@ant.sh/colony 0.1.0

package/dist/esm/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/index.js"],
+  "sourcesContent": ["import fs from \"node:fs/promises\";\nimport path from \"node:path\";\nimport fg from \"fast-glob\";\nimport { parseColony } from \"./parser.js\";\nimport { resolveRules } from \"./resolver.js\";\nimport {\n  applySecretsDeep,\n  SecretCache,\n  hasGlobalProviders,\n  registerSecretProvider,\n  unregisterSecretProvider,\n  clearSecretProviders,\n} from \"./secrets.js\";\n\n// Re-export secrets functions\nexport { registerSecretProvider, unregisterSecretProvider, clearSecretProviders };\n\n// Re-export providers\nexport { AwsSecretsProvider } from \"./providers/aws.js\";\nexport { VaultProvider } from \"./providers/vault.js\";\nexport { OpenBaoProvider } from \"./providers/openbao.js\";\n\n/**\n * @param {object} opts\n * @param {string} opts.entry\n * @param {string[]=} opts.dims\n * @param {Record<string,string>=} opts.ctx\n * @param {Record<string,string>=} opts.vars\n * @param {(cfg: any) => any=} opts.schema   // optional validation hook (e.g. zod.parse)\n * @param {object=} opts.sandbox   // security options\n * @param {string=} opts.sandbox.basePath   // restrict includes to this directory\n * @param {string[]=} opts.sandbox.allowedEnvVars   // whitelist of allowed env vars (null = allow all)\n * @param {number=} opts.sandbox.maxIncludeDepth   // max depth for includes (default 50)\n * @param {boolean=} opts.warnOnSkippedIncludes   // warn when skipping already-visited includes\n * @param {object=} opts.secrets   // secrets provider options\n * @param {Array=} opts.secrets.providers   // secret providers (e.g. AwsSecretsProvider)\n * @param {string[]=} opts.secrets.allowedSecrets   // whitelist of allowed secret patterns\n * @param {object=} opts.secrets.cache   // cache options\n * @param {string=} opts.secrets.onNotFound   // 'empty' | 'warn' | 'error' (default: 'warn')\n * @returns {Promise<object>}\n */\nexport async function loadColony(opts) {\n  const entry = opts?.entry;\n  if (!entry) throw new Error(\"loadColony: opts.entry is required\");\n\n  const sandbox = opts.sandbox ?? {};\n  const basePath = sandbox.basePath ? path.resolve(sandbox.basePath) : null;\n  const maxIncludeDepth = sandbox.maxIncludeDepth ?? 50;\n  const maxFileSize = sandbox.maxFileSize ?? null;\n  const warnOnSkippedIncludes = opts.warnOnSkippedIncludes ?? false;\n\n  const visited = new Set();\n  const warnings = [];\n  const files = await expandIncludes(entry, visited, {\n    basePath,\n    maxIncludeDepth,\n    maxFileSize,\n    warnOnSkippedIncludes,\n    warnings,\n  });\n\n  const parsed = [];\n  for (const file of files) {\n    const text = await fs.readFile(file, \"utf8\");\n    parsed.push(parseColony(text, { filePath: file }));\n  }\n\n  const dims =\n    (Array.isArray(opts.dims) && opts.dims.length ? opts.dims : null) ??\n    parsed.find((p) => p.dims?.length)?.dims ??\n    [\"env\"];\n\n  // ctx precedence: opts.ctx overrides, else @envDefaults, else sensible defaults\n  const envDefaults = mergeEnvDefaults(parsed.map((p) => p.envDefaults ?? {}));\n  const ctx = {\n    ...envDefaults,\n    env: process.env.NODE_ENV ?? \"dev\",\n    ...opts.ctx,\n  };\n\n  const vars = { ROOT: process.cwd(), ...(opts.vars ?? {}) };\n\n  // Collect requires from all parsed files\n  const requires = parsed.flatMap((p) => p.requires ?? []);\n\n  const allRules = parsed.flatMap((p) => p.rules);\n\n  const allowedEnvVars = sandbox.allowedEnvVars ?? null;\n  const allowedVars = sandbox.allowedVars ?? null;\n  let cfg = resolveRules({ rules: allRules, dims, ctx, vars, allowedEnvVars, allowedVars, warnings });\n\n  // Apply secrets if providers are configured\n  const secretsOpts = opts.secrets ?? {};\n  if (secretsOpts.providers?.length || hasGlobalProviders()) {\n    const cacheOpts = secretsOpts.cache ?? {};\n    const cache = cacheOpts.enabled !== false\n      ? new SecretCache(cacheOpts.maxSize ?? 100)\n      : null;\n\n    const secretified = await applySecretsDeep(cfg, {\n      providers: secretsOpts.providers ?? [],\n      allowedSecrets: secretsOpts.allowedSecrets ?? null,\n      cache,\n      cacheTtl: cacheOpts.ttl ?? 300000,\n      onNotFound: secretsOpts.onNotFound ?? \"warn\",\n      warnings,\n    });\n\n    // Copy config methods to new object\n    copyConfigMethods(secretified, cfg, warnings);\n    cfg = secretified;\n  }\n\n  // Enforce @require after resolution\n  const missing = [];\n  for (const reqKey of requires) {\n    if (cfg.get(reqKey) === undefined) missing.push(reqKey);\n  }\n  if (missing.length) {\n    throw new Error(\n      `COLONY @require failed (missing keys):\\n` +\n      missing.map((k) => `  - ${k}`).join(\"\\n\")\n    );\n  }\n\n  // Attach warnings as non-enumerable\n  Object.defineProperty(cfg, \"_warnings\", { enumerable: false, value: warnings });\n\n  // Optional schema validation hook (supports both sync and async)\n  if (typeof opts.schema === \"function\") {\n    const result = opts.schema(cfg);\n\n    // Handle async schema validators (e.g., async Zod, Joi)\n    if (result && typeof result.then === \"function\") {\n      const validated = await result;\n      if (validated && validated !== cfg) {\n        copyConfigMethods(validated, cfg, warnings);\n        return validated;\n      }\n    } else if (result && result !== cfg) {\n      copyConfigMethods(result, cfg, warnings);\n      return result;\n    }\n  }\n\n  return cfg;\n}\n\n/**\n * Copy non-enumerable config methods to validated object\n */\nfunction copyConfigMethods(target, source, warnings) {\n  Object.defineProperties(target, {\n    get: { enumerable: false, value: source.get },\n    explain: { enumerable: false, value: source.explain },\n    toJSON: { enumerable: false, value: source.toJSON },\n    keys: { enumerable: false, value: source.keys },\n    diff: { enumerable: false, value: source.diff },\n    _trace: { enumerable: false, value: source._trace },\n    _warnings: { enumerable: false, value: warnings },\n  });\n}\n\nfunction mergeEnvDefaults(list) {\n  const out = {};\n  for (const m of list) {\n    for (const [k, v] of Object.entries(m)) out[k] = v;\n  }\n  return out;\n}\n\nasync function expandIncludes(entry, visited, { basePath, maxIncludeDepth, maxFileSize, warnOnSkippedIncludes, warnings }) {\n  const absEntry = path.resolve(entry);\n  const out = [];\n  await dfs(absEntry, 0);\n  return out;\n\n  async function dfs(file, depth) {\n    if (depth > maxIncludeDepth) {\n      throw new Error(`COLONY: Max include depth (${maxIncludeDepth}) exceeded at: ${file}`);\n    }\n\n    const abs = path.resolve(file);\n\n    if (visited.has(abs)) {\n      if (warnOnSkippedIncludes) {\n        warnings.push({ type: \"skipped_include\", file: abs, message: `Skipping already-visited include: ${abs}` });\n      }\n      return;\n    }\n    visited.add(abs);\n\n    // Check file size if limit is set\n    if (maxFileSize !== null) {\n      const stat = await fs.stat(abs);\n      if (stat.size > maxFileSize) {\n        throw new Error(`COLONY: File size (${stat.size} bytes) exceeds maxFileSize (${maxFileSize} bytes): ${abs}`);\n      }\n    }\n\n    const text = await fs.readFile(abs, \"utf8\");\n    const { includes } = parseColony(text, { filePath: abs, parseOnlyDirectives: true });\n\n    for (const inc of includes) {\n      const incAbs = path.resolve(path.dirname(abs), inc);\n\n      // Security: validate path is within basePath if set\n      if (basePath !== null) {\n        const normalizedInc = path.normalize(incAbs);\n        if (!normalizedInc.startsWith(basePath + path.sep) && normalizedInc !== basePath) {\n          throw new Error(\n            `COLONY: Path traversal blocked. Include \"${inc}\" resolves to \"${normalizedInc}\" which is outside basePath \"${basePath}\"`\n          );\n        }\n      }\n\n      const matches = await fg(incAbs.replace(/\\\\/g, \"/\"), { dot: true });\n      // Sort alphabetically for deterministic ordering across platforms/filesystems\n      for (const m of matches.sort((a, b) => a.localeCompare(b))) {\n        // Also validate glob matches against basePath\n        if (basePath !== null) {\n          const normalizedMatch = path.normalize(m);\n          if (!normalizedMatch.startsWith(basePath + path.sep) && normalizedMatch !== basePath) {\n            throw new Error(\n              `COLONY: Path traversal blocked. Glob match \"${m}\" is outside basePath \"${basePath}\"`\n            );\n          }\n        }\n        await dfs(m, depth + 1);\n      }\n    }\n\n    out.push(abs);\n  }\n}\n\n/**\n * Validate syntax of colony files without resolving\n * @param {string} entry - Entry file path\n * @returns {Promise<{valid: boolean, files: string[], errors: Array<{file: string, error: string}>}>}\n */\nexport async function validateColony(entry) {\n  const visited = new Set();\n  const files = [];\n  const errors = [];\n\n  await validateDfs(path.resolve(entry));\n\n  return {\n    valid: errors.length === 0,\n    files,\n    errors,\n  };\n\n  async function validateDfs(file) {\n    const abs = path.resolve(file);\n    if (visited.has(abs)) return;\n    visited.add(abs);\n\n    try {\n      const text = await fs.readFile(abs, \"utf8\");\n      const { includes } = parseColony(text, { filePath: abs });\n      files.push(abs);\n\n      for (const inc of includes) {\n        const incAbs = path.resolve(path.dirname(abs), inc);\n        const matches = await fg(incAbs.replace(/\\\\/g, \"/\"), { dot: true });\n        for (const m of matches.sort((a, b) => a.localeCompare(b))) {\n          await validateDfs(m);\n        }\n      }\n    } catch (e) {\n      errors.push({ file: abs, error: e.message });\n    }\n  }\n}\n\n/**\n * Dry-run: list all files that would be included\n * @param {string} entry - Entry file path\n * @returns {Promise<string[]>}\n */\nexport async function dryRunIncludes(entry) {\n  const visited = new Set();\n  const files = [];\n  await dryRunDfs(path.resolve(entry));\n  return files;\n\n  async function dryRunDfs(file) {\n    const abs = path.resolve(file);\n    if (visited.has(abs)) return;\n    visited.add(abs);\n\n    const text = await fs.readFile(abs, \"utf8\");\n    const { includes } = parseColony(text, { filePath: abs, parseOnlyDirectives: true });\n\n    for (const inc of includes) {\n      const incAbs = path.resolve(path.dirname(abs), inc);\n      const matches = await fg(incAbs.replace(/\\\\/g, \"/\"), { dot: true });\n      for (const m of matches.sort((a, b) => a.localeCompare(b))) {\n        await dryRunDfs(m);\n      }\n    }\n\n    files.push(abs);\n  }\n}\n\n/**\n * Compare two configs loaded with different contexts\n * @param {object} opts - Same options as loadColony, but with ctx1 and ctx2\n * @param {Record<string,string>} opts.ctx1 - First context\n * @param {Record<string,string>} opts.ctx2 - Second context\n * @returns {Promise<{cfg1: object, cfg2: object, diff: object}>}\n */\nexport async function diffColony(opts) {\n  const { ctx1, ctx2, ...baseOpts } = opts;\n\n  if (!ctx1 || !ctx2) {\n    throw new Error(\"diffColony: both ctx1 and ctx2 are required\");\n  }\n\n  const cfg1 = await loadColony({ ...baseOpts, ctx: ctx1 });\n  const cfg2 = await loadColony({ ...baseOpts, ctx: ctx2 });\n\n  return {\n    cfg1,\n    cfg2,\n    diff: cfg1.diff(cfg2),\n  };\n}\n\n/**\n * Lint colony files for potential issues\n * @param {object} opts\n * @param {string} opts.entry - Entry file path\n * @param {string[]=} opts.dims - Dimension names\n * @returns {Promise<{issues: Array<{type: string, severity: string, message: string, file?: string, line?: number}>}>}\n */\nexport async function lintColony(opts) {\n  const entry = opts?.entry;\n  if (!entry) throw new Error(\"lintColony: opts.entry is required\");\n\n  const issues = [];\n  const visited = new Set();\n  const allRules = [];\n  const allFiles = [];\n  let foundDims = null;\n\n  // Collect all rules from all files\n  await collectRules(path.resolve(entry));\n\n  async function collectRules(file) {\n    const abs = path.resolve(file);\n    if (visited.has(abs)) return;\n    visited.add(abs);\n\n    try {\n      const text = await fs.readFile(abs, \"utf8\");\n      const parsed = parseColony(text, { filePath: abs });\n      allFiles.push(abs);\n\n      // Capture dims from first file that has them\n      if (!foundDims && parsed.dims?.length) {\n        foundDims = parsed.dims;\n      }\n\n      for (const rule of parsed.rules) {\n        allRules.push({ ...rule, filePath: abs });\n      }\n\n      for (const inc of parsed.includes) {\n        const incAbs = path.resolve(path.dirname(abs), inc);\n        const matches = await fg(incAbs.replace(/\\\\/g, \"/\"), { dot: true });\n        for (const m of matches.sort((a, b) => a.localeCompare(b))) {\n          await collectRules(m);\n        }\n      }\n    } catch (e) {\n      issues.push({\n        type: \"parse_error\",\n        severity: \"error\",\n        message: e.message,\n        file: abs,\n      });\n    }\n  }\n\n  // Get dims from options, or from parsed files, or default\n  const dims = opts.dims ?? foundDims ?? [\"env\"];\n\n  // Check for shadowed rules (same key, same scope, different values)\n  const rulesByKey = new Map();\n  for (const rule of allRules) {\n    const scope = rule.keySegments.slice(0, dims.length).join(\".\");\n    const keyPath = rule.keySegments.slice(dims.length).join(\".\");\n    const key = `${scope}|${keyPath}`;\n\n    if (!rulesByKey.has(key)) {\n      rulesByKey.set(key, []);\n    }\n    rulesByKey.get(key).push(rule);\n  }\n\n  for (const [key, rules] of rulesByKey.entries()) {\n    if (rules.length > 1) {\n      // Check if they're in different files or same file\n      const locations = rules.map((r) => `${r.filePath}:${r.line}`);\n      const uniqueLocations = new Set(locations);\n\n      if (uniqueLocations.size > 1) {\n        const [scope, keyPath] = key.split(\"|\");\n        issues.push({\n          type: \"shadowed_rule\",\n          severity: \"warning\",\n          message: `Rule \"${scope}.${keyPath}\" is defined ${rules.length} times. Later rule wins.`,\n          file: rules[rules.length - 1].filePath,\n          line: rules[rules.length - 1].line,\n        });\n      }\n    }\n  }\n\n  // Check for potentially unused wildcard rules\n  // (rules with all wildcards that might be overridden by more specific rules)\n  for (const rule of allRules) {\n    const scope = rule.keySegments.slice(0, dims.length);\n    const keyPath = rule.keySegments.slice(dims.length).join(\".\");\n\n    if (scope.every((s) => s === \"*\")) {\n      // Check if there are more specific rules for the same key\n      const moreSpecific = allRules.filter((r) => {\n        const rKeyPath = r.keySegments.slice(dims.length).join(\".\");\n        if (rKeyPath !== keyPath) return false;\n        const rScope = r.keySegments.slice(0, dims.length);\n        return rScope.some((s) => s !== \"*\") && r !== rule;\n      });\n\n      if (moreSpecific.length > 0) {\n        issues.push({\n          type: \"overridden_wildcard\",\n          severity: \"info\",\n          message: `Wildcard rule for \"${keyPath}\" is overridden by ${moreSpecific.length} more specific rule(s)`,\n          file: rule.filePath,\n          line: rule.line,\n        });\n      }\n    }\n  }\n\n  // Check for empty includes\n  for (const file of allFiles) {\n    try {\n      const text = await fs.readFile(file, \"utf8\");\n      const parsed = parseColony(text, { filePath: file });\n\n      for (const inc of parsed.includes) {\n        const incAbs = path.resolve(path.dirname(file), inc);\n        const matches = await fg(incAbs.replace(/\\\\/g, \"/\"), { dot: true });\n        if (matches.length === 0) {\n          issues.push({\n            type: \"empty_include\",\n            severity: \"warning\",\n            message: `Include pattern \"${inc}\" matches no files`,\n            file,\n          });\n        }\n      }\n    } catch {}\n  }\n\n  return { issues };\n}\n"],
+  "mappings": "AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,OAAO,QAAQ;AACf,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,SAAS,0BAA0B;AACnC,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB;AAqBhC,eAAsB,WAAW,MAAM;AACrC,QAAM,QAAQ,MAAM;AACpB,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,oCAAoC;AAEhE,QAAM,UAAU,KAAK,WAAW,CAAC;AACjC,QAAM,WAAW,QAAQ,WAAW,KAAK,QAAQ,QAAQ,QAAQ,IAAI;AACrE,QAAM,kBAAkB,QAAQ,mBAAmB;AACnD,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,wBAAwB,KAAK,yBAAyB;AAE5D,QAAM,UAAU,oBAAI,IAAI;AACxB,QAAM,WAAW,CAAC;AAClB,QAAM,QAAQ,MAAM,eAAe,OAAO,SAAS;AAAA,IACjD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,SAAS,CAAC;AAChB,aAAW,QAAQ,OAAO;AACxB,UAAM,OAAO,MAAM,GAAG,SAAS,MAAM,MAAM;AAC3C,WAAO,KAAK,YAAY,MAAM,EAAE,UAAU,KAAK,CAAC,CAAC;AAAA,EACnD;AAEA,QAAM,QACH,MAAM,QAAQ,KAAK,IAAI,KAAK,KAAK,KAAK,SAAS,KAAK,OAAO,SAC5D,OAAO,KAAK,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,QACpC,CAAC,KAAK;AAGR,QAAM,cAAc,iBAAiB,OAAO,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;AAC3E,QAAM,MAAM;AAAA,IACV,GAAG;AAAA,IACH,KAAK,QAAQ,IAAI,YAAY;AAAA,IAC7B,GAAG,KAAK;AAAA,EACV;AAEA,QAAM,OAAO,EAAE,MAAM,QAAQ,IAAI,GAAG,GAAI,KAAK,QAAQ,CAAC,EAAG;AAGzD,QAAM,WAAW,OAAO,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAEvD,QAAM,WAAW,OAAO,QAAQ,CAAC,MAAM,EAAE,KAAK;AAE9C,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,cAAc,QAAQ,eAAe;AAC3C,MAAI,MAAM,aAAa,EAAE,OAAO,UAAU,MAAM,KAAK,MAAM,gBAAgB,aAAa,SAAS,CAAC;AAGlG,QAAM,cAAc,KAAK,WAAW,CAAC;AACrC,MAAI,YAAY,WAAW,UAAU,mBAAmB,GAAG;AACzD,UAAM,YAAY,YAAY,SAAS,CAAC;AACxC,UAAM,QAAQ,UAAU,YAAY,QAChC,IAAI,YAAY,UAAU,WAAW,GAAG,IACxC;AAEJ,UAAM,cAAc,MAAM,iBAAiB,KAAK;AAAA,MAC9C,WAAW,YAAY,aAAa,CAAC;AAAA,MACrC,gBAAgB,YAAY,kBAAkB;AAAA,MAC9C;AAAA,MACA,UAAU,UAAU,OAAO;AAAA,MAC3B,YAAY,YAAY,cAAc;AAAA,MACtC;AAAA,IACF,CAAC;AAGD,sBAAkB,aAAa,KAAK,QAAQ;AAC5C,UAAM;AAAA,EACR;AAGA,QAAM,UAAU,CAAC;AACjB,aAAW,UAAU,UAAU;AAC7B,QAAI,IAAI,IAAI,MAAM,MAAM,OAAW,SAAQ,KAAK,MAAM;AAAA,EACxD;AACA,MAAI,QAAQ,QAAQ;AAClB,UAAM,IAAI;AAAA,MACR;AAAA,IACA,QAAQ,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI;AAAA,IAC1C;AAAA,EACF;AAGA,SAAO,eAAe,KAAK,aAAa,EAAE,YAAY,OAAO,OAAO,SAAS,CAAC;AAG9E,MAAI,OAAO,KAAK,WAAW,YAAY;AACrC,UAAM,SAAS,KAAK,OAAO,GAAG;AAG9B,QAAI,UAAU,OAAO,OAAO,SAAS,YAAY;AAC/C,YAAM,YAAY,MAAM;AACxB,UAAI,aAAa,cAAc,KAAK;AAClC,0BAAkB,WAAW,KAAK,QAAQ;AAC1C,eAAO;AAAA,MACT;AAAA,IACF,WAAW,UAAU,WAAW,KAAK;AACnC,wBAAkB,QAAQ,KAAK,QAAQ;AACvC,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAKA,SAAS,kBAAkB,QAAQ,QAAQ,UAAU;AACnD,SAAO,iBAAiB,QAAQ;AAAA,IAC9B,KAAK,EAAE,YAAY,OAAO,OAAO,OAAO,IAAI;AAAA,IAC5C,SAAS,EAAE,YAAY,OAAO,OAAO,OAAO,QAAQ;AAAA,IACpD,QAAQ,EAAE,YAAY,OAAO,OAAO,OAAO,OAAO;AAAA,IAClD,MAAM,EAAE,YAAY,OAAO,OAAO,OAAO,KAAK;AAAA,IAC9C,MAAM,EAAE,YAAY,OAAO,OAAO,OAAO,KAAK;AAAA,IAC9C,QAAQ,EAAE,YAAY,OAAO,OAAO,OAAO,OAAO;AAAA,IAClD,WAAW,EAAE,YAAY,OAAO,OAAO,SAAS;AAAA,EAClD,CAAC;AACH;AAEA,SAAS,iBAAiB,MAAM;AAC9B,QAAM,MAAM,CAAC;AACb,aAAW,KAAK,MAAM;AACpB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,CAAC,EAAG,KAAI,CAAC,IAAI;AAAA,EACnD;AACA,SAAO;AACT;AAEA,eAAe,eAAe,OAAO,SAAS,EAAE,UAAU,iBAAiB,aAAa,uBAAuB,SAAS,GAAG;AACzH,QAAM,WAAW,KAAK,QAAQ,KAAK;AACnC,QAAM,MAAM,CAAC;AACb,QAAM,IAAI,UAAU,CAAC;AACrB,SAAO;AAEP,iBAAe,IAAI,MAAM,OAAO;AAC9B,QAAI,QAAQ,iBAAiB;AAC3B,YAAM,IAAI,MAAM,8BAA8B,eAAe,kBAAkB,IAAI,EAAE;AAAA,IACvF;AAEA,UAAM,MAAM,KAAK,QAAQ,IAAI;AAE7B,QAAI,QAAQ,IAAI,GAAG,GAAG;AACpB,UAAI,uBAAuB;AACzB,iBAAS,KAAK,EAAE,MAAM,mBAAmB,MAAM,KAAK,SAAS,qCAAqC,GAAG,GAAG,CAAC;AAAA,MAC3G;AACA;AAAA,IACF;AACA,YAAQ,IAAI,GAAG;AAGf,QAAI,gBAAgB,MAAM;AACxB,YAAM,OAAO,MAAM,GAAG,KAAK,GAAG;AAC9B,UAAI,KAAK,OAAO,aAAa;AAC3B,cAAM,IAAI,MAAM,sBAAsB,KAAK,IAAI,gCAAgC,WAAW,YAAY,GAAG,EAAE;AAAA,MAC7G;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,GAAG,SAAS,KAAK,MAAM;AAC1C,UAAM,EAAE,SAAS,IAAI,YAAY,MAAM,EAAE,UAAU,KAAK,qBAAqB,KAAK,CAAC;AAEnF,eAAW,OAAO,UAAU;AAC1B,YAAM,SAAS,KAAK,QAAQ,KAAK,QAAQ,GAAG,GAAG,GAAG;AAGlD,UAAI,aAAa,MAAM;AACrB,cAAM,gBAAgB,KAAK,UAAU,MAAM;AAC3C,YAAI,CAAC,cAAc,WAAW,WAAW,KAAK,GAAG,KAAK,kBAAkB,UAAU;AAChF,gBAAM,IAAI;AAAA,YACR,4CAA4C,GAAG,kBAAkB,aAAa,gCAAgC,QAAQ;AAAA,UACxH;AAAA,QACF;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,GAAG,OAAO,QAAQ,OAAO,GAAG,GAAG,EAAE,KAAK,KAAK,CAAC;AAElE,iBAAW,KAAK,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,GAAG;AAE1D,YAAI,aAAa,MAAM;AACrB,gBAAM,kBAAkB,KAAK,UAAU,CAAC;AACxC,cAAI,CAAC,gBAAgB,WAAW,WAAW,KAAK,GAAG,KAAK,oBAAoB,UAAU;AACpF,kBAAM,IAAI;AAAA,cACR,+CAA+C,CAAC,0BAA0B,QAAQ;AAAA,YACpF;AAAA,UACF;AAAA,QACF;AACA,cAAM,IAAI,GAAG,QAAQ,CAAC;AAAA,MACxB;AAAA,IACF;AAEA,QAAI,KAAK,GAAG;AAAA,EACd;AACF;AAOA,eAAsB,eAAe,OAAO;AAC1C,QAAM,UAAU,oBAAI,IAAI;AACxB,QAAM,QAAQ,CAAC;AACf,QAAM,SAAS,CAAC;AAEhB,QAAM,YAAY,KAAK,QAAQ,KAAK,CAAC;AAErC,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AAEA,iBAAe,YAAY,MAAM;AAC/B,UAAM,MAAM,KAAK,QAAQ,IAAI;AAC7B,QAAI,QAAQ,IAAI,GAAG,EAAG;AACtB,YAAQ,IAAI,GAAG;AAEf,QAAI;AACF,YAAM,OAAO,MAAM,GAAG,SAAS,KAAK,MAAM;AAC1C,YAAM,EAAE,SAAS,IAAI,YAAY,MAAM,EAAE,UAAU,IAAI,CAAC;AACxD,YAAM,KAAK,GAAG;AAEd,iBAAW,OAAO,UAAU;AAC1B,cAAM,SAAS,KAAK,QAAQ,KAAK,QAAQ,GAAG,GAAG,GAAG;AAClD,cAAM,UAAU,MAAM,GAAG,OAAO,QAAQ,OAAO,GAAG,GAAG,EAAE,KAAK,KAAK,CAAC;AAClE,mBAAW,KAAK,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,GAAG;AAC1D,gBAAM,YAAY,CAAC;AAAA,QACrB;AAAA,MACF;AAAA,IACF,SAAS,GAAG;AACV,aAAO,KAAK,EAAE,MAAM,KAAK,OAAO,EAAE,QAAQ,CAAC;AAAA,IAC7C;AAAA,EACF;AACF;AAOA,eAAsB,eAAe,OAAO;AAC1C,QAAM,UAAU,oBAAI,IAAI;AACxB,QAAM,QAAQ,CAAC;AACf,QAAM,UAAU,KAAK,QAAQ,KAAK,CAAC;AACnC,SAAO;AAEP,iBAAe,UAAU,MAAM;AAC7B,UAAM,MAAM,KAAK,QAAQ,IAAI;AAC7B,QAAI,QAAQ,IAAI,GAAG,EAAG;AACtB,YAAQ,IAAI,GAAG;AAEf,UAAM,OAAO,MAAM,GAAG,SAAS,KAAK,MAAM;AAC1C,UAAM,EAAE,SAAS,IAAI,YAAY,MAAM,EAAE,UAAU,KAAK,qBAAqB,KAAK,CAAC;AAEnF,eAAW,OAAO,UAAU;AAC1B,YAAM,SAAS,KAAK,QAAQ,KAAK,QAAQ,GAAG,GAAG,GAAG;AAClD,YAAM,UAAU,MAAM,GAAG,OAAO,QAAQ,OAAO,GAAG,GAAG,EAAE,KAAK,KAAK,CAAC;AAClE,iBAAW,KAAK,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,GAAG;AAC1D,cAAM,UAAU,CAAC;AAAA,MACnB;AAAA,IACF;AAEA,UAAM,KAAK,GAAG;AAAA,EAChB;AACF;AASA,eAAsB,WAAW,MAAM;AACrC,QAAM,EAAE,MAAM,MAAM,GAAG,SAAS,IAAI;AAEpC,MAAI,CAAC,QAAQ,CAAC,MAAM;AAClB,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,QAAM,OAAO,MAAM,WAAW,EAAE,GAAG,UAAU,KAAK,KAAK,CAAC;AACxD,QAAM,OAAO,MAAM,WAAW,EAAE,GAAG,UAAU,KAAK,KAAK,CAAC;AAExD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,KAAK,KAAK,IAAI;AAAA,EACtB;AACF;AASA,eAAsB,WAAW,MAAM;AACrC,QAAM,QAAQ,MAAM;AACpB,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,oCAAoC;AAEhE,QAAM,SAAS,CAAC;AAChB,QAAM,UAAU,oBAAI,IAAI;AACxB,QAAM,WAAW,CAAC;AAClB,QAAM,WAAW,CAAC;AAClB,MAAI,YAAY;AAGhB,QAAM,aAAa,KAAK,QAAQ,KAAK,CAAC;AAEtC,iBAAe,aAAa,MAAM;AAChC,UAAM,MAAM,KAAK,QAAQ,IAAI;AAC7B,QAAI,QAAQ,IAAI,GAAG,EAAG;AACtB,YAAQ,IAAI,GAAG;AAEf,QAAI;AACF,YAAM,OAAO,MAAM,GAAG,SAAS,KAAK,MAAM;AAC1C,YAAM,SAAS,YAAY,MAAM,EAAE,UAAU,IAAI,CAAC;AAClD,eAAS,KAAK,GAAG;AAGjB,UAAI,CAAC,aAAa,OAAO,MAAM,QAAQ;AACrC,oBAAY,OAAO;AAAA,MACrB;AAEA,iBAAW,QAAQ,OAAO,OAAO;AAC/B,iBAAS,KAAK,EAAE,GAAG,MAAM,UAAU,IAAI,CAAC;AAAA,MAC1C;AAEA,iBAAW,OAAO,OAAO,UAAU;AACjC,cAAM,SAAS,KAAK,QAAQ,KAAK,QAAQ,GAAG,GAAG,GAAG;AAClD,cAAM,UAAU,MAAM,GAAG,OAAO,QAAQ,OAAO,GAAG,GAAG,EAAE,KAAK,KAAK,CAAC;AAClE,mBAAW,KAAK,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,GAAG;AAC1D,gBAAM,aAAa,CAAC;AAAA,QACtB;AAAA,MACF;AAAA,IACF,SAAS,GAAG;AACV,aAAO,KAAK;AAAA,QACV,MAAM;AAAA,QACN,UAAU;AAAA,QACV,SAAS,EAAE;AAAA,QACX,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,OAAO,KAAK,QAAQ,aAAa,CAAC,KAAK;AAG7C,QAAM,aAAa,oBAAI,IAAI;AAC3B,aAAW,QAAQ,UAAU;AAC3B,UAAM,QAAQ,KAAK,YAAY,MAAM,GAAG,KAAK,MAAM,EAAE,KAAK,GAAG;AAC7D,UAAM,UAAU,KAAK,YAAY,MAAM,KAAK,MAAM,EAAE,KAAK,GAAG;AAC5D,UAAM,MAAM,GAAG,KAAK,IAAI,OAAO;AAE/B,QAAI,CAAC,WAAW,IAAI,GAAG,GAAG;AACxB,iBAAW,IAAI,KAAK,CAAC,CAAC;AAAA,IACxB;AACA,eAAW,IAAI,GAAG,EAAE,KAAK,IAAI;AAAA,EAC/B;AAEA,aAAW,CAAC,KAAK,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC/C,QAAI,MAAM,SAAS,GAAG;AAEpB,YAAM,YAAY,MAAM,IAAI,CAAC,MAAM,GAAG,EAAE,QAAQ,IAAI,EAAE,IAAI,EAAE;AAC5D,YAAM,kBAAkB,IAAI,IAAI,SAAS;AAEzC,UAAI,gBAAgB,OAAO,GAAG;AAC5B,cAAM,CAAC,OAAO,OAAO,IAAI,IAAI,MAAM,GAAG;AACtC,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,UAAU;AAAA,UACV,SAAS,SAAS,KAAK,IAAI,OAAO,gBAAgB,MAAM,MAAM;AAAA,UAC9D,MAAM,MAAM,MAAM,SAAS,CAAC,EAAE;AAAA,UAC9B,MAAM,MAAM,MAAM,SAAS,CAAC,EAAE;AAAA,QAChC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAIA,aAAW,QAAQ,UAAU;AAC3B,UAAM,QAAQ,KAAK,YAAY,MAAM,GAAG,KAAK,MAAM;AACnD,UAAM,UAAU,KAAK,YAAY,MAAM,KAAK,MAAM,EAAE,KAAK,GAAG;AAE5D,QAAI,MAAM,MAAM,CAAC,MAAM,MAAM,GAAG,GAAG;AAEjC,YAAM,eAAe,SAAS,OAAO,CAAC,MAAM;AAC1C,cAAM,WAAW,EAAE,YAAY,MAAM,KAAK,MAAM,EAAE,KAAK,GAAG;AAC1D,YAAI,aAAa,QAAS,QAAO;AACjC,cAAM,SAAS,EAAE,YAAY,MAAM,GAAG,KAAK,MAAM;AACjD,eAAO,OAAO,KAAK,CAAC,MAAM,MAAM,GAAG,KAAK,MAAM;AAAA,MAChD,CAAC;AAED,UAAI,aAAa,SAAS,GAAG;AAC3B,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,UAAU;AAAA,UACV,SAAS,sBAAsB,OAAO,sBAAsB,aAAa,MAAM;AAAA,UAC/E,MAAM,KAAK;AAAA,UACX,MAAM,KAAK;AAAA,QACb,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,aAAW,QAAQ,UAAU;AAC3B,QAAI;AACF,YAAM,OAAO,MAAM,GAAG,SAAS,MAAM,MAAM;AAC3C,YAAM,SAAS,YAAY,MAAM,EAAE,UAAU,KAAK,CAAC;AAEnD,iBAAW,OAAO,OAAO,UAAU;AACjC,cAAM,SAAS,KAAK,QAAQ,KAAK,QAAQ,IAAI,GAAG,GAAG;AACnD,cAAM,UAAU,MAAM,GAAG,OAAO,QAAQ,OAAO,GAAG,GAAG,EAAE,KAAK,KAAK,CAAC;AAClE,YAAI,QAAQ,WAAW,GAAG;AACxB,iBAAO,KAAK;AAAA,YACV,MAAM;AAAA,YACN,UAAU;AAAA,YACV,SAAS,oBAAoB,GAAG;AAAA,YAChC;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,SAAO,EAAE,OAAO;AAClB;",
+  "names": []
+}

package/dist/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/dist/esm/parser.js

@@ -0,0 +1,286 @@
+import JSON5 from "json5";
+const RX_DIMS = /^@dims\s+([^;]+);/;
+const RX_INCLUDE = /^@include\s+(.+);/;
+const RX_REQUIRE = /^@require\s+([^;]+);/;
+const RX_ENVDEFAULTS = /^@envDefaults\s+([^;]+);/;
+const RX_RULE = /^(.+?)\s*(\:=|\|\=|\+\=|\-\=|\=)\s*([\s\S]+)\s*;$/;
+const RX_HEREDOC_START = /<<([A-Z_][A-Z0-9_]*)\s*$/;
+function stripBlockComments(text) {
+  const result = [];
+  const lineMap = [];
+  let inComment = false;
+  let commentDepth = 0;
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const originalLineNo = i + 1;
+    let line = lines[i];
+    let cleanLine = "";
+    let j = 0;
+    while (j < line.length) {
+      if (!inComment) {
+        if (line[j] === "/" && line[j + 1] === "*") {
+          inComment = true;
+          commentDepth = 1;
+          j += 2;
+          continue;
+        }
+        cleanLine += line[j];
+        j++;
+      } else {
+        if (line[j] === "/" && line[j + 1] === "*") {
+          commentDepth++;
+          j += 2;
+        } else if (line[j] === "*" && line[j + 1] === "/") {
+          commentDepth--;
+          if (commentDepth === 0) {
+            inComment = false;
+          }
+          j += 2;
+        } else {
+          j++;
+        }
+      }
+    }
+    result.push(cleanLine);
+    lineMap.push(originalLineNo);
+  }
+  return { text: result.join("\n"), lineMap };
+}
+function parseKeyPath(keyRaw) {
+  const segments = [];
+  let current = "";
+  let i = 0;
+  while (i < keyRaw.length) {
+    if (keyRaw[i] === "\\" && keyRaw[i + 1] === ".") {
+      current += ".";
+      i += 2;
+    } else if (keyRaw[i] === ".") {
+      if (current.trim()) segments.push(current.trim());
+      current = "";
+      i++;
+    } else {
+      current += keyRaw[i];
+      i++;
+    }
+  }
+  if (current.trim()) segments.push(current.trim());
+  return segments;
+}
+function formatParseError(message, lines, lineNo, col, filePath) {
+  const idx = lineNo - 1;
+  const contextLines = [];
+  for (let i = Math.max(0, idx - 2); i < idx; i++) {
+    contextLines.push(`  ${String(i + 1).padStart(4)} | ${lines[i]}`);
+  }
+  if (idx >= 0 && idx < lines.length) {
+    contextLines.push(`> ${String(lineNo).padStart(4)} | ${lines[idx]}`);
+    if (typeof col === "number" && col >= 0) {
+      const padding = " ".repeat(col + 9);
+      contextLines.push(`${padding}^`);
+    }
+  }
+  if (idx + 1 < lines.length) {
+    contextLines.push(`  ${String(idx + 2).padStart(4)} | ${lines[idx + 1]}`);
+  }
+  return `${filePath}:${lineNo}: ${message}
+
+${contextLines.join("\n")}`;
+}
+function parseColony(text, { filePath = "<memory>", parseOnlyDirectives = false } = {}) {
+  const { text: cleanedText, lineMap } = stripBlockComments(text);
+  const lines = cleanedText.split(/\r?\n/);
+  const originalLines = text.split(/\r?\n/);
+  const rules = [];
+  const includes = [];
+  const requires = [];
+  const envDefaults = {};
+  let dims = null;
+  let buf = "";
+  let bufStartLine = 0;
+  let bufStartOriginalLine = 0;
+  let inHeredoc = false;
+  let heredocDelimiter = "";
+  let heredocContent = "";
+  let heredocStartLine = 0;
+  let heredocKey = "";
+  let heredocOp = "";
+  const getOriginalLine = (lineNo) => lineMap[lineNo - 1] || lineNo;
+  const flush = () => {
+    const raw = buf.trim();
+    buf = "";
+    if (!raw) return;
+    const origLine = bufStartOriginalLine;
+    const mDims = raw.match(RX_DIMS);
+    if (mDims) {
+      dims = mDims[1].split(",").map((s) => s.trim()).filter(Boolean);
+      return;
+    }
+    const mInc = raw.match(RX_INCLUDE);
+    if (mInc) {
+      includes.push(stripQuotes(mInc[1].trim()));
+      return;
+    }
+    const mReq = raw.match(RX_REQUIRE);
+    if (mReq) {
+      const keys = mReq[1].split(",").map((s) => s.trim()).filter(Boolean);
+      requires.push(...keys);
+      return;
+    }
+    const mEnvDef = raw.match(RX_ENVDEFAULTS);
+    if (mEnvDef) {
+      const parts = mEnvDef[1].split(",").map((s) => s.trim()).filter(Boolean);
+      for (const p of parts) {
+        const idx = p.indexOf("=");
+        if (idx === -1) {
+          throw new Error(formatParseError(
+            `Bad @envDefaults entry: ${p}`,
+            originalLines,
+            origLine,
+            void 0,
+            filePath
+          ));
+        }
+        const k = p.slice(0, idx).trim();
+        const vRaw = p.slice(idx + 1).trim();
+        envDefaults[k] = stripQuotes(vRaw);
+      }
+      return;
+    }
+    if (parseOnlyDirectives) return;
+    const mRule = raw.match(RX_RULE);
+    if (!mRule) {
+      throw new Error(formatParseError(
+        "Invalid statement",
+        originalLines,
+        origLine,
+        void 0,
+        filePath
+      ));
+    }
+    const keyRaw = mRule[1].trim();
+    const op = mRule[2];
+    const valueRaw = mRule[3].trim();
+    const keySegments = parseKeyPath(keyRaw);
+    if (keySegments.length === 0) {
+      throw new Error(formatParseError(
+        "Empty key",
+        originalLines,
+        origLine,
+        0,
+        filePath
+      ));
+    }
+    const value = parseValue(valueRaw, { filePath, line: origLine, lines: originalLines });
+    rules.push({
+      filePath,
+      line: origLine,
+      col: 0,
+      keyRaw,
+      keySegments,
+      op,
+      value
+    });
+  };
+  for (let i = 0; i < lines.length; i++) {
+    const lineNo = i + 1;
+    const originalLineNo = getOriginalLine(lineNo);
+    const line = lines[i];
+    const trimmed = line.trim();
+    if (inHeredoc) {
+      if (trimmed === heredocDelimiter) {
+        const keySegments = parseKeyPath(heredocKey);
+        if (keySegments.length === 0) {
+          throw new Error(formatParseError(
+            "Empty key in heredoc",
+            originalLines,
+            heredocStartLine,
+            0,
+            filePath
+          ));
+        }
+        rules.push({
+          filePath,
+          line: heredocStartLine,
+          col: 0,
+          keyRaw: heredocKey,
+          keySegments,
+          op: heredocOp,
+          value: heredocContent
+        });
+        inHeredoc = false;
+        heredocContent = "";
+        continue;
+      }
+      heredocContent += (heredocContent ? "\n" : "") + line;
+      continue;
+    }
+    if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("//")) continue;
+    const heredocMatch = trimmed.match(/^(.+?)\s*(\:=|\|\=|\+\=|\-\=|\=)\s*<<([A-Z_][A-Z0-9_]*)$/);
+    if (heredocMatch) {
+      inHeredoc = true;
+      heredocKey = heredocMatch[1].trim();
+      heredocOp = heredocMatch[2];
+      heredocDelimiter = heredocMatch[3];
+      heredocStartLine = originalLineNo;
+      heredocContent = "";
+      continue;
+    }
+    if (!buf) {
+      bufStartLine = lineNo;
+      bufStartOriginalLine = originalLineNo;
+    }
+    buf += (buf ? "\n" : "") + line;
+    if (trimmed.endsWith(";")) flush();
+  }
+  if (inHeredoc) {
+    throw new Error(formatParseError(
+      `Unterminated heredoc (missing ${heredocDelimiter})`,
+      originalLines,
+      heredocStartLine,
+      void 0,
+      filePath
+    ));
+  }
+  if (buf.trim()) {
+    throw new Error(formatParseError(
+      "Unterminated statement (missing ';')",
+      originalLines,
+      bufStartOriginalLine,
+      void 0,
+      filePath
+    ));
+  }
+  return { dims, includes, requires, envDefaults, rules };
+}
+function parseValue(raw, { filePath, line, lines }) {
+  const r = raw.trim();
+  if (/^(true|false|null)$/.test(r)) return JSON5.parse(r);
+  if (/^-?\d+(\.\d+)?$/.test(r)) return Number(r);
+  const starts = r[0];
+  const ends = r[r.length - 1];
+  const looksJsonish = starts === "{" && ends === "}" || starts === "[" && ends === "]" || starts === `"` && ends === `"` || starts === `'` && ends === `'`;
+  if (looksJsonish) {
+    try {
+      return JSON5.parse(r);
+    } catch (e) {
+      throw new Error(formatParseError(
+        `Bad JSON5 value: ${e.message}`,
+        lines,
+        line,
+        void 0,
+        filePath
+      ));
+    }
+  }
+  return r;
+}
+function stripQuotes(s) {
+  if (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'")) {
+    return s.slice(1, -1);
+  }
+  return s;
+}
+export {
+  parseColony
+};
+//# sourceMappingURL=parser.js.map

package/dist/esm/parser.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/parser.js"],
+  "sourcesContent": ["import JSON5 from \"json5\";\n\nconst RX_DIMS = /^@dims\\s+([^;]+);/;\nconst RX_INCLUDE = /^@include\\s+(.+);/;\nconst RX_REQUIRE = /^@require\\s+([^;]+);/;\nconst RX_ENVDEFAULTS = /^@envDefaults\\s+([^;]+);/;\n\n// Rule: <scoped.key.path> <op> <value>;\n// Using [\\s\\S] instead of . to match newlines in multi-line values\nconst RX_RULE = /^(.+?)\\s*(\\:=|\\|\\=|\\+\\=|\\-\\=|\\=)\\s*([\\s\\S]+)\\s*;$/;\n\n// Heredoc: <<EOF ... EOF\nconst RX_HEREDOC_START = /<<([A-Z_][A-Z0-9_]*)\\s*$/;\n\n/**\n * Remove block comments from text (slash-star to star-slash)\n * @param {string} text\n * @returns {{ text: string, lineMap: number[] }} - cleaned text and mapping from new line numbers to original\n */\nfunction stripBlockComments(text) {\n  const result = [];\n  const lineMap = []; // lineMap[newLineNo] = originalLineNo\n  let inComment = false;\n  let commentDepth = 0;\n  const lines = text.split(/\\r?\\n/);\n\n  for (let i = 0; i < lines.length; i++) {\n    const originalLineNo = i + 1;\n    let line = lines[i];\n    let cleanLine = \"\";\n    let j = 0;\n\n    while (j < line.length) {\n      if (!inComment) {\n        // Check for comment start\n        if (line[j] === \"/\" && line[j + 1] === \"*\") {\n          inComment = true;\n          commentDepth = 1;\n          j += 2;\n          continue;\n        }\n        cleanLine += line[j];\n        j++;\n      } else {\n        // Inside block comment\n        if (line[j] === \"/\" && line[j + 1] === \"*\") {\n          commentDepth++;\n          j += 2;\n        } else if (line[j] === \"*\" && line[j + 1] === \"/\") {\n          commentDepth--;\n          if (commentDepth === 0) {\n            inComment = false;\n          }\n          j += 2;\n        } else {\n          j++;\n        }\n      }\n    }\n\n    result.push(cleanLine);\n    lineMap.push(originalLineNo);\n  }\n\n  return { text: result.join(\"\\n\"), lineMap };\n}\n\n/**\n * Parse a key path with escaped dots\n * \"foo\\.bar.baz\" => [\"foo.bar\", \"baz\"]\n * @param {string} keyRaw\n * @returns {string[]}\n */\nfunction parseKeyPath(keyRaw) {\n  const segments = [];\n  let current = \"\";\n  let i = 0;\n\n  while (i < keyRaw.length) {\n    if (keyRaw[i] === \"\\\\\" && keyRaw[i + 1] === \".\") {\n      // Escaped dot - include literal dot\n      current += \".\";\n      i += 2;\n    } else if (keyRaw[i] === \".\") {\n      // Segment separator\n      if (current.trim()) segments.push(current.trim());\n      current = \"\";\n      i++;\n    } else {\n      current += keyRaw[i];\n      i++;\n    }\n  }\n\n  if (current.trim()) segments.push(current.trim());\n  return segments;\n}\n\n/**\n * Format a parse error with line context and caret\n * @param {string} message\n * @param {string[]} lines\n * @param {number} lineNo - 1-indexed line number\n * @param {number=} col - 0-indexed column (optional)\n * @param {string} filePath\n * @returns {string}\n */\nfunction formatParseError(message, lines, lineNo, col, filePath) {\n  const idx = lineNo - 1;\n  const contextLines = [];\n\n  // Show up to 2 lines before\n  for (let i = Math.max(0, idx - 2); i < idx; i++) {\n    contextLines.push(`  ${String(i + 1).padStart(4)} | ${lines[i]}`);\n  }\n\n  // Show the error line\n  if (idx >= 0 && idx < lines.length) {\n    contextLines.push(`> ${String(lineNo).padStart(4)} | ${lines[idx]}`);\n\n    // Show caret if column is specified\n    if (typeof col === \"number\" && col >= 0) {\n      const padding = \" \".repeat(col + 9); // account for \"> XXXX | \"\n      contextLines.push(`${padding}^`);\n    }\n  }\n\n  // Show up to 1 line after\n  if (idx + 1 < lines.length) {\n    contextLines.push(`  ${String(idx + 2).padStart(4)} | ${lines[idx + 1]}`);\n  }\n\n  return `${filePath}:${lineNo}: ${message}\\n\\n${contextLines.join(\"\\n\")}`;\n}\n\nexport function parseColony(text, { filePath = \"<memory>\", parseOnlyDirectives = false } = {}) {\n  // Strip block comments first, keeping track of original line numbers\n  const { text: cleanedText, lineMap } = stripBlockComments(text);\n  const lines = cleanedText.split(/\\r?\\n/);\n  const originalLines = text.split(/\\r?\\n/);\n\n  const rules = [];\n  const includes = [];\n  const requires = [];\n  const envDefaults = {};\n  let dims = null;\n\n  let buf = \"\";\n  let bufStartLine = 0;\n  let bufStartOriginalLine = 0;\n\n  // Heredoc state\n  let inHeredoc = false;\n  let heredocDelimiter = \"\";\n  let heredocContent = \"\";\n  let heredocStartLine = 0;\n  let heredocKey = \"\";\n  let heredocOp = \"\";\n\n  const getOriginalLine = (lineNo) => lineMap[lineNo - 1] || lineNo;\n\n  const flush = () => {\n    const raw = buf.trim();\n    buf = \"\";\n    if (!raw) return;\n\n    const origLine = bufStartOriginalLine;\n\n    const mDims = raw.match(RX_DIMS);\n    if (mDims) {\n      dims = mDims[1].split(\",\").map((s) => s.trim()).filter(Boolean);\n      return;\n    }\n\n    const mInc = raw.match(RX_INCLUDE);\n    if (mInc) {\n      includes.push(stripQuotes(mInc[1].trim()));\n      return;\n    }\n\n    const mReq = raw.match(RX_REQUIRE);\n    if (mReq) {\n      const keys = mReq[1]\n        .split(\",\")\n        .map((s) => s.trim())\n        .filter(Boolean);\n      requires.push(...keys);\n      return;\n    }\n\n    const mEnvDef = raw.match(RX_ENVDEFAULTS);\n    if (mEnvDef) {\n      const parts = mEnvDef[1]\n        .split(\",\")\n        .map((s) => s.trim())\n        .filter(Boolean);\n\n      for (const p of parts) {\n        const idx = p.indexOf(\"=\");\n        if (idx === -1) {\n          throw new Error(formatParseError(\n            `Bad @envDefaults entry: ${p}`,\n            originalLines,\n            origLine,\n            undefined,\n            filePath\n          ));\n        }\n        const k = p.slice(0, idx).trim();\n        const vRaw = p.slice(idx + 1).trim();\n        envDefaults[k] = stripQuotes(vRaw);\n      }\n      return;\n    }\n\n    if (parseOnlyDirectives) return;\n\n    const mRule = raw.match(RX_RULE);\n    if (!mRule) {\n      throw new Error(formatParseError(\n        \"Invalid statement\",\n        originalLines,\n        origLine,\n        undefined,\n        filePath\n      ));\n    }\n\n    const keyRaw = mRule[1].trim();\n    const op = mRule[2];\n    const valueRaw = mRule[3].trim();\n\n    const keySegments = parseKeyPath(keyRaw);\n    if (keySegments.length === 0) {\n      throw new Error(formatParseError(\n        \"Empty key\",\n        originalLines,\n        origLine,\n        0,\n        filePath\n      ));\n    }\n\n    const value = parseValue(valueRaw, { filePath, line: origLine, lines: originalLines });\n\n    rules.push({\n      filePath,\n      line: origLine,\n      col: 0,\n      keyRaw,\n      keySegments,\n      op,\n      value,\n    });\n  };\n\n  for (let i = 0; i < lines.length; i++) {\n    const lineNo = i + 1;\n    const originalLineNo = getOriginalLine(lineNo);\n    const line = lines[i];\n    const trimmed = line.trim();\n\n    // Handle heredoc mode\n    if (inHeredoc) {\n      if (trimmed === heredocDelimiter) {\n        // End of heredoc\n        const keySegments = parseKeyPath(heredocKey);\n        if (keySegments.length === 0) {\n          throw new Error(formatParseError(\n            \"Empty key in heredoc\",\n            originalLines,\n            heredocStartLine,\n            0,\n            filePath\n          ));\n        }\n\n        rules.push({\n          filePath,\n          line: heredocStartLine,\n          col: 0,\n          keyRaw: heredocKey,\n          keySegments,\n          op: heredocOp,\n          value: heredocContent,\n        });\n\n        inHeredoc = false;\n        heredocContent = \"\";\n        continue;\n      }\n\n      // Add line to heredoc content\n      heredocContent += (heredocContent ? \"\\n\" : \"\") + line;\n      continue;\n    }\n\n    // Skip empty lines and line comments\n    if (!trimmed || trimmed.startsWith(\"#\") || trimmed.startsWith(\"//\")) continue;\n\n    // Check for heredoc start: key = <<EOF\n    const heredocMatch = trimmed.match(/^(.+?)\\s*(\\:=|\\|\\=|\\+\\=|\\-\\=|\\=)\\s*<<([A-Z_][A-Z0-9_]*)$/);\n    if (heredocMatch) {\n      inHeredoc = true;\n      heredocKey = heredocMatch[1].trim();\n      heredocOp = heredocMatch[2];\n      heredocDelimiter = heredocMatch[3];\n      heredocStartLine = originalLineNo;\n      heredocContent = \"\";\n      continue;\n    }\n\n    if (!buf) {\n      bufStartLine = lineNo;\n      bufStartOriginalLine = originalLineNo;\n    }\n    buf += (buf ? \"\\n\" : \"\") + line;\n\n    if (trimmed.endsWith(\";\")) flush();\n  }\n\n  if (inHeredoc) {\n    throw new Error(formatParseError(\n      `Unterminated heredoc (missing ${heredocDelimiter})`,\n      originalLines,\n      heredocStartLine,\n      undefined,\n      filePath\n    ));\n  }\n\n  if (buf.trim()) {\n    throw new Error(formatParseError(\n      \"Unterminated statement (missing ';')\",\n      originalLines,\n      bufStartOriginalLine,\n      undefined,\n      filePath\n    ));\n  }\n\n  return { dims, includes, requires, envDefaults, rules };\n}\n\nfunction parseValue(raw, { filePath, line, lines }) {\n  const r = raw.trim();\n\n  if (/^(true|false|null)$/.test(r)) return JSON5.parse(r);\n  if (/^-?\\d+(\\.\\d+)?$/.test(r)) return Number(r);\n\n  const starts = r[0];\n  const ends = r[r.length - 1];\n  const looksJsonish =\n    (starts === \"{\" && ends === \"}\") ||\n    (starts === \"[\" && ends === \"]\") ||\n    (starts === `\"` && ends === `\"`) ||\n    (starts === `'` && ends === `'`);\n\n  if (looksJsonish) {\n    try {\n      return JSON5.parse(r);\n    } catch (e) {\n      throw new Error(formatParseError(\n        `Bad JSON5 value: ${e.message}`,\n        lines,\n        line,\n        undefined,\n        filePath\n      ));\n    }\n  }\n\n  return r; // bareword => string\n}\n\nfunction stripQuotes(s) {\n  if ((s.startsWith('\"') && s.endsWith('\"')) || (s.startsWith(\"'\") && s.endsWith(\"'\"))) {\n    return s.slice(1, -1);\n  }\n  return s;\n}\n"],
+  "mappings": "AAAA,OAAO,WAAW;AAElB,MAAM,UAAU;AAChB,MAAM,aAAa;AACnB,MAAM,aAAa;AACnB,MAAM,iBAAiB;AAIvB,MAAM,UAAU;AAGhB,MAAM,mBAAmB;AAOzB,SAAS,mBAAmB,MAAM;AAChC,QAAM,SAAS,CAAC;AAChB,QAAM,UAAU,CAAC;AACjB,MAAI,YAAY;AAChB,MAAI,eAAe;AACnB,QAAM,QAAQ,KAAK,MAAM,OAAO;AAEhC,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,iBAAiB,IAAI;AAC3B,QAAI,OAAO,MAAM,CAAC;AAClB,QAAI,YAAY;AAChB,QAAI,IAAI;AAER,WAAO,IAAI,KAAK,QAAQ;AACtB,UAAI,CAAC,WAAW;AAEd,YAAI,KAAK,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AAC1C,sBAAY;AACZ,yBAAe;AACf,eAAK;AACL;AAAA,QACF;AACA,qBAAa,KAAK,CAAC;AACnB;AAAA,MACF,OAAO;AAEL,YAAI,KAAK,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AAC1C;AACA,eAAK;AAAA,QACP,WAAW,KAAK,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AACjD;AACA,cAAI,iBAAiB,GAAG;AACtB,wBAAY;AAAA,UACd;AACA,eAAK;AAAA,QACP,OAAO;AACL;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,KAAK,SAAS;AACrB,YAAQ,KAAK,cAAc;AAAA,EAC7B;AAEA,SAAO,EAAE,MAAM,OAAO,KAAK,IAAI,GAAG,QAAQ;AAC5C;AAQA,SAAS,aAAa,QAAQ;AAC5B,QAAM,WAAW,CAAC;AAClB,MAAI,UAAU;AACd,MAAI,IAAI;AAER,SAAO,IAAI,OAAO,QAAQ;AACxB,QAAI,OAAO,CAAC,MAAM,QAAQ,OAAO,IAAI,CAAC,MAAM,KAAK;AAE/C,iBAAW;AACX,WAAK;AAAA,IACP,WAAW,OAAO,CAAC,MAAM,KAAK;AAE5B,UAAI,QAAQ,KAAK,EAAG,UAAS,KAAK,QAAQ,KAAK,CAAC;AAChD,gBAAU;AACV;AAAA,IACF,OAAO;AACL,iBAAW,OAAO,CAAC;AACnB;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,KAAK,EAAG,UAAS,KAAK,QAAQ,KAAK,CAAC;AAChD,SAAO;AACT;AAWA,SAAS,iBAAiB,SAAS,OAAO,QAAQ,KAAK,UAAU;AAC/D,QAAM,MAAM,SAAS;AACrB,QAAM,eAAe,CAAC;AAGtB,WAAS,IAAI,KAAK,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,KAAK,KAAK;AAC/C,iBAAa,KAAK,KAAK,OAAO,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,EAAE;AAAA,EAClE;AAGA,MAAI,OAAO,KAAK,MAAM,MAAM,QAAQ;AAClC,iBAAa,KAAK,KAAK,OAAO,MAAM,EAAE,SAAS,CAAC,CAAC,MAAM,MAAM,GAAG,CAAC,EAAE;AAGnE,QAAI,OAAO,QAAQ,YAAY,OAAO,GAAG;AACvC,YAAM,UAAU,IAAI,OAAO,MAAM,CAAC;AAClC,mBAAa,KAAK,GAAG,OAAO,GAAG;AAAA,IACjC;AAAA,EACF;AAGA,MAAI,MAAM,IAAI,MAAM,QAAQ;AAC1B,iBAAa,KAAK,KAAK,OAAO,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,MAAM,MAAM,MAAM,CAAC,CAAC,EAAE;AAAA,EAC1E;AAEA,SAAO,GAAG,QAAQ,IAAI,MAAM,KAAK,OAAO;AAAA;AAAA,EAAO,aAAa,KAAK,IAAI,CAAC;AACxE;AAEO,SAAS,YAAY,MAAM,EAAE,WAAW,YAAY,sBAAsB,MAAM,IAAI,CAAC,GAAG;AAE7F,QAAM,EAAE,MAAM,aAAa,QAAQ,IAAI,mBAAmB,IAAI;AAC9D,QAAM,QAAQ,YAAY,MAAM,OAAO;AACvC,QAAM,gBAAgB,KAAK,MAAM,OAAO;AAExC,QAAM,QAAQ,CAAC;AACf,QAAM,WAAW,CAAC;AAClB,QAAM,WAAW,CAAC;AAClB,QAAM,cAAc,CAAC;AACrB,MAAI,OAAO;AAEX,MAAI,MAAM;AACV,MAAI,eAAe;AACnB,MAAI,uBAAuB;AAG3B,MAAI,YAAY;AAChB,MAAI,mBAAmB;AACvB,MAAI,iBAAiB;AACrB,MAAI,mBAAmB;AACvB,MAAI,aAAa;AACjB,MAAI,YAAY;AAEhB,QAAM,kBAAkB,CAAC,WAAW,QAAQ,SAAS,CAAC,KAAK;AAE3D,QAAM,QAAQ,MAAM;AAClB,UAAM,MAAM,IAAI,KAAK;AACrB,UAAM;AACN,QAAI,CAAC,IAAK;AAEV,UAAM,WAAW;AAEjB,UAAM,QAAQ,IAAI,MAAM,OAAO;AAC/B,QAAI,OAAO;AACT,aAAO,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAC9D;AAAA,IACF;AAEA,UAAM,OAAO,IAAI,MAAM,UAAU;AACjC,QAAI,MAAM;AACR,eAAS,KAAK,YAAY,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;AACzC;AAAA,IACF;AAEA,UAAM,OAAO,IAAI,MAAM,UAAU;AACjC,QAAI,MAAM;AACR,YAAM,OAAO,KAAK,CAAC,EAChB,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AACjB,eAAS,KAAK,GAAG,IAAI;AACrB;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,MAAM,cAAc;AACxC,QAAI,SAAS;AACX,YAAM,QAAQ,QAAQ,CAAC,EACpB,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAEjB,iBAAW,KAAK,OAAO;AACrB,cAAM,MAAM,EAAE,QAAQ,GAAG;AACzB,YAAI,QAAQ,IAAI;AACd,gBAAM,IAAI,MAAM;AAAA,YACd,2BAA2B,CAAC;AAAA,YAC5B;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM,IAAI,EAAE,MAAM,GAAG,GAAG,EAAE,KAAK;AAC/B,cAAM,OAAO,EAAE,MAAM,MAAM,CAAC,EAAE,KAAK;AACnC,oBAAY,CAAC,IAAI,YAAY,IAAI;AAAA,MACnC;AACA;AAAA,IACF;AAEA,QAAI,oBAAqB;AAEzB,UAAM,QAAQ,IAAI,MAAM,OAAO;AAC/B,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,CAAC,EAAE,KAAK;AAC7B,UAAM,KAAK,MAAM,CAAC;AAClB,UAAM,WAAW,MAAM,CAAC,EAAE,KAAK;AAE/B,UAAM,cAAc,aAAa,MAAM;AACvC,QAAI,YAAY,WAAW,GAAG;AAC5B,YAAM,IAAI,MAAM;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,WAAW,UAAU,EAAE,UAAU,MAAM,UAAU,OAAO,cAAc,CAAC;AAErF,UAAM,KAAK;AAAA,MACT;AAAA,MACA,MAAM;AAAA,MACN,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAEA,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,SAAS,IAAI;AACnB,UAAM,iBAAiB,gBAAgB,MAAM;AAC7C,UAAM,OAAO,MAAM,CAAC;AACpB,UAAM,UAAU,KAAK,KAAK;AAG1B,QAAI,WAAW;AACb,UAAI,YAAY,kBAAkB;AAEhC,cAAM,cAAc,aAAa,UAAU;AAC3C,YAAI,YAAY,WAAW,GAAG;AAC5B,gBAAM,IAAI,MAAM;AAAA,YACd;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AAEA,cAAM,KAAK;AAAA,UACT;AAAA,UACA,MAAM;AAAA,UACN,KAAK;AAAA,UACL,QAAQ;AAAA,UACR;AAAA,UACA,IAAI;AAAA,UACJ,OAAO;AAAA,QACT,CAAC;AAED,oBAAY;AACZ,yBAAiB;AACjB;AAAA,MACF;AAGA,yBAAmB,iBAAiB,OAAO,MAAM;AACjD;AAAA,IACF;AAGA,QAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,IAAI,EAAG;AAGrE,UAAM,eAAe,QAAQ,MAAM,0DAA0D;AAC7F,QAAI,cAAc;AAChB,kBAAY;AACZ,mBAAa,aAAa,CAAC,EAAE,KAAK;AAClC,kBAAY,aAAa,CAAC;AAC1B,yBAAmB,aAAa,CAAC;AACjC,yBAAmB;AACnB,uBAAiB;AACjB;AAAA,IACF;AAEA,QAAI,CAAC,KAAK;AACR,qBAAe;AACf,6BAAuB;AAAA,IACzB;AACA,YAAQ,MAAM,OAAO,MAAM;AAE3B,QAAI,QAAQ,SAAS,GAAG,EAAG,OAAM;AAAA,EACnC;AAEA,MAAI,WAAW;AACb,UAAM,IAAI,MAAM;AAAA,MACd,iCAAiC,gBAAgB;AAAA,MACjD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,IAAI,KAAK,GAAG;AACd,UAAM,IAAI,MAAM;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,MAAM,UAAU,UAAU,aAAa,MAAM;AACxD;AAEA,SAAS,WAAW,KAAK,EAAE,UAAU,MAAM,MAAM,GAAG;AAClD,QAAM,IAAI,IAAI,KAAK;AAEnB,MAAI,sBAAsB,KAAK,CAAC,EAAG,QAAO,MAAM,MAAM,CAAC;AACvD,MAAI,kBAAkB,KAAK,CAAC,EAAG,QAAO,OAAO,CAAC;AAE9C,QAAM,SAAS,EAAE,CAAC;AAClB,QAAM,OAAO,EAAE,EAAE,SAAS,CAAC;AAC3B,QAAM,eACH,WAAW,OAAO,SAAS,OAC3B,WAAW,OAAO,SAAS,OAC3B,WAAW,OAAO,SAAS,OAC3B,WAAW,OAAO,SAAS;AAE9B,MAAI,cAAc;AAChB,QAAI;AACF,aAAO,MAAM,MAAM,CAAC;AAAA,IACtB,SAAS,GAAG;AACV,YAAM,IAAI,MAAM;AAAA,QACd,oBAAoB,EAAE,OAAO;AAAA,QAC7B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,YAAY,GAAG;AACtB,MAAK,EAAE,WAAW,GAAG,KAAK,EAAE,SAAS,GAAG,KAAO,EAAE,WAAW,GAAG,KAAK,EAAE,SAAS,GAAG,GAAI;AACpF,WAAO,EAAE,MAAM,GAAG,EAAE;AAAA,EACtB;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/esm/providers/aws.js

@@ -0,0 +1,82 @@
+class AwsSecretsProvider {
+  prefix = "AWS";
+  /**
+   * @param {object} options
+   * @param {string=} options.region - AWS region (default: process.env.AWS_REGION or "us-east-1")
+   */
+  constructor(options = {}) {
+    this.region = options.region ?? process.env.AWS_REGION ?? "us-east-1";
+    this.client = null;
+    this.clientPromise = null;
+    this.GetSecretValueCommand = null;
+  }
+  /**
+   * Get or create the AWS client (lazy initialization)
+   * @returns {Promise<object>}
+   */
+  async getClient() {
+    if (this.client) return this.client;
+    if (this.clientPromise) return this.clientPromise;
+    this.clientPromise = (async () => {
+      const { SecretsManagerClient, GetSecretValueCommand } = await import("@aws-sdk/client-secrets-manager");
+      this.client = new SecretsManagerClient({ region: this.region });
+      this.GetSecretValueCommand = GetSecretValueCommand;
+      return this.client;
+    })();
+    return this.clientPromise;
+  }
+  /**
+   * Fetch a secret value
+   * @param {string} key - Secret key, optionally with JSON path: "secret-name#json.path"
+   * @returns {Promise<string>}
+   */
+  async fetch(key) {
+    const client = await this.getClient();
+    const [secretId, jsonPath] = key.split("#");
+    const command = new this.GetSecretValueCommand({ SecretId: secretId });
+    const response = await client.send(command);
+    let value = response.SecretString;
+    if (!value && response.SecretBinary) {
+      value = Buffer.from(response.SecretBinary).toString("utf-8");
+    }
+    if (jsonPath && value) {
+      try {
+        const parsed = JSON.parse(value);
+        value = getJsonPath(parsed, jsonPath);
+      } catch {
+      }
+    }
+    return value ?? "";
+  }
+  /**
+   * Validate provider configuration
+   * @returns {Promise<void>}
+   */
+  async validate() {
+    await this.getClient();
+  }
+  /**
+   * Cleanup resources
+   * @returns {Promise<void>}
+   */
+  async dispose() {
+    if (this.client?.destroy) {
+      this.client.destroy();
+    }
+    this.client = null;
+    this.clientPromise = null;
+  }
+}
+function getJsonPath(obj, path) {
+  const parts = path.split(".");
+  let current = obj;
+  for (const part of parts) {
+    if (current === null || current === void 0) return void 0;
+    current = current[part];
+  }
+  return typeof current === "string" ? current : JSON.stringify(current);
+}
+export {
+  AwsSecretsProvider
+};
+//# sourceMappingURL=aws.js.map

package/dist/esm/providers/aws.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/providers/aws.js"],
+  "sourcesContent": ["/**\n * AWS Secrets Manager provider for colony\n */\n\n/**\n * @class AwsSecretsProvider\n * @property {string} prefix - Provider prefix (\"AWS\")\n */\nexport class AwsSecretsProvider {\n  prefix = \"AWS\";\n\n  /**\n   * @param {object} options\n   * @param {string=} options.region - AWS region (default: process.env.AWS_REGION or \"us-east-1\")\n   */\n  constructor(options = {}) {\n    this.region = options.region ?? process.env.AWS_REGION ?? \"us-east-1\";\n    this.client = null;\n    this.clientPromise = null;\n    this.GetSecretValueCommand = null;\n  }\n\n  /**\n   * Get or create the AWS client (lazy initialization)\n   * @returns {Promise<object>}\n   */\n  async getClient() {\n    if (this.client) return this.client;\n    if (this.clientPromise) return this.clientPromise;\n\n    this.clientPromise = (async () => {\n      // Dynamic import to avoid requiring AWS SDK if not used\n      const { SecretsManagerClient, GetSecretValueCommand } = await import(\n        \"@aws-sdk/client-secrets-manager\"\n      );\n      this.client = new SecretsManagerClient({ region: this.region });\n      this.GetSecretValueCommand = GetSecretValueCommand;\n      return this.client;\n    })();\n\n    return this.clientPromise;\n  }\n\n  /**\n   * Fetch a secret value\n   * @param {string} key - Secret key, optionally with JSON path: \"secret-name#json.path\"\n   * @returns {Promise<string>}\n   */\n  async fetch(key) {\n    const client = await this.getClient();\n\n    // Support key with JSON path: secret-name#json.path\n    const [secretId, jsonPath] = key.split(\"#\");\n\n    const command = new this.GetSecretValueCommand({ SecretId: secretId });\n    const response = await client.send(command);\n\n    let value = response.SecretString;\n    if (!value && response.SecretBinary) {\n      value = Buffer.from(response.SecretBinary).toString(\"utf-8\");\n    }\n\n    // Extract JSON path if specified\n    if (jsonPath && value) {\n      try {\n        const parsed = JSON.parse(value);\n        value = getJsonPath(parsed, jsonPath);\n      } catch {\n        // Not JSON or invalid path, return as-is\n      }\n    }\n\n    return value ?? \"\";\n  }\n\n  /**\n   * Validate provider configuration\n   * @returns {Promise<void>}\n   */\n  async validate() {\n    // Try to initialize client to verify SDK is available\n    await this.getClient();\n  }\n\n  /**\n   * Cleanup resources\n   * @returns {Promise<void>}\n   */\n  async dispose() {\n    if (this.client?.destroy) {\n      this.client.destroy();\n    }\n    this.client = null;\n    this.clientPromise = null;\n  }\n}\n\n/**\n * Get a value from an object using dot notation path\n * @param {object} obj - Object to traverse\n * @param {string} path - Dot-separated path (e.g., \"database.password\")\n * @returns {string|undefined}\n */\nfunction getJsonPath(obj, path) {\n  const parts = path.split(\".\");\n  let current = obj;\n  for (const part of parts) {\n    if (current === null || current === undefined) return undefined;\n    current = current[part];\n  }\n  return typeof current === \"string\" ? current : JSON.stringify(current);\n}\n"],
+  "mappings": "AAQO,MAAM,mBAAmB;AAAA,EAC9B,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAMT,YAAY,UAAU,CAAC,GAAG;AACxB,SAAK,SAAS,QAAQ,UAAU,QAAQ,IAAI,cAAc;AAC1D,SAAK,SAAS;AACd,SAAK,gBAAgB;AACrB,SAAK,wBAAwB;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAY;AAChB,QAAI,KAAK,OAAQ,QAAO,KAAK;AAC7B,QAAI,KAAK,cAAe,QAAO,KAAK;AAEpC,SAAK,iBAAiB,YAAY;AAEhC,YAAM,EAAE,sBAAsB,sBAAsB,IAAI,MAAM,OAC5D,iCACF;AACA,WAAK,SAAS,IAAI,qBAAqB,EAAE,QAAQ,KAAK,OAAO,CAAC;AAC9D,WAAK,wBAAwB;AAC7B,aAAO,KAAK;AAAA,IACd,GAAG;AAEH,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAAM,KAAK;AACf,UAAM,SAAS,MAAM,KAAK,UAAU;AAGpC,UAAM,CAAC,UAAU,QAAQ,IAAI,IAAI,MAAM,GAAG;AAE1C,UAAM,UAAU,IAAI,KAAK,sBAAsB,EAAE,UAAU,SAAS,CAAC;AACrE,UAAM,WAAW,MAAM,OAAO,KAAK,OAAO;AAE1C,QAAI,QAAQ,SAAS;AACrB,QAAI,CAAC,SAAS,SAAS,cAAc;AACnC,cAAQ,OAAO,KAAK,SAAS,YAAY,EAAE,SAAS,OAAO;AAAA,IAC7D;AAGA,QAAI,YAAY,OAAO;AACrB,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,gBAAQ,YAAY,QAAQ,QAAQ;AAAA,MACtC,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,WAAO,SAAS;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW;AAEf,UAAM,KAAK,UAAU;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAU;AACd,QAAI,KAAK,QAAQ,SAAS;AACxB,WAAK,OAAO,QAAQ;AAAA,IACtB;AACA,SAAK,SAAS;AACd,SAAK,gBAAgB;AAAA,EACvB;AACF;AAQA,SAAS,YAAY,KAAK,MAAM;AAC9B,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,UAAU;AACd,aAAW,QAAQ,OAAO;AACxB,QAAI,YAAY,QAAQ,YAAY,OAAW,QAAO;AACtD,cAAU,QAAQ,IAAI;AAAA,EACxB;AACA,SAAO,OAAO,YAAY,WAAW,UAAU,KAAK,UAAU,OAAO;AACvE;",
+  "names": []
+}

package/dist/esm/providers/openbao.js

@@ -0,0 +1,26 @@
+import { VaultCompatibleProvider } from "./vault-base.js";
+class OpenBaoProvider extends VaultCompatibleProvider {
+  /**
+   * @param {object} options
+   * @param {string=} options.addr - OpenBao address (default: process.env.BAO_ADDR or "http://127.0.0.1:8200")
+   * @param {string=} options.token - OpenBao token (default: process.env.BAO_TOKEN)
+   * @param {string=} options.namespace - OpenBao namespace (default: process.env.BAO_NAMESPACE)
+   * @param {number=} options.timeout - Request timeout in ms (default: 30000)
+   */
+  constructor(options = {}) {
+    super(
+      {
+        prefix: "OPENBAO",
+        addrEnvVar: "BAO_ADDR",
+        tokenEnvVar: "BAO_TOKEN",
+        namespaceEnvVar: "BAO_NAMESPACE",
+        errorPrefix: "OpenBao"
+      },
+      options
+    );
+  }
+}
+export {
+  OpenBaoProvider
+};
+//# sourceMappingURL=openbao.js.map

package/dist/esm/providers/openbao.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/providers/openbao.js"],
+  "sourcesContent": ["/**\n * OpenBao provider for colony\n * OpenBao is an API-compatible fork of HashiCorp Vault\n */\n\nimport { VaultCompatibleProvider } from \"./vault-base.js\";\n\n/**\n * @class OpenBaoProvider\n * @property {string} prefix - Provider prefix (\"OPENBAO\")\n */\nexport class OpenBaoProvider extends VaultCompatibleProvider {\n  /**\n   * @param {object} options\n   * @param {string=} options.addr - OpenBao address (default: process.env.BAO_ADDR or \"http://127.0.0.1:8200\")\n   * @param {string=} options.token - OpenBao token (default: process.env.BAO_TOKEN)\n   * @param {string=} options.namespace - OpenBao namespace (default: process.env.BAO_NAMESPACE)\n   * @param {number=} options.timeout - Request timeout in ms (default: 30000)\n   */\n  constructor(options = {}) {\n    super(\n      {\n        prefix: \"OPENBAO\",\n        addrEnvVar: \"BAO_ADDR\",\n        tokenEnvVar: \"BAO_TOKEN\",\n        namespaceEnvVar: \"BAO_NAMESPACE\",\n        errorPrefix: \"OpenBao\",\n      },\n      options\n    );\n  }\n}\n"],
+  "mappings": "AAKA,SAAS,+BAA+B;AAMjC,MAAM,wBAAwB,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ3D,YAAY,UAAU,CAAC,GAAG;AACxB;AAAA,MACE;AAAA,QACE,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,iBAAiB;AAAA,QACjB,aAAa;AAAA,MACf;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/esm/providers/vault-base.js

@@ -0,0 +1,75 @@
+class VaultCompatibleProvider {
+  /**
+   * @param {object} config
+   * @param {string} config.prefix - Provider prefix (e.g., "VAULT", "OPENBAO")
+   * @param {string} config.addrEnvVar - Environment variable for address
+   * @param {string} config.tokenEnvVar - Environment variable for token
+   * @param {string} config.namespaceEnvVar - Environment variable for namespace
+   * @param {string} config.errorPrefix - Prefix for error messages
+   * @param {object} options - User options
+   * @param {string=} options.addr - Server address
+   * @param {string=} options.token - Auth token
+   * @param {string=} options.namespace - Namespace
+   * @param {number=} options.timeout - Request timeout in ms (default: 30000)
+   */
+  constructor(config, options = {}) {
+    this.prefix = config.prefix;
+    this.errorPrefix = config.errorPrefix;
+    this.addr = options.addr ?? process.env[config.addrEnvVar] ?? "http://127.0.0.1:8200";
+    this.token = options.token ?? process.env[config.tokenEnvVar];
+    this.namespace = options.namespace ?? process.env[config.namespaceEnvVar];
+    this.timeout = options.timeout ?? 3e4;
+    this.tokenEnvVar = config.tokenEnvVar;
+  }
+  /**
+   * Fetch a secret value
+   * @param {string} key - Secret path, optionally with field: "secret/data/myapp#password"
+   * @returns {Promise<string>}
+   */
+  async fetch(key) {
+    const [path, field] = key.split("#");
+    const url = `${this.addr}/v1/${path}`;
+    const headers = {
+      "X-Vault-Token": this.token
+    };
+    if (this.namespace) {
+      headers["X-Vault-Namespace"] = this.namespace;
+    }
+    const response = await fetch(url, {
+      headers,
+      signal: AbortSignal.timeout(this.timeout)
+    });
+    if (response.status === 404) {
+      const err = new Error(`Secret not found: ${key}`);
+      err.code = "NOT_FOUND";
+      throw err;
+    }
+    if (!response.ok) {
+      throw new Error(`${this.errorPrefix} error: ${response.status} ${response.statusText}`);
+    }
+    const data = await response.json();
+    const secretData = data.data?.data ?? data.data;
+    if (field) {
+      return String(secretData?.[field] ?? "");
+    }
+    if (typeof secretData === "object" && secretData !== null) {
+      const values = Object.values(secretData);
+      if (values.length === 1) return String(values[0]);
+      return JSON.stringify(secretData);
+    }
+    return String(secretData ?? "");
+  }
+  /**
+   * Validate provider configuration
+   * @returns {Promise<void>}
+   */
+  async validate() {
+    if (!this.token) {
+      throw new Error(`${this.tokenEnvVar} is required`);
+    }
+  }
+}
+export {
+  VaultCompatibleProvider
+};
+//# sourceMappingURL=vault-base.js.map

package/dist/esm/providers/vault-base.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/providers/vault-base.js"],
+  "sourcesContent": ["/**\n * Base class for Vault-compatible secret providers (Vault, OpenBao)\n * Both use the same HTTP API, differing only in environment variables and naming.\n */\n\n/**\n * @class VaultCompatibleProvider\n * @property {string} prefix - Provider prefix\n */\nexport class VaultCompatibleProvider {\n  /**\n   * @param {object} config\n   * @param {string} config.prefix - Provider prefix (e.g., \"VAULT\", \"OPENBAO\")\n   * @param {string} config.addrEnvVar - Environment variable for address\n   * @param {string} config.tokenEnvVar - Environment variable for token\n   * @param {string} config.namespaceEnvVar - Environment variable for namespace\n   * @param {string} config.errorPrefix - Prefix for error messages\n   * @param {object} options - User options\n   * @param {string=} options.addr - Server address\n   * @param {string=} options.token - Auth token\n   * @param {string=} options.namespace - Namespace\n   * @param {number=} options.timeout - Request timeout in ms (default: 30000)\n   */\n  constructor(config, options = {}) {\n    this.prefix = config.prefix;\n    this.errorPrefix = config.errorPrefix;\n    this.addr = options.addr ?? process.env[config.addrEnvVar] ?? \"http://127.0.0.1:8200\";\n    this.token = options.token ?? process.env[config.tokenEnvVar];\n    this.namespace = options.namespace ?? process.env[config.namespaceEnvVar];\n    this.timeout = options.timeout ?? 30000;\n    this.tokenEnvVar = config.tokenEnvVar;\n  }\n\n  /**\n   * Fetch a secret value\n   * @param {string} key - Secret path, optionally with field: \"secret/data/myapp#password\"\n   * @returns {Promise<string>}\n   */\n  async fetch(key) {\n    const [path, field] = key.split(\"#\");\n\n    const url = `${this.addr}/v1/${path}`;\n    const headers = {\n      \"X-Vault-Token\": this.token,\n    };\n    if (this.namespace) {\n      headers[\"X-Vault-Namespace\"] = this.namespace;\n    }\n\n    const response = await fetch(url, {\n      headers,\n      signal: AbortSignal.timeout(this.timeout),\n    });\n\n    if (response.status === 404) {\n      const err = new Error(`Secret not found: ${key}`);\n      err.code = \"NOT_FOUND\";\n      throw err;\n    }\n\n    if (!response.ok) {\n      throw new Error(`${this.errorPrefix} error: ${response.status} ${response.statusText}`);\n    }\n\n    const data = await response.json();\n\n    // KV v2 returns data.data.data, KV v1 returns data.data\n    const secretData = data.data?.data ?? data.data;\n\n    if (field) {\n      return String(secretData?.[field] ?? \"\");\n    }\n\n    if (typeof secretData === \"object\" && secretData !== null) {\n      const values = Object.values(secretData);\n      if (values.length === 1) return String(values[0]);\n      return JSON.stringify(secretData);\n    }\n\n    return String(secretData ?? \"\");\n  }\n\n  /**\n   * Validate provider configuration\n   * @returns {Promise<void>}\n   */\n  async validate() {\n    if (!this.token) {\n      throw new Error(`${this.tokenEnvVar} is required`);\n    }\n  }\n}\n"],
+  "mappings": "AASO,MAAM,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcnC,YAAY,QAAQ,UAAU,CAAC,GAAG;AAChC,SAAK,SAAS,OAAO;AACrB,SAAK,cAAc,OAAO;AAC1B,SAAK,OAAO,QAAQ,QAAQ,QAAQ,IAAI,OAAO,UAAU,KAAK;AAC9D,SAAK,QAAQ,QAAQ,SAAS,QAAQ,IAAI,OAAO,WAAW;AAC5D,SAAK,YAAY,QAAQ,aAAa,QAAQ,IAAI,OAAO,eAAe;AACxE,SAAK,UAAU,QAAQ,WAAW;AAClC,SAAK,cAAc,OAAO;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAAM,KAAK;AACf,UAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,GAAG;AAEnC,UAAM,MAAM,GAAG,KAAK,IAAI,OAAO,IAAI;AACnC,UAAM,UAAU;AAAA,MACd,iBAAiB,KAAK;AAAA,IACxB;AACA,QAAI,KAAK,WAAW;AAClB,cAAQ,mBAAmB,IAAI,KAAK;AAAA,IACtC;AAEA,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAChC;AAAA,MACA,QAAQ,YAAY,QAAQ,KAAK,OAAO;AAAA,IAC1C,CAAC;AAED,QAAI,SAAS,WAAW,KAAK;AAC3B,YAAM,MAAM,IAAI,MAAM,qBAAqB,GAAG,EAAE;AAChD,UAAI,OAAO;AACX,YAAM;AAAA,IACR;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,GAAG,KAAK,WAAW,WAAW,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAAA,IACxF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AAGjC,UAAM,aAAa,KAAK,MAAM,QAAQ,KAAK;AAE3C,QAAI,OAAO;AACT,aAAO,OAAO,aAAa,KAAK,KAAK,EAAE;AAAA,IACzC;AAEA,QAAI,OAAO,eAAe,YAAY,eAAe,MAAM;AACzD,YAAM,SAAS,OAAO,OAAO,UAAU;AACvC,UAAI,OAAO,WAAW,EAAG,QAAO,OAAO,OAAO,CAAC,CAAC;AAChD,aAAO,KAAK,UAAU,UAAU;AAAA,IAClC;AAEA,WAAO,OAAO,cAAc,EAAE;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW;AACf,QAAI,CAAC,KAAK,OAAO;AACf,YAAM,IAAI,MAAM,GAAG,KAAK,WAAW,cAAc;AAAA,IACnD;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/esm/providers/vault.js

@@ -0,0 +1,26 @@
+import { VaultCompatibleProvider } from "./vault-base.js";
+class VaultProvider extends VaultCompatibleProvider {
+  /**
+   * @param {object} options
+   * @param {string=} options.addr - Vault address (default: process.env.VAULT_ADDR or "http://127.0.0.1:8200")
+   * @param {string=} options.token - Vault token (default: process.env.VAULT_TOKEN)
+   * @param {string=} options.namespace - Vault namespace (default: process.env.VAULT_NAMESPACE)
+   * @param {number=} options.timeout - Request timeout in ms (default: 30000)
+   */
+  constructor(options = {}) {
+    super(
+      {
+        prefix: "VAULT",
+        addrEnvVar: "VAULT_ADDR",
+        tokenEnvVar: "VAULT_TOKEN",
+        namespaceEnvVar: "VAULT_NAMESPACE",
+        errorPrefix: "Vault"
+      },
+      options
+    );
+  }
+}
+export {
+  VaultProvider
+};
+//# sourceMappingURL=vault.js.map