAA,EAAe;AAAA,IACnD;AAGA,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC9C,MAAA,MAAM,IAAI,YAAY,qFAAqF,CAAA;AAAA,IAC7G;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,CAAQ,CAAC,GAAG,QAAA,EAAU;AAC9B,MAAA,MAAM,IAAI,YAAY,4DAA4D,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,CAAE,WAAA;AAChC,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,YAAY,qCAAqC,CAAA;AAAA,IAC7D;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAQ;AAAA,EACpC,CAAA;AAAA,EACA,MAAM,QAAQ,KAAA,EAA6B;AACzC,IAAA,IAAI,KAAA,CAAM,SAAS,SAAA,EAAW;AAC5B,MAAA,IAAI,aAAa,KAAA,CAAM,OAAA;AACvB,MAAA,IAAI,UAAA,CAAW,UAAA,CAAW,YAAY,CAAA,EAAG;AACvC,QAAA,UAAA,GAAa,UAAA,CAAW,KAAA,CAAM,YAAA,CAAa,MAAM,CAAA;AAAA,MACnD;AACA,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,eAAe,UAAU,CAAA;AAAA,MACxC,SAAS,GAAA,EAAK;AAEZ,QAAA,IAAI,GAAA,YAAe,iBAAiB,MAAM,GAAA;AAE1C,QAAA,MAAM,UAAuB,cAAA,EAAe;AAC5C,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,CAAA,mBAAA,EAAsB,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA,CAAA;AAAA,UAC9D;AAAA,YACE,GAAA,EAAK;AAAA,cACH,YAAY,OAAA,CAAQ,IAAI,KAAK,OAAA,CAAQ,cAAA,GAAiB,oBAAoB,YAAY,CAAA,CAAA,CAAA;AAAA,cACtF,6EAAA;AAAA,cACA;AAAA,aACF,CAAE,KAAK,IAAI;AAAA;AACb,SACF;AAAA,MACF;AAAA,IACF;AAIA,IAAA,MAAM,EAAE,OAAA,EAAS,cAAA,EAAe,GAAI,KAAA;AACpC,IAAA,OAAO,cAAc,YAAY;AAC/B,MAAA,MAAM,UAAuB,cAAA,EAAe;AAG5C,MAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,gBAAA,IAAoB,OAAA,CAAQ,kBAAA,EAAoB;AACnE,QAAA,MAAM,SAAsB,eAAA,EAAgB;AAC5C,QAAA,MAAMA,WAAAA,GAAa,MAAM,MAAA,CAAO,YAAA,CAAa;AAAA,UAC3C,OAAA;AAAA,UACA,OAAA,EAAS,8BAA8B,OAAO,CAAA,CAAA;AAAA,SAC/C,CAAA;AAED,QAAA,IAAI,CAACA,WAAAA,EAAY;AACf,UAAA,MAAM,IAAI,gBAAgB,4BAAA,EAA8B;AAAA,YACtD,GAAA,EAAK;AAAA,WACN,CAAA;AAAA,QACH;AAEA,QAAA,MAAMC,gBAAAA,GAAkB,uBAAA,CAAwB,OAAA,EAASD,WAAAA,EAAY,cAAc,CAAA;AACnF,QAAA,IAAI,CAACC,iBAAgB,OAAA,EAAS;AAC5B,UAAA,IAAIA,gBAAAA,CAAgB,WAAW,qBAAA,EAAuB;AACpD,YAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,cAC5E,GAAA,EAAK;AAAA,aACN,CAAA;AAAA,UACH;AAEA,UAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,YAC5E,GAAA,EAAK,CAAA,4BAAA,EAA+B,OAAO,CAAA,mCAAA,EAAsC,cAAc,CAAA,CAAA;AAAA,WAChG,CAAA;AAAA,QACH;AAEA,QAAA,OAAoB,aAAaD,WAAU,CAAA;AAAA,MAC7C;AAGA,MAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAC,OAAA,CAAQ,MAAM,KAAA,EAAO;AACjD,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,gCAAgC,OAAO,CAAA,CAAA;AAAA,UACvC;AAAA,YACE,GAAA,EAAK,CAAA,6BAAA,EAAgC,cAAA,IAAkB,iBAAiB,CAAA,uCAAA;AAAA;AAC1E,SACF;AAAA,MACF;AAEA,MAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAQ,QAAA,CAAS,EAAE,OAAA,EAAS,CAAA,2BAAA,EAA8B,OAAO,CAAA,CAAA,CAAA,EAAK,IAAA,EAAM,8CAAA,EAAgD,CAAA;AACnJ,MAAA,MAAM,UAAA,GAAa,OAAO,QAAA,KAAa,QAAA;AACvC,MAAA,IAAI,UAAA,IAAc,CAAC,QAAA,EAAU;AAC3B,QAAA,MAAM,IAAI,gBAAgB,4BAAA,EAA8B;AAAA,UACtD,GAAA,EAAK;AAAA,SACN,CAAA;AAAA,MACH;AAEA,MAAA,MAAM,UAAA,GAAa,MAAmB,YAAA,CAAa,QAAQ,CAAA;AAC3D,MAAA,MAAM,eAAA,GAAkB,uBAAA,CAAwB,OAAA,EAAS,UAAA,EAAY,cAAc,CAAA;AAEnF,MAAA,IAAI,CAAC,gBAAgB,OAAA,EAAS;AAC5B,QAAA,IAAI,eAAA,CAAgB,WAAW,qBAAA,EAAuB;AACpD,UAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,YAC5E,GAAA,EAAK;AAAA,WACN,CAAA;AAAA,QACH;AAEA,QAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,UAC5E,GAAA,EAAK,CAAA,4BAAA,EAA+B,OAAO,CAAA,mCAAA,EAAsC,cAAc,CAAA,CAAA;AAAA,SAChG,CAAA;AAAA,MACH;AAEA,MAAA,OAAO,QAAA;AAAA,IACT,CAAC,CAAA;AAAA,EACH;AACF,CAAC,CAAA;;;ACxOD,SAAS,oBAAA,CACP,OAAA,EACA,GAAA,EACA,cAAA,EACA;AAEA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,CAAC,GAAA,CAAI,OAAA,IAAW,CAAC,IAAI,QAAA,EAAU;AACjC,IAAA,OAAA,GAAU,CAAA,CAAA,EAAI,IAAI,OAAO,CAAA,CAAA,CAAA;AAAA,EAC3B,CAAA,MAAO;AACL,IAAA,MAAM,KAAA,GAAuB,CAAC,CAAA,SAAA,EAAY,GAAA,CAAI,OAAO,CAAA,CAAA,CAAG,CAAA;AACxD,IAAA,IAAI,IAAI,OAAA,EAAS,KAAA,CAAM,KAAK,CAAA,SAAA,EAAY,GAAA,CAAI,OAAO,CAAA,CAAA,CAAG,CAAA;AACtD,IAAA,IAAI,IAAI,QAAA,EAAU,KAAA,CAAM,KAAK,CAAA,UAAA,EAAa,GAAA,CAAI,QAAQ,CAAA,CAAA,CAAG,CAAA;AACzD,IAAA,OAAA,GAAU,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EAC3B;AAEA,EAAA,cAAA,CAAe,OAAA,EAAS,CAAA,SAAA,EAAY,OAAO,CAAA,CAAA,CAAA,EAAK,cAAc,CAAA;AAChE;AAjBS,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AAmBF,IAAM,mBAAoC,cAAA,CAAsC;AAAA,EACrF,IAAA,EAAM,UAAA;AAAA,EACN,KAAA,EAAO,0BAAA;AAAA,EACP,IAAA,EAAM,eAAA;AAAA,EACN,gBAAA,EAAkB,IAAA;AAAA,EAClB,UAAA,EAAY;AAAA,IACV,IAAA,EAAM,OAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,OAAA,GAAiC;AAC/B,IAAA,IAAI,OAAA,CAAQ,aAAa,QAAA,EAAU;AACjC,MAAA,MAAM,IAAI,YAAY,uCAAuC,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,SAAA,GAAY,KAAK,OAAA,EAAS,MAAA;AAChC,IAAA,MAAM,kBAAA,GAAqB,IAAA,CAAK,OAAA,EAAS,MAAA,KAAW,KAC/C,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAA,IACjB,IAAA,CAAK,OAAA,CAAQ,CAAC,EAAE,WAAA,KAAgB,QAAA;AAErC,IAAA,IAAI,aAAa,kBAAA,EAAoB;AACnC,MAAA,MAAM,SAAU,IAAA,CAAa,MAAA;AAC7B,MAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,IAAO,SAAA;AAC/B,MAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,MAAA,MAAM,iBAAiB,UAAA,EAAY,QAAA;AACnC,MAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,cAAA,EAAe;AAAA,IACnD;AAGA,IAAA,MAAM,UAAA,GAAa,KAAK,OAAA,EAAS,OAAA;AACjC,IAAA,MAAM,UAAA,GAAa,KAAK,OAAA,EAAS,OAAA;AACjC,IAAA,MAAM,WAAA,GAAc,KAAK,OAAA,EAAS,QAAA;AAClC,IAAA,MAAM,QAAA,GAAW,KAAK,OAAA,EAAS,KAAA;AAE/B,IAAA,MAAM,OAAA,GAAU,UAAA,EAAY,QAAA,GAAW,UAAA,CAAW,WAAA,GAAwB,MAAA;AAC1E,IAAA,MAAM,QAAA,GAAW,WAAA,EAAa,QAAA,GAAW,WAAA,CAAY,WAAA,GAAwB,MAAA;AAC7E,IAAA,MAAM,KAAA,GAAQ,QAAA,EAAU,QAAA,GAAW,QAAA,CAAS,WAAA,GAAwB,MAAA;AAEpE,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,CAAC,UAAA,CAAW,QAAA,IAAY,OAAO,UAAA,CAAW,gBAAgB,QAAA,EAAU;AACtE,QAAA,MAAM,IAAI,YAAY,4CAA4C,CAAA;AAAA,MACpE;AACA,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,KAAA;AAAA,QAAO,SAAS,UAAA,CAAW,WAAA;AAAA,QAAa,OAAA;AAAA,QAAS,QAAA;AAAA,QAAU;AAAA,OACnE;AAAA,IACF;AAGA,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,KAAA;AAAA,QAAO,OAAA;AAAA,QAAS,QAAA;AAAA,QAAU;AAAA,OAClC;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,MAAA,KAAW,CAAA,IAAK,KAAK,OAAA,CAAQ,CAAC,GAAG,QAAA,EAAU;AAC3D,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,CAAE,WAAA;AAC9B,MAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,QAAA,MAAM,IAAI,YAAY,0CAA0C,CAAA;AAAA,MAClE;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,OAAA,EAAS,OAAO,KAAA,EAAM;AAAA,IAC9C;AAEA,IAAA,MAAM,IAAI,WAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF,CAAA;AAAA,EACA,MAAM,QAAQ,KAAA,EAA8B;AAC1C,IAAA,MAAM,SAAS,eAAA,EAAgB;AAE/B,IAAA,IAAI,KAAA,CAAM,SAAS,KAAA,EAAO;AACxB,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,OAAO,WAAA,CAAY;AAAA,UAC9B,SAAS,KAAA,CAAM,OAAA;AAAA,UACf,SAAS,KAAA,CAAM,OAAA;AAAA,UACf,UAAU,KAAA,CAAM,QAAA;AAAA,UAChB,OAAO,KAAA,CAAM;AAAA,SACd,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,CAAA,8BAAA,EAAiC,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA,CAAA;AAAA,UACzE;AAAA,YACE,GAAA,EAAK;AAAA,cACH,KAAA,CAAM,OAAA,GAAU,CAAA,SAAA,EAAY,KAAA,CAAM,OAAO,CAAA,CAAA,GAAK,IAAA;AAAA,cAC9C,KAAA,CAAM,OAAA,GAAU,CAAA,SAAA,EAAY,KAAA,CAAM,OAAO,CAAA,CAAA,GAAK,IAAA;AAAA,cAC9C,KAAA,CAAM,QAAA,GAAW,CAAA,UAAA,EAAa,KAAA,CAAM,QAAQ,CAAA,CAAA,GAAK,IAAA;AAAA,cACjD,KAAA,CAAM,KAAA,GAAQ,CAAA,OAAA,EAAU,KAAA,CAAM,KAAK,CAAA,CAAA,GAAK,IAAA;AAAA,cACxC,2EAAA;AAAA,cACA;AAAA,aACF,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,KAAK,IAAI;AAAA;AAC7B,SACF;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,EAAE,OAAA,EAAS,cAAA,EAAe,GAAI,KAAA;AAEpC,IAAA,MAAM,WAAW,MAAM,MAAA,CAAO,YAAA,CAAa,EAAE,SAAS,CAAA;AACtD,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,gBAAgB,uCAAA,EAAyC;AAAA,QACjE,GAAA,EAAK;AAAA,OACN,CAAA;AAAA,IACH;AAEA,IAAA,oBAAA,CAAqB,OAAA,EAAS,UAAU,cAAc,CAAA;AAGtD,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,OAAO,WAAA,CAAY;AAAA,QAC9B,SAAS,QAAA,CAAS,OAAA;AAAA,QAClB,SAAS,QAAA,CAAS,OAAA;AAAA,QAClB,UAAU,QAAA,CAAS;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,CAAA,iDAAA,EAAoD,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA,CAAA;AAAA,QAC5F;AAAA,UACE,GAAA,EAAK;AAAA;AACP,OACF;AAAA,IACF;AAAA,EACF;AACF,CAAC,CAAA;ACnKM,SAAS,6BAA6B,IAAA,EAA+D;AAC1G,EAAA,MAAM,GAAA,GAAM,IAAA,EAAM,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAI;AACrC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AAC7C,EAAA,IAAI,CAACE,EAAAA,CAAG,UAAA,CAAW,OAAO,GAAG,OAAO,MAAA;AACpC,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAMA,GAAG,YAAA,CAAa,OAAA,EAAS,OAAO,CAAC,CAAA;AACxD,IAAA,IAAI,GAAA,CAAI,OAAA,IAAW,OAAO,GAAA,CAAI,YAAY,QAAA,EAAU;AAClD,MAAA,OAAO,GAAA,CAAI,OAAA;AAAA,IACb;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAA4B;AACpC,EAAA,OAAO,MAAA;AACT;AAXgB,MAAA,CAAA,4BAAA,EAAA,8BAAA,CAAA;;;ACFhB,IAAM,KAAA,GAAQ,YAAY,cAAc,CAAA;AAExC,SAAS,qBAAqB,WAAA,EAAoD;AAChF,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,EAAG,OAAO,WAAA;AACvC,EAAA,OAAO,CAAC,WAAW,CAAA;AACrB;AAHS,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AAKT,SAAS,aAAA,CACP,UACA,MAAA,EAMA;AACA,EAAA,MAAM,aAAA,GAAgB,SAAS,GAAA,CAAI,CAAC,MAAMC,IAAAA,CAAK,OAAA,CAAQ,CAAC,CAAC,CAAA;AAEzD,EAAA,IAAI,aAAA,CAAc,WAAW,CAAA,EAAG;AAC9B,IAAA,KAAA,CAAM,wBAAA,EAA0B,MAAA,CAAO,MAAA,EAAQ,aAAA,CAAc,CAAC,CAAC,CAAA;AAAA,EACjE,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,4BAAA,EAA8B,cAAc,MAAA,EAAQ,MAAA,CAAO,QAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,EACnG;AAEA,EAAA,KAAA,MAAW,gBAAgB,aAAA,EAAe;AACxC,IAAA,IAAI,CAACD,EAAAA,CAAG,UAAA,CAAW,YAAY,CAAA,EAAG;AAChC,MAAA,MAAM,IAAI,YAAA,CAAa,CAAA,EAAG,OAAO,WAAW,CAAA,EAAA,EAAK,YAAY,CAAA,CAAA,EAAI;AAAA,QAC/D,YAAY,MAAA,CAAO;AAAA,OACpB,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,oBAAA,CAAqB,MAAM,YAAA,CAAa;AAAA,IAC7C,oBAAoB,MAAA,CAAO,kBAAA;AAAA,IAC3B,cAAA,EAAgB,aAAA;AAAA,IAChB,SAAA,gCAAkB,CAAA,KAAM;AACtB,MAAA,CAAA,CAAE,iBAAiB,eAAe,CAAA;AAClC,MAAA,CAAA,CAAE,iBAAiB,gBAAgB,CAAA;AAAA,IACrC,CAAA,EAHW,WAAA;AAAA,GAIZ,CAAC,CAAA;AACJ;AAjCS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAmCF,SAAS,oBAAoB,IAAA,EAIjC;AACD,EAAA,MAAM,QAAA,GAAW,IAAA,EAAM,cAAA,EAAgB,MAAA,CAAO,OAAO,CAAA;AAGrD,EAAA,IAAI,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAEnC,IAAA,OAAO,cAAc,QAAA,EAAU;AAAA,MAC7B,MAAA,EAAQ,aAAA;AAAA,MACR,WAAA,EAAa,iCAAA;AAAA,MACb,eAAA,EAAiB,oDAAA;AAAA,MACjB,oBAAoB,IAAA,EAAM;AAAA,KAC3B,CAAA;AAAA,EACH;AAGA,EAAA,MAAM,WAAA,GAAc,8BAA6B,EAAG,QAAA;AACpD,EAAA,MAAM,YAAA,GAAe,WAAA,GAAc,oBAAA,CAAqB,WAAW,CAAA,GAAI,MAAA;AAEvE,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,OAAO,cAAc,YAAA,EAAc;AAAA,MACjC,MAAA,EAAQ,+BAAA;AAAA,MACR,WAAA,EAAa,wEAAA;AAAA,MACb,eAAA,EAAiB,wFAAA;AAAA,MACjB,oBAAoB,IAAA,EAAM;AAAA,KAC3B,CAAA;AAAA,EACH;AAEA,EAAA,KAAA,CAAM,mCAAA,EAAqC,OAAA,CAAQ,GAAA,EAAK,CAAA;AAExD,EAAA,OAAO,oBAAA,CAAqB,MAAM,YAAA,CAAa;AAAA,IAC7C,oBAAoB,IAAA,EAAM,kBAAA;AAAA,IAC1B,SAAA,gCAAkB,CAAA,KAAM;AACtB,MAAA,CAAA,CAAE,iBAAiB,eAAe,CAAA;AAClC,MAAA,CAAA,CAAE,iBAAiB,gBAAgB,CAAA;AAAA,IACrC,CAAA,EAHW,WAAA;AAAA,GAIZ,CAAC,CAAA;AACJ;AAxCgB,MAAA,CAAA,mBAAA,EAAA,qBAAA,CAAA","file":"chunk-H2JVYUHZ.js","sourcesContent":["/*\n Shared utilities for writing back encrypted/resolved values to .env files.\n \n Uses the env-spec AST parser to safely update values.\n /\n\nimport fs from 'node:fs';\nimport { parseEnvSpecDotEnvFile } from '@env-spec/parser';\n\ntype WriteBackResult = { updated: boolean; reason?: 'missing-source-file' \| 'item-not-found' };\n\n/\n Update a config item's value in a .env file using AST-based replacement.\n /\nexport function writeBackValue(\n itemKey: string,\n newValueStr: string,\n sourceFilePath: string \| undefined,\n): WriteBackResult {\n if (!sourceFilePath) {\n return { updated: false, reason: 'missing-source-file' };\n }\n\n const currentContents = fs.readFileSync(sourceFilePath, 'utf-8');\n const file = parseEnvSpecDotEnvFile(currentContents);\n\n const item = file.configItems.find((i) => i.key === itemKey);\n if (!item) {\n return { updated: false, reason: 'item-not-found' };\n }\n\n // Parse a dummy line to get the correct AST value node\n const dummyFile = parseEnvSpecDotEnvFile(`_=${newValueStr}`);\n const dummyItem = dummyFile.configItems[0];\n if (!dummyItem?.value) {\n return { updated: false, reason: 'item-not-found' };\n }\n\n // Replace the value\n item.data.value = dummyItem.value;\n item.value = dummyItem.value;\n\n fs.writeFileSync(sourceFilePath, file.toString());\n return { updated: true };\n}\n\n","/\n Built-in varlock() resolver function.\n \n Replaces the plugin-based resolver from @varlock/secure-enclave-plugin.\n * Works cross-platform using the local-encrypt abstraction layer.\n /\n\nimport { createResolver, Resolver } from '../../env-graph/lib/resolver';\nimport { ResolutionError, SchemaError } from '../../env-graph/lib/errors';\nimport prompts from '../../cli/helpers/prompts';\nimport as localEncrypt from './index';\nimport { writeBackValue } from './write-back';\n\nconst LOCAL_PREFIX = 'local:';\nconst PLUGIN_ICON = 'mdi:fingerprint';\n\n// ── Unified varlock() batch queue ──────────────────────────────\n// Collects all concurrent varlock() calls (both prompt and decrypt) into a\n// single batch using setImmediate, then processes them sequentially.\n// Prompts are sorted first so the user enters values before biometric decrypts.\n// If the user cancels a prompt or biometric auth, all remaining items in the\n// batch are rejected immediately.\n\ntype VarlockBatchEntry = {\n kind: 'prompt' \| 'decrypt';\n resolve: (value: string) => void;\n reject: (reason: unknown) => void;\n} & (\n \| { kind: 'decrypt'; ciphertext: string }\n \| { kind: 'prompt'; execute: () => Promise<string> }\n);\n\nlet pendingBatch: Array<VarlockBatchEntry> \| undefined;\n\nfunction enqueueBatchEntry(entry: VarlockBatchEntry) {\n let triggerBatch = false;\n if (!pendingBatch) {\n pendingBatch = [];\n triggerBatch = true;\n }\n pendingBatch.push(entry);\n\n if (triggerBatch) {\n // eslint-disable-next-line no-use-before-define\n setImmediate(() => executeBatch());\n }\n}\n\nfunction enqueueDecrypt(ciphertext: string): Promise<string> {\n return new Promise<string>((resolve, reject) => {\n enqueueBatchEntry({\n kind: 'decrypt', ciphertext, resolve, reject,\n });\n });\n}\n\nfunction enqueuePrompt(execute: () => Promise<string>): Promise<string> {\n return new Promise<string>((resolve, reject) => {\n enqueueBatchEntry({\n kind: 'prompt', execute, resolve, reject,\n });\n });\n}\n\nfunction bailRemaining(batch: Array<VarlockBatchEntry>, startIndex: number, error: Error) {\n for (let j = startIndex; j < batch.length; j++) {\n batch[j].reject(error);\n }\n}\n\nasync function executeBatch() {\n const batch = pendingBatch;\n pendingBatch = undefined;\n if (!batch?.length) return;\n\n // Sort prompts before decrypts so the user enters values first\n batch.sort((a, b) => {\n if (a.kind === b.kind) return 0;\n return a.kind === 'prompt' ? -1 : 1;\n });\n\n // Ensure encryption key exists before processing any items\n await localEncrypt.ensureKey();\n\n for (let i = 0; i < batch.length; i++) {\n const entry = batch[i];\n try {\n if (entry.kind === 'decrypt') {\n const plaintext = await localEncrypt.decryptValue(entry.ciphertext);\n entry.resolve(plaintext);\n } else {\n const result = await entry.execute();\n entry.resolve(result);\n }\n } catch (err) {\n entry.reject(err);\n\n // If this looks like a user cancellation or auth failure, bail on remaining items\n const msg = err instanceof Error ? err.message : String(err);\n if (\n msg.includes('cancelled') \|\| msg.includes('canceled')\n \|\| msg.includes('verification failed')\n ) {\n bailRemaining(batch, i + 1, new ResolutionError('Skipped — user cancelled'));\n return;\n }\n }\n }\n}\n\ntype VarlockResolverState = {\n mode: 'decrypt';\n payload: string;\n} \| {\n mode: 'prompt';\n itemKey: string;\n sourceFilePath: string \| undefined;\n};\n\nfunction writeBackEncryptedValue(\n itemKey: string,\n ciphertext: string,\n sourceFilePath: string \| undefined,\n) {\n const prefixedCiphertext = `${LOCAL_PREFIX}${ciphertext}`;\n return writeBackValue(itemKey, `varlock(\"${prefixedCiphertext}\")`, sourceFilePath);\n}\n\n\nexport const VarlockResolver: typeof Resolver = createResolver<VarlockResolverState>({\n name: 'varlock',\n label: 'Decrypt locally encrypted value',\n icon: PLUGIN_ICON,\n impliesSensitive: true,\n argsSchema: {\n type: 'mixed',\n arrayMinLength: 0,\n },\n process(): VarlockResolverState {\n // Check for prompt mode: varlock(prompt=1) or varlock(prompt)\n const promptArg = this.objArgs?.prompt;\n const isPromptPositional = this.arrArgs?.length === 1\n && this.arrArgs[0]?.isStatic\n && this.arrArgs[0].staticValue === 'prompt';\n if (promptArg \|\| isPromptPositional) {\n // Resolver doesn't expose parent item in its type, but it's available at runtime\n const parent = (this as any).parent;\n const itemKey = parent?.key \|\| 'unknown';\n const dataSource = this.dataSource as any;\n const sourceFilePath = dataSource?.fullPath as string \| undefined;\n return { mode: 'prompt', itemKey, sourceFilePath };\n }\n\n // Normal mode: varlock(\"encrypted-payload\")\n if (!this.arrArgs \|\| this.arrArgs.length !== 1) {\n throw new SchemaError('varlock() expects a single encrypted payload string, or prompt to enter a new value');\n }\n if (!this.arrArgs[0]?.isStatic) {\n throw new SchemaError('varlock() expects a single static encrypted payload string');\n }\n const payload = this.arrArgs[0].staticValue;\n if (typeof payload !== 'string') {\n throw new SchemaError('varlock() expects a string argument');\n }\n return { mode: 'decrypt', payload };\n },\n async resolve(state: VarlockResolverState) {\n if (state.mode === 'decrypt') {\n let ciphertext = state.payload;\n if (ciphertext.startsWith(LOCAL_PREFIX)) {\n ciphertext = ciphertext.slice(LOCAL_PREFIX.length);\n }\n try {\n return await enqueueDecrypt(ciphertext);\n } catch (err) {\n // Re-throw ResolutionErrors (e.g. batch cancellation) as-is\n if (err instanceof ResolutionError) throw err;\n\n const backend = localEncrypt.getBackendInfo();\n throw new ResolutionError(\n `Decryption failed: ${err instanceof Error ? err.message : err}`,\n {\n tip: [\n `Backend: ${backend.type} (${backend.hardwareBacked ? 'hardware-backed' : 'file-based'})`,\n 'This usually means the value was encrypted with a different key or backend.',\n 'Set a new value using `varlock encrypt` or `KEY=varlock(prompt)`.',\n ].join('\\n'),\n },\n );\n }\n }\n\n // Prompt mode: enqueued into the unified batch so prompts run before decrypts\n // and cancellation propagates to all remaining items.\n const { itemKey, sourceFilePath } = state;\n return enqueuePrompt(async () => {\n const backend = localEncrypt.getBackendInfo();\n\n // Use daemon's native dialog on macOS Secure Enclave\n if (backend.type === 'secure-enclave' && backend.biometricAvailable) {\n const client = localEncrypt.getDaemonClient();\n const ciphertext = await client.promptSecret({\n itemKey,\n message: `Enter the secret value for ${itemKey}:`,\n });\n\n if (!ciphertext) {\n throw new ResolutionError('Secret input was cancelled', {\n tip: 'Run varlock again and enter a value, or replace prompt=1 with an encrypted value',\n });\n }\n\n const writeBackResult = writeBackEncryptedValue(itemKey, ciphertext, sourceFilePath);\n if (!writeBackResult.updated) {\n if (writeBackResult.reason === 'missing-source-file') {\n throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n tip: 'varlock(prompt=1) can only persist values from file-backed sources. Use `varlock encrypt` to generate an encrypted value manually.',\n });\n }\n\n throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n tip: `Could not find a writable \\`${itemKey}=varlock(...)\\` entry to update in ${sourceFilePath}.`,\n });\n }\n\n return localEncrypt.decryptValue(ciphertext);\n }\n\n // Terminal prompt for file-based backend\n if (!process.stdout.isTTY \|\| !process.stdin.isTTY) {\n throw new ResolutionError(\n `No encrypted value found for ${itemKey}`,\n {\n tip: `Run \\`varlock encrypt --file ${sourceFilePath \|\| '<your-env-file>'}\\` to encrypt this value interactively.`,\n },\n );\n }\n\n const rawValue = await prompts.password({ message: `Enter the secret value for ${itemKey}:`, hint: 'for multi-line values, use `varlock encrypt`' });\n const isCanceled = typeof rawValue !== 'string';\n if (isCanceled \|\| !rawValue) {\n throw new ResolutionError('Secret input was cancelled', {\n tip: 'Run varlock again and enter a value, or replace prompt=1 with an encrypted value',\n });\n }\n\n const ciphertext = await localEncrypt.encryptValue(rawValue);\n const writeBackResult = writeBackEncryptedValue(itemKey, ciphertext, sourceFilePath);\n\n if (!writeBackResult.updated) {\n if (writeBackResult.reason === 'missing-source-file') {\n throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n tip: 'varlock(prompt=1) can only persist values from file-backed sources. Use `varlock encrypt` to generate an encrypted value manually.',\n });\n }\n\n throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n tip: `Could not find a writable \\`${itemKey}=varlock(...)\\` entry to update in ${sourceFilePath}.`,\n });\n }\n\n return rawValue;\n });\n },\n});\n","/*\n Built-in keychain() resolver function.\n \n Reads secrets from the macOS Keychain via the Swift daemon binary.\n * Always goes through the daemon to enforce biometric gating (per-TTY sessions)\n * and to make VarlockEnclave the authorized keychain accessor.\n \n Syntax:\n * keychain(service=\"com.company.db\")\n * keychain(service=\"com.company.db\", account=\"admin\")\n * keychain(service=\"com.company.db\", keychain=\"System\")\n * keychain(\"com.company.db\") — shorthand for service\n * keychain(prompt) — interactive picker, writes back reference\n /\n\nimport { createResolver, Resolver } from '../../env-graph/lib/resolver';\nimport { ResolutionError, SchemaError } from '../../env-graph/lib/errors';\nimport { getDaemonClient } from './index';\nimport { writeBackValue } from './write-back';\n\ntype KeychainResolverState = {\n mode: 'get';\n service?: string;\n account?: string;\n keychain?: string;\n field?: string;\n} \| {\n mode: 'prompt';\n itemKey: string;\n sourceFilePath: string \| undefined;\n};\n\nfunction writeBackKeychainRef(\n itemKey: string,\n ref: { service: string; account?: string; keychain?: string },\n sourceFilePath: string \| undefined,\n) {\n // Use positional shorthand when only service is needed, named args when disambiguating\n let argsStr: string;\n if (!ref.account && !ref.keychain) {\n argsStr = `\"${ref.service}\"`;\n } else {\n const parts: Array<string> = [`service=\"${ref.service}\"`];\n if (ref.account) parts.push(`account=\"${ref.account}\"`);\n if (ref.keychain) parts.push(`keychain=\"${ref.keychain}\"`);\n argsStr = parts.join(', ');\n }\n\n writeBackValue(itemKey, `keychain(${argsStr})`, sourceFilePath);\n}\n\nexport const KeychainResolver: typeof Resolver = createResolver<KeychainResolverState>({\n name: 'keychain',\n label: 'Read from macOS Keychain',\n icon: 'mdi:key-chain',\n impliesSensitive: true,\n argsSchema: {\n type: 'mixed',\n arrayMinLength: 0,\n },\n process(): KeychainResolverState {\n if (process.platform !== 'darwin') {\n throw new SchemaError('keychain() is only supported on macOS');\n }\n\n // Check for prompt mode: keychain(prompt) or keychain(prompt=1)\n const promptArg = this.objArgs?.prompt;\n const isPromptPositional = this.arrArgs?.length === 1\n && this.arrArgs[0]?.isStatic\n && this.arrArgs[0].staticValue === 'prompt';\n\n if (promptArg \|\| isPromptPositional) {\n const parent = (this as any).parent;\n const itemKey = parent?.key \|\| 'unknown';\n const dataSource = this.dataSource as any;\n const sourceFilePath = dataSource?.fullPath as string \| undefined;\n return { mode: 'prompt', itemKey, sourceFilePath };\n }\n\n // Named args mode: keychain(service=\"...\", account=\"...\", keychain=\"...\", field=\"...\")\n const serviceArg = this.objArgs?.service;\n const accountArg = this.objArgs?.account;\n const keychainArg = this.objArgs?.keychain;\n const fieldArg = this.objArgs?.field;\n\n const account = accountArg?.isStatic ? accountArg.staticValue as string : undefined;\n const keychain = keychainArg?.isStatic ? keychainArg.staticValue as string : undefined;\n const field = fieldArg?.isStatic ? fieldArg.staticValue as string : undefined;\n\n if (serviceArg) {\n if (!serviceArg.isStatic \|\| typeof serviceArg.staticValue !== 'string') {\n throw new SchemaError('keychain() service must be a static string');\n }\n return {\n mode: 'get', service: serviceArg.staticValue, account, keychain, field,\n };\n }\n\n // account-only lookup: keychain(account=\"admin@corp.com\", field=\"account\")\n if (accountArg) {\n return {\n mode: 'get', account, keychain, field,\n };\n }\n\n // Positional shorthand: keychain(\"com.company.service\")\n if (this.arrArgs?.length === 1 && this.arrArgs[0]?.isStatic) {\n const value = this.arrArgs[0].staticValue;\n if (typeof value !== 'string') {\n throw new SchemaError('keychain() expects a string service name');\n }\n return { mode: 'get', service: value, field };\n }\n\n throw new SchemaError(\n 'keychain() requires service name, account, or prompt mode. '\n + 'Usage: keychain(service=\"com.example\"), keychain(\"com.example\"), or keychain(prompt)',\n );\n },\n async resolve(state: KeychainResolverState) {\n const client = getDaemonClient();\n\n if (state.mode === 'get') {\n try {\n return await client.keychainGet({\n service: state.service,\n account: state.account,\n keychain: state.keychain,\n field: state.field,\n });\n } catch (err) {\n throw new ResolutionError(\n `Failed to read keychain item: ${err instanceof Error ? err.message : err}`,\n {\n tip: [\n state.service ? `Service: ${state.service}` : null,\n state.account ? `Account: ${state.account}` : null,\n state.keychain ? `Keychain: ${state.keychain}` : null,\n state.field ? `Field: ${state.field}` : null,\n 'Make sure the item exists in your Keychain and VarlockEnclave has access.',\n 'You can grant access via: keychain(prompt)',\n ].filter(Boolean).join('\\n'),\n },\n );\n }\n }\n\n // Prompt mode: show native picker, write back reference\n const { itemKey, sourceFilePath } = state;\n\n const selected = await client.keychainPick({ itemKey });\n if (!selected) {\n throw new ResolutionError('Keychain item selection was cancelled', {\n tip: 'Run varlock again and select an item, or use keychain(service=\"...\") with an explicit service name',\n });\n }\n\n writeBackKeychainRef(itemKey, selected, sourceFilePath);\n\n // Now fetch the actual value\n try {\n return await client.keychainGet({\n service: selected.service,\n account: selected.account,\n keychain: selected.keychain,\n });\n } catch (err) {\n throw new ResolutionError(\n `Selected keychain item but failed to read value: ${err instanceof Error ? err.message : err}`,\n {\n tip: 'The item reference has been written to your config. Try running varlock again.',\n },\n );\n }\n },\n});\n","import path from 'node:path';\nimport fs from 'node:fs';\n\nexport type VarlockPackageJsonConfig = {\n /* Path (or array of paths) to a specific .env file or directory to use as the entry point for loading /\n loadPath?: string \| Array<string>;\n};\n\n/\n Reads varlock configuration from the `package.json` in `cwd`.\n * Returns undefined if no `package.json` exists or it has no `varlock` key.\n /\nexport function readVarlockPackageJsonConfig(opts?: { cwd?: string }): VarlockPackageJsonConfig \| undefined {\n const cwd = opts?.cwd ?? process.cwd();\n const pkgPath = path.join(cwd, 'package.json');\n if (!fs.existsSync(pkgPath)) return undefined;\n try {\n const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));\n if (pkg.varlock && typeof pkg.varlock === 'object') {\n return pkg.varlock as VarlockPackageJsonConfig;\n }\n } catch { / ignore parse errors / }\n return undefined;\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\nimport { loadEnvGraph } from '../env-graph';\nimport { VarlockResolver } from './local-encrypt/builtin-resolver';\nimport { KeychainResolver } from './local-encrypt/keychain-resolver';\nimport { CliExitError } from '../cli/helpers/exit-error';\nimport { runWithWorkspaceInfo } from './workspace-utils';\nimport { readVarlockPackageJsonConfig } from './package-json-config';\nimport { createDebug } from './debug';\n\nconst debug = createDebug('varlock:load');\n\nfunction normalizePkgLoadPath(pkgLoadPath: string \| Array<string>): Array<string> {\n if (Array.isArray(pkgLoadPath)) return pkgLoadPath;\n return [pkgLoadPath];\n}\n\nfunction loadFromPaths(\n rawPaths: Array<string>,\n config: {\n source: string,\n errorPrefix: string,\n errorSuggestion: string,\n currentEnvFallback?: string,\n },\n) {\n const resolvedPaths = rawPaths.map((p) => path.resolve(p));\n\n if (resolvedPaths.length === 1) {\n debug('using path from %s: %s', config.source, resolvedPaths[0]);\n } else {\n debug('using %d paths from %s: %s', resolvedPaths.length, config.source, resolvedPaths.join(', '));\n }\n\n for (const resolvedPath of resolvedPaths) {\n if (!fs.existsSync(resolvedPath)) {\n throw new CliExitError(`${config.errorPrefix}: ${resolvedPath}`, {\n suggestion: config.errorSuggestion,\n });\n }\n }\n\n return runWithWorkspaceInfo(() => loadEnvGraph({\n currentEnvFallback: config.currentEnvFallback,\n entryFilePaths: resolvedPaths,\n afterInit: async (g) => {\n g.registerResolver(VarlockResolver);\n g.registerResolver(KeychainResolver);\n },\n }));\n}\n\nexport function loadVarlockEnvGraph(opts?: {\n currentEnvFallback?: string,\n /* Explicit entry file paths from --path flag(s) - overrides package.json config */\n entryFilePaths?: Array<string>,\n}) {\n const cliPaths = opts?.entryFilePaths?.filter(Boolean);\n\n // If --path flag(s) provided, they take precedence over package.json config\n if (cliPaths && cliPaths.length > 0) {\n // Return early and ignore pkgLoadPaths\n return loadFromPaths(cliPaths, {\n source: '--path flag',\n errorPrefix: 'The --path value does not exist',\n errorSuggestion: 'Use `--path` to specify a valid file or directory.',\n currentEnvFallback: opts?.currentEnvFallback,\n });\n }\n\n // Fall back to package.json varlock.loadPath\n const pkgLoadPath = readVarlockPackageJsonConfig()?.loadPath;\n const pkgLoadPaths = pkgLoadPath ? normalizePkgLoadPath(pkgLoadPath) : undefined;\n\n if (pkgLoadPaths) {\n return loadFromPaths(pkgLoadPaths, {\n source: 'package.json varlock.loadPath',\n errorPrefix: 'A path in `varlock.loadPath` configured in package.json does not exist',\n errorSuggestion: 'Update `varlock.loadPath` in your package.json to point to valid files or directories.',\n currentEnvFallback: opts?.currentEnvFallback,\n });\n }\n\n debug('no path configured, using cwd: %s', process.cwd());\n\n return runWithWorkspaceInfo(() => loadEnvGraph({\n currentEnvFallback: opts?.currentEnvFallback,\n afterInit: async (g) => {\n g.registerResolver(VarlockResolver);\n g.registerResolver(KeychainResolver);\n },\n }));\n}\n"]}
1	+ {"version":3,"sources":["../src/lib/local-encrypt/write-back.ts","../src/lib/local-encrypt/builtin-resolver.ts","../src/lib/local-encrypt/keychain-resolver.ts","../src/lib/package-json-config.ts","../src/lib/load-graph.ts"],"names":["ciphertext","writeBackResult","fs","path"],"mappings":";;;;;;;;AAcO,SAAS,cAAA,CACd,OAAA,EACA,WAAA,EACA,cAAA,EACiB;AACjB,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,qBAAA,EAAsB;AAAA,EACzD;AAEA,EAAA,MAAM,eAAA,GAAkB,EAAA,CAAG,YAAA,CAAa,cAAA,EAAgB,OAAO,CAAA;AAC/D,EAAA,MAAM,IAAA,GAAO,uBAAuB,eAAe,CAAA;AAEnD,EAAA,MAAM,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,OAAO,CAAA;AAC3D,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACpD;AAGA,EAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,CAAA,EAAA,EAAK,WAAW,CAAA,CAAE,CAAA;AAC3D,EAAA,MAAM,SAAA,GAAY,SAAA,CAAU,WAAA,CAAY,CAAC,CAAA;AACzC,EAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACpD;AAGA,EAAA,IAAA,CAAK,IAAA,CAAK,QAAQ,SAAA,CAAU,KAAA;AAC5B,EAAA,IAAA,CAAK,QAAQ,SAAA,CAAU,KAAA;AAEvB,EAAA,EAAA,CAAG,aAAA,CAAc,cAAA,EAAgB,IAAA,CAAK,QAAA,EAAU,CAAA;AAChD,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AA9BgB,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;;;ACDhB,IAAM,YAAA,GAAe,QAAA;AACrB,IAAM,WAAA,GAAc,iBAAA;AAkBpB,IAAI,YAAA;AAEJ,SAAS,kBAAkB,KAAA,EAA0B;AACnD,EAAA,IAAI,YAAA,GAAe,KAAA;AACnB,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,YAAA,GAAe,EAAC;AAChB,IAAA,YAAA,GAAe,IAAA;AAAA,EACjB;AACA,EAAA,YAAA,CAAa,KAAK,KAAK,CAAA;AAEvB,EAAA,IAAI,YAAA,EAAc;AAEhB,IAAA,YAAA,CAAa,MAAM,cAAc,CAAA;AAAA,EACnC;AACF;AAZS,MAAA,CAAA,iBAAA,EAAA,mBAAA,CAAA;AAcT,SAAS,eAAe,UAAA,EAAqC;AAC3D,EAAA,OAAO,IAAI,OAAA,CAAgB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC9C,IAAA,iBAAA,CAAkB;AAAA,MAChB,IAAA,EAAM,SAAA;AAAA,MAAW,UAAA;AAAA,MAAY,OAAA;AAAA,MAAS;AAAA,KACvC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AANS,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAQT,SAAS,cAAc,OAAA,EAAiD;AACtE,EAAA,OAAO,IAAI,OAAA,CAAgB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC9C,IAAA,iBAAA,CAAkB;AAAA,MAChB,IAAA,EAAM,QAAA;AAAA,MAAU,OAAA;AAAA,MAAS,OAAA;AAAA,MAAS;AAAA,KACnC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AANS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAQT,SAAS,aAAA,CAAc,KAAA,EAAiC,UAAA,EAAoB,KAAA,EAAc;AACxF,EAAA,KAAA,IAAS,CAAA,GAAI,UAAA,EAAY,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AAC9C,IAAA,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,EACvB;AACF;AAJS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAMT,eAAe,YAAA,GAAe;AAC5B,EAAA,MAAM,KAAA,GAAQ,YAAA;AACd,EAAA,YAAA,GAAe,MAAA;AACf,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAGpB,EAAA,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM;AACnB,IAAA,IAAI,CAAA,CAAE,IAAA,KAAS,CAAA,CAAE,IAAA,EAAM,OAAO,CAAA;AAC9B,IAAA,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,EAAA,GAAK,CAAA;AAAA,EACpC,CAAC,CAAA;AAGD,EAAA,MAAmB,SAAA,EAAU;AAE7B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,KAAA,GAAQ,MAAM,CAAC,CAAA;AACrB,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,CAAM,SAAS,SAAA,EAAW;AAC5B,QAAA,MAAM,SAAA,GAAY,MAAmB,YAAA,CAAa,KAAA,CAAM,UAAU,CAAA;AAClE,QAAA,KAAA,CAAM,QAAQ,SAAS,CAAA;AAAA,MACzB,CAAA,MAAO;AACL,QAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,EAAQ;AACnC,QAAA,KAAA,CAAM,QAAQ,MAAM,CAAA;AAAA,MACtB;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAGhB,MAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC3D,MAAA,IACE,GAAA,CAAI,QAAA,CAAS,WAAW,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,UAAU,CAAA,IACjD,GAAA,CAAI,QAAA,CAAS,qBAAqB,CAAA,EACrC;AACA,QAAA,aAAA,CAAc,OAAO,CAAA,GAAI,CAAA,EAAG,IAAI,eAAA,CAAgB,+BAA0B,CAAC,CAAA;AAC3E,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAtCe,MAAA,CAAA,YAAA,EAAA,cAAA,CAAA;AAiDf,SAAS,uBAAA,CACP,OAAA,EACA,UAAA,EACA,cAAA,EACA;AACA,EAAA,MAAM,kBAAA,GAAqB,CAAA,EAAG,YAAY,CAAA,EAAG,UAAU,CAAA,CAAA;AACvD,EAAA,OAAO,cAAA,CAAe,OAAA,EAAS,CAAA,SAAA,EAAY,kBAAkB,MAAM,cAAc,CAAA;AACnF;AAPS,MAAA,CAAA,uBAAA,EAAA,yBAAA,CAAA;AAUF,IAAM,kBAAmC,cAAA,CAAqC;AAAA,EACnF,IAAA,EAAM,SAAA;AAAA,EACN,KAAA,EAAO,iCAAA;AAAA,EACP,IAAA,EAAM,WAAA;AAAA,EACN,gBAAA,EAAkB,IAAA;AAAA,EAClB,UAAA,EAAY;AAAA,IACV,IAAA,EAAM,OAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,OAAA,GAAgC;AAE9B,IAAA,MAAM,SAAA,GAAY,KAAK,OAAA,EAAS,MAAA;AAChC,IAAA,MAAM,kBAAA,GAAqB,IAAA,CAAK,OAAA,EAAS,MAAA,KAAW,KAC/C,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAA,IACjB,IAAA,CAAK,OAAA,CAAQ,CAAC,EAAE,WAAA,KAAgB,QAAA;AACrC,IAAA,IAAI,aAAa,kBAAA,EAAoB;AAEnC,MAAA,MAAM,SAAU,IAAA,CAAa,MAAA;AAC7B,MAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,IAAO,SAAA;AAC/B,MAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,MAAA,MAAM,iBAAiB,UAAA,EAAY,QAAA;AACnC,MAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,cAAA,EAAe;AAAA,IACnD;AAGA,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC9C,MAAA,MAAM,IAAI,YAAY,qFAAqF,CAAA;AAAA,IAC7G;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,CAAQ,CAAC,GAAG,QAAA,EAAU;AAC9B,MAAA,MAAM,IAAI,YAAY,4DAA4D,CAAA;AAAA,IACpF;AACA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,CAAE,WAAA;AAChC,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,YAAY,qCAAqC,CAAA;AAAA,IAC7D;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAQ;AAAA,EACpC,CAAA;AAAA,EACA,MAAM,QAAQ,KAAA,EAA6B;AACzC,IAAA,IAAI,KAAA,CAAM,SAAS,SAAA,EAAW;AAC5B,MAAA,IAAI,aAAa,KAAA,CAAM,OAAA;AACvB,MAAA,IAAI,UAAA,CAAW,UAAA,CAAW,YAAY,CAAA,EAAG;AACvC,QAAA,UAAA,GAAa,UAAA,CAAW,KAAA,CAAM,YAAA,CAAa,MAAM,CAAA;AAAA,MACnD;AACA,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,eAAe,UAAU,CAAA;AAAA,MACxC,SAAS,GAAA,EAAK;AAEZ,QAAA,IAAI,GAAA,YAAe,iBAAiB,MAAM,GAAA;AAE1C,QAAA,MAAM,UAAuB,cAAA,EAAe;AAC5C,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,CAAA,mBAAA,EAAsB,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA,CAAA;AAAA,UAC9D;AAAA,YACE,GAAA,EAAK;AAAA,cACH,YAAY,OAAA,CAAQ,IAAI,KAAK,OAAA,CAAQ,cAAA,GAAiB,oBAAoB,YAAY,CAAA,CAAA,CAAA;AAAA,cACtF,6EAAA;AAAA,cACA;AAAA,aACF,CAAE,KAAK,IAAI;AAAA;AACb,SACF;AAAA,MACF;AAAA,IACF;AAIA,IAAA,MAAM,EAAE,OAAA,EAAS,cAAA,EAAe,GAAI,KAAA;AACpC,IAAA,OAAO,cAAc,YAAY;AAC/B,MAAA,MAAM,UAAuB,cAAA,EAAe;AAG5C,MAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,gBAAA,IAAoB,OAAA,CAAQ,kBAAA,EAAoB;AACnE,QAAA,MAAM,SAAsB,eAAA,EAAgB;AAC5C,QAAA,MAAMA,WAAAA,GAAa,MAAM,MAAA,CAAO,YAAA,CAAa;AAAA,UAC3C,OAAA;AAAA,UACA,OAAA,EAAS,8BAA8B,OAAO,CAAA,CAAA;AAAA,SAC/C,CAAA;AAED,QAAA,IAAI,CAACA,WAAAA,EAAY;AACf,UAAA,MAAM,IAAI,gBAAgB,4BAAA,EAA8B;AAAA,YACtD,GAAA,EAAK;AAAA,WACN,CAAA;AAAA,QACH;AAEA,QAAA,MAAMC,gBAAAA,GAAkB,uBAAA,CAAwB,OAAA,EAASD,WAAAA,EAAY,cAAc,CAAA;AACnF,QAAA,IAAI,CAACC,iBAAgB,OAAA,EAAS;AAC5B,UAAA,IAAIA,gBAAAA,CAAgB,WAAW,qBAAA,EAAuB;AACpD,YAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,cAC5E,GAAA,EAAK;AAAA,aACN,CAAA;AAAA,UACH;AAEA,UAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,YAC5E,GAAA,EAAK,CAAA,4BAAA,EAA+B,OAAO,CAAA,mCAAA,EAAsC,cAAc,CAAA,CAAA;AAAA,WAChG,CAAA;AAAA,QACH;AAEA,QAAA,OAAoB,aAAaD,WAAU,CAAA;AAAA,MAC7C;AAGA,MAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAC,OAAA,CAAQ,MAAM,KAAA,EAAO;AACjD,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,gCAAgC,OAAO,CAAA,CAAA;AAAA,UACvC;AAAA,YACE,GAAA,EAAK,CAAA,6BAAA,EAAgC,cAAA,IAAkB,iBAAiB,CAAA,uCAAA;AAAA;AAC1E,SACF;AAAA,MACF;AAEA,MAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAQ,QAAA,CAAS,EAAE,OAAA,EAAS,CAAA,2BAAA,EAA8B,OAAO,CAAA,CAAA,CAAA,EAAK,IAAA,EAAM,8CAAA,EAAgD,CAAA;AACnJ,MAAA,MAAM,UAAA,GAAa,OAAO,QAAA,KAAa,QAAA;AACvC,MAAA,IAAI,UAAA,IAAc,CAAC,QAAA,EAAU;AAC3B,QAAA,MAAM,IAAI,gBAAgB,4BAAA,EAA8B;AAAA,UACtD,GAAA,EAAK;AAAA,SACN,CAAA;AAAA,MACH;AAEA,MAAA,MAAM,UAAA,GAAa,MAAmB,YAAA,CAAa,QAAQ,CAAA;AAC3D,MAAA,MAAM,eAAA,GAAkB,uBAAA,CAAwB,OAAA,EAAS,UAAA,EAAY,cAAc,CAAA;AAEnF,MAAA,IAAI,CAAC,gBAAgB,OAAA,EAAS;AAC5B,QAAA,IAAI,eAAA,CAAgB,WAAW,qBAAA,EAAuB;AACpD,UAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,YAC5E,GAAA,EAAK;AAAA,WACN,CAAA;AAAA,QACH;AAEA,QAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,sCAAA,EAAyC,OAAO,CAAA,CAAA,EAAI;AAAA,UAC5E,GAAA,EAAK,CAAA,4BAAA,EAA+B,OAAO,CAAA,mCAAA,EAAsC,cAAc,CAAA,CAAA;AAAA,SAChG,CAAA;AAAA,MACH;AAEA,MAAA,OAAO,QAAA;AAAA,IACT,CAAC,CAAA;AAAA,EACH;AACF,CAAC,CAAA;;;ACxOD,SAAS,oBAAA,CACP,OAAA,EACA,GAAA,EACA,cAAA,EACA;AAEA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,CAAC,GAAA,CAAI,OAAA,IAAW,CAAC,IAAI,QAAA,EAAU;AACjC,IAAA,OAAA,GAAU,CAAA,CAAA,EAAI,IAAI,OAAO,CAAA,CAAA,CAAA;AAAA,EAC3B,CAAA,MAAO;AACL,IAAA,MAAM,KAAA,GAAuB,CAAC,CAAA,SAAA,EAAY,GAAA,CAAI,OAAO,CAAA,CAAA,CAAG,CAAA;AACxD,IAAA,IAAI,IAAI,OAAA,EAAS,KAAA,CAAM,KAAK,CAAA,SAAA,EAAY,GAAA,CAAI,OAAO,CAAA,CAAA,CAAG,CAAA;AACtD,IAAA,IAAI,IAAI,QAAA,EAAU,KAAA,CAAM,KAAK,CAAA,UAAA,EAAa,GAAA,CAAI,QAAQ,CAAA,CAAA,CAAG,CAAA;AACzD,IAAA,OAAA,GAAU,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EAC3B;AAEA,EAAA,cAAA,CAAe,OAAA,EAAS,CAAA,SAAA,EAAY,OAAO,CAAA,CAAA,CAAA,EAAK,cAAc,CAAA;AAChE;AAjBS,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AAmBF,IAAM,mBAAoC,cAAA,CAAsC;AAAA,EACrF,IAAA,EAAM,UAAA;AAAA,EACN,KAAA,EAAO,0BAAA;AAAA,EACP,IAAA,EAAM,eAAA;AAAA,EACN,gBAAA,EAAkB,IAAA;AAAA,EAClB,UAAA,EAAY;AAAA,IACV,IAAA,EAAM,OAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,OAAA,GAAiC;AAC/B,IAAA,IAAI,OAAA,CAAQ,aAAa,QAAA,EAAU;AACjC,MAAA,MAAM,IAAI,YAAY,uCAAuC,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,SAAA,GAAY,KAAK,OAAA,EAAS,MAAA;AAChC,IAAA,MAAM,kBAAA,GAAqB,IAAA,CAAK,OAAA,EAAS,MAAA,KAAW,KAC/C,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,EAAG,QAAA,IACjB,IAAA,CAAK,OAAA,CAAQ,CAAC,EAAE,WAAA,KAAgB,QAAA;AAErC,IAAA,IAAI,aAAa,kBAAA,EAAoB;AACnC,MAAA,MAAM,SAAU,IAAA,CAAa,MAAA;AAC7B,MAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,IAAO,SAAA;AAC/B,MAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,MAAA,MAAM,iBAAiB,UAAA,EAAY,QAAA;AACnC,MAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,cAAA,EAAe;AAAA,IACnD;AAGA,IAAA,MAAM,UAAA,GAAa,KAAK,OAAA,EAAS,OAAA;AACjC,IAAA,MAAM,UAAA,GAAa,KAAK,OAAA,EAAS,OAAA;AACjC,IAAA,MAAM,WAAA,GAAc,KAAK,OAAA,EAAS,QAAA;AAClC,IAAA,MAAM,QAAA,GAAW,KAAK,OAAA,EAAS,KAAA;AAE/B,IAAA,MAAM,OAAA,GAAU,UAAA,EAAY,QAAA,GAAW,UAAA,CAAW,WAAA,GAAwB,MAAA;AAC1E,IAAA,MAAM,QAAA,GAAW,WAAA,EAAa,QAAA,GAAW,WAAA,CAAY,WAAA,GAAwB,MAAA;AAC7E,IAAA,MAAM,KAAA,GAAQ,QAAA,EAAU,QAAA,GAAW,QAAA,CAAS,WAAA,GAAwB,MAAA;AAEpE,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,CAAC,UAAA,CAAW,QAAA,IAAY,OAAO,UAAA,CAAW,gBAAgB,QAAA,EAAU;AACtE,QAAA,MAAM,IAAI,YAAY,4CAA4C,CAAA;AAAA,MACpE;AACA,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,KAAA;AAAA,QAAO,SAAS,UAAA,CAAW,WAAA;AAAA,QAAa,OAAA;AAAA,QAAS,QAAA;AAAA,QAAU;AAAA,OACnE;AAAA,IACF;AAGA,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,KAAA;AAAA,QAAO,OAAA;AAAA,QAAS,QAAA;AAAA,QAAU;AAAA,OAClC;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,MAAA,KAAW,CAAA,IAAK,KAAK,OAAA,CAAQ,CAAC,GAAG,QAAA,EAAU;AAC3D,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,CAAE,WAAA;AAC9B,MAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,QAAA,MAAM,IAAI,YAAY,0CAA0C,CAAA;AAAA,MAClE;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,OAAA,EAAS,OAAO,KAAA,EAAM;AAAA,IAC9C;AAEA,IAAA,MAAM,IAAI,WAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF,CAAA;AAAA,EACA,MAAM,QAAQ,KAAA,EAA8B;AAC1C,IAAA,MAAM,SAAS,eAAA,EAAgB;AAE/B,IAAA,IAAI,KAAA,CAAM,SAAS,KAAA,EAAO;AACxB,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,OAAO,WAAA,CAAY;AAAA,UAC9B,SAAS,KAAA,CAAM,OAAA;AAAA,UACf,SAAS,KAAA,CAAM,OAAA;AAAA,UACf,UAAU,KAAA,CAAM,QAAA;AAAA,UAChB,OAAO,KAAA,CAAM;AAAA,SACd,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,CAAA,8BAAA,EAAiC,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA,CAAA;AAAA,UACzE;AAAA,YACE,GAAA,EAAK;AAAA,cACH,KAAA,CAAM,OAAA,GAAU,CAAA,SAAA,EAAY,KAAA,CAAM,OAAO,CAAA,CAAA,GAAK,IAAA;AAAA,cAC9C,KAAA,CAAM,OAAA,GAAU,CAAA,SAAA,EAAY,KAAA,CAAM,OAAO,CAAA,CAAA,GAAK,IAAA;AAAA,cAC9C,KAAA,CAAM,QAAA,GAAW,CAAA,UAAA,EAAa,KAAA,CAAM,QAAQ,CAAA,CAAA,GAAK,IAAA;AAAA,cACjD,KAAA,CAAM,KAAA,GAAQ,CAAA,OAAA,EAAU,KAAA,CAAM,KAAK,CAAA,CAAA,GAAK,IAAA;AAAA,cACxC,2EAAA;AAAA,cACA;AAAA,aACF,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,KAAK,IAAI;AAAA;AAC7B,SACF;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,EAAE,OAAA,EAAS,cAAA,EAAe,GAAI,KAAA;AAEpC,IAAA,MAAM,WAAW,MAAM,MAAA,CAAO,YAAA,CAAa,EAAE,SAAS,CAAA;AACtD,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,gBAAgB,uCAAA,EAAyC;AAAA,QACjE,GAAA,EAAK;AAAA,OACN,CAAA;AAAA,IACH;AAEA,IAAA,oBAAA,CAAqB,OAAA,EAAS,UAAU,cAAc,CAAA;AAGtD,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,OAAO,WAAA,CAAY;AAAA,QAC9B,SAAS,QAAA,CAAS,OAAA;AAAA,QAClB,SAAS,QAAA,CAAS,OAAA;AAAA,QAClB,UAAU,QAAA,CAAS;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,CAAA,iDAAA,EAAoD,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA,CAAA;AAAA,QAC5F;AAAA,UACE,GAAA,EAAK;AAAA;AACP,OACF;AAAA,IACF;AAAA,EACF;AACF,CAAC,CAAA;ACnKM,SAAS,6BAA6B,IAAA,EAA+D;AAC1G,EAAA,MAAM,GAAA,GAAM,IAAA,EAAM,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAI;AACrC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,cAAc,CAAA;AAC7C,EAAA,IAAI,CAACE,EAAAA,CAAG,UAAA,CAAW,OAAO,GAAG,OAAO,MAAA;AACpC,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAMA,GAAG,YAAA,CAAa,OAAA,EAAS,OAAO,CAAC,CAAA;AACxD,IAAA,IAAI,GAAA,CAAI,OAAA,IAAW,OAAO,GAAA,CAAI,YAAY,QAAA,EAAU;AAClD,MAAA,OAAO,GAAA,CAAI,OAAA;AAAA,IACb;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAA4B;AACpC,EAAA,OAAO,MAAA;AACT;AAXgB,MAAA,CAAA,4BAAA,EAAA,8BAAA,CAAA;;;ACFhB,IAAM,KAAA,GAAQ,YAAY,cAAc,CAAA;AAExC,SAAS,qBAAqB,WAAA,EAAoD;AAChF,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,EAAG,OAAO,WAAA;AACvC,EAAA,OAAO,CAAC,WAAW,CAAA;AACrB;AAHS,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA;AAKT,SAAS,aAAA,CACP,UACA,MAAA,EAMA;AACA,EAAA,MAAM,aAAA,GAAgB,SAAS,GAAA,CAAI,CAAC,MAAMC,IAAAA,CAAK,OAAA,CAAQ,CAAC,CAAC,CAAA;AAEzD,EAAA,IAAI,aAAA,CAAc,WAAW,CAAA,EAAG;AAC9B,IAAA,KAAA,CAAM,wBAAA,EAA0B,MAAA,CAAO,MAAA,EAAQ,aAAA,CAAc,CAAC,CAAC,CAAA;AAAA,EACjE,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,4BAAA,EAA8B,cAAc,MAAA,EAAQ,MAAA,CAAO,QAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,EACnG;AAEA,EAAA,KAAA,MAAW,gBAAgB,aAAA,EAAe;AACxC,IAAA,IAAI,CAACD,EAAAA,CAAG,UAAA,CAAW,YAAY,CAAA,EAAG;AAChC,MAAA,MAAM,IAAI,YAAA,CAAa,CAAA,EAAG,OAAO,WAAW,CAAA,EAAA,EAAK,YAAY,CAAA,CAAA,EAAI;AAAA,QAC/D,YAAY,MAAA,CAAO;AAAA,OACpB,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,oBAAA,CAAqB,MAAM,YAAA,CAAa;AAAA,IAC7C,oBAAoB,MAAA,CAAO,kBAAA;AAAA,IAC3B,cAAA,EAAgB,aAAA;AAAA,IAChB,SAAA,gCAAkB,CAAA,KAAM;AACtB,MAAA,CAAA,CAAE,iBAAiB,eAAe,CAAA;AAClC,MAAA,CAAA,CAAE,iBAAiB,gBAAgB,CAAA;AAAA,IACrC,CAAA,EAHW,WAAA;AAAA,GAIZ,CAAC,CAAA;AACJ;AAjCS,MAAA,CAAA,aAAA,EAAA,eAAA,CAAA;AAmCF,SAAS,oBAAoB,IAAA,EAIjC;AACD,EAAA,MAAM,QAAA,GAAW,IAAA,EAAM,cAAA,EAAgB,MAAA,CAAO,OAAO,CAAA;AAGrD,EAAA,IAAI,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAEnC,IAAA,OAAO,cAAc,QAAA,EAAU;AAAA,MAC7B,MAAA,EAAQ,aAAA;AAAA,MACR,WAAA,EAAa,iCAAA;AAAA,MACb,eAAA,EAAiB,oDAAA;AAAA,MACjB,oBAAoB,IAAA,EAAM;AAAA,KAC3B,CAAA;AAAA,EACH;AAGA,EAAA,MAAM,WAAA,GAAc,8BAA6B,EAAG,QAAA;AACpD,EAAA,MAAM,YAAA,GAAe,WAAA,GAAc,oBAAA,CAAqB,WAAW,CAAA,GAAI,MAAA;AAEvE,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,OAAO,cAAc,YAAA,EAAc;AAAA,MACjC,MAAA,EAAQ,+BAAA;AAAA,MACR,WAAA,EAAa,wEAAA;AAAA,MACb,eAAA,EAAiB,wFAAA;AAAA,MACjB,oBAAoB,IAAA,EAAM;AAAA,KAC3B,CAAA;AAAA,EACH;AAEA,EAAA,KAAA,CAAM,mCAAA,EAAqC,OAAA,CAAQ,GAAA,EAAK,CAAA;AAExD,EAAA,OAAO,oBAAA,CAAqB,MAAM,YAAA,CAAa;AAAA,IAC7C,oBAAoB,IAAA,EAAM,kBAAA;AAAA,IAC1B,SAAA,gCAAkB,CAAA,KAAM;AACtB,MAAA,CAAA,CAAE,iBAAiB,eAAe,CAAA;AAClC,MAAA,CAAA,CAAE,iBAAiB,gBAAgB,CAAA;AAAA,IACrC,CAAA,EAHW,WAAA;AAAA,GAIZ,CAAC,CAAA;AACJ;AAxCgB,MAAA,CAAA,mBAAA,EAAA,qBAAA,CAAA","file":"chunk-Q4I7MXFB.js","sourcesContent":["/*\n Shared utilities for writing back encrypted/resolved values to .env files.\n \n Uses the env-spec AST parser to safely update values.\n /\n\nimport fs from 'node:fs';\nimport { parseEnvSpecDotEnvFile } from '@env-spec/parser';\n\ntype WriteBackResult = { updated: boolean; reason?: 'missing-source-file' \| 'item-not-found' };\n\n/\n Update a config item's value in a .env file using AST-based replacement.\n /\nexport function writeBackValue(\n itemKey: string,\n newValueStr: string,\n sourceFilePath: string \| undefined,\n): WriteBackResult {\n if (!sourceFilePath) {\n return { updated: false, reason: 'missing-source-file' };\n }\n\n const currentContents = fs.readFileSync(sourceFilePath, 'utf-8');\n const file = parseEnvSpecDotEnvFile(currentContents);\n\n const item = file.configItems.find((i) => i.key === itemKey);\n if (!item) {\n return { updated: false, reason: 'item-not-found' };\n }\n\n // Parse a dummy line to get the correct AST value node\n const dummyFile = parseEnvSpecDotEnvFile(`_=${newValueStr}`);\n const dummyItem = dummyFile.configItems[0];\n if (!dummyItem?.value) {\n return { updated: false, reason: 'item-not-found' };\n }\n\n // Replace the value\n item.data.value = dummyItem.value;\n item.value = dummyItem.value;\n\n fs.writeFileSync(sourceFilePath, file.toString());\n return { updated: true };\n}\n\n","/\n Built-in varlock() resolver function.\n \n Replaces the plugin-based resolver from @varlock/secure-enclave-plugin.\n * Works cross-platform using the local-encrypt abstraction layer.\n /\n\nimport { createResolver, Resolver } from '../../env-graph/lib/resolver';\nimport { ResolutionError, SchemaError } from '../../env-graph/lib/errors';\nimport prompts from '../../cli/helpers/prompts';\nimport as localEncrypt from './index';\nimport { writeBackValue } from './write-back';\n\nconst LOCAL_PREFIX = 'local:';\nconst PLUGIN_ICON = 'mdi:fingerprint';\n\n// ── Unified varlock() batch queue ──────────────────────────────\n// Collects all concurrent varlock() calls (both prompt and decrypt) into a\n// single batch using setImmediate, then processes them sequentially.\n// Prompts are sorted first so the user enters values before biometric decrypts.\n// If the user cancels a prompt or biometric auth, all remaining items in the\n// batch are rejected immediately.\n\ntype VarlockBatchEntry = {\n kind: 'prompt' \| 'decrypt';\n resolve: (value: string) => void;\n reject: (reason: unknown) => void;\n} & (\n \| { kind: 'decrypt'; ciphertext: string }\n \| { kind: 'prompt'; execute: () => Promise<string> }\n);\n\nlet pendingBatch: Array<VarlockBatchEntry> \| undefined;\n\nfunction enqueueBatchEntry(entry: VarlockBatchEntry) {\n let triggerBatch = false;\n if (!pendingBatch) {\n pendingBatch = [];\n triggerBatch = true;\n }\n pendingBatch.push(entry);\n\n if (triggerBatch) {\n // eslint-disable-next-line no-use-before-define\n setImmediate(() => executeBatch());\n }\n}\n\nfunction enqueueDecrypt(ciphertext: string): Promise<string> {\n return new Promise<string>((resolve, reject) => {\n enqueueBatchEntry({\n kind: 'decrypt', ciphertext, resolve, reject,\n });\n });\n}\n\nfunction enqueuePrompt(execute: () => Promise<string>): Promise<string> {\n return new Promise<string>((resolve, reject) => {\n enqueueBatchEntry({\n kind: 'prompt', execute, resolve, reject,\n });\n });\n}\n\nfunction bailRemaining(batch: Array<VarlockBatchEntry>, startIndex: number, error: Error) {\n for (let j = startIndex; j < batch.length; j++) {\n batch[j].reject(error);\n }\n}\n\nasync function executeBatch() {\n const batch = pendingBatch;\n pendingBatch = undefined;\n if (!batch?.length) return;\n\n // Sort prompts before decrypts so the user enters values first\n batch.sort((a, b) => {\n if (a.kind === b.kind) return 0;\n return a.kind === 'prompt' ? -1 : 1;\n });\n\n // Ensure encryption key exists before processing any items\n await localEncrypt.ensureKey();\n\n for (let i = 0; i < batch.length; i++) {\n const entry = batch[i];\n try {\n if (entry.kind === 'decrypt') {\n const plaintext = await localEncrypt.decryptValue(entry.ciphertext);\n entry.resolve(plaintext);\n } else {\n const result = await entry.execute();\n entry.resolve(result);\n }\n } catch (err) {\n entry.reject(err);\n\n // If this looks like a user cancellation or auth failure, bail on remaining items\n const msg = err instanceof Error ? err.message : String(err);\n if (\n msg.includes('cancelled') \|\| msg.includes('canceled')\n \|\| msg.includes('verification failed')\n ) {\n bailRemaining(batch, i + 1, new ResolutionError('Skipped — user cancelled'));\n return;\n }\n }\n }\n}\n\ntype VarlockResolverState = {\n mode: 'decrypt';\n payload: string;\n} \| {\n mode: 'prompt';\n itemKey: string;\n sourceFilePath: string \| undefined;\n};\n\nfunction writeBackEncryptedValue(\n itemKey: string,\n ciphertext: string,\n sourceFilePath: string \| undefined,\n) {\n const prefixedCiphertext = `${LOCAL_PREFIX}${ciphertext}`;\n return writeBackValue(itemKey, `varlock(\"${prefixedCiphertext}\")`, sourceFilePath);\n}\n\n\nexport const VarlockResolver: typeof Resolver = createResolver<VarlockResolverState>({\n name: 'varlock',\n label: 'Decrypt locally encrypted value',\n icon: PLUGIN_ICON,\n impliesSensitive: true,\n argsSchema: {\n type: 'mixed',\n arrayMinLength: 0,\n },\n process(): VarlockResolverState {\n // Check for prompt mode: varlock(prompt=1) or varlock(prompt)\n const promptArg = this.objArgs?.prompt;\n const isPromptPositional = this.arrArgs?.length === 1\n && this.arrArgs[0]?.isStatic\n && this.arrArgs[0].staticValue === 'prompt';\n if (promptArg \|\| isPromptPositional) {\n // Resolver doesn't expose parent item in its type, but it's available at runtime\n const parent = (this as any).parent;\n const itemKey = parent?.key \|\| 'unknown';\n const dataSource = this.dataSource as any;\n const sourceFilePath = dataSource?.fullPath as string \| undefined;\n return { mode: 'prompt', itemKey, sourceFilePath };\n }\n\n // Normal mode: varlock(\"encrypted-payload\")\n if (!this.arrArgs \|\| this.arrArgs.length !== 1) {\n throw new SchemaError('varlock() expects a single encrypted payload string, or prompt to enter a new value');\n }\n if (!this.arrArgs[0]?.isStatic) {\n throw new SchemaError('varlock() expects a single static encrypted payload string');\n }\n const payload = this.arrArgs[0].staticValue;\n if (typeof payload !== 'string') {\n throw new SchemaError('varlock() expects a string argument');\n }\n return { mode: 'decrypt', payload };\n },\n async resolve(state: VarlockResolverState) {\n if (state.mode === 'decrypt') {\n let ciphertext = state.payload;\n if (ciphertext.startsWith(LOCAL_PREFIX)) {\n ciphertext = ciphertext.slice(LOCAL_PREFIX.length);\n }\n try {\n return await enqueueDecrypt(ciphertext);\n } catch (err) {\n // Re-throw ResolutionErrors (e.g. batch cancellation) as-is\n if (err instanceof ResolutionError) throw err;\n\n const backend = localEncrypt.getBackendInfo();\n throw new ResolutionError(\n `Decryption failed: ${err instanceof Error ? err.message : err}`,\n {\n tip: [\n `Backend: ${backend.type} (${backend.hardwareBacked ? 'hardware-backed' : 'file-based'})`,\n 'This usually means the value was encrypted with a different key or backend.',\n 'Set a new value using `varlock encrypt` or `KEY=varlock(prompt)`.',\n ].join('\\n'),\n },\n );\n }\n }\n\n // Prompt mode: enqueued into the unified batch so prompts run before decrypts\n // and cancellation propagates to all remaining items.\n const { itemKey, sourceFilePath } = state;\n return enqueuePrompt(async () => {\n const backend = localEncrypt.getBackendInfo();\n\n // Use daemon's native dialog on macOS Secure Enclave\n if (backend.type === 'secure-enclave' && backend.biometricAvailable) {\n const client = localEncrypt.getDaemonClient();\n const ciphertext = await client.promptSecret({\n itemKey,\n message: `Enter the secret value for ${itemKey}:`,\n });\n\n if (!ciphertext) {\n throw new ResolutionError('Secret input was cancelled', {\n tip: 'Run varlock again and enter a value, or replace prompt=1 with an encrypted value',\n });\n }\n\n const writeBackResult = writeBackEncryptedValue(itemKey, ciphertext, sourceFilePath);\n if (!writeBackResult.updated) {\n if (writeBackResult.reason === 'missing-source-file') {\n throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n tip: 'varlock(prompt=1) can only persist values from file-backed sources. Use `varlock encrypt` to generate an encrypted value manually.',\n });\n }\n\n throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n tip: `Could not find a writable \\`${itemKey}=varlock(...)\\` entry to update in ${sourceFilePath}.`,\n });\n }\n\n return localEncrypt.decryptValue(ciphertext);\n }\n\n // Terminal prompt for file-based backend\n if (!process.stdout.isTTY \|\| !process.stdin.isTTY) {\n throw new ResolutionError(\n `No encrypted value found for ${itemKey}`,\n {\n tip: `Run \\`varlock encrypt --file ${sourceFilePath \|\| '<your-env-file>'}\\` to encrypt this value interactively.`,\n },\n );\n }\n\n const rawValue = await prompts.password({ message: `Enter the secret value for ${itemKey}:`, hint: 'for multi-line values, use `varlock encrypt`' });\n const isCanceled = typeof rawValue !== 'string';\n if (isCanceled \|\| !rawValue) {\n throw new ResolutionError('Secret input was cancelled', {\n tip: 'Run varlock again and enter a value, or replace prompt=1 with an encrypted value',\n });\n }\n\n const ciphertext = await localEncrypt.encryptValue(rawValue);\n const writeBackResult = writeBackEncryptedValue(itemKey, ciphertext, sourceFilePath);\n\n if (!writeBackResult.updated) {\n if (writeBackResult.reason === 'missing-source-file') {\n throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n tip: 'varlock(prompt=1) can only persist values from file-backed sources. Use `varlock encrypt` to generate an encrypted value manually.',\n });\n }\n\n throw new ResolutionError(`Unable to persist encrypted value for ${itemKey}`, {\n tip: `Could not find a writable \\`${itemKey}=varlock(...)\\` entry to update in ${sourceFilePath}.`,\n });\n }\n\n return rawValue;\n });\n },\n});\n","/*\n Built-in keychain() resolver function.\n \n Reads secrets from the macOS Keychain via the Swift daemon binary.\n * Always goes through the daemon to enforce biometric gating (per-TTY sessions)\n * and to make VarlockEnclave the authorized keychain accessor.\n \n Syntax:\n * keychain(service=\"com.company.db\")\n * keychain(service=\"com.company.db\", account=\"admin\")\n * keychain(service=\"com.company.db\", keychain=\"System\")\n * keychain(\"com.company.db\") — shorthand for service\n * keychain(prompt) — interactive picker, writes back reference\n /\n\nimport { createResolver, Resolver } from '../../env-graph/lib/resolver';\nimport { ResolutionError, SchemaError } from '../../env-graph/lib/errors';\nimport { getDaemonClient } from './index';\nimport { writeBackValue } from './write-back';\n\ntype KeychainResolverState = {\n mode: 'get';\n service?: string;\n account?: string;\n keychain?: string;\n field?: string;\n} \| {\n mode: 'prompt';\n itemKey: string;\n sourceFilePath: string \| undefined;\n};\n\nfunction writeBackKeychainRef(\n itemKey: string,\n ref: { service: string; account?: string; keychain?: string },\n sourceFilePath: string \| undefined,\n) {\n // Use positional shorthand when only service is needed, named args when disambiguating\n let argsStr: string;\n if (!ref.account && !ref.keychain) {\n argsStr = `\"${ref.service}\"`;\n } else {\n const parts: Array<string> = [`service=\"${ref.service}\"`];\n if (ref.account) parts.push(`account=\"${ref.account}\"`);\n if (ref.keychain) parts.push(`keychain=\"${ref.keychain}\"`);\n argsStr = parts.join(', ');\n }\n\n writeBackValue(itemKey, `keychain(${argsStr})`, sourceFilePath);\n}\n\nexport const KeychainResolver: typeof Resolver = createResolver<KeychainResolverState>({\n name: 'keychain',\n label: 'Read from macOS Keychain',\n icon: 'mdi:key-chain',\n impliesSensitive: true,\n argsSchema: {\n type: 'mixed',\n arrayMinLength: 0,\n },\n process(): KeychainResolverState {\n if (process.platform !== 'darwin') {\n throw new SchemaError('keychain() is only supported on macOS');\n }\n\n // Check for prompt mode: keychain(prompt) or keychain(prompt=1)\n const promptArg = this.objArgs?.prompt;\n const isPromptPositional = this.arrArgs?.length === 1\n && this.arrArgs[0]?.isStatic\n && this.arrArgs[0].staticValue === 'prompt';\n\n if (promptArg \|\| isPromptPositional) {\n const parent = (this as any).parent;\n const itemKey = parent?.key \|\| 'unknown';\n const dataSource = this.dataSource as any;\n const sourceFilePath = dataSource?.fullPath as string \| undefined;\n return { mode: 'prompt', itemKey, sourceFilePath };\n }\n\n // Named args mode: keychain(service=\"...\", account=\"...\", keychain=\"...\", field=\"...\")\n const serviceArg = this.objArgs?.service;\n const accountArg = this.objArgs?.account;\n const keychainArg = this.objArgs?.keychain;\n const fieldArg = this.objArgs?.field;\n\n const account = accountArg?.isStatic ? accountArg.staticValue as string : undefined;\n const keychain = keychainArg?.isStatic ? keychainArg.staticValue as string : undefined;\n const field = fieldArg?.isStatic ? fieldArg.staticValue as string : undefined;\n\n if (serviceArg) {\n if (!serviceArg.isStatic \|\| typeof serviceArg.staticValue !== 'string') {\n throw new SchemaError('keychain() service must be a static string');\n }\n return {\n mode: 'get', service: serviceArg.staticValue, account, keychain, field,\n };\n }\n\n // account-only lookup: keychain(account=\"admin@corp.com\", field=\"account\")\n if (accountArg) {\n return {\n mode: 'get', account, keychain, field,\n };\n }\n\n // Positional shorthand: keychain(\"com.company.service\")\n if (this.arrArgs?.length === 1 && this.arrArgs[0]?.isStatic) {\n const value = this.arrArgs[0].staticValue;\n if (typeof value !== 'string') {\n throw new SchemaError('keychain() expects a string service name');\n }\n return { mode: 'get', service: value, field };\n }\n\n throw new SchemaError(\n 'keychain() requires service name, account, or prompt mode. '\n + 'Usage: keychain(service=\"com.example\"), keychain(\"com.example\"), or keychain(prompt)',\n );\n },\n async resolve(state: KeychainResolverState) {\n const client = getDaemonClient();\n\n if (state.mode === 'get') {\n try {\n return await client.keychainGet({\n service: state.service,\n account: state.account,\n keychain: state.keychain,\n field: state.field,\n });\n } catch (err) {\n throw new ResolutionError(\n `Failed to read keychain item: ${err instanceof Error ? err.message : err}`,\n {\n tip: [\n state.service ? `Service: ${state.service}` : null,\n state.account ? `Account: ${state.account}` : null,\n state.keychain ? `Keychain: ${state.keychain}` : null,\n state.field ? `Field: ${state.field}` : null,\n 'Make sure the item exists in your Keychain and VarlockEnclave has access.',\n 'You can grant access via: keychain(prompt)',\n ].filter(Boolean).join('\\n'),\n },\n );\n }\n }\n\n // Prompt mode: show native picker, write back reference\n const { itemKey, sourceFilePath } = state;\n\n const selected = await client.keychainPick({ itemKey });\n if (!selected) {\n throw new ResolutionError('Keychain item selection was cancelled', {\n tip: 'Run varlock again and select an item, or use keychain(service=\"...\") with an explicit service name',\n });\n }\n\n writeBackKeychainRef(itemKey, selected, sourceFilePath);\n\n // Now fetch the actual value\n try {\n return await client.keychainGet({\n service: selected.service,\n account: selected.account,\n keychain: selected.keychain,\n });\n } catch (err) {\n throw new ResolutionError(\n `Selected keychain item but failed to read value: ${err instanceof Error ? err.message : err}`,\n {\n tip: 'The item reference has been written to your config. Try running varlock again.',\n },\n );\n }\n },\n});\n","import path from 'node:path';\nimport fs from 'node:fs';\n\nexport type VarlockPackageJsonConfig = {\n /* Path (or array of paths) to a specific .env file or directory to use as the entry point for loading /\n loadPath?: string \| Array<string>;\n};\n\n/\n Reads varlock configuration from the `package.json` in `cwd`.\n * Returns undefined if no `package.json` exists or it has no `varlock` key.\n /\nexport function readVarlockPackageJsonConfig(opts?: { cwd?: string }): VarlockPackageJsonConfig \| undefined {\n const cwd = opts?.cwd ?? process.cwd();\n const pkgPath = path.join(cwd, 'package.json');\n if (!fs.existsSync(pkgPath)) return undefined;\n try {\n const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));\n if (pkg.varlock && typeof pkg.varlock === 'object') {\n return pkg.varlock as VarlockPackageJsonConfig;\n }\n } catch { / ignore parse errors / }\n return undefined;\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\nimport { loadEnvGraph } from '../env-graph';\nimport { VarlockResolver } from './local-encrypt/builtin-resolver';\nimport { KeychainResolver } from './local-encrypt/keychain-resolver';\nimport { CliExitError } from '../cli/helpers/exit-error';\nimport { runWithWorkspaceInfo } from './workspace-utils';\nimport { readVarlockPackageJsonConfig } from './package-json-config';\nimport { createDebug } from './debug';\n\nconst debug = createDebug('varlock:load');\n\nfunction normalizePkgLoadPath(pkgLoadPath: string \| Array<string>): Array<string> {\n if (Array.isArray(pkgLoadPath)) return pkgLoadPath;\n return [pkgLoadPath];\n}\n\nfunction loadFromPaths(\n rawPaths: Array<string>,\n config: {\n source: string,\n errorPrefix: string,\n errorSuggestion: string,\n currentEnvFallback?: string,\n },\n) {\n const resolvedPaths = rawPaths.map((p) => path.resolve(p));\n\n if (resolvedPaths.length === 1) {\n debug('using path from %s: %s', config.source, resolvedPaths[0]);\n } else {\n debug('using %d paths from %s: %s', resolvedPaths.length, config.source, resolvedPaths.join(', '));\n }\n\n for (const resolvedPath of resolvedPaths) {\n if (!fs.existsSync(resolvedPath)) {\n throw new CliExitError(`${config.errorPrefix}: ${resolvedPath}`, {\n suggestion: config.errorSuggestion,\n });\n }\n }\n\n return runWithWorkspaceInfo(() => loadEnvGraph({\n currentEnvFallback: config.currentEnvFallback,\n entryFilePaths: resolvedPaths,\n afterInit: async (g) => {\n g.registerResolver(VarlockResolver);\n g.registerResolver(KeychainResolver);\n },\n }));\n}\n\nexport function loadVarlockEnvGraph(opts?: {\n currentEnvFallback?: string,\n /* Explicit entry file paths from --path flag(s) - overrides package.json config */\n entryFilePaths?: Array<string>,\n}) {\n const cliPaths = opts?.entryFilePaths?.filter(Boolean);\n\n // If --path flag(s) provided, they take precedence over package.json config\n if (cliPaths && cliPaths.length > 0) {\n // Return early and ignore pkgLoadPaths\n return loadFromPaths(cliPaths, {\n source: '--path flag',\n errorPrefix: 'The --path value does not exist',\n errorSuggestion: 'Use `--path` to specify a valid file or directory.',\n currentEnvFallback: opts?.currentEnvFallback,\n });\n }\n\n // Fall back to package.json varlock.loadPath\n const pkgLoadPath = readVarlockPackageJsonConfig()?.loadPath;\n const pkgLoadPaths = pkgLoadPath ? normalizePkgLoadPath(pkgLoadPath) : undefined;\n\n if (pkgLoadPaths) {\n return loadFromPaths(pkgLoadPaths, {\n source: 'package.json varlock.loadPath',\n errorPrefix: 'A path in `varlock.loadPath` configured in package.json does not exist',\n errorSuggestion: 'Update `varlock.loadPath` in your package.json to point to valid files or directories.',\n currentEnvFallback: opts?.currentEnvFallback,\n });\n }\n\n debug('no path configured, using cwd: %s', process.cwd());\n\n return runWithWorkspaceInfo(() => loadEnvGraph({\n currentEnvFallback: opts?.currentEnvFallback,\n afterInit: async (g) => {\n g.registerResolver(VarlockResolver);\n g.registerResolver(KeychainResolver);\n },\n }));\n}\n"]}

package/dist/{chunk-GJ7PTJM4.js → chunk-Q7XUQDLE.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { define } from './chunk-4A54P4EM.js';
+import { define } from './chunk-MGUGRIW2.js';
 import { __name } from './chunk-6PEHRAEP.js';
 // src/cli/commands/help.command.ts
@@ -11,5 +11,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 export { commandFn, commandSpec };
-//# sourceMappingURL=chunk-GJ7PTJM4.js.map
-//# sourceMappingURL=chunk-GJ7PTJM4.js.map
+//# sourceMappingURL=chunk-Q7XUQDLE.js.map
+//# sourceMappingURL=chunk-Q7XUQDLE.js.map

package/dist/{chunk-GJ7PTJM4.js.map → chunk-Q7XUQDLE.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/cli/commands/help.command.ts"],"names":[],"mappings":";;;;AAGO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,MAAA;AAAA,EACN,WAAA,EAAa,4BAAA;AAAA,EACb,MAAM;AACR,CAAC;AAEM,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAElF,CAAA,EAFmE,WAAA","file":"chunk-~~GJ7PTJM4~~.js","sourcesContent":["import { define } from 'gunshi';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\n\nexport const commandSpec = define({\n name: 'help',\n description: 'Show help info for varlock',\n args: {},\n});\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n // no-op - we'll trigger help from main entry point\n};\n"]}
1	+ {"version":3,"sources":["../src/cli/commands/help.command.ts"],"names":[],"mappings":";;;;AAGO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,MAAA;AAAA,EACN,WAAA,EAAa,4BAAA;AAAA,EACb,MAAM;AACR,CAAC;AAEM,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAElF,CAAA,EAFmE,WAAA","file":"chunk-Q7XUQDLE.js","sourcesContent":["import { define } from 'gunshi';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\n\nexport const commandSpec = define({\n name: 'help',\n description: 'Show help info for varlock',\n args: {},\n});\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n // no-op - we'll trigger help from main entry point\n};\n"]}

package/dist/{chunk-R73FENLU.js → chunk-QDEAHBCB.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { debug, varlockSettings, redactSensitiveConfig } from './chunk-MGWUDHT5.js';
+import { debug, varlockSettings, redactSensitiveConfig } from './chunk-UUJK65RS.js';
 import { __name } from './chunk-6PEHRAEP.js';
 // src/runtime/patch-console.ts
@@ -40,5 +40,5 @@ function unpatchGlobalConsole() {
 __name(unpatchGlobalConsole, "unpatchGlobalConsole");
 export { patchGlobalConsole, unpatchGlobalConsole };
-//# sourceMappingURL=chunk-R73FENLU.js.map
-//# sourceMappingURL=chunk-R73FENLU.js.map
+//# sourceMappingURL=chunk-QDEAHBCB.js.map
+//# sourceMappingURL=chunk-QDEAHBCB.js.map

package/dist/{chunk-R73FENLU.js.map → chunk-QDEAHBCB.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/runtime/patch-console.ts"],"names":[],"mappings":";;;;AAWO,SAAS,kBAAA,GAAqB;AACnC,EAAA,KAAA,CAAM,8CAAoC,CAAA;AAC1C,EAAA,IAAK,OAAA,CAAQ,IAAY,iBAAA,EAAmB;AAC1C,IAAA,KAAA,CAAM,mBAAmB,CAAA;AACzB,IAAA;AAAA,EACF;AACA,EAAA,IAAI,eAAA,CAAgB,eAAe,KAAA,EAAO;AACxC,IAAA,KAAA,CAAM,wBAAwB,CAAA;AAC9B,IAAA;AAAA,EACF;AAQA,EAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,qBAAA,CAAsB,UAAA,CAAW,OAAO,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,KAAgB,iBAAiB,CAAA;AAG9H,EAAC,UAAA,CAAmB,4BAAA,KAAiC,UAAA,CAAW,OAAA,CAAQ,qBAAqB,CAAA;AAE7F,EAAA,UAAA,CAAW,OAAA,CAAQ,qBAAqB,CAAA,GAAI,WAAY;AACtD,IAAC,UAAA,CAAmB,4BAAA,CAA6B,KAAA,CAAM,IAAA,EAAM;AAAA,MAC3D,UAAU,CAAC,CAAA;AAAA,MACX,qBAAA,CAAsB,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,MAClC,UAAU,CAAC;AAAA,KACZ,CAAA;AAAA,EACH,CAAA;AAOA,EAAA,KAAA,MAAW,aAAA,IAAiB,CAAC,OAAA,EAAS,OAAA,EAAS,QAAQ,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAA,EAAG;AAEtF,IAAA,MAAM,iBAAA,GAAoB,UAAA,CAAW,OAAA,CAAQ,aAAa,CAAA;AAE1D,IAAA,MAAM,4BAAY,MAAA,CAAA,WAAY;AAE5B,MAAA,iBAAA,CAAkB,KAAA,CAAM,MAAM,KAAA,CAAM,IAAA,CAAK,SAAS,CAAA,CAAE,GAAA,CAAI,qBAAqB,CAAC,CAAA;AAAA,IAChF,CAAA,EAHkB,WAAA,CAAA;AAIlB,IAAA,SAAA,CAAU,iBAAA,GAAoB,IAAA;AAG9B,IAAA,UAAA,CAAW,OAAA,CAAQ,aAAa,CAAA,GAAI,SAAA;AAAA,EACtC;AACF;AAhDgB,MAAA,CAAA,kBAAA,EAAA,oBAAA,CAAA;AAuDT,SAAS,oBAAA,GAAuB;AAErC,EAAA,IAAI,CAAE,WAAmB,4BAAA,EAA8B;AAEvD,EAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,qBAAA,CAAsB,UAAA,CAAW,OAAO,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,KAAgB,iBAAiB,CAAA;AAE9H,EAAA,UAAA,CAAW,OAAA,CAAQ,qBAAqB,CAAA,GAAK,UAAA,CAAmB,4BAAA;AAChE,EAAA,OAAQ,UAAA,CAAmB,4BAAA;AAC7B;AARgB,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA","file":"chunk-~~R73FENLU~~.js","sourcesContent":["/* eslint-disable func-names, no-console, prefer-rest-params /\n\nimport { redactSensitiveConfig, varlockSettings } from './env';\nimport { debug } from './lib/debug';\n\n\n/\n patches global console methods to redact sensitive config\n \n NOTE - this may not be 100% foolproof depending on the platform\n * /\nexport function patchGlobalConsole() {\n debug('⚡️ PATCHING global console methods');\n if ((console.log as any)._varlockPatchedFn) {\n debug('> already patched');\n return;\n }\n if (varlockSettings.redactLogs === false) {\n debug('> disabled by settings');\n return;\n }\n\n // our method of patching involves replacing an internal node method which may not be called if console.log itself has also been patched\n // for example AWS lambdas patches this to write the logs to a file which then is pushed to the rest of their system\n\n // so first we'll just patch the internal method do deal with normal stdout/stderr logs -------------------------------------\n\n // we need the internal symbol name to access the internal method\n const kWriteToConsoleSymbol = Object.getOwnPropertySymbols(globalThis.console).find((s) => s.description === 'kWriteToConsole');\n\n // @ts-ignore\n (globalThis as any)._varlockOrigWriteToConsoleFn \|\|= globalThis.console[kWriteToConsoleSymbol];\n // @ts-ignore\n globalThis.console[kWriteToConsoleSymbol] = function () {\n (globalThis as any)._varlockOrigWriteToConsoleFn.apply(this, [\n arguments[0],\n redactSensitiveConfig(arguments[1]),\n arguments[2],\n ]);\n };\n\n // and now we'll wrap console.log (and the other methods) if it looks like they have been patched already ------------------\n // NOTE - this will not fully redact from everything since we can't safely reach deep into objects\n // ideally we would only turn this when the above method does not work, but it's not trivial to detect when it that is the case\n // so we'll turn it on all the time for now...\n\n for (const logMethodName of ['trace', 'debug', 'info', 'log', 'info', 'warn', 'error']) {\n // @ts-ignore\n const originalLogMethod = globalThis.console[logMethodName];\n\n const patchedFn = function () {\n // @ts-ignore\n originalLogMethod.apply(this, Array.from(arguments).map(redactSensitiveConfig));\n };\n patchedFn._varlockPatchedFn = true;\n\n // @ts-ignore\n globalThis.console[logMethodName] = patchedFn;\n }\n}\n\n/\n restore's original global console methods to stop redacting secrets\n \n (only needed during local development when switching settings on/off in a process that does not reload)\n * */\nexport function unpatchGlobalConsole() {\n // we'll only care about the normal case where console.log has NOT been patched by something else... (see above)\n if (!(globalThis as any)._varlockOrigWriteToConsoleFn) return;\n\n const kWriteToConsoleSymbol = Object.getOwnPropertySymbols(globalThis.console).find((s) => s.description === 'kWriteToConsole');\n // @ts-ignore\n globalThis.console[kWriteToConsoleSymbol] = (globalThis as any)._varlockOrigWriteToConsoleFn;\n delete (globalThis as any)._varlockOrigWriteToConsoleFn;\n}\n"]}
1	+ {"version":3,"sources":["../src/runtime/patch-console.ts"],"names":[],"mappings":";;;;AAWO,SAAS,kBAAA,GAAqB;AACnC,EAAA,KAAA,CAAM,8CAAoC,CAAA;AAC1C,EAAA,IAAK,OAAA,CAAQ,IAAY,iBAAA,EAAmB;AAC1C,IAAA,KAAA,CAAM,mBAAmB,CAAA;AACzB,IAAA;AAAA,EACF;AACA,EAAA,IAAI,eAAA,CAAgB,eAAe,KAAA,EAAO;AACxC,IAAA,KAAA,CAAM,wBAAwB,CAAA;AAC9B,IAAA;AAAA,EACF;AAQA,EAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,qBAAA,CAAsB,UAAA,CAAW,OAAO,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,KAAgB,iBAAiB,CAAA;AAG9H,EAAC,UAAA,CAAmB,4BAAA,KAAiC,UAAA,CAAW,OAAA,CAAQ,qBAAqB,CAAA;AAE7F,EAAA,UAAA,CAAW,OAAA,CAAQ,qBAAqB,CAAA,GAAI,WAAY;AACtD,IAAC,UAAA,CAAmB,4BAAA,CAA6B,KAAA,CAAM,IAAA,EAAM;AAAA,MAC3D,UAAU,CAAC,CAAA;AAAA,MACX,qBAAA,CAAsB,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,MAClC,UAAU,CAAC;AAAA,KACZ,CAAA;AAAA,EACH,CAAA;AAOA,EAAA,KAAA,MAAW,aAAA,IAAiB,CAAC,OAAA,EAAS,OAAA,EAAS,QAAQ,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAA,EAAG;AAEtF,IAAA,MAAM,iBAAA,GAAoB,UAAA,CAAW,OAAA,CAAQ,aAAa,CAAA;AAE1D,IAAA,MAAM,4BAAY,MAAA,CAAA,WAAY;AAE5B,MAAA,iBAAA,CAAkB,KAAA,CAAM,MAAM,KAAA,CAAM,IAAA,CAAK,SAAS,CAAA,CAAE,GAAA,CAAI,qBAAqB,CAAC,CAAA;AAAA,IAChF,CAAA,EAHkB,WAAA,CAAA;AAIlB,IAAA,SAAA,CAAU,iBAAA,GAAoB,IAAA;AAG9B,IAAA,UAAA,CAAW,OAAA,CAAQ,aAAa,CAAA,GAAI,SAAA;AAAA,EACtC;AACF;AAhDgB,MAAA,CAAA,kBAAA,EAAA,oBAAA,CAAA;AAuDT,SAAS,oBAAA,GAAuB;AAErC,EAAA,IAAI,CAAE,WAAmB,4BAAA,EAA8B;AAEvD,EAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,qBAAA,CAAsB,UAAA,CAAW,OAAO,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,KAAgB,iBAAiB,CAAA;AAE9H,EAAA,UAAA,CAAW,OAAA,CAAQ,qBAAqB,CAAA,GAAK,UAAA,CAAmB,4BAAA;AAChE,EAAA,OAAQ,UAAA,CAAmB,4BAAA;AAC7B;AARgB,MAAA,CAAA,oBAAA,EAAA,sBAAA,CAAA","file":"chunk-QDEAHBCB.js","sourcesContent":["/* eslint-disable func-names, no-console, prefer-rest-params /\n\nimport { redactSensitiveConfig, varlockSettings } from './env';\nimport { debug } from './lib/debug';\n\n\n/\n patches global console methods to redact sensitive config\n \n NOTE - this may not be 100% foolproof depending on the platform\n * /\nexport function patchGlobalConsole() {\n debug('⚡️ PATCHING global console methods');\n if ((console.log as any)._varlockPatchedFn) {\n debug('> already patched');\n return;\n }\n if (varlockSettings.redactLogs === false) {\n debug('> disabled by settings');\n return;\n }\n\n // our method of patching involves replacing an internal node method which may not be called if console.log itself has also been patched\n // for example AWS lambdas patches this to write the logs to a file which then is pushed to the rest of their system\n\n // so first we'll just patch the internal method do deal with normal stdout/stderr logs -------------------------------------\n\n // we need the internal symbol name to access the internal method\n const kWriteToConsoleSymbol = Object.getOwnPropertySymbols(globalThis.console).find((s) => s.description === 'kWriteToConsole');\n\n // @ts-ignore\n (globalThis as any)._varlockOrigWriteToConsoleFn \|\|= globalThis.console[kWriteToConsoleSymbol];\n // @ts-ignore\n globalThis.console[kWriteToConsoleSymbol] = function () {\n (globalThis as any)._varlockOrigWriteToConsoleFn.apply(this, [\n arguments[0],\n redactSensitiveConfig(arguments[1]),\n arguments[2],\n ]);\n };\n\n // and now we'll wrap console.log (and the other methods) if it looks like they have been patched already ------------------\n // NOTE - this will not fully redact from everything since we can't safely reach deep into objects\n // ideally we would only turn this when the above method does not work, but it's not trivial to detect when it that is the case\n // so we'll turn it on all the time for now...\n\n for (const logMethodName of ['trace', 'debug', 'info', 'log', 'info', 'warn', 'error']) {\n // @ts-ignore\n const originalLogMethod = globalThis.console[logMethodName];\n\n const patchedFn = function () {\n // @ts-ignore\n originalLogMethod.apply(this, Array.from(arguments).map(redactSensitiveConfig));\n };\n patchedFn._varlockPatchedFn = true;\n\n // @ts-ignore\n globalThis.console[logMethodName] = patchedFn;\n }\n}\n\n/\n restore's original global console methods to stop redacting secrets\n \n (only needed during local development when switching settings on/off in a process that does not reload)\n * */\nexport function unpatchGlobalConsole() {\n // we'll only care about the normal case where console.log has NOT been patched by something else... (see above)\n if (!(globalThis as any)._varlockOrigWriteToConsoleFn) return;\n\n const kWriteToConsoleSymbol = Object.getOwnPropertySymbols(globalThis.console).find((s) => s.description === 'kWriteToConsole');\n // @ts-ignore\n globalThis.console[kWriteToConsoleSymbol] = (globalThis as any)._varlockOrigWriteToConsoleFn;\n delete (globalThis as any)._varlockOrigWriteToConsoleFn;\n}\n"]}

package/dist/{chunk-2PBFWISH.js → chunk-ROZITJAP.js} RENAMED Viewed

@@ -1,9 +1,9 @@
-import { define } from './chunk-4A54P4EM.js';
-import { loadVarlockEnvGraph, writeBackValue } from './chunk-H2JVYUHZ.js';
-import { encryptValue, getBackendInfo, ensureKey, getDaemonClient } from './chunk-GURKQO4J.js';
 import { gracefulExit } from './chunk-CHQDS2PI.js';
-import { CliExitError } from './chunk-LGEHJHB2.js';
-import { FileBasedDataSource, ParsedEnvSpecFunctionCall, ParsedEnvSpecStaticValue, multiselect, ansis_default, password } from './chunk-6CRDPEUT.js';
+import { define } from './chunk-MGUGRIW2.js';
+import { loadVarlockEnvGraph, writeBackValue } from './chunk-Q4I7MXFB.js';
+import { encryptValue, getBackendInfo, ensureKey, getDaemonClient } from './chunk-P4HNABAM.js';
+import { CliExitError } from './chunk-SX2NUZCL.js';
+import { FileBasedDataSource, ParsedEnvSpecFunctionCall, ParsedEnvSpecStaticValue, multiselect, ansis_default, password } from './chunk-PBWMMYWL.js';
 import { q } from './chunk-IRXBCLL2.js';
 import { __name } from './chunk-6PEHRAEP.js';
 import path from 'path';
@@ -121,7 +121,7 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
         `Encryption failed: ${err instanceof Error ? err.message : err}`
       );
     }
-  } else if (backend.biometricAvailable) {
+  } else if (backend.biometricAvailable && backend.type === "secure-enclave") {
     const client = getDaemonClient();
     const result = await client.promptSecret({ keyId });
     if (!result) {
@@ -145,5 +145,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 export { commandFn, commandSpec };
-//# sourceMappingURL=chunk-2PBFWISH.js.map
-//# sourceMappingURL=chunk-2PBFWISH.js.map
+//# sourceMappingURL=chunk-ROZITJAP.js.map
+//# sourceMappingURL=chunk-ROZITJAP.js.map

package/dist/chunk-ROZITJAP.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/cli/commands/encrypt.command.ts"],"names":[],"mappings":";;;;;;;;;;;AAmBO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,SAAA;AAAA,EACN,WAAA,EAAa,+CAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,QAAA,EAAU;AAAA,MACR,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EAAa,8CAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACX;AAAA,IACA,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EAAa;AAAA;AACf;AAEJ,CAAC;AAED,eAAe,WAAA,CAAY,OAAe,QAAA,EAAkB;AAC1D,EAAA,MAAM,YAAA,GAAe,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AAC1C,EAAA,IAAI,CAAC,EAAA,CAAG,UAAA,CAAW,YAAY,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,gBAAA,EAAmB,YAAY,CAAA,CAAE,CAAA;AAAA,EAC1D;AAGA,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,EAAoB;AAC3C,EAAA,MAAM,SAAS,gBAAA,EAAiB;AAGhC,EAAA,MAAM,YAAA,GAAe,SAAS,iBAAA,CAAkB,IAAA;AAAA,IAC9C,CAAC,CAAA,KAAM,CAAA,YAAa,mBAAA,IAAuB,EAAE,QAAA,KAAa;AAAA,GAC5D;AAEA,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,SAAS,QAAQ,CAAA,qCAAA,CAAA;AAAA,MACjB,EAAE,YAAY,4EAAA;AAA6E,KAC7F;AAAA,EACF;AAGA,EAAA,MAAM,iBAAwD,EAAC;AAE/D,EAAA,KAAA,MAAW,CAAC,KAAK,OAAO,CAAA,IAAK,OAAO,OAAA,CAAQ,YAAA,CAAa,cAAc,CAAA,EAAG;AACxE,IAAA,MAAM,SAAA,GAAY,QAAA,CAAS,YAAA,CAAa,GAAG,CAAA;AAC3C,IAAA,IAAI,CAAC,WAAW,WAAA,EAAa;AAG7B,IAAA,IAAI,OAAA,CAAQ,uBAAuB,yBAAA,EAA2B;AAG9D,IAAA,IAAI,EAAE,OAAA,CAAQ,WAAA,YAAuB,wBAAA,CAAA,EAA2B;AAChE,IAAA,MAAM,GAAA,GAAM,QAAQ,WAAA,CAAY,cAAA;AAChC,IAAA,IAAI,QAAQ,MAAA,IAAa,GAAA,KAAQ,EAAA,IAAM,OAAO,QAAQ,QAAA,EAAU;AAEhE,IAAA,cAAA,CAAe,IAAA,CAAK,EAAE,GAAA,EAAK,KAAA,EAAO,KAAK,CAAA;AAAA,EACzC;AAEA,EAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC/B,IAAA,OAAA,CAAQ,IAAI,iDAAiD,CAAA;AAC7D,IAAA;AAAA,EACF;AAEA,EAAA,OAAA,CAAQ,IAAI,0DAA0D,CAAA;AACtE,EAAA,OAAA,CAAQ,IAAI,kEAAkE,CAAA;AAE9E,EAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY;AAAA,IACjC,SAAS,CAAA,6BAAA,EAAgC,QAAQ,IAAI,aAAA,CAAM,IAAA,CAAK,iDAAiD,CAAC,CAAA,CAAA;AAAA,IAClH,OAAA,EAAS,cAAA,CAAe,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,MACrC,OAAO,IAAA,CAAK,GAAA;AAAA,MACZ,OAAO,IAAA,CAAK;AAAA,KACd,CAAE,CAAA;AAAA,IACF,eAAe,cAAA,CAAe,GAAA,CAAI,CAAC,IAAA,KAAS,KAAK,GAAG;AAAA,GACrD,CAAA;AAED,EAAA,IAAI,CAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,YAAA,EAAa;AAE5C,EAAA,MAAM,YAAA,GAAe,IAAI,GAAA,CAAI,QAAyB,CAAA;AACtD,EAAA,MAAM,aAAA,GAAgB,eAAe,MAAA,CAAO,CAAC,SAAS,YAAA,CAAa,GAAA,CAAI,IAAA,CAAK,GAAG,CAAC,CAAA;AAEhF,EAAA,IAAI,aAAA,CAAc,WAAW,CAAA,EAAG;AAC9B,IAAA,OAAA,CAAQ,IAAI,oBAAoB,CAAA;AAChC,IAAA;AAAA,EACF;AAEA,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AAEd,EAAA,IAAI,cAAA,GAAiB,CAAA;AACrB,EAAA,KAAA,MAAW,QAAQ,aAAA,EAAe;AAChC,IAAA,MAAM,UAAA,GAAa,MAAmB,YAAA,CAAa,IAAA,CAAK,OAAO,KAAK,CAAA;AACpE,IAAA,MAAM,SAAS,cAAA,CAAe,IAAA,CAAK,KAAK,CAAA,eAAA,EAAkB,UAAU,MAAM,YAAY,CAAA;AAEtF,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,cAAA,EAAA;AACA,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,aAAA,EAAgB,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AAAA,IACxC;AAAA,EACF;AAEA,EAAA,OAAA,CAAQ,GAAA,CAAI;AAAA,UAAA,EAAe,cAAc,SAAS,cAAA,KAAmB,CAAA,GAAI,MAAM,EAAE,CAAA,IAAA,EAAO,QAAQ,CAAA,CAAE,CAAA;AACpG;AAjFe,MAAA,CAAA,WAAA,EAAA,aAAA,CAAA;AAmFR,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAChF,EAAA,MAAM,QAAQ,MAAA,CAAO,GAAA,CAAI,MAAA,CAAO,QAAQ,KAAK,iBAAiB,CAAA;AAC9D,EAAA,MAAM,UAAuB,cAAA,EAAe;AAE5C,EAAA,IAAI;AACF,IAAA,MAAmB,UAAU,KAAK,CAAA;AAAA,EACpC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,GAAA,YAAe,cAAc,MAAM,GAAA;AACvC,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,CAAA,uCAAA,EAA0C,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA;AAAA,KACpF;AAAA,EACF;AAEA,EAAA,OAAA,CAAQ,GAAA,CAAI,SAAS,OAAA,CAAQ,IAAI,aAAa,OAAA,CAAQ,cAAA,GAAiB,iBAAA,GAAoB,YAAY,CAAA,CAAA,CAAG,CAAA;AAE1G,EAAA,MAAM,QAAA,GAAW,IAAI,MAAA,CAAO,IAAA;AAG5B,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,MAAM,WAAA,CAAY,OAAO,QAAQ,CAAA;AACjC,IAAA;AAAA,EACF;AAIA,EAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AAEd,EAAA,IAAI,UAAA;AAEJ,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAA,CAAM,KAAA,EAAO;AACxB,IAAA,MAAM,SAAwB,EAAC;AAC/B,IAAA,WAAA,MAAiB,KAAA,IAAS,QAAQ,KAAA,EAAO;AACvC,MAAA,MAAA,CAAO,KAAK,KAAe,CAAA;AAAA,IAC7B;AACA,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,SAAS,OAAO,CAAA,CAAE,OAAA,CAAQ,QAAA,EAAU,EAAE,CAAA;AAC7E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,aAAa,4BAA4B,CAAA;AAAA,IACrD;AACA,IAAA,IAAI;AACF,MAAA,UAAA,GAAa,MAAmB,YAAA,CAAa,QAAA,EAAU,KAAK,CAAA;AAAA,IAC9D,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,cAAc,MAAM,GAAA;AACvC,MAAA,MAAM,IAAI,YAAA;AAAA,QACR,CAAA,mBAAA,EAAsB,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA;AAAA,OAChE;AAAA,IACF;AAAA,EACF,CAAA,MAAA,IAAW,OAAA,CAAQ,kBAAA,IAAsB,OAAA,CAAQ,SAAS,gBAAA,EAAkB;AAI1E,IAAA,MAAM,SAAsB,eAAA,EAAgB;AAC5C,IAAA,MAAM,SAAS,MAAM,MAAA,CAAO,YAAA,CAAa,EAAE,OAAO,CAAA;AAClD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO,YAAA,EAAa;AAAA,IACtB;AACA,IAAA,UAAA,GAAa,MAAA;AAAA,EACf,CAAA,MAAO;AACL,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,EAAE,SAAS,qCAAA,EAAuC,IAAA,EAAM,yCAAyC,CAAA;AACjI,IAAA,IAAI,CAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,YAAA,EAAa;AAC5C,IAAA,IAAI;AACF,MAAA,UAAA,GAAa,MAAmB,YAAA,CAAa,QAAA,EAAU,KAAK,CAAA;AAAA,IAC9D,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,cAAc,MAAM,GAAA;AACvC,MAAA,MAAM,IAAI,YAAA;AAAA,QACR,CAAA,mBAAA,EAAsB,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,GAAG,CAAA;AAAA,OAChE;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAA,CAAQ,IAAI,2EAA2E,CAAA;AACvF,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,kCAAA,EAAqC,UAAU,CAAA,EAAA,CAAI,CAAA;AACjE,CAAA,EAvEmE,WAAA","file":"chunk-ROZITJAP.js","sourcesContent":["import { define } from 'gunshi';\nimport { isCancel } from '@clack/prompts';\nimport ansis from 'ansis';\nimport path from 'node:path';\nimport fs from 'node:fs';\n\nimport {\n ParsedEnvSpecStaticValue,\n ParsedEnvSpecFunctionCall,\n} from '@env-spec/parser';\nimport { FileBasedDataSource } from '../../env-graph';\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport { CliExitError } from '../helpers/exit-error';\nimport { multiselect, password } from '../helpers/prompts';\nimport { gracefulExit } from 'exit-hook';\nimport * as localEncrypt from '../../lib/local-encrypt';\nimport { writeBackValue } from '../../lib/local-encrypt/write-back';\n\nexport const commandSpec = define({\n name: 'encrypt',\n description: 'Encrypt a value using device-local encryption',\n args: {\n 'key-id': {\n type: 'string',\n description: 'Encryption key ID (default: varlock-default)',\n default: 'varlock-default',\n },\n file: {\n type: 'string',\n description: 'Path to a .env file — encrypts all sensitive plaintext values in-place',\n },\n },\n});\n\nasync function encryptFile(keyId: string, filePath: string) {\n const resolvedPath = path.resolve(filePath);\n if (!fs.existsSync(resolvedPath)) {\n throw new CliExitError(`File not found: ${resolvedPath}`);\n }\n\n // Load the full env graph and resolve to get sensitivity info from the schema\n const envGraph = await loadVarlockEnvGraph();\n await envGraph.resolveEnvValues();\n\n // Find the data source matching the target file\n const targetSource = envGraph.sortedDataSources.find(\n (s) => s instanceof FileBasedDataSource && s.fullPath === resolvedPath,\n ) as FileBasedDataSource | undefined;\n\n if (!targetSource) {\n throw new CliExitError(\n `File \"${filePath}\" is not part of the loaded env graph`,\n { suggestion: 'Make sure the file is in the project directory or imported by your schema.' },\n );\n }\n\n // Find sensitive items that have plaintext static values in this file\n const itemsToEncrypt: Array<{ key: string; value: string }> = [];\n\n for (const [key, itemDef] of Object.entries(targetSource.configItemDefs)) {\n const graphItem = envGraph.configSchema[key];\n if (!graphItem?.isSensitive) continue;\n\n // Skip items already using varlock() or another function call\n if (itemDef.parsedValue instanceof ParsedEnvSpecFunctionCall) continue;\n\n // Only encrypt items with actual static string values\n if (!(itemDef.parsedValue instanceof ParsedEnvSpecStaticValue)) continue;\n const val = itemDef.parsedValue.unescapedValue;\n if (val === undefined || val === '' || typeof val !== 'string') continue;\n\n itemsToEncrypt.push({ key, value: val });\n }\n\n if (itemsToEncrypt.length === 0) {\n console.log('No sensitive plaintext values found to encrypt.');\n return;\n }\n\n console.log('Only items marked as @sensitive in the schema are shown.');\n console.log('If a key is missing, add @sensitive to it in your schema file.\\n');\n\n const selected = await multiselect({\n message: `Confirm values to encrypt in ${filePath} ${ansis.gray('(use arrows, space to toggle, enter to confirm)')}`,\n options: itemsToEncrypt.map((item) => ({\n value: item.key,\n label: item.key,\n })),\n initialValues: itemsToEncrypt.map((item) => item.key),\n });\n\n if (isCancel(selected)) return gracefulExit();\n\n const selectedKeys = new Set(selected as Array<string>);\n const filteredItems = itemsToEncrypt.filter((item) => selectedKeys.has(item.key));\n\n if (filteredItems.length === 0) {\n console.log('No items selected.');\n return;\n }\n\n console.log('');\n\n let encryptedCount = 0;\n for (const item of filteredItems) {\n const ciphertext = await localEncrypt.encryptValue(item.value, keyId);\n const result = writeBackValue(item.key, `varlock(\"local:${ciphertext}\")`, resolvedPath);\n\n if (result.updated) {\n encryptedCount++;\n console.log(` Encrypted: ${item.key}`);\n }\n }\n\n console.log(`\\nEncrypted ${encryptedCount} value${encryptedCount !== 1 ? 's' : ''} in ${filePath}`);\n}\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n const keyId = String(ctx.values['key-id'] || 'varlock-default');\n const backend = localEncrypt.getBackendInfo();\n\n try {\n await localEncrypt.ensureKey(keyId);\n } catch (err) {\n if (err instanceof CliExitError) throw err;\n throw new CliExitError(\n `Failed to check/create encryption key: ${err instanceof Error ? err.message : err}`,\n );\n }\n\n console.log(`Using ${backend.type} backend (${backend.hardwareBacked ? 'hardware-backed' : 'file-based'})`);\n\n const filePath = ctx.values.file;\n\n // --file mode: encrypt all sensitive plaintext values in a .env file\n if (filePath) {\n await encryptFile(keyId, filePath);\n return;\n }\n\n // Single-value mode — read from stdin if piped, otherwise prompt interactively.\n // Avoids putting secrets in shell history (e.g. `echo $SECRET | varlock encrypt`).\n console.log('');\n\n let ciphertext: string;\n\n if (!process.stdin.isTTY) {\n const chunks: Array<Buffer> = [];\n for await (const chunk of process.stdin) {\n chunks.push(chunk as Buffer);\n }\n const rawValue = Buffer.concat(chunks).toString('utf-8').replace(/\\r?\\n$/, '');\n if (!rawValue) {\n throw new CliExitError('No value received on stdin');\n }\n try {\n ciphertext = await localEncrypt.encryptValue(rawValue, keyId);\n } catch (err) {\n if (err instanceof CliExitError) throw err;\n throw new CliExitError(\n `Encryption failed: ${err instanceof Error ? err.message : err}`,\n );\n }\n } else if (backend.biometricAvailable && backend.type === 'secure-enclave') {\n // Use native secure input dialog (supports multi-line paste) — macOS Secure Enclave only.\n // Windows Hello (windows-tpm) and WSL2 do not support the prompt-secret daemon action;\n // those backends fall through to the terminal prompt below.\n const client = localEncrypt.getDaemonClient();\n const result = await client.promptSecret({ keyId });\n if (!result) {\n return gracefulExit();\n }\n ciphertext = result;\n } else {\n const prompted = await password({ message: 'Enter the value you want to encrypt', hint: 'for multi-line values, pipe via stdin' });\n if (isCancel(prompted)) return gracefulExit();\n try {\n ciphertext = await localEncrypt.encryptValue(prompted, keyId);\n } catch (err) {\n if (err instanceof CliExitError) throw err;\n throw new CliExitError(\n `Encryption failed: ${err instanceof Error ? err.message : err}`,\n );\n }\n }\n\n console.log('\\nCopy this into your .env.local file and rename the key appropriately:\\n');\n console.log(`SOME_SENSITIVE_KEY=varlock(\"local:${ciphertext}\")`);\n};\n"]}

package/dist/{chunk-35LTPRXV.js → chunk-RTKFINP6.js} RENAMED Viewed

@@ -1,9 +1,9 @@
 import { scanCodeForEnvVars } from './chunk-P33JXOU6.js';
-import { define } from './chunk-4A54P4EM.js';
-import { checkForSchemaErrors, checkForNoEnvFiles } from './chunk-45N5EFNL.js';
-import { loadVarlockEnvGraph } from './chunk-H2JVYUHZ.js';
 import { gracefulExit } from './chunk-CHQDS2PI.js';
-import { FileBasedDataSource, ansis_default } from './chunk-6CRDPEUT.js';
+import { define } from './chunk-MGUGRIW2.js';
+import { checkForSchemaErrors, checkForNoEnvFiles } from './chunk-NHNQJTPB.js';
+import { loadVarlockEnvGraph } from './chunk-Q4I7MXFB.js';
+import { FileBasedDataSource, ansis_default } from './chunk-PBWMMYWL.js';
 import { __name } from './chunk-6PEHRAEP.js';
 import fs from 'fs/promises';
 import path from 'path';
@@ -194,5 +194,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 export { commandFn, commandSpec };
-//# sourceMappingURL=chunk-35LTPRXV.js.map
-//# sourceMappingURL=chunk-35LTPRXV.js.map
+//# sourceMappingURL=chunk-RTKFINP6.js.map
+//# sourceMappingURL=chunk-RTKFINP6.js.map

package/dist/{chunk-35LTPRXV.js.map → chunk-RTKFINP6.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/cli/helpers/audit-diff.ts","../src/cli/commands/audit.command.ts"],"names":[],"mappings":";;;;;;;;;;;AAAO,SAAS,qBAAA,CAAsB,YAA2B,QAAA,EAAyB;AACxF,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,UAAU,CAAA;AACpC,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,QAAQ,CAAA;AAEhC,EAAA,MAAM,eAAA,GAAkB,CAAC,GAAG,OAAO,EAAE,MAAA,CAAO,CAAC,MAAM,CAAC,SAAA,CAAU,IAAI,CAAC,CAAC,EAAE,IAAA,CAAK,CAAC,GAAG,CAAA,KAAM,CAAA,CAAE,aAAA,CAAc,CAAC,CAAC,CAAA;AACvG,EAAA,MAAM,cAAA,GAAiB,CAAC,GAAG,SAAS,EAAE,MAAA,CAAO,CAAC,MAAM,CAAC,OAAA,CAAQ,IAAI,CAAC,CAAC,EAAE,IAAA,CAAK,CAAC,GAAG,CAAA,KAAM,CAAA,CAAE,aAAA,CAAc,CAAC,CAAC,CAAA;AAEtG,EAAA,OAAO;AAAA,IACL,eAAA;AAAA,IACA;AAAA,GACF;AACF;AAXgB,MAAA,CAAA,qBAAA,EAAA,uBAAA,CAAA;;;ACiBT,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,OAAA;AAAA,EACN,WAAA,EAAa,mDAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,WAAA,EAAa;AAAA,KACf;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAUV,IAAA;AACF,CAAC;AAED,SAAS,eAAA,CAAgB,KAAa,GAAA,EAA8B;AAClE,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,IAAI,QAAQ,CAAA;AAC/C,EAAA,OAAO,GAAG,OAAO,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA,CAAA,EAAI,IAAI,YAAY,CAAA,CAAA;AACzD;AAHS,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA;AAKT,eAAe,yBAAyB,iBAAA,EAA4C;AAClF,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,iBAAiB,CAAA;AAC/C,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAM,EAAA,CAAG,IAAA,CAAK,QAAQ,CAAA;AACxC,IAAA,IAAI,SAAA,CAAU,WAAA,EAAY,EAAG,OAAO,QAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,iBAAA,CAAkB,SAAS,GAAG,CAAA,IAAK,kBAAkB,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG;AAC3E,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA,CAAK,QAAQ,QAAQ,CAAA;AAC9B;AAbe,MAAA,CAAA,wBAAA,EAAA,0BAAA,CAAA;AAef,SAAS,iBAAA,CAAkB,OAAgB,GAAA,EAAoB;AAC7D,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,KAAA,MAAW,KAAA,IAAS,KAAA,EAAO,iBAAA,CAAkB,KAAA,EAAO,GAAG,CAAA;AACvD,IAAA;AAAA,EACF;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAE/B,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,OAAA,CAAQ,SAAS,EAAE,CAAA,CAAE,OAAA,CAAQ,SAAA,EAAW,EAAE,CAAA;AAC1E,EAAA,IAAI,CAAC,UAAA,EAAY;AACjB,EAAA,GAAA,CAAI,KAAK,UAAU,CAAA;AACrB;AAVS,MAAA,CAAA,iBAAA,EAAA,mBAAA,CAAA;AAaT,SAAS,4BAA4B,QAAA,EAA4B;AAC/D,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AAGnC,EAAA,MAAM,UAAU,QAAA,CAAS,kBAAA;AACzB,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,KAAA,MAAW,WAAW,OAAA,EAAS;AAC7B,MAAA,KAAA,MAAW,GAAA,IAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClC,QAAA,UAAA,CAAW,IAAI,GAAG,CAAA;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AAGA,EAAA,KAAA,MAAW,MAAA,IAAU,QAAA,CAAS,iBAAA,IAAqB,EAAC,EAAG;AACrD,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,cAAA,IAAkB,EAAC,EAAG;AAC7C,MAAA,KAAA,MAAW,GAAA,IAAO,GAAA,CAAI,gBAAA,EAAkB,IAAA,IAAQ,EAAC,EAAG;AAClD,QAAA,UAAA,CAAW,IAAI,GAAG,CAAA;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,UAAA;AACT;AAvBS,MAAA,CAAA,2BAAA,EAAA,6BAAA,CAAA;AAyBT,eAAe,0BAA0B,QAAA,EAAuC;AAC9E,EAAA,MAAM,UAAA,GAAa,OAAO,QAAA,EAAU,aAAA,KAAkB,aAClD,QAAA,CAAS,aAAA,CAAc,kBAAkB,CAAA,GACzC,EAAC;AAEL,EAAA,MAAM,cAA6B,EAAC;AACpC,EAAA,KAAA,MAAW,GAAA,IAAO,UAAA,IAAc,EAAC,EAAG;AAClC,IAAA,MAAM,QAAA,GAAW,MAAM,GAAA,CAAI,OAAA,EAAQ;AACnC,IAAA,iBAAA,CAAkB,QAAA,EAAU,KAAK,WAAW,CAAA;AAAA,EAC9C;AAEA,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,WAAW,CAAC,CAAA;AACjC;AAZe,MAAA,CAAA,yBAAA,EAAA,2BAAA,CAAA;AAcR,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAChF,EAAA,MAAM,iBAAA,GAAoB,IAAI,MAAA,CAAO,IAAA;AACrC,EAAA,MAAM,aAAA,GAAiB,GAAA,CAAI,MAAA,CAAO,MAAA,IAAU,EAAC;AAC7C,EAAA,MAAM,WAAA,GAAA,CAAe,IAAI,WAAA,IAAe,IAAI,KAAA,CAAM,GAAA,CAAI,WAAA,EAAa,MAAA,IAAU,CAAC,CAAA;AAE9E,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,CAAoB;AAAA,IACzC,cAAA,EAAgB,iBAAA,GAAoB,CAAC,iBAAiB,CAAA,GAAI;AAAA,GAC3D,CAAA;AAED,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAC7B,EAAA,kBAAA,CAAmB,QAAQ,CAAA;AAE3B,EAAA,MAAM,kBAAkB,MAAM;AAC5B,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,aAAa,QAAA,CAAS,cAAA;AAC5B,IAAA,IAAI,sBAAsB,mBAAA,EAAqB;AAC7C,MAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,UAAA,CAAW,QAAQ,CAAA;AAAA,IACzC;AACA,IAAA,OAAO,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,GAAA,EAAI;AAAA,EAC1C,CAAA,GAAG;AAEH,EAAA,MAAM,aAAA,GAAgB,oBAClB,MAAM,wBAAA,CAAyB,iBAAiB,CAAA,GAC/C,cAAA,IAAkB,QAAQ,GAAA,EAAI;AAEnC,EAAA,MAAM,kBAAA,GAAqB,MAAM,yBAAA,CAA0B,QAAQ,CAAA;AAEnE,EAAA,MAAM,eAAA,GAAkB,CAAC,GAAG,kBAAA,EAAoB,GAAG,aAAa,CAAA;AAChE,EAAA,IAAI,eAAA,CAAgB,SAAS,CAAA,EAAG;AAC9B,IAAA,OAAA,CAAQ,IAAI,CAAA,qCAAA,EAA8B,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EACxE;AAGA,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,IAAA,MAAM,aAAqC,EAAC;AAC5C,IAAA,IAAI,iBAAA,GAAoB,CAAA;AACxB,IAAA,KAAA,MAAW,UAAU,WAAA,EAAa;AAChC,MAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,OAAA,CAAQ,aAAA,EAAe,MAAM,CAAA;AACzD,MAAA,MAAM,SAAS,MAAM,kBAAA;AAAA,QACnB,EAAE,KAAK,cAAA,EAAe;AAAA,QACtB;AAAA,OACF;AACA,MAAA,UAAA,CAAW,IAAA,CAAK,GAAG,MAAA,CAAO,UAAU,CAAA;AACpC,MAAA,iBAAA,IAAqB,MAAA,CAAO,iBAAA;AAAA,IAC9B;AACA,IAAA,MAAM,UAAA,GAAa,CAAC,GAAG,IAAI,IAAI,UAAA,CAAW,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,GAAG,CAAC,CAAC,EAAE,IAAA,CAAK,CAAC,GAAG,CAAA,KAAM,CAAA,CAAE,aAAA,CAAc,CAAC,CAAC,CAAA;AAC/F,IAAA,UAAA,GAAa,EAAE,IAAA,EAAM,UAAA,EAAY,UAAA,EAAY,UAAA,EAAY,mBAAmB,iBAAA,EAAkB;AAAA,EAChG,CAAA,MAAO;AACL,IAAA,UAAA,GAAa,MAAM,kBAAA;AAAA,MACjB,EAAE,KAAK,aAAA,EAAc;AAAA,MACrB;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA;AAEpD,EAAA,MAAM,IAAA,GAAO,qBAAA,CAAsB,UAAA,EAAY,UAAA,CAAW,IAAI,CAAA;AAC9D,EAAA,MAAM,oBAAA,GAAuB,4BAA4B,QAAQ,CAAA;AACjE,EAAA,MAAM,iBAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,GAAA,IAAO,KAAK,cAAA,EAAgB;AAErC,IAAA,IAAI,oBAAA,CAAqB,GAAA,CAAI,GAAG,CAAA,EAAG;AAEnC,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,YAAA,CAAa,GAAG,CAAA;AACtC,IAAA,MAAM,iBAAkB,IAAA,EAAc,UAAA;AACtC,IAAA,MAAM,SAAA,GAAa,OAAO,IAAA,EAAM,MAAA,KAAW,UAAA,IAAe,IAAA,CAAK,MAAA,CAAO,aAAa,CAAA,KAAkB,IAAA,IAC/F,cAAA,EAAgB,WAAA,KAAgB,IAAA;AACtC,IAAA,IAAI,SAAA,EAAW;AACf,IAAA,cAAA,CAAe,KAAK,GAAG,CAAA;AAAA,EACzB;AAEA,EAAA,IAAI,KAAK,eAAA,CAAgB,MAAA,KAAW,CAAA,IAAK,cAAA,CAAe,WAAW,CAAA,EAAG;AACpE,IAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,KAAA,CAAM,CAAA,wDAAA,EAAsD,UAAA,CAAW,iBAAiB,CAAA,KAAA,EAAQ,UAAA,CAAW,iBAAA,KAAsB,CAAA,GAAI,EAAA,GAAK,GAAG,GAAG,CAAC,CAAA;AACnK,IAAA,YAAA,CAAa,CAAC,CAAA;AACd,IAAA;AAAA,EACF;AAEA,EAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAM,GAAA,CAAI,8CAAuC,CAAC,CAAA;AAEhE,EAAA,IAAI,IAAA,CAAK,eAAA,CAAgB,MAAA,GAAS,CAAA,EAAG;AACnC,IAAA,OAAA,CAAQ,KAAA,CAAM,cAAM,GAAA,CAAI,CAAA,mBAAA,EAAsB,KAAK,eAAA,CAAgB,MAAM,IAAI,CAAC,CAAA;AAC9E,IAAA,KAAA,MAAW,GAAA,IAAO,KAAK,eAAA,EAAiB;AACtC,MAAA,MAAM,IAAA,GAAO,UAAA,CAAW,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAC1E,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM,eAAA,CAAgB,aAAA,EAAe,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAC/E,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,IAAA,EAAO,aAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA,EAAG,UAAA,GAAa,aAAA,CAAM,IAAI,CAAA,UAAA,EAAa,UAAU,CAAA,CAAA,CAAG,CAAA,GAAI,EAAE,CAAA,CAAE,CAAA;AAAA,IAClG;AACA,IAAA,OAAA,CAAQ,MAAM,EAAE,CAAA;AAAA,EAClB;AAEA,EAAA,IAAI,cAAA,CAAe,SAAS,CAAA,EAAG;AAC7B,IAAA,OAAA,CAAQ,MAAM,aAAA,CAAM,MAAA,CAAO,qBAAqB,cAAA,CAAe,MAAM,IAAI,CAAC,CAAA;AAC1E,IAAA,KAAA,MAAW,OAAO,cAAA,EAAgB;AAChC,MAAA,OAAA,CAAQ,MAAM,CAAA,IAAA,EAAO,aAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IACxC;AACA,IAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAM,GAAA,CAAI,6EAA6E,CAAC,CAAA;AACtG,IAAA,OAAA,CAAQ,MAAM,EAAE,CAAA;AAAA,EAClB;AAEA,EAAA,YAAA,CAAa,CAAC,CAAA;AAChB,CAAA,EAtGmE,WAAA","file":"chunk-35LTPRXV.js","sourcesContent":["export function diffSchemaAndCodeKeys(schemaKeys: Array<string>, codeKeys: Array<string>) {\n const schemaSet = new Set(schemaKeys);\n const codeSet = new Set(codeKeys);\n\n const missingInSchema = [...codeSet].filter((k) => !schemaSet.has(k)).sort((a, b) => a.localeCompare(b));\n const unusedInSchema = [...schemaSet].filter((k) => !codeSet.has(k)).sort((a, b) => a.localeCompare(b));\n\n return {\n missingInSchema,\n unusedInSchema,\n };\n}\n","import fs from 'node:fs/promises';\nimport path from 'node:path';\nimport ansis from 'ansis';\nimport { define } from 'gunshi';\n\nimport { FileBasedDataSource } from '../../env-graph';\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { checkForNoEnvFiles, checkForSchemaErrors } from '../helpers/error-checks';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport {\n scanCodeForEnvVars,\n type EnvVarReference,\n type ScanCodeEnvVarsResult,\n} from '../helpers/env-var-scanner';\nimport { gracefulExit } from 'exit-hook';\nimport { diffSchemaAndCodeKeys } from '../helpers/audit-diff';\n\nexport const commandSpec = define({\n name: 'audit',\n description: 'Audit code env var usage against your .env.schema',\n args: {\n path: {\n type: 'string',\n short: 'p',\n description: 'Path to a specific .env file or directory to use as the schema entry point',\n },\n ignore: {\n type: 'string',\n short: 'i',\n multiple: true,\n description: 'Directory to exclude from code scanning (can be specified multiple times)',\n },\n },\n examples: `\nScans your source code for environment variable references and compares them\nto keys defined in your varlock schema.\n\nExamples:\n varlock audit # Audit current project\n varlock audit --path .env.prod # Audit using a specific env entry point\n varlock audit ./src ./lib # Only scan specific directories\n varlock audit --ignore vendor # Exclude a directory from scanning\n varlock audit -i vendor -i generated # Exclude multiple directories\n`.trim(),\n});\n\nfunction formatReference(cwd: string, ref: EnvVarReference): string {\n const relPath = path.relative(cwd, ref.filePath);\n return `${relPath}:${ref.lineNumber}:${ref.columnNumber}`;\n}\n\nasync function getScanRootFromEntryPath(providedEntryPath: string): Promise<string> {\n const resolved = path.resolve(providedEntryPath);\n try {\n const entryStat = await fs.stat(resolved);\n if (entryStat.isDirectory()) return resolved;\n } catch {\n // loadVarlockEnvGraph validates path before this point; fallback keeps behavior predictable\n }\n\n if (providedEntryPath.endsWith('/') \|\| providedEntryPath.endsWith(path.sep)) {\n return resolved;\n }\n return path.dirname(resolved);\n}\n\nfunction collectStringArgs(input: unknown, out: Array<string>) {\n if (Array.isArray(input)) {\n for (const entry of input) collectStringArgs(entry, out);\n return;\n }\n if (typeof input !== 'string') return;\n\n const normalized = input.trim().replace(/^\\.\\//, '').replace(/[/\\\\]+$/, '');\n if (!normalized) return;\n out.push(normalized);\n}\n\n/** Collect all config keys that are depended on by other items or root decorators */\nfunction getInternallyReferencedKeys(envGraph: any): Set<string> {\n const referenced = new Set<string>();\n\n // Keys referenced by other config items (via $REF, concat, fallback, etc.)\n const adjList = envGraph.graphAdjacencyList;\n if (adjList) {\n for (const itemKey in adjList) {\n for (const dep of adjList[itemKey]) {\n referenced.add(dep);\n }\n }\n }\n\n // Keys referenced by root decorators (e.g., @currentEnv=$APP_ENV)\n for (const source of envGraph.sortedDataSources ?? []) {\n for (const dec of source.rootDecorators ?? []) {\n for (const dep of dec.decValueResolver?.deps ?? []) {\n referenced.add(dep);\n }\n }\n }\n\n return referenced;\n}\n\nasync function getCustomAuditIgnorePaths(envGraph: any): Promise<Array<string>> {\n const rootDecFns = typeof envGraph?.getRootDecFns === 'function'\n ? envGraph.getRootDecFns('auditIgnorePaths')\n : [];\n\n const mergedPaths: Array<string> = [];\n for (const dec of rootDecFns \|\| []) {\n const resolved = await dec.resolve();\n collectStringArgs(resolved?.arr, mergedPaths);\n }\n\n return [...new Set(mergedPaths)];\n}\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n const providedEntryPath = ctx.values.path as string \| undefined;\n const cliIgnoreDirs = (ctx.values.ignore ?? []) as Array<string>;\n const scanTargets = (ctx.positionals ?? []).slice(ctx.commandPath?.length ?? 0);\n\n const envGraph = await loadVarlockEnvGraph({\n entryFilePaths: providedEntryPath ? [providedEntryPath] : undefined,\n });\n\n checkForSchemaErrors(envGraph);\n checkForNoEnvFiles(envGraph);\n\n const schemaScanRoot = (() => {\n if (providedEntryPath) {\n return undefined;\n }\n\n const rootSource = envGraph.rootDataSource;\n if (rootSource instanceof FileBasedDataSource) {\n return path.dirname(rootSource.fullPath);\n }\n return envGraph.basePath ?? process.cwd();\n })();\n\n const finalScanRoot = providedEntryPath\n ? await getScanRootFromEntryPath(providedEntryPath)\n : (schemaScanRoot ?? process.cwd());\n\n const customIgnoredPaths = await getCustomAuditIgnorePaths(envGraph);\n // Merge CLI --ignore dirs with schema @auditIgnorePaths\n const allIgnoredPaths = [...customIgnoredPaths, ...cliIgnoreDirs];\n if (allIgnoredPaths.length > 0) {\n console.log(`ℹ️ Skipping ignored paths: ${allIgnoredPaths.join(', ')}`);\n }\n\n // If positional scan targets are provided, scan each one individually and merge results\n let scanResult: ScanCodeEnvVarsResult;\n if (scanTargets.length > 0) {\n const mergedRefs: Array<EnvVarReference> = [];\n let totalFilesScanned = 0;\n for (const target of scanTargets) {\n const resolvedTarget = path.resolve(finalScanRoot, target);\n const result = await scanCodeForEnvVars(\n { cwd: resolvedTarget },\n allIgnoredPaths,\n );\n mergedRefs.push(...result.references);\n totalFilesScanned += result.scannedFilesCount;\n }\n const uniqueKeys = [...new Set(mergedRefs.map((r) => r.key))].sort((a, b) => a.localeCompare(b));\n scanResult = { keys: uniqueKeys, references: mergedRefs, scannedFilesCount: totalFilesScanned };\n } else {\n scanResult = await scanCodeForEnvVars(\n { cwd: finalScanRoot },\n allIgnoredPaths,\n );\n }\n const schemaKeys = Object.keys(envGraph.configSchema);\n\n const diff = diffSchemaAndCodeKeys(schemaKeys, scanResult.keys);\n const internallyReferenced = getInternallyReferencedKeys(envGraph);\n const unusedInSchema: Array<string> = [];\n for (const key of diff.unusedInSchema) {\n // Skip keys that are referenced internally by other items or root decorators\n if (internallyReferenced.has(key)) continue;\n\n const item = envGraph.configSchema[key];\n const itemDecorators = (item as any)?.decorators as Record<string, unknown> \| undefined;\n const isIgnored = (typeof item?.getDec === 'function' && (item.getDec('auditIgnore') as unknown) === true)\n \|\| (itemDecorators?.auditIgnore === true);\n if (isIgnored) continue;\n unusedInSchema.push(key);\n }\n\n if (diff.missingInSchema.length === 0 && unusedInSchema.length === 0) {\n console.log(ansis.green(`✅ Schema and code references are in sync. (scanned ${scanResult.scannedFilesCount} file${scanResult.scannedFilesCount === 1 ? '' : 's'})`));\n gracefulExit(0);\n return;\n }\n\n console.error(ansis.red('\\n🚨 Schema/code mismatch detected:\\n'));\n\n if (diff.missingInSchema.length > 0) {\n console.error(ansis.red(`Missing in schema (${diff.missingInSchema.length}):`));\n for (const key of diff.missingInSchema) {\n const refs = scanResult.references.filter((r) => r.key === key).slice(0, 3);\n const refPreview = refs.map((r) => formatReference(finalScanRoot, r)).join(', ');\n console.error(` - ${ansis.bold(key)}${refPreview ? ansis.dim(` (seen at ${refPreview})`) : ''}`);\n }\n console.error('');\n }\n\n if (unusedInSchema.length > 0) {\n console.error(ansis.yellow(`Unused in schema (${unusedInSchema.length}):`));\n for (const key of unusedInSchema) {\n console.error(` - ${ansis.bold(key)}`);\n }\n console.error(ansis.dim('(Hint: If this is used by an external tool, add # @auditIgnore to the item)'));\n console.error('');\n }\n\n gracefulExit(1);\n};\n"]}
1	+ {"version":3,"sources":["../src/cli/helpers/audit-diff.ts","../src/cli/commands/audit.command.ts"],"names":[],"mappings":";;;;;;;;;;;AAAO,SAAS,qBAAA,CAAsB,YAA2B,QAAA,EAAyB;AACxF,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,UAAU,CAAA;AACpC,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,QAAQ,CAAA;AAEhC,EAAA,MAAM,eAAA,GAAkB,CAAC,GAAG,OAAO,EAAE,MAAA,CAAO,CAAC,MAAM,CAAC,SAAA,CAAU,IAAI,CAAC,CAAC,EAAE,IAAA,CAAK,CAAC,GAAG,CAAA,KAAM,CAAA,CAAE,aAAA,CAAc,CAAC,CAAC,CAAA;AACvG,EAAA,MAAM,cAAA,GAAiB,CAAC,GAAG,SAAS,EAAE,MAAA,CAAO,CAAC,MAAM,CAAC,OAAA,CAAQ,IAAI,CAAC,CAAC,EAAE,IAAA,CAAK,CAAC,GAAG,CAAA,KAAM,CAAA,CAAE,aAAA,CAAc,CAAC,CAAC,CAAA;AAEtG,EAAA,OAAO;AAAA,IACL,eAAA;AAAA,IACA;AAAA,GACF;AACF;AAXgB,MAAA,CAAA,qBAAA,EAAA,uBAAA,CAAA;;;ACiBT,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,OAAA;AAAA,EACN,WAAA,EAAa,mDAAA;AAAA,EACb,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,WAAA,EAAa;AAAA,KACf;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA;AACf,GACF;AAAA,EACA,QAAA,EAAU;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAUV,IAAA;AACF,CAAC;AAED,SAAS,eAAA,CAAgB,KAAa,GAAA,EAA8B;AAClE,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,IAAI,QAAQ,CAAA;AAC/C,EAAA,OAAO,GAAG,OAAO,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA,CAAA,EAAI,IAAI,YAAY,CAAA,CAAA;AACzD;AAHS,MAAA,CAAA,eAAA,EAAA,iBAAA,CAAA;AAKT,eAAe,yBAAyB,iBAAA,EAA4C;AAClF,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,iBAAiB,CAAA;AAC/C,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAM,EAAA,CAAG,IAAA,CAAK,QAAQ,CAAA;AACxC,IAAA,IAAI,SAAA,CAAU,WAAA,EAAY,EAAG,OAAO,QAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,iBAAA,CAAkB,SAAS,GAAG,CAAA,IAAK,kBAAkB,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG;AAC3E,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA,CAAK,QAAQ,QAAQ,CAAA;AAC9B;AAbe,MAAA,CAAA,wBAAA,EAAA,0BAAA,CAAA;AAef,SAAS,iBAAA,CAAkB,OAAgB,GAAA,EAAoB;AAC7D,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,KAAA,MAAW,KAAA,IAAS,KAAA,EAAO,iBAAA,CAAkB,KAAA,EAAO,GAAG,CAAA;AACvD,IAAA;AAAA,EACF;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAE/B,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,OAAA,CAAQ,SAAS,EAAE,CAAA,CAAE,OAAA,CAAQ,SAAA,EAAW,EAAE,CAAA;AAC1E,EAAA,IAAI,CAAC,UAAA,EAAY;AACjB,EAAA,GAAA,CAAI,KAAK,UAAU,CAAA;AACrB;AAVS,MAAA,CAAA,iBAAA,EAAA,mBAAA,CAAA;AAaT,SAAS,4BAA4B,QAAA,EAA4B;AAC/D,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AAGnC,EAAA,MAAM,UAAU,QAAA,CAAS,kBAAA;AACzB,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,KAAA,MAAW,WAAW,OAAA,EAAS;AAC7B,MAAA,KAAA,MAAW,GAAA,IAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClC,QAAA,UAAA,CAAW,IAAI,GAAG,CAAA;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AAGA,EAAA,KAAA,MAAW,MAAA,IAAU,QAAA,CAAS,iBAAA,IAAqB,EAAC,EAAG;AACrD,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,cAAA,IAAkB,EAAC,EAAG;AAC7C,MAAA,KAAA,MAAW,GAAA,IAAO,GAAA,CAAI,gBAAA,EAAkB,IAAA,IAAQ,EAAC,EAAG;AAClD,QAAA,UAAA,CAAW,IAAI,GAAG,CAAA;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,UAAA;AACT;AAvBS,MAAA,CAAA,2BAAA,EAAA,6BAAA,CAAA;AAyBT,eAAe,0BAA0B,QAAA,EAAuC;AAC9E,EAAA,MAAM,UAAA,GAAa,OAAO,QAAA,EAAU,aAAA,KAAkB,aAClD,QAAA,CAAS,aAAA,CAAc,kBAAkB,CAAA,GACzC,EAAC;AAEL,EAAA,MAAM,cAA6B,EAAC;AACpC,EAAA,KAAA,MAAW,GAAA,IAAO,UAAA,IAAc,EAAC,EAAG;AAClC,IAAA,MAAM,QAAA,GAAW,MAAM,GAAA,CAAI,OAAA,EAAQ;AACnC,IAAA,iBAAA,CAAkB,QAAA,EAAU,KAAK,WAAW,CAAA;AAAA,EAC9C;AAEA,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,WAAW,CAAC,CAAA;AACjC;AAZe,MAAA,CAAA,yBAAA,EAAA,2BAAA,CAAA;AAcR,IAAM,SAAA,iCAA6D,GAAA,KAAQ;AAChF,EAAA,MAAM,iBAAA,GAAoB,IAAI,MAAA,CAAO,IAAA;AACrC,EAAA,MAAM,aAAA,GAAiB,GAAA,CAAI,MAAA,CAAO,MAAA,IAAU,EAAC;AAC7C,EAAA,MAAM,WAAA,GAAA,CAAe,IAAI,WAAA,IAAe,IAAI,KAAA,CAAM,GAAA,CAAI,WAAA,EAAa,MAAA,IAAU,CAAC,CAAA;AAE9E,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,CAAoB;AAAA,IACzC,cAAA,EAAgB,iBAAA,GAAoB,CAAC,iBAAiB,CAAA,GAAI;AAAA,GAC3D,CAAA;AAED,EAAA,oBAAA,CAAqB,QAAQ,CAAA;AAC7B,EAAA,kBAAA,CAAmB,QAAQ,CAAA;AAE3B,EAAA,MAAM,kBAAkB,MAAM;AAC5B,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,aAAa,QAAA,CAAS,cAAA;AAC5B,IAAA,IAAI,sBAAsB,mBAAA,EAAqB;AAC7C,MAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,UAAA,CAAW,QAAQ,CAAA;AAAA,IACzC;AACA,IAAA,OAAO,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,GAAA,EAAI;AAAA,EAC1C,CAAA,GAAG;AAEH,EAAA,MAAM,aAAA,GAAgB,oBAClB,MAAM,wBAAA,CAAyB,iBAAiB,CAAA,GAC/C,cAAA,IAAkB,QAAQ,GAAA,EAAI;AAEnC,EAAA,MAAM,kBAAA,GAAqB,MAAM,yBAAA,CAA0B,QAAQ,CAAA;AAEnE,EAAA,MAAM,eAAA,GAAkB,CAAC,GAAG,kBAAA,EAAoB,GAAG,aAAa,CAAA;AAChE,EAAA,IAAI,eAAA,CAAgB,SAAS,CAAA,EAAG;AAC9B,IAAA,OAAA,CAAQ,IAAI,CAAA,qCAAA,EAA8B,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EACxE;AAGA,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,IAAA,MAAM,aAAqC,EAAC;AAC5C,IAAA,IAAI,iBAAA,GAAoB,CAAA;AACxB,IAAA,KAAA,MAAW,UAAU,WAAA,EAAa;AAChC,MAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,OAAA,CAAQ,aAAA,EAAe,MAAM,CAAA;AACzD,MAAA,MAAM,SAAS,MAAM,kBAAA;AAAA,QACnB,EAAE,KAAK,cAAA,EAAe;AAAA,QACtB;AAAA,OACF;AACA,MAAA,UAAA,CAAW,IAAA,CAAK,GAAG,MAAA,CAAO,UAAU,CAAA;AACpC,MAAA,iBAAA,IAAqB,MAAA,CAAO,iBAAA;AAAA,IAC9B;AACA,IAAA,MAAM,UAAA,GAAa,CAAC,GAAG,IAAI,IAAI,UAAA,CAAW,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,GAAG,CAAC,CAAC,EAAE,IAAA,CAAK,CAAC,GAAG,CAAA,KAAM,CAAA,CAAE,aAAA,CAAc,CAAC,CAAC,CAAA;AAC/F,IAAA,UAAA,GAAa,EAAE,IAAA,EAAM,UAAA,EAAY,UAAA,EAAY,UAAA,EAAY,mBAAmB,iBAAA,EAAkB;AAAA,EAChG,CAAA,MAAO;AACL,IAAA,UAAA,GAAa,MAAM,kBAAA;AAAA,MACjB,EAAE,KAAK,aAAA,EAAc;AAAA,MACrB;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA;AAEpD,EAAA,MAAM,IAAA,GAAO,qBAAA,CAAsB,UAAA,EAAY,UAAA,CAAW,IAAI,CAAA;AAC9D,EAAA,MAAM,oBAAA,GAAuB,4BAA4B,QAAQ,CAAA;AACjE,EAAA,MAAM,iBAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,GAAA,IAAO,KAAK,cAAA,EAAgB;AAErC,IAAA,IAAI,oBAAA,CAAqB,GAAA,CAAI,GAAG,CAAA,EAAG;AAEnC,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,YAAA,CAAa,GAAG,CAAA;AACtC,IAAA,MAAM,iBAAkB,IAAA,EAAc,UAAA;AACtC,IAAA,MAAM,SAAA,GAAa,OAAO,IAAA,EAAM,MAAA,KAAW,UAAA,IAAe,IAAA,CAAK,MAAA,CAAO,aAAa,CAAA,KAAkB,IAAA,IAC/F,cAAA,EAAgB,WAAA,KAAgB,IAAA;AACtC,IAAA,IAAI,SAAA,EAAW;AACf,IAAA,cAAA,CAAe,KAAK,GAAG,CAAA;AAAA,EACzB;AAEA,EAAA,IAAI,KAAK,eAAA,CAAgB,MAAA,KAAW,CAAA,IAAK,cAAA,CAAe,WAAW,CAAA,EAAG;AACpE,IAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,CAAM,KAAA,CAAM,CAAA,wDAAA,EAAsD,UAAA,CAAW,iBAAiB,CAAA,KAAA,EAAQ,UAAA,CAAW,iBAAA,KAAsB,CAAA,GAAI,EAAA,GAAK,GAAG,GAAG,CAAC,CAAA;AACnK,IAAA,YAAA,CAAa,CAAC,CAAA;AACd,IAAA;AAAA,EACF;AAEA,EAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAM,GAAA,CAAI,8CAAuC,CAAC,CAAA;AAEhE,EAAA,IAAI,IAAA,CAAK,eAAA,CAAgB,MAAA,GAAS,CAAA,EAAG;AACnC,IAAA,OAAA,CAAQ,KAAA,CAAM,cAAM,GAAA,CAAI,CAAA,mBAAA,EAAsB,KAAK,eAAA,CAAgB,MAAM,IAAI,CAAC,CAAA;AAC9E,IAAA,KAAA,MAAW,GAAA,IAAO,KAAK,eAAA,EAAiB;AACtC,MAAA,MAAM,IAAA,GAAO,UAAA,CAAW,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAC1E,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM,eAAA,CAAgB,aAAA,EAAe,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAC/E,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,IAAA,EAAO,aAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA,EAAG,UAAA,GAAa,aAAA,CAAM,IAAI,CAAA,UAAA,EAAa,UAAU,CAAA,CAAA,CAAG,CAAA,GAAI,EAAE,CAAA,CAAE,CAAA;AAAA,IAClG;AACA,IAAA,OAAA,CAAQ,MAAM,EAAE,CAAA;AAAA,EAClB;AAEA,EAAA,IAAI,cAAA,CAAe,SAAS,CAAA,EAAG;AAC7B,IAAA,OAAA,CAAQ,MAAM,aAAA,CAAM,MAAA,CAAO,qBAAqB,cAAA,CAAe,MAAM,IAAI,CAAC,CAAA;AAC1E,IAAA,KAAA,MAAW,OAAO,cAAA,EAAgB;AAChC,MAAA,OAAA,CAAQ,MAAM,CAAA,IAAA,EAAO,aAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IACxC;AACA,IAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAM,GAAA,CAAI,6EAA6E,CAAC,CAAA;AACtG,IAAA,OAAA,CAAQ,MAAM,EAAE,CAAA;AAAA,EAClB;AAEA,EAAA,YAAA,CAAa,CAAC,CAAA;AAChB,CAAA,EAtGmE,WAAA","file":"chunk-RTKFINP6.js","sourcesContent":["export function diffSchemaAndCodeKeys(schemaKeys: Array<string>, codeKeys: Array<string>) {\n const schemaSet = new Set(schemaKeys);\n const codeSet = new Set(codeKeys);\n\n const missingInSchema = [...codeSet].filter((k) => !schemaSet.has(k)).sort((a, b) => a.localeCompare(b));\n const unusedInSchema = [...schemaSet].filter((k) => !codeSet.has(k)).sort((a, b) => a.localeCompare(b));\n\n return {\n missingInSchema,\n unusedInSchema,\n };\n}\n","import fs from 'node:fs/promises';\nimport path from 'node:path';\nimport ansis from 'ansis';\nimport { define } from 'gunshi';\n\nimport { FileBasedDataSource } from '../../env-graph';\nimport { loadVarlockEnvGraph } from '../../lib/load-graph';\nimport { checkForNoEnvFiles, checkForSchemaErrors } from '../helpers/error-checks';\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport {\n scanCodeForEnvVars,\n type EnvVarReference,\n type ScanCodeEnvVarsResult,\n} from '../helpers/env-var-scanner';\nimport { gracefulExit } from 'exit-hook';\nimport { diffSchemaAndCodeKeys } from '../helpers/audit-diff';\n\nexport const commandSpec = define({\n name: 'audit',\n description: 'Audit code env var usage against your .env.schema',\n args: {\n path: {\n type: 'string',\n short: 'p',\n description: 'Path to a specific .env file or directory to use as the schema entry point',\n },\n ignore: {\n type: 'string',\n short: 'i',\n multiple: true,\n description: 'Directory to exclude from code scanning (can be specified multiple times)',\n },\n },\n examples: `\nScans your source code for environment variable references and compares them\nto keys defined in your varlock schema.\n\nExamples:\n varlock audit # Audit current project\n varlock audit --path .env.prod # Audit using a specific env entry point\n varlock audit ./src ./lib # Only scan specific directories\n varlock audit --ignore vendor # Exclude a directory from scanning\n varlock audit -i vendor -i generated # Exclude multiple directories\n`.trim(),\n});\n\nfunction formatReference(cwd: string, ref: EnvVarReference): string {\n const relPath = path.relative(cwd, ref.filePath);\n return `${relPath}:${ref.lineNumber}:${ref.columnNumber}`;\n}\n\nasync function getScanRootFromEntryPath(providedEntryPath: string): Promise<string> {\n const resolved = path.resolve(providedEntryPath);\n try {\n const entryStat = await fs.stat(resolved);\n if (entryStat.isDirectory()) return resolved;\n } catch {\n // loadVarlockEnvGraph validates path before this point; fallback keeps behavior predictable\n }\n\n if (providedEntryPath.endsWith('/') \|\| providedEntryPath.endsWith(path.sep)) {\n return resolved;\n }\n return path.dirname(resolved);\n}\n\nfunction collectStringArgs(input: unknown, out: Array<string>) {\n if (Array.isArray(input)) {\n for (const entry of input) collectStringArgs(entry, out);\n return;\n }\n if (typeof input !== 'string') return;\n\n const normalized = input.trim().replace(/^\\.\\//, '').replace(/[/\\\\]+$/, '');\n if (!normalized) return;\n out.push(normalized);\n}\n\n/** Collect all config keys that are depended on by other items or root decorators */\nfunction getInternallyReferencedKeys(envGraph: any): Set<string> {\n const referenced = new Set<string>();\n\n // Keys referenced by other config items (via $REF, concat, fallback, etc.)\n const adjList = envGraph.graphAdjacencyList;\n if (adjList) {\n for (const itemKey in adjList) {\n for (const dep of adjList[itemKey]) {\n referenced.add(dep);\n }\n }\n }\n\n // Keys referenced by root decorators (e.g., @currentEnv=$APP_ENV)\n for (const source of envGraph.sortedDataSources ?? []) {\n for (const dec of source.rootDecorators ?? []) {\n for (const dep of dec.decValueResolver?.deps ?? []) {\n referenced.add(dep);\n }\n }\n }\n\n return referenced;\n}\n\nasync function getCustomAuditIgnorePaths(envGraph: any): Promise<Array<string>> {\n const rootDecFns = typeof envGraph?.getRootDecFns === 'function'\n ? envGraph.getRootDecFns('auditIgnorePaths')\n : [];\n\n const mergedPaths: Array<string> = [];\n for (const dec of rootDecFns \|\| []) {\n const resolved = await dec.resolve();\n collectStringArgs(resolved?.arr, mergedPaths);\n }\n\n return [...new Set(mergedPaths)];\n}\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {\n const providedEntryPath = ctx.values.path as string \| undefined;\n const cliIgnoreDirs = (ctx.values.ignore ?? []) as Array<string>;\n const scanTargets = (ctx.positionals ?? []).slice(ctx.commandPath?.length ?? 0);\n\n const envGraph = await loadVarlockEnvGraph({\n entryFilePaths: providedEntryPath ? [providedEntryPath] : undefined,\n });\n\n checkForSchemaErrors(envGraph);\n checkForNoEnvFiles(envGraph);\n\n const schemaScanRoot = (() => {\n if (providedEntryPath) {\n return undefined;\n }\n\n const rootSource = envGraph.rootDataSource;\n if (rootSource instanceof FileBasedDataSource) {\n return path.dirname(rootSource.fullPath);\n }\n return envGraph.basePath ?? process.cwd();\n })();\n\n const finalScanRoot = providedEntryPath\n ? await getScanRootFromEntryPath(providedEntryPath)\n : (schemaScanRoot ?? process.cwd());\n\n const customIgnoredPaths = await getCustomAuditIgnorePaths(envGraph);\n // Merge CLI --ignore dirs with schema @auditIgnorePaths\n const allIgnoredPaths = [...customIgnoredPaths, ...cliIgnoreDirs];\n if (allIgnoredPaths.length > 0) {\n console.log(`ℹ️ Skipping ignored paths: ${allIgnoredPaths.join(', ')}`);\n }\n\n // If positional scan targets are provided, scan each one individually and merge results\n let scanResult: ScanCodeEnvVarsResult;\n if (scanTargets.length > 0) {\n const mergedRefs: Array<EnvVarReference> = [];\n let totalFilesScanned = 0;\n for (const target of scanTargets) {\n const resolvedTarget = path.resolve(finalScanRoot, target);\n const result = await scanCodeForEnvVars(\n { cwd: resolvedTarget },\n allIgnoredPaths,\n );\n mergedRefs.push(...result.references);\n totalFilesScanned += result.scannedFilesCount;\n }\n const uniqueKeys = [...new Set(mergedRefs.map((r) => r.key))].sort((a, b) => a.localeCompare(b));\n scanResult = { keys: uniqueKeys, references: mergedRefs, scannedFilesCount: totalFilesScanned };\n } else {\n scanResult = await scanCodeForEnvVars(\n { cwd: finalScanRoot },\n allIgnoredPaths,\n );\n }\n const schemaKeys = Object.keys(envGraph.configSchema);\n\n const diff = diffSchemaAndCodeKeys(schemaKeys, scanResult.keys);\n const internallyReferenced = getInternallyReferencedKeys(envGraph);\n const unusedInSchema: Array<string> = [];\n for (const key of diff.unusedInSchema) {\n // Skip keys that are referenced internally by other items or root decorators\n if (internallyReferenced.has(key)) continue;\n\n const item = envGraph.configSchema[key];\n const itemDecorators = (item as any)?.decorators as Record<string, unknown> \| undefined;\n const isIgnored = (typeof item?.getDec === 'function' && (item.getDec('auditIgnore') as unknown) === true)\n \|\| (itemDecorators?.auditIgnore === true);\n if (isIgnored) continue;\n unusedInSchema.push(key);\n }\n\n if (diff.missingInSchema.length === 0 && unusedInSchema.length === 0) {\n console.log(ansis.green(`✅ Schema and code references are in sync. (scanned ${scanResult.scannedFilesCount} file${scanResult.scannedFilesCount === 1 ? '' : 's'})`));\n gracefulExit(0);\n return;\n }\n\n console.error(ansis.red('\\n🚨 Schema/code mismatch detected:\\n'));\n\n if (diff.missingInSchema.length > 0) {\n console.error(ansis.red(`Missing in schema (${diff.missingInSchema.length}):`));\n for (const key of diff.missingInSchema) {\n const refs = scanResult.references.filter((r) => r.key === key).slice(0, 3);\n const refPreview = refs.map((r) => formatReference(finalScanRoot, r)).join(', ');\n console.error(` - ${ansis.bold(key)}${refPreview ? ansis.dim(` (seen at ${refPreview})`) : ''}`);\n }\n console.error('');\n }\n\n if (unusedInSchema.length > 0) {\n console.error(ansis.yellow(`Unused in schema (${unusedInSchema.length}):`));\n for (const key of unusedInSchema) {\n console.error(` - ${ansis.bold(key)}`);\n }\n console.error(ansis.dim('(Hint: If this is used by an external tool, add # @auditIgnore to the item)'));\n console.error('');\n }\n\n gracefulExit(1);\n};\n"]}

package/dist/{chunk-QSYH5IDD.js → chunk-RWXFFQWH.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { define } from './chunk-4A54P4EM.js';
-import { getBackendInfo, lockSession } from './chunk-GURKQO4J.js';
+import { define } from './chunk-MGUGRIW2.js';
+import { getBackendInfo, lockSession } from './chunk-P4HNABAM.js';
 import { __name } from './chunk-6PEHRAEP.js';
 // src/cli/commands/lock.command.ts
@@ -22,5 +22,5 @@ var commandFn = /* @__PURE__ */ __name(async () => {
 }, "commandFn");
 export { commandFn, commandSpec };
-//# sourceMappingURL=chunk-QSYH5IDD.js.map
-//# sourceMappingURL=chunk-QSYH5IDD.js.map
+//# sourceMappingURL=chunk-RWXFFQWH.js.map
+//# sourceMappingURL=chunk-RWXFFQWH.js.map

package/dist/{chunk-QSYH5IDD.js.map → chunk-RWXFFQWH.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/cli/commands/lock.command.ts"],"names":[],"mappings":";;;;;AAMO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,MAAA;AAAA,EACN,WAAA,EAAa;AACf,CAAC;AAEM,IAAM,4BAAsD,MAAA,CAAA,YAAY;AAC7E,EAAA,MAAM,UAAuB,cAAA,EAAe;AAE5C,EAAA,IAAI,CAAC,QAAQ,kBAAA,EAAoB;AAC/B,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,IAAA,EAAO,OAAA,CAAQ,IAAI,CAAA,yCAAA,CAA2C,CAAA;AAC1E,IAAA;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAmB,WAAA,EAAY;AAC/B,IAAA,OAAA,CAAQ,IAAI,wFAAwF,CAAA;AAAA,EACtG,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,CAAQ,IAAI,yDAAoD,CAAA;AAAA,EAClE;AACF,CAAA,EAdmE,WAAA","file":"chunk-~~QSYH5IDD~~.js","sourcesContent":["\nimport { define } from 'gunshi';\n\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport * as localEncrypt from '../../lib/local-encrypt';\n\nexport const commandSpec = define({\n name: 'lock',\n description: 'Lock the encryption daemon, requiring biometric for next decrypt',\n});\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async () => {\n const backend = localEncrypt.getBackendInfo();\n\n if (!backend.biometricAvailable) {\n console.log(`The ${backend.type} backend does not support biometric lock.`);\n return;\n }\n\n try {\n await localEncrypt.lockSession();\n console.log('Encryption session locked. Biometric authentication will be required for next decrypt.');\n } catch {\n console.log('No encryption daemon is running — nothing to lock.');\n }\n};\n"]}
1	+ {"version":3,"sources":["../src/cli/commands/lock.command.ts"],"names":[],"mappings":";;;;;AAMO,IAAM,cAAc,MAAA,CAAO;AAAA,EAChC,IAAA,EAAM,MAAA;AAAA,EACN,WAAA,EAAa;AACf,CAAC;AAEM,IAAM,4BAAsD,MAAA,CAAA,YAAY;AAC7E,EAAA,MAAM,UAAuB,cAAA,EAAe;AAE5C,EAAA,IAAI,CAAC,QAAQ,kBAAA,EAAoB;AAC/B,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,IAAA,EAAO,OAAA,CAAQ,IAAI,CAAA,yCAAA,CAA2C,CAAA;AAC1E,IAAA;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAmB,WAAA,EAAY;AAC/B,IAAA,OAAA,CAAQ,IAAI,wFAAwF,CAAA;AAAA,EACtG,CAAA,CAAA,MAAQ;AACN,IAAA,OAAA,CAAQ,IAAI,yDAAoD,CAAA;AAAA,EAClE;AACF,CAAA,EAdmE,WAAA","file":"chunk-RWXFFQWH.js","sourcesContent":["\nimport { define } from 'gunshi';\n\nimport { type TypedGunshiCommandFn } from '../helpers/gunshi-type-utils';\nimport * as localEncrypt from '../../lib/local-encrypt';\n\nexport const commandSpec = define({\n name: 'lock',\n description: 'Lock the encryption daemon, requiring biometric for next decrypt',\n});\n\nexport const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async () => {\n const backend = localEncrypt.getBackendInfo();\n\n if (!backend.biometricAvailable) {\n console.log(`The ${backend.type} backend does not support biometric lock.`);\n return;\n }\n\n try {\n await localEncrypt.lockSession();\n console.log('Encryption session locked. Biometric authentication will be required for next decrypt.');\n } catch {\n console.log('No encryption daemon is running — nothing to lock.');\n }\n};\n"]}

package/dist/{chunk-LGEHJHB2.js → chunk-SX2NUZCL.js} RENAMED Viewed

@@ -1,5 +1,5 @@
-import { ansis_default, EnvGraph, MultiplePathsContainerDataSource, DirectoryDataSource, DotEnvFileDataSource } from './chunk-6CRDPEUT.js';
-import { my_dash_default } from './chunk-6CCHLM3U.js';
+import { ansis_default, EnvGraph, MultiplePathsContainerDataSource, DirectoryDataSource, DotEnvFileDataSource } from './chunk-PBWMMYWL.js';
+import { my_dash_default } from './chunk-FA5SNEKN.js';
 import { redactString } from './chunk-XLYSNOR3.js';
 import { __name } from './chunk-6PEHRAEP.js';
 import fs from 'fs';
@@ -102,7 +102,7 @@ var VALIDATION_STATE_COLORS = {
 function getItemSummary(item) {
   const summary = [];
   const itemErrors = item.errors;
-  const icon = itemErrors.length ? itemErrors[0].icon : "\u2705";
+  const icon = itemErrors.length ? (itemErrors.find((e) => !e.isWarning) ?? itemErrors[0]).icon : "\u2705";
   const isSensitive = item.isSensitive;
   const isRequired = item.isRequired;
   summary.push(joinAndCompact([
@@ -148,6 +148,7 @@ var CliExitError = class extends Error {
     return !!this.more?.forceExit;
   }
   getFormattedOutput() {
+    if (this.more?.silent) return "";
     let msg = `
 \u{1F4A5} ${ansis_default.red(this.message)} \u{1F4A5}
 `;
@@ -163,5 +164,5 @@ var CliExitError = class extends Error {
 };
 export { CliExitError, formattedValue, getItemSummary, joinAndCompact, loadEnvGraph };
-//# sourceMappingURL=chunk-LGEHJHB2.js.map
-//# sourceMappingURL=chunk-LGEHJHB2.js.map
+//# sourceMappingURL=chunk-SX2NUZCL.js.map
+//# sourceMappingURL=chunk-SX2NUZCL.js.map

package/dist/{chunk-LGEHJHB2.js.map → chunk-SX2NUZCL.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/env-graph/lib/loader.ts","../src/lib/formatting.ts","../src/cli/helpers/exit-error.ts"],"names":[],"mappings":";;;;;;;AAMA,eAAsB,aAAa,IAAA,EAShC;AACD,EAAA,MAAM,KAAA,GAAQ,IAAI,QAAA,EAAS;AAE3B,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,MAAM,cAAA,EAAgB;AACxB,IAAA,QAAA,GAAW,KAAA,CAAM,QAAQ,IAAA,CAAK,cAAc,IAAI,IAAA,CAAK,cAAA,GAAiB,CAAC,IAAA,CAAK,cAAc,CAAA;AAAA,EAC5F;AAEA,EAAA,IAAI,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AACnC,IAAA,KAAA,CAAM,QAAA,GAAW,IAAA,EAAM,QAAA,IAAY,OAAA,CAAQ,GAAA,EAAI;AAC/C,IAAA,IAAI,IAAA,EAAM,SAAA,EAAW,MAAM,IAAA,CAAK,UAAU,KAAK,CAAA;AAC/C,IAAA,IAAI,IAAA,EAAM,kBAAA,EAAoB,KAAA,CAAM,eAAA,GAAkB,IAAA,CAAK,kBAAA;AAC3D,IAAA,MAAM,aAAA,GAAgB,SAAS,GAAA,CAAI,CAAC,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAC,CAAA;AACzD,IAAA,MAAM,KAAA,CAAM,iBAAA,CAAkB,IAAI,gCAAA,CAAiC,aAAa,CAAC,CAAA;AAAA,EACnF,CAAA,MAAA,IAAW,QAAA,EAAU,MAAA,KAAW,CAAA,EAAG;AACjC,IAAA,MAAM,aAAA,GAAgB,SAAS,CAAC,CAAA;AAChC,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AAC/C,IAAA,MAAM,cAAc,aAAA,CAAc,QAAA,CAAS,GAAG,CAAA,IAAK,aAAA,CAAc,SAAS,IAAA,CAAK,GAAG,CAAA,IAC5E,EAAA,CAAG,WAAW,YAAY,CAAA,IAAK,GAAG,QAAA,CAAS,YAAY,EAAE,WAAA,EAAY;AAC3E,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,KAAA,CAAM,QAAA,GAAW,YAAA;AACjB,MAAA,IAAI,IAAA,EAAM,SAAA,EAAW,MAAM,IAAA,CAAK,UAAU,KAAK,CAAA;AAC/C,MAAA,IAAI,IAAA,EAAM,kBAAA,EAAoB,KAAA,CAAM,eAAA,GAAkB,IAAA,CAAK,kBAAA;AAC3D,MAAA,MAAM,KAAA,CAAM,iBAAA,CAAkB,IAAI,mBAAA,CAAoB,YAAY,CAAC,CAAA;AAAA,IACrE,CAAA,MAAO;AACL,MAAA,KAAA,CAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA;AAC1C,MAAA,IAAI,IAAA,EAAM,SAAA,EAAW,MAAM,IAAA,CAAK,UAAU,KAAK,CAAA;AAC/C,MAAA,IAAI,IAAA,EAAM,kBAAA,EAAoB,KAAA,CAAM,eAAA,GAAkB,IAAA,CAAK,kBAAA;AAC3D,MAAA,MAAM,KAAA,CAAM,iBAAA,CAAkB,IAAI,oBAAA,CAAqB,YAAY,CAAC,CAAA;AAAA,IACtE;AAAA,EACF,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,QAAA,GAAW,IAAA,EAAM,QAAA,IAAY,OAAA,CAAQ,GAAA,EAAI;AAC/C,IAAA,IAAI,IAAA,EAAM,SAAA,EAAW,MAAM,IAAA,CAAK,UAAU,KAAK,CAAA;AAC/C,IAAA,IAAI,IAAA,EAAM,kBAAA,EAAoB,KAAA,CAAM,eAAA,GAAkB,IAAA,CAAK,kBAAA;AAC3D,IAAA,MAAM,MAAM,iBAAA,CAAkB,IAAI,mBAAA,CAAoB,KAAA,CAAM,QAAQ,CAAC,CAAA;AAAA,EACvE;AAEA,EAAA,MAAM,MAAM,UAAA,EAAW;AAEvB,EAAA,OAAO,KAAA;AACT;AAjDsB,MAAA,CAAA,YAAA,EAAA,cAAA,CAAA;;;ACGtB,SAAS,SAAA,CAAU,KAAa,IAAA,EAAkB;AAChD,EAAA,IAAI,CAAC,MAAM,OAAO,GAAA;AAClB,EAAA,IAAI,eAAA,CAAE,OAAA,CAAQ,IAAI,CAAA,EAAG;AACnB,IAAA,IAAI,MAAA,GAAS,GAAA;AACb,IAAA,IAAA,CAAK,OAAA,CAAQ,CAAC,GAAA,KAAQ;AACpB,MAAA,MAAA,GAAS,aAAA,CAAM,GAAG,CAAA,CAAE,MAAM,CAAA;AAAA,IAC5B,CAAC,CAAA;AACD,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,aAAA,CAAM,IAAI,CAAA,CAAE,GAAG,CAAA;AACxB;AAVS,MAAA,CAAA,SAAA,EAAA,WAAA,CAAA;AAYF,SAAS,cAAA,CAAe,GAAA,EAAU,QAAA,GAAW,KAAA,EAAO;AACzD,EAAA,IAAI,MAAA,GAAiB,EAAA;AACrB,EAAA,IAAI,OAAA,GAAkB,EAAA;AACtB,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,eAAA,CAAE,SAAA,CAAU,GAAG,CAAA,EAAG;AACpB,IAAA,MAAA,GAAS,IAAI,QAAA,EAAS;AACtB,IAAA,IAAA,GAAO,CAAC,UAAU,QAAQ,CAAA;AAC1B,IAAA,OAAA,GAAU,SAAA;AAAA,EACZ,CAAA,MAAA,IAAW,eAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AAC1B,IAAA,MAAA,GAAS,IAAI,QAAA,EAAS;AACtB,IAAA,IAAA,GAAO,QAAA;AACP,IAAA,OAAA,GAAU,QAAA;AAAA,EACZ,CAAA,MAAA,IAAW,eAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AAC1B,IAAA,MAAA,GAAS,IAAI,GAAG,CAAA,CAAA,CAAA;AAChB,IAAA,OAAA,GAAU,QAAA;AAAA,EACZ,CAAA,MAAA,IAAW,eAAA,CAAE,aAAA,CAAc,GAAG,CAAA,EAAG;AAE/B,IAAA,MAAA,GAAS,IAAA,CAAK,UAAU,GAAG,CAAA;AAC3B,IAAA,OAAA,GAAU,QAAA;AAAA,EACZ,CAAA,MAAA,IAAW,QAAQ,IAAA,EAAM;AACvB,IAAA,MAAA,GAAS,MAAA;AACT,IAAA,IAAA,GAAO,MAAA;AAAA,EACT,CAAA,MAAA,IAAW,QAAQ,MAAA,EAAW;AAC5B,IAAA,MAAA,GAAS,WAAA;AACT,IAAA,IAAA,GAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,SAAA,CAAU,QAAQ,IAAI,CAAA;AAAA,IACtB,YAAY,OAAA,GAAU,aAAA,CAAM,KAAK,CAAA,EAAA,EAAK,OAAO,GAAG,CAAA,GAAI;AAAA,GACtD,CAAE,KAAK,EAAE,CAAA;AACX;AA9BgB,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAwDT,SAAS,cAAA,CAAe,OAAA,EAAsE,QAAA,GAAW,GAAA,EAAK;AACnH,EAAA,OAAO,OAAA,CAAQ,OAAO,CAAC,CAAA;AAAA;AAAA,IAErB,CAAA,KAAM,MAAA,IAAa,CAAA,KAAM,IAAA,IAAQ,CAAA,KAAM;AAAA,GACxC,CAAA,CAAE,KAAK,QAAQ,CAAA;AAClB;AALgB,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAOhB,IAAM,uBAAA,GAA0B;AAAA,EAC9B,KAAA,EAAO,KAAA;AAAA,EACP,IAAA,EAAM,QAAA;AAAA,EACN,KAAA,EAAO;AACT,CAAA;AAEO,SAAS,eAAe,IAAA,EAAkB;AAC/C,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,aAAa,IAAA,CAAK,MAAA;AACxB,EAAA,MAAM,OAAO,UAAA,CAAW,MAAA,GAAS,UAAA,CAAW,CAAC,EAAE,IAAA,GAAO,QAAA;AACtD,EAAA,MAAM,cAAc,IAAA,CAAK,WAAA;AACzB,EAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,EAAA,OAAA,CAAQ,KAAK,cAAA,CAAe;AAAA,IAC1B,IAAA;AAAA,IACA,aAAA,CAAM,wBAAwB,IAAA,CAAK,eAAe,CAAC,CAAA,CAAE,IAAA,CAAK,eAAe,aAAA,CAAM,aAAA,CAAc,KAAK,GAAG,CAAA,GAAI,KAAK,GAAG,CAAA,IAAK,aAAa,aAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,GAAI,EAAA,CAAA;AAAA;AAAA,IAGxJ,eAAe,CAAA,UAAA,EAAM,aAAA,CAAM,IAAA,CAAK,MAAA,CAAO,WAAW,CAAC,CAAA,CAAA;AAAA,IACnD,IAAA,CAAK,gBAAgB,CAAA,UAAA,EAAM,aAAA,CAAM,OAAO,GAAA,CAAI,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA;AAAA,GAGjE,CAAC,CAAA;AAEF,EAAA,IAAI,QAAA,GAAW,cAAA,CAAe,IAAA,CAAK,aAAA,EAAe,KAAK,CAAA;AACvD,EAAA,IAAI,eAAe,IAAA,CAAK,aAAA,IAAiB,gBAAE,QAAA,CAAS,IAAA,CAAK,aAAa,CAAA,EAAG;AACvE,IAAA,QAAA,GAAW,YAAA,CAAa,KAAK,aAAa,CAAA;AAAA,EAC5C;AAEA,EAAA,OAAA,CAAQ,KAAK,cAAA,CAAe;AAAA,IAC1B,aAAA,CAAM,KAAK,WAAM,CAAA;AAAA,IACjB,QAAA;AAAA,IACA,IAAA,CAAK,SAAA,IACH,aAAA,CAAM,IAAA,CAAK,OAAO,iBAAiB,CAAA,IAChC,WAAA,GAAc,cAAA,CAAe,KAAK,gBAAgB,CAAA,GAAI,cAAA,CAAe,IAAA,CAAK,kBAAkB,KAAK,CAAA;AAAA,GAEvG,CAAC,CAAA;AAEF,EAAA,IAAI,KAAK,YAAA,EAAc;AACrB,IAAA,OAAA,CAAQ,KAAK,CAAA,aAAA,EAAS,aAAA,CAAM,OAAO,MAAA,CAAO,8BAA8B,CAAC,CAAA,CAAE,CAAA;AAAA,EAC7E;AAEA,EAAA,UAAA,EAAY,OAAA,CAAQ,CAAC,GAAA,KAAQ;AAC3B,IAAA,OAAA,CAAQ,KAAK,aAAA,CAAM,GAAA,CAAI,SAAA,GAAY,QAAA,GAAW,KAAK,CAAA,CAAE,CAAA,KAAA,EAAQ,GAAA,CAAI,SAAA,GAAY,eAAe,EAAE,CAAA,EAAG,GAAA,CAAI,OAAO,EAAE,CAAC,CAAA;AAK/G,IAAA,IAAI,IAAI,GAAA,EAAK;AACX,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAAS,CAAA,KAAA,EAAQ,IAAI,EAAE,CAAC,CAAA;AAAA,IACnE;AAAA,EACF,CAAC,CAAA;AAQD,EAAA,OAAO,OAAA,CAAQ,KAAK,IAAI,CAAA;AAC1B;AArDgB,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;;;ACtFT,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,WAAA,CACE,SACQ,IAAA,EAMR;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAPL,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAQV;AAAA,EAfF;AAIwC,IAAA,MAAA,CAAA,IAAA,EAAA,cAAA,CAAA;AAAA;AAAA,EAatC,IAAI,SAAA,GAAY;AAAE,IAAA,OAAO,CAAC,CAAC,IAAA,CAAK,IAAA,EAAM,SAAA;AAAA,EAAW;AAAA,EAEjD,kBAAA,GAAqB;AACnB,IAAA,IAAI,GAAA,GAAM;AAAA,UAAA,EAAQ,aAAA,CAAM,GAAA,CAAI,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,CAAA;AAEzC,IAAA,IAAI,IAAA,CAAK,MAAM,OAAA,EAAS;AACtB,MAAA,GAAA,IAAO,eAAe,eAAA,CAAE,SAAA,CAAU,KAAK,IAAA,EAAM,OAAO,GAAG,IAAI,CAAA;AAAA,IAC7D;AAEA,IAAA,IAAI,IAAA,CAAK,MAAM,UAAA,EAAY;AACzB,MAAA,GAAA,IAAO,eAAe,eAAA,CAAE,SAAA,CAAU,KAAK,IAAA,EAAM,UAAU,GAAG,IAAI,CAAA;AAAA,IAChE;AAEA,IAAA,GAAA,IAAO,IAAA;AACP,IAAA,OAAO,GAAA;AAAA,EACT;AACF","file":"chunk-LGEHJHB2.js","sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\nimport _ from '@env-spec/utils/my-dash';\nimport { EnvGraph } from './env-graph';\nimport { DirectoryDataSource, DotEnvFileDataSource, MultiplePathsContainerDataSource } from './data-source';\n\nexport async function loadEnvGraph(opts?: {\n basePath?: string,\n /** Entry file path(s) — accepts a single path or array of paths /\n entryFilePaths?: string \| Array<string>,\n relativePaths?: Array<string>,\n checkGitIgnored?: boolean,\n excludeDirs?: Array<string>,\n currentEnvFallback?: string,\n afterInit?: (graph: EnvGraph) => Promise<void>,\n}) {\n const graph = new EnvGraph();\n\n let rawPaths: Array<string> \| undefined;\n if (opts?.entryFilePaths) {\n rawPaths = Array.isArray(opts.entryFilePaths) ? opts.entryFilePaths : [opts.entryFilePaths];\n }\n\n if (rawPaths && rawPaths.length > 1) {\n graph.basePath = opts?.basePath ?? process.cwd();\n if (opts?.afterInit) await opts.afterInit(graph);\n if (opts?.currentEnvFallback) graph.envFlagFallback = opts.currentEnvFallback;\n const resolvedPaths = rawPaths.map((p) => path.resolve(p));\n await graph.setRootDataSource(new MultiplePathsContainerDataSource(resolvedPaths));\n } else if (rawPaths?.length === 1) {\n const entryFilePath = rawPaths[0];\n const resolvedPath = path.resolve(entryFilePath);\n const isDirectory = entryFilePath.endsWith('/') \|\| entryFilePath.endsWith(path.sep)\n \|\| (fs.existsSync(resolvedPath) && fs.statSync(resolvedPath).isDirectory());\n if (isDirectory) {\n graph.basePath = resolvedPath;\n if (opts?.afterInit) await opts.afterInit(graph);\n if (opts?.currentEnvFallback) graph.envFlagFallback = opts.currentEnvFallback;\n await graph.setRootDataSource(new DirectoryDataSource(resolvedPath));\n } else {\n graph.basePath = path.dirname(resolvedPath);\n if (opts?.afterInit) await opts.afterInit(graph);\n if (opts?.currentEnvFallback) graph.envFlagFallback = opts.currentEnvFallback;\n await graph.setRootDataSource(new DotEnvFileDataSource(resolvedPath));\n }\n } else {\n graph.basePath = opts?.basePath ?? process.cwd();\n if (opts?.afterInit) await opts.afterInit(graph);\n if (opts?.currentEnvFallback) graph.envFlagFallback = opts.currentEnvFallback;\n await graph.setRootDataSource(new DirectoryDataSource(graph.basePath));\n }\n\n await graph.finishLoad();\n\n return graph;\n}\n\n","import ansis, { type AnsiColors, type AnsiStyles } from 'ansis';\nimport _ from '@env-spec/utils/my-dash';\n\nimport { ConfigItem, VarlockError } from '../env-graph';\nimport { redactString } from '../runtime/lib/redaction';\n\ntype ColorMod = AnsiStyles \| AnsiColors;\ntype ColorMods = ColorMod \| Array<ColorMod>;\n\nfunction applyMods(str: string, mods?: ColorMods) {\n if (!mods) return str;\n if (_.isArray(mods)) {\n let modStr = str;\n mods.forEach((mod) => {\n modStr = ansis[mod](modStr);\n });\n return modStr;\n }\n return ansis[mods](str);\n}\n\nexport function formattedValue(val: any, showType = false) {\n let strVal: string = '';\n let strType: string = '';\n let mods: ColorMods \| undefined;\n if (_.isBoolean(val)) {\n strVal = val.toString();\n mods = ['yellow', 'italic'];\n strType = 'boolean';\n } else if (_.isNumber(val)) {\n strVal = val.toString();\n mods = 'yellow';\n strType = 'number';\n } else if (_.isString(val)) {\n strVal = `\"${val}\"`;\n strType = 'string';\n } else if (_.isPlainObject(val)) {\n // TODO: can definitely make this better...\n strVal = JSON.stringify(val);\n strType = 'object';\n } else if (val === null) {\n strVal = 'null';\n mods = 'gray';\n } else if (val === undefined) {\n strVal = 'undefined';\n mods = 'gray';\n }\n return [\n applyMods(strVal, mods),\n showType && strType ? ansis.gray(` (${strType})`) : '',\n ].join('');\n}\n\n\nexport function formatError(err: VarlockError) {\n let whenStr = '';\n if (err.type === 'SchemaError') {\n whenStr += 'during schema initialization';\n }\n if (err.type === 'ValidationError') {\n whenStr += 'during validation';\n }\n if (err.type === 'CoercionError') {\n whenStr += 'during coercion';\n }\n if (err.type === 'ResolutionError') {\n whenStr += 'during resolution';\n }\n\n let errStr = `${err.icon} ${err.message}`;\n if (err.isUnexpected) {\n errStr += ansis.gray.italic(`\\n (unexpected error${whenStr ? ` ${whenStr}` : ''})`);\n if ('stack' in err) errStr += err.stack;\n }\n return errStr;\n}\n\nexport function joinAndCompact(strings: Array<string \| number \| boolean \| undefined \| null \| false>, joinChar = ' ') {\n return strings.filter((s) => (\n // we'll not filter out empty strings - because it's useful to just add newlines\n s !== undefined && s !== null && s !== false\n )).join(joinChar);\n}\n\nconst VALIDATION_STATE_COLORS = {\n error: 'red',\n warn: 'yellow',\n valid: 'cyan',\n} as const;\n\nexport function getItemSummary(item: ConfigItem) {\n const summary: Array<string> = [];\n const itemErrors = item.errors;\n const icon = itemErrors.length ? itemErrors[0].icon : '✅';\n const isSensitive = item.isSensitive;\n const isRequired = item.isRequired;\n summary.push(joinAndCompact([\n icon,\n ansis[VALIDATION_STATE_COLORS[item.validationState]](item.isDeprecated ? ansis.strikethrough(item.key) : item.key) + (isRequired ? ansis.magenta('') : ''),\n\n // ansis.gray(`[type = ${item.type.typeLabel}]`),\n isSensitive && ` 🔐${ansis.gray.italic('sensitive')}`,\n item.isDeprecated && ` 😵${ansis.yellow.dim.italic('deprecated')}`,\n\n // item.useAt ? ansis.gray.italic(`(${item.useAt?.join(', ')})`) : undefined,\n ]));\n\n let valAsStr = formattedValue(item.resolvedValue, false);\n if (isSensitive && item.resolvedValue && _.isString(item.resolvedValue)) {\n valAsStr = redactString(item.resolvedValue)!;\n }\n\n summary.push(joinAndCompact([\n ansis.gray(' └'),\n valAsStr,\n item.isCoerced && (\n ansis.gray.italic('< coerced from ')\n + (isSensitive ? formattedValue(item.resolvedRawValue) : formattedValue(item.resolvedRawValue, false))\n ),\n ]));\n\n if (item.isOverridden) {\n summary.push(` 🟡 ${ansis.yellow.italic('set via process.env override')}`);\n }\n\n itemErrors?.forEach((err) => {\n summary.push(ansis[err.isWarning ? 'yellow' : 'red'](` - ${err.isWarning ? '[WARNING] ' : ''}${err.message}`));\n\n // TODO: standardize here how we show parse error locations and stack info?\n\n // summary.push(...err.cleanedStack \|\| '');\n if (err.tip) {\n summary.push(...err.tip.split('\\n').map((line) => ` ${line}`));\n }\n });\n\n // NO OBJECT/CHILDREN FOR NOW\n // for (const childItem of _.values(item.children)) {\n // const childSummary = getItemSummary(childItem);\n // summary.push(childSummary.split('\\n').map((l) => ` ${l}`).join('\\n'));\n // }\n\n return summary.join('\\n');\n}\n","import ansis from 'ansis';\nimport _ from '@env-spec/utils/my-dash';\nimport { joinAndCompact } from '../../lib/formatting';\n\nexport class CliExitError extends Error {\n constructor(\n message: string,\n private more?: {\n details?: string \| Array<string>,\n suggestion?: string \| Array<string>,\n /** always triggers a full exit, even in watch mode - useful if problem is irrecoverable */\n forceExit?: boolean,\n },\n ) {\n super(message);\n }\n\n get forceExit() { return !!this.more?.forceExit; }\n\n getFormattedOutput() {\n let msg = `\\n💥 ${ansis.red(this.message)} 💥\\n`;\n\n if (this.more?.details) {\n msg += joinAndCompact(_.castArray(this.more?.details), '\\n');\n }\n\n if (this.more?.suggestion) {\n msg += joinAndCompact(_.castArray(this.more?.suggestion), '\\n');\n }\n\n msg += '\\n';\n return msg;\n }\n}\n"]}
1	+ {"version":3,"sources":["../src/env-graph/lib/loader.ts","../src/lib/formatting.ts","../src/cli/helpers/exit-error.ts"],"names":[],"mappings":";;;;;;;AAMA,eAAsB,aAAa,IAAA,EAShC;AACD,EAAA,MAAM,KAAA,GAAQ,IAAI,QAAA,EAAS;AAE3B,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,MAAM,cAAA,EAAgB;AACxB,IAAA,QAAA,GAAW,KAAA,CAAM,QAAQ,IAAA,CAAK,cAAc,IAAI,IAAA,CAAK,cAAA,GAAiB,CAAC,IAAA,CAAK,cAAc,CAAA;AAAA,EAC5F;AAEA,EAAA,IAAI,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AACnC,IAAA,KAAA,CAAM,QAAA,GAAW,IAAA,EAAM,QAAA,IAAY,OAAA,CAAQ,GAAA,EAAI;AAC/C,IAAA,IAAI,IAAA,EAAM,SAAA,EAAW,MAAM,IAAA,CAAK,UAAU,KAAK,CAAA;AAC/C,IAAA,IAAI,IAAA,EAAM,kBAAA,EAAoB,KAAA,CAAM,eAAA,GAAkB,IAAA,CAAK,kBAAA;AAC3D,IAAA,MAAM,aAAA,GAAgB,SAAS,GAAA,CAAI,CAAC,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAC,CAAA;AACzD,IAAA,MAAM,KAAA,CAAM,iBAAA,CAAkB,IAAI,gCAAA,CAAiC,aAAa,CAAC,CAAA;AAAA,EACnF,CAAA,MAAA,IAAW,QAAA,EAAU,MAAA,KAAW,CAAA,EAAG;AACjC,IAAA,MAAM,aAAA,GAAgB,SAAS,CAAC,CAAA;AAChC,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AAC/C,IAAA,MAAM,cAAc,aAAA,CAAc,QAAA,CAAS,GAAG,CAAA,IAAK,aAAA,CAAc,SAAS,IAAA,CAAK,GAAG,CAAA,IAC5E,EAAA,CAAG,WAAW,YAAY,CAAA,IAAK,GAAG,QAAA,CAAS,YAAY,EAAE,WAAA,EAAY;AAC3E,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,KAAA,CAAM,QAAA,GAAW,YAAA;AACjB,MAAA,IAAI,IAAA,EAAM,SAAA,EAAW,MAAM,IAAA,CAAK,UAAU,KAAK,CAAA;AAC/C,MAAA,IAAI,IAAA,EAAM,kBAAA,EAAoB,KAAA,CAAM,eAAA,GAAkB,IAAA,CAAK,kBAAA;AAC3D,MAAA,MAAM,KAAA,CAAM,iBAAA,CAAkB,IAAI,mBAAA,CAAoB,YAAY,CAAC,CAAA;AAAA,IACrE,CAAA,MAAO;AACL,MAAA,KAAA,CAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA;AAC1C,MAAA,IAAI,IAAA,EAAM,SAAA,EAAW,MAAM,IAAA,CAAK,UAAU,KAAK,CAAA;AAC/C,MAAA,IAAI,IAAA,EAAM,kBAAA,EAAoB,KAAA,CAAM,eAAA,GAAkB,IAAA,CAAK,kBAAA;AAC3D,MAAA,MAAM,KAAA,CAAM,iBAAA,CAAkB,IAAI,oBAAA,CAAqB,YAAY,CAAC,CAAA;AAAA,IACtE;AAAA,EACF,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,QAAA,GAAW,IAAA,EAAM,QAAA,IAAY,OAAA,CAAQ,GAAA,EAAI;AAC/C,IAAA,IAAI,IAAA,EAAM,SAAA,EAAW,MAAM,IAAA,CAAK,UAAU,KAAK,CAAA;AAC/C,IAAA,IAAI,IAAA,EAAM,kBAAA,EAAoB,KAAA,CAAM,eAAA,GAAkB,IAAA,CAAK,kBAAA;AAC3D,IAAA,MAAM,MAAM,iBAAA,CAAkB,IAAI,mBAAA,CAAoB,KAAA,CAAM,QAAQ,CAAC,CAAA;AAAA,EACvE;AAEA,EAAA,MAAM,MAAM,UAAA,EAAW;AAEvB,EAAA,OAAO,KAAA;AACT;AAjDsB,MAAA,CAAA,YAAA,EAAA,cAAA,CAAA;;;ACGtB,SAAS,SAAA,CAAU,KAAa,IAAA,EAAkB;AAChD,EAAA,IAAI,CAAC,MAAM,OAAO,GAAA;AAClB,EAAA,IAAI,eAAA,CAAE,OAAA,CAAQ,IAAI,CAAA,EAAG;AACnB,IAAA,IAAI,MAAA,GAAS,GAAA;AACb,IAAA,IAAA,CAAK,OAAA,CAAQ,CAAC,GAAA,KAAQ;AACpB,MAAA,MAAA,GAAS,aAAA,CAAM,GAAG,CAAA,CAAE,MAAM,CAAA;AAAA,IAC5B,CAAC,CAAA;AACD,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,aAAA,CAAM,IAAI,CAAA,CAAE,GAAG,CAAA;AACxB;AAVS,MAAA,CAAA,SAAA,EAAA,WAAA,CAAA;AAYF,SAAS,cAAA,CAAe,GAAA,EAAU,QAAA,GAAW,KAAA,EAAO;AACzD,EAAA,IAAI,MAAA,GAAiB,EAAA;AACrB,EAAA,IAAI,OAAA,GAAkB,EAAA;AACtB,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,eAAA,CAAE,SAAA,CAAU,GAAG,CAAA,EAAG;AACpB,IAAA,MAAA,GAAS,IAAI,QAAA,EAAS;AACtB,IAAA,IAAA,GAAO,CAAC,UAAU,QAAQ,CAAA;AAC1B,IAAA,OAAA,GAAU,SAAA;AAAA,EACZ,CAAA,MAAA,IAAW,eAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AAC1B,IAAA,MAAA,GAAS,IAAI,QAAA,EAAS;AACtB,IAAA,IAAA,GAAO,QAAA;AACP,IAAA,OAAA,GAAU,QAAA;AAAA,EACZ,CAAA,MAAA,IAAW,eAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AAC1B,IAAA,MAAA,GAAS,IAAI,GAAG,CAAA,CAAA,CAAA;AAChB,IAAA,OAAA,GAAU,QAAA;AAAA,EACZ,CAAA,MAAA,IAAW,eAAA,CAAE,aAAA,CAAc,GAAG,CAAA,EAAG;AAE/B,IAAA,MAAA,GAAS,IAAA,CAAK,UAAU,GAAG,CAAA;AAC3B,IAAA,OAAA,GAAU,QAAA;AAAA,EACZ,CAAA,MAAA,IAAW,QAAQ,IAAA,EAAM;AACvB,IAAA,MAAA,GAAS,MAAA;AACT,IAAA,IAAA,GAAO,MAAA;AAAA,EACT,CAAA,MAAA,IAAW,QAAQ,MAAA,EAAW;AAC5B,IAAA,MAAA,GAAS,WAAA;AACT,IAAA,IAAA,GAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,SAAA,CAAU,QAAQ,IAAI,CAAA;AAAA,IACtB,YAAY,OAAA,GAAU,aAAA,CAAM,KAAK,CAAA,EAAA,EAAK,OAAO,GAAG,CAAA,GAAI;AAAA,GACtD,CAAE,KAAK,EAAE,CAAA;AACX;AA9BgB,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAwDT,SAAS,cAAA,CAAe,OAAA,EAAsE,QAAA,GAAW,GAAA,EAAK;AACnH,EAAA,OAAO,OAAA,CAAQ,OAAO,CAAC,CAAA;AAAA;AAAA,IAErB,CAAA,KAAM,MAAA,IAAa,CAAA,KAAM,IAAA,IAAQ,CAAA,KAAM;AAAA,GACxC,CAAA,CAAE,KAAK,QAAQ,CAAA;AAClB;AALgB,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;AAOhB,IAAM,uBAAA,GAA0B;AAAA,EAC9B,KAAA,EAAO,KAAA;AAAA,EACP,IAAA,EAAM,QAAA;AAAA,EACN,KAAA,EAAO;AACT,CAAA;AAEO,SAAS,eAAe,IAAA,EAAkB;AAC/C,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,aAAa,IAAA,CAAK,MAAA;AACxB,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,MAAA,GAAA,CACnB,UAAA,CAAW,KAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,SAAS,CAAA,IAAK,UAAA,CAAW,CAAC,GAAG,IAAA,GACxD,QAAA;AACJ,EAAA,MAAM,cAAc,IAAA,CAAK,WAAA;AACzB,EAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,EAAA,OAAA,CAAQ,KAAK,cAAA,CAAe;AAAA,IAC1B,IAAA;AAAA,IACA,aAAA,CAAM,wBAAwB,IAAA,CAAK,eAAe,CAAC,CAAA,CAAE,IAAA,CAAK,eAAe,aAAA,CAAM,aAAA,CAAc,KAAK,GAAG,CAAA,GAAI,KAAK,GAAG,CAAA,IAAK,aAAa,aAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,GAAI,EAAA,CAAA;AAAA;AAAA,IAGxJ,eAAe,CAAA,UAAA,EAAM,aAAA,CAAM,IAAA,CAAK,MAAA,CAAO,WAAW,CAAC,CAAA,CAAA;AAAA,IACnD,IAAA,CAAK,gBAAgB,CAAA,UAAA,EAAM,aAAA,CAAM,OAAO,GAAA,CAAI,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA;AAAA,GAGjE,CAAC,CAAA;AAEF,EAAA,IAAI,QAAA,GAAW,cAAA,CAAe,IAAA,CAAK,aAAA,EAAe,KAAK,CAAA;AACvD,EAAA,IAAI,eAAe,IAAA,CAAK,aAAA,IAAiB,gBAAE,QAAA,CAAS,IAAA,CAAK,aAAa,CAAA,EAAG;AACvE,IAAA,QAAA,GAAW,YAAA,CAAa,KAAK,aAAa,CAAA;AAAA,EAC5C;AAEA,EAAA,OAAA,CAAQ,KAAK,cAAA,CAAe;AAAA,IAC1B,aAAA,CAAM,KAAK,WAAM,CAAA;AAAA,IACjB,QAAA;AAAA,IACA,IAAA,CAAK,SAAA,IACH,aAAA,CAAM,IAAA,CAAK,OAAO,iBAAiB,CAAA,IAChC,WAAA,GAAc,cAAA,CAAe,KAAK,gBAAgB,CAAA,GAAI,cAAA,CAAe,IAAA,CAAK,kBAAkB,KAAK,CAAA;AAAA,GAEvG,CAAC,CAAA;AAEF,EAAA,IAAI,KAAK,YAAA,EAAc;AACrB,IAAA,OAAA,CAAQ,KAAK,CAAA,aAAA,EAAS,aAAA,CAAM,OAAO,MAAA,CAAO,8BAA8B,CAAC,CAAA,CAAE,CAAA;AAAA,EAC7E;AAEA,EAAA,UAAA,EAAY,OAAA,CAAQ,CAAC,GAAA,KAAQ;AAC3B,IAAA,OAAA,CAAQ,KAAK,aAAA,CAAM,GAAA,CAAI,SAAA,GAAY,QAAA,GAAW,KAAK,CAAA,CAAE,CAAA,KAAA,EAAQ,GAAA,CAAI,SAAA,GAAY,eAAe,EAAE,CAAA,EAAG,GAAA,CAAI,OAAO,EAAE,CAAC,CAAA;AAK/G,IAAA,IAAI,IAAI,GAAA,EAAK;AACX,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAAS,CAAA,KAAA,EAAQ,IAAI,EAAE,CAAC,CAAA;AAAA,IACnE;AAAA,EACF,CAAC,CAAA;AAQD,EAAA,OAAO,OAAA,CAAQ,KAAK,IAAI,CAAA;AAC1B;AAvDgB,MAAA,CAAA,cAAA,EAAA,gBAAA,CAAA;;;ACtFT,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,WAAA,CACE,SACQ,IAAA,EAQR;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AATL,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAUV;AAAA,EAjBF;AAIwC,IAAA,MAAA,CAAA,IAAA,EAAA,cAAA,CAAA;AAAA;AAAA,EAetC,IAAI,SAAA,GAAY;AAAE,IAAA,OAAO,CAAC,CAAC,IAAA,CAAK,IAAA,EAAM,SAAA;AAAA,EAAW;AAAA,EAEjD,kBAAA,GAAqB;AACnB,IAAA,IAAI,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,OAAO,EAAA;AAE9B,IAAA,IAAI,GAAA,GAAM;AAAA,UAAA,EAAQ,aAAA,CAAM,GAAA,CAAI,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,CAAA;AAEzC,IAAA,IAAI,IAAA,CAAK,MAAM,OAAA,EAAS;AACtB,MAAA,GAAA,IAAO,eAAe,eAAA,CAAE,SAAA,CAAU,KAAK,IAAA,EAAM,OAAO,GAAG,IAAI,CAAA;AAAA,IAC7D;AAEA,IAAA,IAAI,IAAA,CAAK,MAAM,UAAA,EAAY;AACzB,MAAA,GAAA,IAAO,eAAe,eAAA,CAAE,SAAA,CAAU,KAAK,IAAA,EAAM,UAAU,GAAG,IAAI,CAAA;AAAA,IAChE;AAEA,IAAA,GAAA,IAAO,IAAA;AACP,IAAA,OAAO,GAAA;AAAA,EACT;AACF","file":"chunk-SX2NUZCL.js","sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\nimport _ from '@env-spec/utils/my-dash';\nimport { EnvGraph } from './env-graph';\nimport { DirectoryDataSource, DotEnvFileDataSource, MultiplePathsContainerDataSource } from './data-source';\n\nexport async function loadEnvGraph(opts?: {\n basePath?: string,\n /** Entry file path(s) — accepts a single path or array of paths /\n entryFilePaths?: string \| Array<string>,\n relativePaths?: Array<string>,\n checkGitIgnored?: boolean,\n excludeDirs?: Array<string>,\n currentEnvFallback?: string,\n afterInit?: (graph: EnvGraph) => Promise<void>,\n}) {\n const graph = new EnvGraph();\n\n let rawPaths: Array<string> \| undefined;\n if (opts?.entryFilePaths) {\n rawPaths = Array.isArray(opts.entryFilePaths) ? opts.entryFilePaths : [opts.entryFilePaths];\n }\n\n if (rawPaths && rawPaths.length > 1) {\n graph.basePath = opts?.basePath ?? process.cwd();\n if (opts?.afterInit) await opts.afterInit(graph);\n if (opts?.currentEnvFallback) graph.envFlagFallback = opts.currentEnvFallback;\n const resolvedPaths = rawPaths.map((p) => path.resolve(p));\n await graph.setRootDataSource(new MultiplePathsContainerDataSource(resolvedPaths));\n } else if (rawPaths?.length === 1) {\n const entryFilePath = rawPaths[0];\n const resolvedPath = path.resolve(entryFilePath);\n const isDirectory = entryFilePath.endsWith('/') \|\| entryFilePath.endsWith(path.sep)\n \|\| (fs.existsSync(resolvedPath) && fs.statSync(resolvedPath).isDirectory());\n if (isDirectory) {\n graph.basePath = resolvedPath;\n if (opts?.afterInit) await opts.afterInit(graph);\n if (opts?.currentEnvFallback) graph.envFlagFallback = opts.currentEnvFallback;\n await graph.setRootDataSource(new DirectoryDataSource(resolvedPath));\n } else {\n graph.basePath = path.dirname(resolvedPath);\n if (opts?.afterInit) await opts.afterInit(graph);\n if (opts?.currentEnvFallback) graph.envFlagFallback = opts.currentEnvFallback;\n await graph.setRootDataSource(new DotEnvFileDataSource(resolvedPath));\n }\n } else {\n graph.basePath = opts?.basePath ?? process.cwd();\n if (opts?.afterInit) await opts.afterInit(graph);\n if (opts?.currentEnvFallback) graph.envFlagFallback = opts.currentEnvFallback;\n await graph.setRootDataSource(new DirectoryDataSource(graph.basePath));\n }\n\n await graph.finishLoad();\n\n return graph;\n}\n\n","import ansis, { type AnsiColors, type AnsiStyles } from 'ansis';\nimport _ from '@env-spec/utils/my-dash';\n\nimport { ConfigItem, VarlockError } from '../env-graph';\nimport { redactString } from '../runtime/lib/redaction';\n\ntype ColorMod = AnsiStyles \| AnsiColors;\ntype ColorMods = ColorMod \| Array<ColorMod>;\n\nfunction applyMods(str: string, mods?: ColorMods) {\n if (!mods) return str;\n if (_.isArray(mods)) {\n let modStr = str;\n mods.forEach((mod) => {\n modStr = ansis[mod](modStr);\n });\n return modStr;\n }\n return ansis[mods](str);\n}\n\nexport function formattedValue(val: any, showType = false) {\n let strVal: string = '';\n let strType: string = '';\n let mods: ColorMods \| undefined;\n if (_.isBoolean(val)) {\n strVal = val.toString();\n mods = ['yellow', 'italic'];\n strType = 'boolean';\n } else if (_.isNumber(val)) {\n strVal = val.toString();\n mods = 'yellow';\n strType = 'number';\n } else if (_.isString(val)) {\n strVal = `\"${val}\"`;\n strType = 'string';\n } else if (_.isPlainObject(val)) {\n // TODO: can definitely make this better...\n strVal = JSON.stringify(val);\n strType = 'object';\n } else if (val === null) {\n strVal = 'null';\n mods = 'gray';\n } else if (val === undefined) {\n strVal = 'undefined';\n mods = 'gray';\n }\n return [\n applyMods(strVal, mods),\n showType && strType ? ansis.gray(` (${strType})`) : '',\n ].join('');\n}\n\n\nexport function formatError(err: VarlockError) {\n let whenStr = '';\n if (err.type === 'SchemaError') {\n whenStr += 'during schema initialization';\n }\n if (err.type === 'ValidationError') {\n whenStr += 'during validation';\n }\n if (err.type === 'CoercionError') {\n whenStr += 'during coercion';\n }\n if (err.type === 'ResolutionError') {\n whenStr += 'during resolution';\n }\n\n let errStr = `${err.icon} ${err.message}`;\n if (err.isUnexpected) {\n errStr += ansis.gray.italic(`\\n (unexpected error${whenStr ? ` ${whenStr}` : ''})`);\n if ('stack' in err) errStr += err.stack;\n }\n return errStr;\n}\n\nexport function joinAndCompact(strings: Array<string \| number \| boolean \| undefined \| null \| false>, joinChar = ' ') {\n return strings.filter((s) => (\n // we'll not filter out empty strings - because it's useful to just add newlines\n s !== undefined && s !== null && s !== false\n )).join(joinChar);\n}\n\nconst VALIDATION_STATE_COLORS = {\n error: 'red',\n warn: 'yellow',\n valid: 'cyan',\n} as const;\n\nexport function getItemSummary(item: ConfigItem) {\n const summary: Array<string> = [];\n const itemErrors = item.errors;\n const icon = itemErrors.length\n ? (itemErrors.find((e) => !e.isWarning) ?? itemErrors[0]).icon\n : '✅';\n const isSensitive = item.isSensitive;\n const isRequired = item.isRequired;\n summary.push(joinAndCompact([\n icon,\n ansis[VALIDATION_STATE_COLORS[item.validationState]](item.isDeprecated ? ansis.strikethrough(item.key) : item.key) + (isRequired ? ansis.magenta('') : ''),\n\n // ansis.gray(`[type = ${item.type.typeLabel}]`),\n isSensitive && ` 🔐${ansis.gray.italic('sensitive')}`,\n item.isDeprecated && ` 😵${ansis.yellow.dim.italic('deprecated')}`,\n\n // item.useAt ? ansis.gray.italic(`(${item.useAt?.join(', ')})`) : undefined,\n ]));\n\n let valAsStr = formattedValue(item.resolvedValue, false);\n if (isSensitive && item.resolvedValue && _.isString(item.resolvedValue)) {\n valAsStr = redactString(item.resolvedValue)!;\n }\n\n summary.push(joinAndCompact([\n ansis.gray(' └'),\n valAsStr,\n item.isCoerced && (\n ansis.gray.italic('< coerced from ')\n + (isSensitive ? formattedValue(item.resolvedRawValue) : formattedValue(item.resolvedRawValue, false))\n ),\n ]));\n\n if (item.isOverridden) {\n summary.push(` 🟡 ${ansis.yellow.italic('set via process.env override')}`);\n }\n\n itemErrors?.forEach((err) => {\n summary.push(ansis[err.isWarning ? 'yellow' : 'red'](` - ${err.isWarning ? '[WARNING] ' : ''}${err.message}`));\n\n // TODO: standardize here how we show parse error locations and stack info?\n\n // summary.push(...err.cleanedStack \|\| '');\n if (err.tip) {\n summary.push(...err.tip.split('\\n').map((line) => ` ${line}`));\n }\n });\n\n // NO OBJECT/CHILDREN FOR NOW\n // for (const childItem of _.values(item.children)) {\n // const childSummary = getItemSummary(childItem);\n // summary.push(childSummary.split('\\n').map((l) => ` ${l}`).join('\\n'));\n // }\n\n return summary.join('\\n');\n}\n","import ansis from 'ansis';\nimport _ from '@env-spec/utils/my-dash';\nimport { joinAndCompact } from '../../lib/formatting';\n\nexport class CliExitError extends Error {\n constructor(\n message: string,\n private more?: {\n details?: string \| Array<string>,\n suggestion?: string \| Array<string>,\n /** always triggers a full exit, even in watch mode - useful if problem is irrecoverable /\n forceExit?: boolean,\n /* suppress formatted output (details already logged to stderr) */\n silent?: boolean,\n },\n ) {\n super(message);\n }\n\n get forceExit() { return !!this.more?.forceExit; }\n\n getFormattedOutput() {\n if (this.more?.silent) return '';\n\n let msg = `\\n💥 ${ansis.red(this.message)} 💥\\n`;\n\n if (this.more?.details) {\n msg += joinAndCompact(_.castArray(this.more?.details), '\\n');\n }\n\n if (this.more?.suggestion) {\n msg += joinAndCompact(_.castArray(this.more?.suggestion), '\\n');\n }\n\n msg += '\\n';\n return msg;\n }\n}\n"]}

package/dist/{chunk-A2JUQ2GK.js → chunk-T3NMDBCU.js} RENAMED Viewed

@@ -1,8 +1,8 @@
-import { define } from './chunk-4A54P4EM.js';
-import { checkForSchemaErrors, checkForNoEnvFiles, checkForConfigErrors } from './chunk-45N5EFNL.js';
-import { loadVarlockEnvGraph } from './chunk-H2JVYUHZ.js';
 import { gracefulExit } from './chunk-CHQDS2PI.js';
-import { resetRedactionMap, redactSensitiveConfig } from './chunk-MGWUDHT5.js';
+import { define } from './chunk-MGUGRIW2.js';
+import { checkForSchemaErrors, checkForNoEnvFiles, checkForConfigErrors } from './chunk-NHNQJTPB.js';
+import { loadVarlockEnvGraph } from './chunk-Q4I7MXFB.js';
+import { resetRedactionMap, redactSensitiveConfig } from './chunk-UUJK65RS.js';
 import { __name } from './chunk-6PEHRAEP.js';
 import { spawn } from 'child_process';
 import 'stream';
@@ -333,5 +333,5 @@ var commandFn = /* @__PURE__ */ __name(async (ctx) => {
 }, "commandFn");
 export { commandFn, commandSpec };
-//# sourceMappingURL=chunk-A2JUQ2GK.js.map
-//# sourceMappingURL=chunk-A2JUQ2GK.js.map
+//# sourceMappingURL=chunk-T3NMDBCU.js.map
+//# sourceMappingURL=chunk-T3NMDBCU.js.map