@aprovan/node 0.1.0 → 0.1.1-dev.53db668

package/dist/chunk-XZEPXBX5.js

@@ -0,0 +1,326 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/index.ts
+import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
+
+// src/dotenv.ts
+var dotenv_exports = {};
+__export(dotenv_exports, {
+  config: () => config,
+  decrypt: () => decrypt,
+  parse: () => parse,
+  populate: () => populate
+});
+import fs from "fs";
+import path from "path";
+import os from "os";
+import crypto from "crypto";
+var createError = (message, code) => {
+  const err = new Error(message);
+  err.code = code;
+  return err;
+};
+var parseBoolean = (value) => typeof value === "string" ? !["false", "0", "no", "off", ""].includes(value.toLowerCase()) : Boolean(value);
+var supportsAnsi = () => process.stdout.isTTY;
+var dim = (text) => supportsAnsi() ? `\x1B[2m${text}\x1B[0m` : text;
+var log = (msg) => console.log(`[dotenv] ${msg}`);
+var debug = (msg) => console.debug(`[dotenv:debug] ${msg}`);
+var warn = (msg) => console.warn(`[dotenv:warn] ${msg}`);
+var resolveHome = (envPath) => envPath.startsWith("~") ? path.join(os.homedir(), envPath.slice(1)) : envPath;
+var LINE_REGEX = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/gm;
+var parse = (src) => {
+  const lines = src.toString().replace(/\r\n?/gm, "\n");
+  const result = {};
+  let match;
+  while ((match = LINE_REGEX.exec(lines)) !== null) {
+    const key = match[1];
+    if (!key) continue;
+    let value = (match[2] ?? "").trim();
+    const quote = value[0];
+    value = value.replace(/^(['"`])([\s\S]*)\1$/gm, "$2");
+    if (quote === '"') {
+      value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r");
+    }
+    result[key] = value;
+  }
+  return result;
+};
+var decrypt = (encrypted, keyStr) => {
+  const key = Buffer.from(keyStr.slice(-64), "hex");
+  const cipherBuffer = Buffer.from(encrypted, "base64");
+  const nonce = cipherBuffer.subarray(0, 12);
+  const authTag = cipherBuffer.subarray(-16);
+  const ciphertext = cipherBuffer.subarray(12, -16);
+  try {
+    const decipher = crypto.createDecipheriv("aes-256-gcm", key, nonce);
+    decipher.setAuthTag(authTag);
+    return decipher.update(ciphertext).toString() + decipher.final().toString();
+  } catch (error) {
+    const err = error;
+    const isRange = error instanceof RangeError;
+    const invalidKeyLength = err.message === "Invalid key length";
+    const decryptionFailed = err.message === "Unsupported state or unable to authenticate data";
+    if (isRange || invalidKeyLength) {
+      throw createError(
+        "INVALID_DOTENV_KEY: It must be 64 characters long (or more)",
+        "INVALID_DOTENV_KEY"
+      );
+    }
+    if (decryptionFailed) {
+      throw createError(
+        "DECRYPTION_FAILED: Please check your DOTENV_KEY",
+        "DECRYPTION_FAILED"
+      );
+    }
+    throw error;
+  }
+};
+var populate = (target, source, options = {}) => {
+  const { debug: showDebug = false, override = false } = options;
+  const populated = {};
+  if (typeof source !== "object" || source === null) {
+    throw createError(
+      "OBJECT_REQUIRED: Please check the argument being passed to populate",
+      "OBJECT_REQUIRED"
+    );
+  }
+  for (const [key, value] of Object.entries(source)) {
+    const exists = Object.prototype.hasOwnProperty.call(target, key);
+    if (exists && !override) {
+      if (showDebug) debug(`"${key}" already defined, not overwritten`);
+      continue;
+    }
+    if (exists && showDebug) {
+      debug(`"${key}" already defined, overwritten`);
+    }
+    target[key] = value;
+    populated[key] = value;
+  }
+  return populated;
+};
+var getDotenvKey = (options) => options?.DOTENV_KEY || process.env["DOTENV_KEY"] || "";
+var findVaultPath = (options) => {
+  const toVaultPath = (p) => p.endsWith(".vault") ? p : `${p}.vault`;
+  if (options?.path) {
+    const paths = Array.isArray(options.path) ? options.path : [options.path];
+    const found = paths.find((p) => fs.existsSync(p));
+    if (found) {
+      const vaultPath = toVaultPath(found);
+      return fs.existsSync(vaultPath) ? vaultPath : null;
+    }
+  }
+  const defaultPath = path.resolve(process.cwd(), ".env.vault");
+  return fs.existsSync(defaultPath) ? defaultPath : null;
+};
+var parseVaultKey = (dotenvKey, parsed) => {
+  let uri;
+  try {
+    uri = new URL(dotenvKey);
+  } catch (error) {
+    const err = error;
+    if (err.code === "ERR_INVALID_URL") {
+      throw createError(
+        "INVALID_DOTENV_KEY: Wrong format. Must be valid URI like dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=development",
+        "INVALID_DOTENV_KEY"
+      );
+    }
+    throw error;
+  }
+  const key = uri.password;
+  if (!key) {
+    throw createError(
+      "INVALID_DOTENV_KEY: Missing key part",
+      "INVALID_DOTENV_KEY"
+    );
+  }
+  const environment = uri.searchParams.get("environment");
+  if (!environment) {
+    throw createError(
+      "INVALID_DOTENV_KEY: Missing environment part",
+      "INVALID_DOTENV_KEY"
+    );
+  }
+  const envKey = `DOTENV_VAULT_${environment.toUpperCase()}`;
+  const ciphertext = parsed[envKey];
+  if (!ciphertext) {
+    throw createError(
+      `NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate ${envKey} in .env.vault`,
+      "NOT_FOUND_DOTENV_ENVIRONMENT"
+    );
+  }
+  return { ciphertext, key };
+};
+var parseVault = (options) => {
+  const vaultPath = findVaultPath(options);
+  const vaultResult = configDotenv({
+    ...options,
+    path: vaultPath ?? void 0
+  });
+  if (!vaultResult.parsed || Object.keys(vaultResult.parsed).length === 0) {
+    throw createError(
+      `MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`,
+      "MISSING_DATA"
+    );
+  }
+  const keys = getDotenvKey(options).split(",");
+  let lastError = null;
+  for (const rawKey of keys) {
+    try {
+      const { ciphertext, key } = parseVaultKey(
+        rawKey.trim(),
+        vaultResult.parsed
+      );
+      return parse(decrypt(ciphertext, key));
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  throw lastError ?? createError("DECRYPTION_FAILED", "DECRYPTION_FAILED");
+};
+var configVault = (options) => {
+  const showDebug = parseBoolean(
+    process.env["DOTENV_CONFIG_DEBUG"] ?? options.debug
+  );
+  const quiet = parseBoolean(
+    process.env["DOTENV_CONFIG_QUIET"] ?? options.quiet
+  );
+  if (showDebug || !quiet) {
+    log("Loading env from encrypted .env.vault");
+  }
+  const parsed = parseVault(options);
+  const target = options.processEnv ?? process.env;
+  populate(target, parsed, options);
+  return { parsed };
+};
+var configDotenv = (options) => {
+  const target = options?.processEnv ?? process.env;
+  const encoding = options?.encoding ?? "utf8";
+  let showDebug = parseBoolean(
+    target["DOTENV_CONFIG_DEBUG"] ?? options?.debug ?? false
+  );
+  let quiet = parseBoolean(
+    target["DOTENV_CONFIG_QUIET"] ?? options?.quiet ?? false
+  );
+  const defaultPath = path.resolve(process.cwd(), ".env");
+  const paths = options?.path ? (Array.isArray(options.path) ? options.path : [options.path]).map(
+    resolveHome
+  ) : [defaultPath];
+  const parsedAll = {};
+  let lastError;
+  for (const filePath of paths) {
+    try {
+      const content = fs.readFileSync(filePath, { encoding });
+      const parsed = parse(content);
+      populate(parsedAll, parsed, options);
+    } catch (e) {
+      if (showDebug)
+        debug(`Failed to load ${filePath}: ${e.message}`);
+      lastError = e;
+    }
+  }
+  const populated = populate(target, parsedAll, options);
+  showDebug = parseBoolean(target["DOTENV_CONFIG_DEBUG"] ?? showDebug);
+  quiet = parseBoolean(target["DOTENV_CONFIG_QUIET"] ?? quiet);
+  if (showDebug || !quiet) {
+    const count = Object.keys(populated).length;
+    const shortPaths = paths.map((p) => {
+      try {
+        return path.relative(process.cwd(), p);
+      } catch {
+        return p;
+      }
+    }).join(", ");
+    log(
+      `injected ${count} env var(s) from ${shortPaths} ${dim(
+        "-- tip: set DOTENV_CONFIG_QUIET=true to silence"
+      )}`
+    );
+  }
+  return lastError ? { parsed: parsedAll, error: lastError } : { parsed: parsedAll };
+};
+var config = (options) => {
+  const dotenvKey = getDotenvKey(options);
+  if (!dotenvKey) {
+    return configDotenv(options);
+  }
+  const vaultPath = findVaultPath(options);
+  if (!vaultPath) {
+    warn(
+      `DOTENV_KEY is set but .env.vault file not found. Did you forget to build it?`
+    );
+    return configDotenv(options);
+  }
+  return configVault(options ?? {});
+};
+
+// src/index.ts
+var aprovanEnvParameterName = (environment = "prd") => `/aprovan/${environment}/env`;
+async function getAprovanEnv(environment = "prd", client = new SSMClient({})) {
+  const response = await client.send(
+    new GetParameterCommand({
+      Name: aprovanEnvParameterName(environment),
+      WithDecryption: true
+    })
+  );
+  const raw = response.Parameter?.Value;
+  if (raw === void 0) {
+    throw new Error(`Aprovan environment parameter ${environment} has no value`);
+  }
+  return { raw, values: parse(raw) };
+}
+async function loadAprovanEnv(environment = "prd", options = { overwrite: true }) {
+  const { values } = await getAprovanEnv(environment, options.client);
+  for (const [key, value] of Object.entries(values)) {
+    if (options.overwrite !== false || process.env[key] === void 0) {
+      process.env[key] = value;
+    }
+  }
+  return values;
+}
+
+export {
+  dotenv_exports,
+  aprovanEnvParameterName,
+  getAprovanEnv,
+  loadAprovanEnv
+};
+/**
+ * Dotenv - Load environment variables from .env files
+ *
+ * Adapted from dotenv by motdotla
+ * @see https://github.com/motdotla/dotenv/blob/master/lib/main.js
+ * @license BSD-2-Clause
+ *
+ * @example
+ * // Basic usage - loads from .env in current directory
+ * import { config } from './dotenv';
+ * config();
+ *
+ * @example
+ * // Custom path
+ * config({ path: '/custom/path/.env' });
+ *
+ * @example
+ * // Multiple files (loaded in order, later values don't override)
+ * config({ path: ['.env.local', '.env'] });
+ *
+ * @example
+ * // Override existing env vars
+ * config({ override: true });
+ *
+ * @example
+ * // Encrypted vault (requires DOTENV_KEY env var)
+ * // Automatically loads from .env.vault when DOTENV_KEY is set
+ * config();
+ *
+ * @example
+ * // Parse a string directly
+ * import { parse } from './dotenv';
+ * const env = parse('FOO=bar\nBAZ=qux');
+ * // => { FOO: 'bar', BAZ: 'qux' }
+ */
+//# sourceMappingURL=chunk-XZEPXBX5.js.map

package/dist/chunk-XZEPXBX5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/dotenv.ts"],"sourcesContent":["import { GetParameterCommand, SSMClient } from \"@aws-sdk/client-ssm\";\nimport * as dotenv from './dotenv';\n\nexport const aprovanEnvParameterName = (environment = \"prd\"): string =>\n  `/aprovan/${environment}/env`;\n\nexport interface LoadAprovanEnvOptions {\n  client?: SSMClient;\n  overwrite?: boolean;\n}\n\nexport async function getAprovanEnv(\n  environment = \"prd\",\n  client = new SSMClient({}),\n): Promise<{ raw: string; values: Record<string, string> }> {\n  const response = await client.send(\n    new GetParameterCommand({\n      Name: aprovanEnvParameterName(environment),\n      WithDecryption: true,\n    }),\n  );\n  const raw = response.Parameter?.Value;\n  if (raw === undefined) {\n    throw new Error(`Aprovan environment parameter ${environment} has no value`);\n  }\n  return { raw, values: dotenv.parse(raw) };\n}\n\nexport async function loadAprovanEnv(\n  environment = \"prd\",\n  options: LoadAprovanEnvOptions = { overwrite: true },\n): Promise<Record<string, string>> {\n  const { values } = await getAprovanEnv(environment, options.client);\n  for (const [key, value] of Object.entries(values)) {\n    if (options.overwrite !== false || process.env[key] === undefined) {\n      process.env[key] = value;\n    }\n  }\n  return values;\n}\n\nexport { dotenv };\n","/**\n * Dotenv - Load environment variables from .env files\n *\n * Adapted from dotenv by motdotla\n * @see https://github.com/motdotla/dotenv/blob/master/lib/main.js\n * @license BSD-2-Clause\n *\n * @example\n * // Basic usage - loads from .env in current directory\n * import { config } from './dotenv';\n * config();\n *\n * @example\n * // Custom path\n * config({ path: '/custom/path/.env' });\n *\n * @example\n * // Multiple files (loaded in order, later values don't override)\n * config({ path: ['.env.local', '.env'] });\n *\n * @example\n * // Override existing env vars\n * config({ override: true });\n *\n * @example\n * // Encrypted vault (requires DOTENV_KEY env var)\n * // Automatically loads from .env.vault when DOTENV_KEY is set\n * config();\n *\n * @example\n * // Parse a string directly\n * import { parse } from './dotenv';\n * const env = parse('FOO=bar\\nBAZ=qux');\n * // => { FOO: 'bar', BAZ: 'qux' }\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport os from 'os';\nimport crypto from 'crypto';\n\ntype EnvRecord = Record<string, string>;\ntype ProcessEnv = NodeJS.ProcessEnv | EnvRecord;\n\ninterface DotenvError extends Error {\n  code: string;\n}\n\ninterface DotenvOptions {\n  path?: string | string[];\n  encoding?: BufferEncoding;\n  debug?: boolean;\n  quiet?: boolean;\n  override?: boolean;\n  processEnv?: ProcessEnv;\n  DOTENV_KEY?: string;\n}\n\ninterface DotenvResult {\n  parsed: EnvRecord;\n  error?: Error;\n}\n\nconst createError = (message: string, code: string): DotenvError => {\n  const err = new Error(message) as DotenvError;\n  err.code = code;\n  return err;\n};\n\nconst parseBoolean = (value: unknown): boolean =>\n  typeof value === 'string'\n    ? !['false', '0', 'no', 'off', ''].includes(value.toLowerCase())\n    : Boolean(value);\n\nconst supportsAnsi = (): boolean => process.stdout.isTTY;\n\nconst dim = (text: string): string =>\n  supportsAnsi() ? `\\x1b[2m${text}\\x1b[0m` : text;\n\nconst log = (msg: string): void => console.log(`[dotenv] ${msg}`);\nconst debug = (msg: string): void => console.debug(`[dotenv:debug] ${msg}`);\nconst warn = (msg: string): void => console.warn(`[dotenv:warn] ${msg}`);\n\nconst resolveHome = (envPath: string): string =>\n  envPath.startsWith('~') ? path.join(os.homedir(), envPath.slice(1)) : envPath;\n\nconst LINE_REGEX =\n  /(?:^|^)\\s*(?:export\\s+)?([\\w.-]+)(?:\\s*=\\s*?|:\\s+?)(\\s*'(?:\\\\'|[^'])*'|\\s*\"(?:\\\\\"|[^\"])*\"|\\s*`(?:\\\\`|[^`])*`|[^#\\r\\n]+)?\\s*(?:#.*)?(?:$|$)/gm;\n\nconst parse = (src: string | Buffer): EnvRecord => {\n  const lines = src.toString().replace(/\\r\\n?/gm, '\\n');\n  const result: EnvRecord = {};\n  let match: RegExpExecArray | null;\n\n  while ((match = LINE_REGEX.exec(lines)) !== null) {\n    const key = match[1];\n    if (!key) continue;\n\n    let value = (match[2] ?? '').trim();\n    const quote = value[0];\n\n    // Remove surrounding quotes\n    value = value.replace(/^(['\"`])([\\s\\S]*)\\1$/gm, '$2');\n\n    // Expand escape sequences for double-quoted strings\n    if (quote === '\"') {\n      value = value.replace(/\\\\n/g, '\\n').replace(/\\\\r/g, '\\r');\n    }\n\n    result[key] = value;\n  }\n\n  return result;\n};\n\nconst decrypt = (encrypted: string, keyStr: string): string => {\n  const key = Buffer.from(keyStr.slice(-64), 'hex');\n  const cipherBuffer = Buffer.from(encrypted, 'base64');\n\n  const nonce = cipherBuffer.subarray(0, 12);\n  const authTag = cipherBuffer.subarray(-16);\n  const ciphertext = cipherBuffer.subarray(12, -16);\n\n  try {\n    const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonce);\n    decipher.setAuthTag(authTag);\n    return decipher.update(ciphertext).toString() + decipher.final().toString();\n  } catch (error) {\n    const err = error as Error;\n    const isRange = error instanceof RangeError;\n    const invalidKeyLength = err.message === 'Invalid key length';\n    const decryptionFailed =\n      err.message === 'Unsupported state or unable to authenticate data';\n\n    if (isRange || invalidKeyLength) {\n      throw createError(\n        'INVALID_DOTENV_KEY: It must be 64 characters long (or more)',\n        'INVALID_DOTENV_KEY',\n      );\n    }\n    if (decryptionFailed) {\n      throw createError(\n        'DECRYPTION_FAILED: Please check your DOTENV_KEY',\n        'DECRYPTION_FAILED',\n      );\n    }\n    throw error;\n  }\n};\n\nconst populate = (\n  target: ProcessEnv,\n  source: EnvRecord,\n  options: Pick<DotenvOptions, 'debug' | 'override'> = {},\n): EnvRecord => {\n  const { debug: showDebug = false, override = false } = options;\n  const populated: EnvRecord = {};\n\n  if (typeof source !== 'object' || source === null) {\n    throw createError(\n      'OBJECT_REQUIRED: Please check the argument being passed to populate',\n      'OBJECT_REQUIRED',\n    );\n  }\n\n  for (const [key, value] of Object.entries(source)) {\n    const exists = Object.prototype.hasOwnProperty.call(target, key);\n\n    if (exists && !override) {\n      if (showDebug) debug(`\"${key}\" already defined, not overwritten`);\n      continue;\n    }\n\n    if (exists && showDebug) {\n      debug(`\"${key}\" already defined, overwritten`);\n    }\n\n    target[key] = value;\n    populated[key] = value;\n  }\n\n  return populated;\n};\n\nconst getDotenvKey = (options?: DotenvOptions): string =>\n  options?.DOTENV_KEY || process.env['DOTENV_KEY'] || '';\n\nconst findVaultPath = (options?: DotenvOptions): string | null => {\n  const toVaultPath = (p: string): string =>\n    p.endsWith('.vault') ? p : `${p}.vault`;\n\n  if (options?.path) {\n    const paths = Array.isArray(options.path) ? options.path : [options.path];\n    const found = paths.find((p) => fs.existsSync(p));\n    if (found) {\n      const vaultPath = toVaultPath(found);\n      return fs.existsSync(vaultPath) ? vaultPath : null;\n    }\n  }\n\n  const defaultPath = path.resolve(process.cwd(), '.env.vault');\n  return fs.existsSync(defaultPath) ? defaultPath : null;\n};\n\nconst parseVaultKey = (\n  dotenvKey: string,\n  parsed: EnvRecord,\n): { ciphertext: string; key: string } => {\n  let uri: URL;\n  try {\n    uri = new URL(dotenvKey);\n  } catch (error) {\n    const err = error as NodeJS.ErrnoException;\n    if (err.code === 'ERR_INVALID_URL') {\n      throw createError(\n        'INVALID_DOTENV_KEY: Wrong format. Must be valid URI like dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=development',\n        'INVALID_DOTENV_KEY',\n      );\n    }\n    throw error;\n  }\n\n  const key = uri.password;\n  if (!key) {\n    throw createError(\n      'INVALID_DOTENV_KEY: Missing key part',\n      'INVALID_DOTENV_KEY',\n    );\n  }\n\n  const environment = uri.searchParams.get('environment');\n  if (!environment) {\n    throw createError(\n      'INVALID_DOTENV_KEY: Missing environment part',\n      'INVALID_DOTENV_KEY',\n    );\n  }\n\n  const envKey = `DOTENV_VAULT_${environment.toUpperCase()}`;\n  const ciphertext = parsed[envKey];\n  if (!ciphertext) {\n    throw createError(\n      `NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate ${envKey} in .env.vault`,\n      'NOT_FOUND_DOTENV_ENVIRONMENT',\n    );\n  }\n\n  return { ciphertext, key };\n};\n\nconst parseVault = (options: DotenvOptions): EnvRecord => {\n  const vaultPath = findVaultPath(options);\n  const vaultResult = configDotenv({\n    ...options,\n    path: vaultPath ?? undefined,\n  });\n\n  if (!vaultResult.parsed || Object.keys(vaultResult.parsed).length === 0) {\n    throw createError(\n      `MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`,\n      'MISSING_DATA',\n    );\n  }\n\n  const keys = getDotenvKey(options).split(',');\n  let lastError: Error | null = null;\n\n  for (const rawKey of keys) {\n    try {\n      const { ciphertext, key } = parseVaultKey(\n        rawKey.trim(),\n        vaultResult.parsed,\n      );\n      return parse(decrypt(ciphertext, key));\n    } catch (error) {\n      lastError = error as Error;\n    }\n  }\n\n  throw lastError ?? createError('DECRYPTION_FAILED', 'DECRYPTION_FAILED');\n};\n\nconst configVault = (options: DotenvOptions): DotenvResult => {\n  const showDebug = parseBoolean(\n    process.env['DOTENV_CONFIG_DEBUG'] ?? options.debug,\n  );\n  const quiet = parseBoolean(\n    process.env['DOTENV_CONFIG_QUIET'] ?? options.quiet,\n  );\n\n  if (showDebug || !quiet) {\n    log('Loading env from encrypted .env.vault');\n  }\n\n  const parsed = parseVault(options);\n  const target = options.processEnv ?? process.env;\n  populate(target, parsed, options);\n\n  return { parsed };\n};\n\nconst configDotenv = (options?: DotenvOptions): DotenvResult => {\n  const target = options?.processEnv ?? process.env;\n  const encoding: BufferEncoding = options?.encoding ?? 'utf8';\n  let showDebug = parseBoolean(\n    target['DOTENV_CONFIG_DEBUG'] ?? options?.debug ?? false,\n  );\n  let quiet = parseBoolean(\n    target['DOTENV_CONFIG_QUIET'] ?? options?.quiet ?? false,\n  );\n\n  const defaultPath = path.resolve(process.cwd(), '.env');\n  const paths = options?.path\n    ? (Array.isArray(options.path) ? options.path : [options.path]).map(\n        resolveHome,\n      )\n    : [defaultPath];\n\n  const parsedAll: EnvRecord = {};\n  let lastError: Error | undefined;\n\n  for (const filePath of paths) {\n    try {\n      const content = fs.readFileSync(filePath, { encoding });\n      const parsed = parse(content);\n      populate(parsedAll, parsed, options);\n    } catch (e) {\n      if (showDebug)\n        debug(`Failed to load ${filePath}: ${(e as Error).message}`);\n      lastError = e as Error;\n    }\n  }\n\n  const populated = populate(target, parsedAll, options);\n\n  // Re-check settings from loaded .env\n  showDebug = parseBoolean(target['DOTENV_CONFIG_DEBUG'] ?? showDebug);\n  quiet = parseBoolean(target['DOTENV_CONFIG_QUIET'] ?? quiet);\n\n  if (showDebug || !quiet) {\n    const count = Object.keys(populated).length;\n    const shortPaths = paths\n      .map((p) => {\n        try {\n          return path.relative(process.cwd(), p);\n        } catch {\n          return p;\n        }\n      })\n      .join(', ');\n    log(\n      `injected ${count} env var(s) from ${shortPaths} ${dim(\n        '-- tip: set DOTENV_CONFIG_QUIET=true to silence',\n      )}`,\n    );\n  }\n\n  return lastError\n    ? { parsed: parsedAll, error: lastError }\n    : { parsed: parsedAll };\n};\n\n/** Load environment variables from .env file(s) */\nexport const config = (options?: DotenvOptions): DotenvResult => {\n  const dotenvKey = getDotenvKey(options);\n\n  if (!dotenvKey) {\n    return configDotenv(options);\n  }\n\n  const vaultPath = findVaultPath(options);\n  if (!vaultPath) {\n    warn(\n      `DOTENV_KEY is set but .env.vault file not found. Did you forget to build it?`,\n    );\n    return configDotenv(options);\n  }\n\n  return configVault(options ?? {});\n};\n\nexport { parse, populate, decrypt };\n"],"mappings":";;;;;;;AAAA,SAAS,qBAAqB,iBAAiB;;;ACA/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoCA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,OAAO,QAAQ;AACf,OAAO,YAAY;AAwBnB,IAAM,cAAc,CAAC,SAAiB,SAA8B;AAClE,QAAM,MAAM,IAAI,MAAM,OAAO;AAC7B,MAAI,OAAO;AACX,SAAO;AACT;AAEA,IAAM,eAAe,CAAC,UACpB,OAAO,UAAU,WACb,CAAC,CAAC,SAAS,KAAK,MAAM,OAAO,EAAE,EAAE,SAAS,MAAM,YAAY,CAAC,IAC7D,QAAQ,KAAK;AAEnB,IAAM,eAAe,MAAe,QAAQ,OAAO;AAEnD,IAAM,MAAM,CAAC,SACX,aAAa,IAAI,UAAU,IAAI,YAAY;AAE7C,IAAM,MAAM,CAAC,QAAsB,QAAQ,IAAI,YAAY,GAAG,EAAE;AAChE,IAAM,QAAQ,CAAC,QAAsB,QAAQ,MAAM,kBAAkB,GAAG,EAAE;AAC1E,IAAM,OAAO,CAAC,QAAsB,QAAQ,KAAK,iBAAiB,GAAG,EAAE;AAEvE,IAAM,cAAc,CAAC,YACnB,QAAQ,WAAW,GAAG,IAAI,KAAK,KAAK,GAAG,QAAQ,GAAG,QAAQ,MAAM,CAAC,CAAC,IAAI;AAExE,IAAM,aACJ;AAEF,IAAM,QAAQ,CAAC,QAAoC;AACjD,QAAM,QAAQ,IAAI,SAAS,EAAE,QAAQ,WAAW,IAAI;AACpD,QAAM,SAAoB,CAAC;AAC3B,MAAI;AAEJ,UAAQ,QAAQ,WAAW,KAAK,KAAK,OAAO,MAAM;AAChD,UAAM,MAAM,MAAM,CAAC;AACnB,QAAI,CAAC,IAAK;AAEV,QAAI,SAAS,MAAM,CAAC,KAAK,IAAI,KAAK;AAClC,UAAM,QAAQ,MAAM,CAAC;AAGrB,YAAQ,MAAM,QAAQ,0BAA0B,IAAI;AAGpD,QAAI,UAAU,KAAK;AACjB,cAAQ,MAAM,QAAQ,QAAQ,IAAI,EAAE,QAAQ,QAAQ,IAAI;AAAA,IAC1D;AAEA,WAAO,GAAG,IAAI;AAAA,EAChB;AAEA,SAAO;AACT;AAEA,IAAM,UAAU,CAAC,WAAmB,WAA2B;AAC7D,QAAM,MAAM,OAAO,KAAK,OAAO,MAAM,GAAG,GAAG,KAAK;AAChD,QAAM,eAAe,OAAO,KAAK,WAAW,QAAQ;AAEpD,QAAM,QAAQ,aAAa,SAAS,GAAG,EAAE;AACzC,QAAM,UAAU,aAAa,SAAS,GAAG;AACzC,QAAM,aAAa,aAAa,SAAS,IAAI,GAAG;AAEhD,MAAI;AACF,UAAM,WAAW,OAAO,iBAAiB,eAAe,KAAK,KAAK;AAClE,aAAS,WAAW,OAAO;AAC3B,WAAO,SAAS,OAAO,UAAU,EAAE,SAAS,IAAI,SAAS,MAAM,EAAE,SAAS;AAAA,EAC5E,SAAS,OAAO;AACd,UAAM,MAAM;AACZ,UAAM,UAAU,iBAAiB;AACjC,UAAM,mBAAmB,IAAI,YAAY;AACzC,UAAM,mBACJ,IAAI,YAAY;AAElB,QAAI,WAAW,kBAAkB;AAC/B,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,kBAAkB;AACpB,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEA,IAAM,WAAW,CACf,QACA,QACA,UAAqD,CAAC,MACxC;AACd,QAAM,EAAE,OAAO,YAAY,OAAO,WAAW,MAAM,IAAI;AACvD,QAAM,YAAuB,CAAC;AAE9B,MAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAM,SAAS,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG;AAE/D,QAAI,UAAU,CAAC,UAAU;AACvB,UAAI,UAAW,OAAM,IAAI,GAAG,oCAAoC;AAChE;AAAA,IACF;AAEA,QAAI,UAAU,WAAW;AACvB,YAAM,IAAI,GAAG,gCAAgC;AAAA,IAC/C;AAEA,WAAO,GAAG,IAAI;AACd,cAAU,GAAG,IAAI;AAAA,EACnB;AAEA,SAAO;AACT;AAEA,IAAM,eAAe,CAAC,YACpB,SAAS,cAAc,QAAQ,IAAI,YAAY,KAAK;AAEtD,IAAM,gBAAgB,CAAC,YAA2C;AAChE,QAAM,cAAc,CAAC,MACnB,EAAE,SAAS,QAAQ,IAAI,IAAI,GAAG,CAAC;AAEjC,MAAI,SAAS,MAAM;AACjB,UAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,IAAI,QAAQ,OAAO,CAAC,QAAQ,IAAI;AACxE,UAAM,QAAQ,MAAM,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC;AAChD,QAAI,OAAO;AACT,YAAM,YAAY,YAAY,KAAK;AACnC,aAAO,GAAG,WAAW,SAAS,IAAI,YAAY;AAAA,IAChD;AAAA,EACF;AAEA,QAAM,cAAc,KAAK,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAC5D,SAAO,GAAG,WAAW,WAAW,IAAI,cAAc;AACpD;AAEA,IAAM,gBAAgB,CACpB,WACA,WACwC;AACxC,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,SAAS;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,MAAM;AACZ,QAAI,IAAI,SAAS,mBAAmB;AAClC,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAEA,QAAM,MAAM,IAAI;AAChB,MAAI,CAAC,KAAK;AACR,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,IAAI,aAAa,IAAI,aAAa;AACtD,MAAI,CAAC,aAAa;AAChB,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,gBAAgB,YAAY,YAAY,CAAC;AACxD,QAAM,aAAa,OAAO,MAAM;AAChC,MAAI,CAAC,YAAY;AACf,UAAM;AAAA,MACJ,+CAA+C,MAAM;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,YAAY,IAAI;AAC3B;AAEA,IAAM,aAAa,CAAC,YAAsC;AACxD,QAAM,YAAY,cAAc,OAAO;AACvC,QAAM,cAAc,aAAa;AAAA,IAC/B,GAAG;AAAA,IACH,MAAM,aAAa;AAAA,EACrB,CAAC;AAED,MAAI,CAAC,YAAY,UAAU,OAAO,KAAK,YAAY,MAAM,EAAE,WAAW,GAAG;AACvE,UAAM;AAAA,MACJ,8BAA8B,SAAS;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,aAAa,OAAO,EAAE,MAAM,GAAG;AAC5C,MAAI,YAA0B;AAE9B,aAAW,UAAU,MAAM;AACzB,QAAI;AACF,YAAM,EAAE,YAAY,IAAI,IAAI;AAAA,QAC1B,OAAO,KAAK;AAAA,QACZ,YAAY;AAAA,MACd;AACA,aAAO,MAAM,QAAQ,YAAY,GAAG,CAAC;AAAA,IACvC,SAAS,OAAO;AACd,kBAAY;AAAA,IACd;AAAA,EACF;AAEA,QAAM,aAAa,YAAY,qBAAqB,mBAAmB;AACzE;AAEA,IAAM,cAAc,CAAC,YAAyC;AAC5D,QAAM,YAAY;AAAA,IAChB,QAAQ,IAAI,qBAAqB,KAAK,QAAQ;AAAA,EAChD;AACA,QAAM,QAAQ;AAAA,IACZ,QAAQ,IAAI,qBAAqB,KAAK,QAAQ;AAAA,EAChD;AAEA,MAAI,aAAa,CAAC,OAAO;AACvB,QAAI,uCAAuC;AAAA,EAC7C;AAEA,QAAM,SAAS,WAAW,OAAO;AACjC,QAAM,SAAS,QAAQ,cAAc,QAAQ;AAC7C,WAAS,QAAQ,QAAQ,OAAO;AAEhC,SAAO,EAAE,OAAO;AAClB;AAEA,IAAM,eAAe,CAAC,YAA0C;AAC9D,QAAM,SAAS,SAAS,cAAc,QAAQ;AAC9C,QAAM,WAA2B,SAAS,YAAY;AACtD,MAAI,YAAY;AAAA,IACd,OAAO,qBAAqB,KAAK,SAAS,SAAS;AAAA,EACrD;AACA,MAAI,QAAQ;AAAA,IACV,OAAO,qBAAqB,KAAK,SAAS,SAAS;AAAA,EACrD;AAEA,QAAM,cAAc,KAAK,QAAQ,QAAQ,IAAI,GAAG,MAAM;AACtD,QAAM,QAAQ,SAAS,QAClB,MAAM,QAAQ,QAAQ,IAAI,IAAI,QAAQ,OAAO,CAAC,QAAQ,IAAI,GAAG;AAAA,IAC5D;AAAA,EACF,IACA,CAAC,WAAW;AAEhB,QAAM,YAAuB,CAAC;AAC9B,MAAI;AAEJ,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,UAAU,GAAG,aAAa,UAAU,EAAE,SAAS,CAAC;AACtD,YAAM,SAAS,MAAM,OAAO;AAC5B,eAAS,WAAW,QAAQ,OAAO;AAAA,IACrC,SAAS,GAAG;AACV,UAAI;AACF,cAAM,kBAAkB,QAAQ,KAAM,EAAY,OAAO,EAAE;AAC7D,kBAAY;AAAA,IACd;AAAA,EACF;AAEA,QAAM,YAAY,SAAS,QAAQ,WAAW,OAAO;AAGrD,cAAY,aAAa,OAAO,qBAAqB,KAAK,SAAS;AACnE,UAAQ,aAAa,OAAO,qBAAqB,KAAK,KAAK;AAE3D,MAAI,aAAa,CAAC,OAAO;AACvB,UAAM,QAAQ,OAAO,KAAK,SAAS,EAAE;AACrC,UAAM,aAAa,MAChB,IAAI,CAAC,MAAM;AACV,UAAI;AACF,eAAO,KAAK,SAAS,QAAQ,IAAI,GAAG,CAAC;AAAA,MACvC,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF,CAAC,EACA,KAAK,IAAI;AACZ;AAAA,MACE,YAAY,KAAK,oBAAoB,UAAU,IAAI;AAAA,QACjD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,YACH,EAAE,QAAQ,WAAW,OAAO,UAAU,IACtC,EAAE,QAAQ,UAAU;AAC1B;AAGO,IAAM,SAAS,CAAC,YAA0C;AAC/D,QAAM,YAAY,aAAa,OAAO;AAEtC,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,OAAO;AAAA,EAC7B;AAEA,QAAM,YAAY,cAAc,OAAO;AACvC,MAAI,CAAC,WAAW;AACd;AAAA,MACE;AAAA,IACF;AACA,WAAO,aAAa,OAAO;AAAA,EAC7B;AAEA,SAAO,YAAY,WAAW,CAAC,CAAC;AAClC;;;ADxXO,IAAM,0BAA0B,CAAC,cAAc,UACpD,YAAY,WAAW;AAOzB,eAAsB,cACpB,cAAc,OACd,SAAS,IAAI,UAAU,CAAC,CAAC,GACiC;AAC1D,QAAM,WAAW,MAAM,OAAO;AAAA,IAC5B,IAAI,oBAAoB;AAAA,MACtB,MAAM,wBAAwB,WAAW;AAAA,MACzC,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,QAAM,MAAM,SAAS,WAAW;AAChC,MAAI,QAAQ,QAAW;AACrB,UAAM,IAAI,MAAM,iCAAiC,WAAW,eAAe;AAAA,EAC7E;AACA,SAAO,EAAE,KAAK,QAAe,MAAM,GAAG,EAAE;AAC1C;AAEA,eAAsB,eACpB,cAAc,OACd,UAAiC,EAAE,WAAW,KAAK,GAClB;AACjC,QAAM,EAAE,OAAO,IAAI,MAAM,cAAc,aAAa,QAAQ,MAAM;AAClE,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,cAAc,SAAS,QAAQ,IAAI,GAAG,MAAM,QAAW;AACjE,cAAQ,IAAI,GAAG,IAAI;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   getAprovanEnv
-} from "./chunk-QVRIXCGD.js";
+} from "./chunk-XZEPXBX5.js";
 
 // src/cli.ts
 var [, , command, environment = "prd"] = process.argv;

package/dist/index.d.ts

@@ -1,5 +1,69 @@
 import { SSMClient } from '@aws-sdk/client-ssm';
 
+/**
+ * Dotenv - Load environment variables from .env files
+ *
+ * Adapted from dotenv by motdotla
+ * @see https://github.com/motdotla/dotenv/blob/master/lib/main.js
+ * @license BSD-2-Clause
+ *
+ * @example
+ * // Basic usage - loads from .env in current directory
+ * import { config } from './dotenv';
+ * config();
+ *
+ * @example
+ * // Custom path
+ * config({ path: '/custom/path/.env' });
+ *
+ * @example
+ * // Multiple files (loaded in order, later values don't override)
+ * config({ path: ['.env.local', '.env'] });
+ *
+ * @example
+ * // Override existing env vars
+ * config({ override: true });
+ *
+ * @example
+ * // Encrypted vault (requires DOTENV_KEY env var)
+ * // Automatically loads from .env.vault when DOTENV_KEY is set
+ * config();
+ *
+ * @example
+ * // Parse a string directly
+ * import { parse } from './dotenv';
+ * const env = parse('FOO=bar\nBAZ=qux');
+ * // => { FOO: 'bar', BAZ: 'qux' }
+ */
+type EnvRecord = Record<string, string>;
+type ProcessEnv = NodeJS.ProcessEnv | EnvRecord;
+interface DotenvOptions {
+    path?: string | string[];
+    encoding?: BufferEncoding;
+    debug?: boolean;
+    quiet?: boolean;
+    override?: boolean;
+    processEnv?: ProcessEnv;
+    DOTENV_KEY?: string;
+}
+interface DotenvResult {
+    parsed: EnvRecord;
+    error?: Error;
+}
+declare const parse: (src: string | Buffer) => EnvRecord;
+declare const decrypt: (encrypted: string, keyStr: string) => string;
+declare const populate: (target: ProcessEnv, source: EnvRecord, options?: Pick<DotenvOptions, "debug" | "override">) => EnvRecord;
+/** Load environment variables from .env file(s) */
+declare const config: (options?: DotenvOptions) => DotenvResult;
+
+declare const dotenv_config: typeof config;
+declare const dotenv_decrypt: typeof decrypt;
+declare const dotenv_parse: typeof parse;
+declare const dotenv_populate: typeof populate;
+declare namespace dotenv {
+  export { dotenv_config as config, dotenv_decrypt as decrypt, dotenv_parse as parse, dotenv_populate as populate };
+}
+
 declare const aprovanEnvParameterName: (environment?: string) => string;
 interface LoadAprovanEnvOptions {
     client?: SSMClient;
@@ -11,4 +75,4 @@ declare function getAprovanEnv(environment?: string, client?: SSMClient): Promis
 }>;
 declare function loadAprovanEnv(environment?: string, options?: LoadAprovanEnvOptions): Promise<Record<string, string>>;
 
-export { type LoadAprovanEnvOptions, aprovanEnvParameterName, getAprovanEnv, loadAprovanEnv };
+export { type LoadAprovanEnvOptions, aprovanEnvParameterName, dotenv, getAprovanEnv, loadAprovanEnv };

package/dist/index.js

@@ -1,10 +1,12 @@
 import {
   aprovanEnvParameterName,
+  dotenv_exports,
   getAprovanEnv,
   loadAprovanEnv
-} from "./chunk-QVRIXCGD.js";
+} from "./chunk-XZEPXBX5.js";
 export {
   aprovanEnvParameterName,
+  dotenv_exports as dotenv,
   getAprovanEnv,
   loadAprovanEnv
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aprovan/node",
-  "version": "0.1.0",
+  "version": "0.1.1-dev.53db668",
   "description": "Shared Aprovan environment loading and utilities",
   "type": "module",
   "bin": {

package/dist/chunk-QVRIXCGD.js

@@ -1,89 +0,0 @@
-// src/index.ts
-import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
-
-// src/dotenv.ts
-var LINE_REGEX = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/gm;
-var parse = (src) => {
-  const lines = src.toString().replace(/\r\n?/gm, "\n");
-  const result = {};
-  let match;
-  while ((match = LINE_REGEX.exec(lines)) !== null) {
-    const key = match[1];
-    if (!key) continue;
-    let value = (match[2] ?? "").trim();
-    const quote = value[0];
-    value = value.replace(/^(['"`])([\s\S]*)\1$/gm, "$2");
-    if (quote === '"') {
-      value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r");
-    }
-    result[key] = value;
-  }
-  return result;
-};
-
-// src/index.ts
-var aprovanEnvParameterName = (environment = "prd") => `/aprovan/${environment}/env`;
-async function getAprovanEnv(environment = "prd", client = new SSMClient({})) {
-  const response = await client.send(
-    new GetParameterCommand({
-      Name: aprovanEnvParameterName(environment),
-      WithDecryption: true
-    })
-  );
-  const raw = response.Parameter?.Value;
-  if (raw === void 0) {
-    throw new Error(`Aprovan environment parameter ${environment} has no value`);
-  }
-  return { raw, values: parse(raw) };
-}
-async function loadAprovanEnv(environment = "prd", options = { overwrite: true }) {
-  const { values } = await getAprovanEnv(environment, options.client);
-  for (const [key, value] of Object.entries(values)) {
-    if (options.overwrite !== false || process.env[key] === void 0) {
-      process.env[key] = value;
-    }
-  }
-  return values;
-}
-
-export {
-  aprovanEnvParameterName,
-  getAprovanEnv,
-  loadAprovanEnv
-};
-/**
- * Dotenv - Load environment variables from .env files
- *
- * Adapted from dotenv by motdotla
- * @see https://github.com/motdotla/dotenv/blob/master/lib/main.js
- * @license BSD-2-Clause
- *
- * @example
- * // Basic usage - loads from .env in current directory
- * import { config } from './dotenv';
- * config();
- *
- * @example
- * // Custom path
- * config({ path: '/custom/path/.env' });
- *
- * @example
- * // Multiple files (loaded in order, later values don't override)
- * config({ path: ['.env.local', '.env'] });
- *
- * @example
- * // Override existing env vars
- * config({ override: true });
- *
- * @example
- * // Encrypted vault (requires DOTENV_KEY env var)
- * // Automatically loads from .env.vault when DOTENV_KEY is set
- * config();
- *
- * @example
- * // Parse a string directly
- * import { parse } from './dotenv';
- * const env = parse('FOO=bar\nBAZ=qux');
- * // => { FOO: 'bar', BAZ: 'qux' }
- */
-//# sourceMappingURL=chunk-QVRIXCGD.js.map

package/dist/chunk-QVRIXCGD.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts","../src/dotenv.ts"],"sourcesContent":["import { GetParameterCommand, SSMClient } from \"@aws-sdk/client-ssm\";\nimport { parse } from \"./dotenv\";\n\nexport const aprovanEnvParameterName = (environment = \"prd\"): string =>\n  `/aprovan/${environment}/env`;\n\nexport interface LoadAprovanEnvOptions {\n  client?: SSMClient;\n  overwrite?: boolean;\n}\n\nexport async function getAprovanEnv(\n  environment = \"prd\",\n  client = new SSMClient({}),\n): Promise<{ raw: string; values: Record<string, string> }> {\n  const response = await client.send(\n    new GetParameterCommand({\n      Name: aprovanEnvParameterName(environment),\n      WithDecryption: true,\n    }),\n  );\n  const raw = response.Parameter?.Value;\n  if (raw === undefined) {\n    throw new Error(`Aprovan environment parameter ${environment} has no value`);\n  }\n  return { raw, values: parse(raw) };\n}\n\nexport async function loadAprovanEnv(\n  environment = \"prd\",\n  options: LoadAprovanEnvOptions = { overwrite: true },\n): Promise<Record<string, string>> {\n  const { values } = await getAprovanEnv(environment, options.client);\n  for (const [key, value] of Object.entries(values)) {\n    if (options.overwrite !== false || process.env[key] === undefined) {\n      process.env[key] = value;\n    }\n  }\n  return values;\n}\n","/**\n * Dotenv - Load environment variables from .env files\n *\n * Adapted from dotenv by motdotla\n * @see https://github.com/motdotla/dotenv/blob/master/lib/main.js\n * @license BSD-2-Clause\n *\n * @example\n * // Basic usage - loads from .env in current directory\n * import { config } from './dotenv';\n * config();\n *\n * @example\n * // Custom path\n * config({ path: '/custom/path/.env' });\n *\n * @example\n * // Multiple files (loaded in order, later values don't override)\n * config({ path: ['.env.local', '.env'] });\n *\n * @example\n * // Override existing env vars\n * config({ override: true });\n *\n * @example\n * // Encrypted vault (requires DOTENV_KEY env var)\n * // Automatically loads from .env.vault when DOTENV_KEY is set\n * config();\n *\n * @example\n * // Parse a string directly\n * import { parse } from './dotenv';\n * const env = parse('FOO=bar\\nBAZ=qux');\n * // => { FOO: 'bar', BAZ: 'qux' }\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport os from 'os';\nimport crypto from 'crypto';\n\ntype EnvRecord = Record<string, string>;\ntype ProcessEnv = NodeJS.ProcessEnv | EnvRecord;\n\ninterface DotenvError extends Error {\n  code: string;\n}\n\ninterface DotenvOptions {\n  path?: string | string[];\n  encoding?: BufferEncoding;\n  debug?: boolean;\n  quiet?: boolean;\n  override?: boolean;\n  processEnv?: ProcessEnv;\n  DOTENV_KEY?: string;\n}\n\ninterface DotenvResult {\n  parsed: EnvRecord;\n  error?: Error;\n}\n\nconst createError = (message: string, code: string): DotenvError => {\n  const err = new Error(message) as DotenvError;\n  err.code = code;\n  return err;\n};\n\nconst parseBoolean = (value: unknown): boolean =>\n  typeof value === 'string'\n    ? !['false', '0', 'no', 'off', ''].includes(value.toLowerCase())\n    : Boolean(value);\n\nconst supportsAnsi = (): boolean => process.stdout.isTTY;\n\nconst dim = (text: string): string =>\n  supportsAnsi() ? `\\x1b[2m${text}\\x1b[0m` : text;\n\nconst log = (msg: string): void => console.log(`[dotenv] ${msg}`);\nconst debug = (msg: string): void => console.debug(`[dotenv:debug] ${msg}`);\nconst warn = (msg: string): void => console.warn(`[dotenv:warn] ${msg}`);\n\nconst resolveHome = (envPath: string): string =>\n  envPath.startsWith('~') ? path.join(os.homedir(), envPath.slice(1)) : envPath;\n\nconst LINE_REGEX =\n  /(?:^|^)\\s*(?:export\\s+)?([\\w.-]+)(?:\\s*=\\s*?|:\\s+?)(\\s*'(?:\\\\'|[^'])*'|\\s*\"(?:\\\\\"|[^\"])*\"|\\s*`(?:\\\\`|[^`])*`|[^#\\r\\n]+)?\\s*(?:#.*)?(?:$|$)/gm;\n\nconst parse = (src: string | Buffer): EnvRecord => {\n  const lines = src.toString().replace(/\\r\\n?/gm, '\\n');\n  const result: EnvRecord = {};\n  let match: RegExpExecArray | null;\n\n  while ((match = LINE_REGEX.exec(lines)) !== null) {\n    const key = match[1];\n    if (!key) continue;\n\n    let value = (match[2] ?? '').trim();\n    const quote = value[0];\n\n    // Remove surrounding quotes\n    value = value.replace(/^(['\"`])([\\s\\S]*)\\1$/gm, '$2');\n\n    // Expand escape sequences for double-quoted strings\n    if (quote === '\"') {\n      value = value.replace(/\\\\n/g, '\\n').replace(/\\\\r/g, '\\r');\n    }\n\n    result[key] = value;\n  }\n\n  return result;\n};\n\nconst decrypt = (encrypted: string, keyStr: string): string => {\n  const key = Buffer.from(keyStr.slice(-64), 'hex');\n  const cipherBuffer = Buffer.from(encrypted, 'base64');\n\n  const nonce = cipherBuffer.subarray(0, 12);\n  const authTag = cipherBuffer.subarray(-16);\n  const ciphertext = cipherBuffer.subarray(12, -16);\n\n  try {\n    const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonce);\n    decipher.setAuthTag(authTag);\n    return decipher.update(ciphertext).toString() + decipher.final().toString();\n  } catch (error) {\n    const err = error as Error;\n    const isRange = error instanceof RangeError;\n    const invalidKeyLength = err.message === 'Invalid key length';\n    const decryptionFailed =\n      err.message === 'Unsupported state or unable to authenticate data';\n\n    if (isRange || invalidKeyLength) {\n      throw createError(\n        'INVALID_DOTENV_KEY: It must be 64 characters long (or more)',\n        'INVALID_DOTENV_KEY',\n      );\n    }\n    if (decryptionFailed) {\n      throw createError(\n        'DECRYPTION_FAILED: Please check your DOTENV_KEY',\n        'DECRYPTION_FAILED',\n      );\n    }\n    throw error;\n  }\n};\n\nconst populate = (\n  target: ProcessEnv,\n  source: EnvRecord,\n  options: Pick<DotenvOptions, 'debug' | 'override'> = {},\n): EnvRecord => {\n  const { debug: showDebug = false, override = false } = options;\n  const populated: EnvRecord = {};\n\n  if (typeof source !== 'object' || source === null) {\n    throw createError(\n      'OBJECT_REQUIRED: Please check the argument being passed to populate',\n      'OBJECT_REQUIRED',\n    );\n  }\n\n  for (const [key, value] of Object.entries(source)) {\n    const exists = Object.prototype.hasOwnProperty.call(target, key);\n\n    if (exists && !override) {\n      if (showDebug) debug(`\"${key}\" already defined, not overwritten`);\n      continue;\n    }\n\n    if (exists && showDebug) {\n      debug(`\"${key}\" already defined, overwritten`);\n    }\n\n    target[key] = value;\n    populated[key] = value;\n  }\n\n  return populated;\n};\n\nconst getDotenvKey = (options?: DotenvOptions): string =>\n  options?.DOTENV_KEY || process.env.DOTENV_KEY || '';\n\nconst findVaultPath = (options?: DotenvOptions): string | null => {\n  const toVaultPath = (p: string): string =>\n    p.endsWith('.vault') ? p : `${p}.vault`;\n\n  if (options?.path) {\n    const paths = Array.isArray(options.path) ? options.path : [options.path];\n    const found = paths.find((p) => fs.existsSync(p));\n    if (found) {\n      const vaultPath = toVaultPath(found);\n      return fs.existsSync(vaultPath) ? vaultPath : null;\n    }\n  }\n\n  const defaultPath = path.resolve(process.cwd(), '.env.vault');\n  return fs.existsSync(defaultPath) ? defaultPath : null;\n};\n\nconst parseVaultKey = (\n  dotenvKey: string,\n  parsed: EnvRecord,\n): { ciphertext: string; key: string } => {\n  let uri: URL;\n  try {\n    uri = new URL(dotenvKey);\n  } catch (error) {\n    const err = error as NodeJS.ErrnoException;\n    if (err.code === 'ERR_INVALID_URL') {\n      throw createError(\n        'INVALID_DOTENV_KEY: Wrong format. Must be valid URI like dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=development',\n        'INVALID_DOTENV_KEY',\n      );\n    }\n    throw error;\n  }\n\n  const key = uri.password;\n  if (!key) {\n    throw createError(\n      'INVALID_DOTENV_KEY: Missing key part',\n      'INVALID_DOTENV_KEY',\n    );\n  }\n\n  const environment = uri.searchParams.get('environment');\n  if (!environment) {\n    throw createError(\n      'INVALID_DOTENV_KEY: Missing environment part',\n      'INVALID_DOTENV_KEY',\n    );\n  }\n\n  const envKey = `DOTENV_VAULT_${environment.toUpperCase()}`;\n  const ciphertext = parsed[envKey];\n  if (!ciphertext) {\n    throw createError(\n      `NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate ${envKey} in .env.vault`,\n      'NOT_FOUND_DOTENV_ENVIRONMENT',\n    );\n  }\n\n  return { ciphertext, key };\n};\n\nconst parseVault = (options: DotenvOptions): EnvRecord => {\n  const vaultPath = findVaultPath(options);\n  const vaultResult = configDotenv({\n    ...options,\n    path: vaultPath ?? undefined,\n  });\n\n  if (!vaultResult.parsed || Object.keys(vaultResult.parsed).length === 0) {\n    throw createError(\n      `MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`,\n      'MISSING_DATA',\n    );\n  }\n\n  const keys = getDotenvKey(options).split(',');\n  let lastError: Error | null = null;\n\n  for (const rawKey of keys) {\n    try {\n      const { ciphertext, key } = parseVaultKey(\n        rawKey.trim(),\n        vaultResult.parsed,\n      );\n      return parse(decrypt(ciphertext, key));\n    } catch (error) {\n      lastError = error as Error;\n    }\n  }\n\n  throw lastError ?? createError('DECRYPTION_FAILED', 'DECRYPTION_FAILED');\n};\n\nconst configVault = (options: DotenvOptions): DotenvResult => {\n  const showDebug = parseBoolean(\n    process.env.DOTENV_CONFIG_DEBUG ?? options.debug,\n  );\n  const quiet = parseBoolean(process.env.DOTENV_CONFIG_QUIET ?? options.quiet);\n\n  if (showDebug || !quiet) {\n    log('Loading env from encrypted .env.vault');\n  }\n\n  const parsed = parseVault(options);\n  const target = options.processEnv ?? process.env;\n  populate(target, parsed, options);\n\n  return { parsed };\n};\n\nconst configDotenv = (options?: DotenvOptions): DotenvResult => {\n  const target = options?.processEnv ?? process.env;\n  const encoding: BufferEncoding = options?.encoding ?? 'utf8';\n  let showDebug = parseBoolean(\n    target.DOTENV_CONFIG_DEBUG ?? options?.debug ?? false,\n  );\n  let quiet = parseBoolean(\n    target.DOTENV_CONFIG_QUIET ?? options?.quiet ?? false,\n  );\n\n  const defaultPath = path.resolve(process.cwd(), '.env');\n  const paths = options?.path\n    ? (Array.isArray(options.path) ? options.path : [options.path]).map(\n        resolveHome,\n      )\n    : [defaultPath];\n\n  const parsedAll: EnvRecord = {};\n  let lastError: Error | undefined;\n\n  for (const filePath of paths) {\n    try {\n      const content = fs.readFileSync(filePath, { encoding });\n      const parsed = parse(content);\n      populate(parsedAll, parsed, options);\n    } catch (e) {\n      if (showDebug)\n        debug(`Failed to load ${filePath}: ${(e as Error).message}`);\n      lastError = e as Error;\n    }\n  }\n\n  const populated = populate(target, parsedAll, options);\n\n  // Re-check settings from loaded .env\n  showDebug = parseBoolean(target.DOTENV_CONFIG_DEBUG ?? showDebug);\n  quiet = parseBoolean(target.DOTENV_CONFIG_QUIET ?? quiet);\n\n  if (showDebug || !quiet) {\n    const count = Object.keys(populated).length;\n    const shortPaths = paths\n      .map((p) => {\n        try {\n          return path.relative(process.cwd(), p);\n        } catch {\n          return p;\n        }\n      })\n      .join(', ');\n    log(\n      `injected ${count} env var(s) from ${shortPaths} ${dim(\n        '-- tip: set DOTENV_CONFIG_QUIET=true to silence',\n      )}`,\n    );\n  }\n\n  return lastError\n    ? { parsed: parsedAll, error: lastError }\n    : { parsed: parsedAll };\n};\n\n/** Load environment variables from .env file(s) */\nexport const config = (options?: DotenvOptions): DotenvResult => {\n  const dotenvKey = getDotenvKey(options);\n\n  if (!dotenvKey) {\n    return configDotenv(options);\n  }\n\n  const vaultPath = findVaultPath(options);\n  if (!vaultPath) {\n    warn(\n      `DOTENV_KEY is set but .env.vault file not found. Did you forget to build it?`,\n    );\n    return configDotenv(options);\n  }\n\n  return configVault(options ?? {});\n};\n\nexport { parse, populate, decrypt };\n"],"mappings":";AAAA,SAAS,qBAAqB,iBAAiB;;;ACsF/C,IAAM,aACJ;AAEF,IAAM,QAAQ,CAAC,QAAoC;AACjD,QAAM,QAAQ,IAAI,SAAS,EAAE,QAAQ,WAAW,IAAI;AACpD,QAAM,SAAoB,CAAC;AAC3B,MAAI;AAEJ,UAAQ,QAAQ,WAAW,KAAK,KAAK,OAAO,MAAM;AAChD,UAAM,MAAM,MAAM,CAAC;AACnB,QAAI,CAAC,IAAK;AAEV,QAAI,SAAS,MAAM,CAAC,KAAK,IAAI,KAAK;AAClC,UAAM,QAAQ,MAAM,CAAC;AAGrB,YAAQ,MAAM,QAAQ,0BAA0B,IAAI;AAGpD,QAAI,UAAU,KAAK;AACjB,cAAQ,MAAM,QAAQ,QAAQ,IAAI,EAAE,QAAQ,QAAQ,IAAI;AAAA,IAC1D;AAEA,WAAO,GAAG,IAAI;AAAA,EAChB;AAEA,SAAO;AACT;;;AD9GO,IAAM,0BAA0B,CAAC,cAAc,UACpD,YAAY,WAAW;AAOzB,eAAsB,cACpB,cAAc,OACd,SAAS,IAAI,UAAU,CAAC,CAAC,GACiC;AAC1D,QAAM,WAAW,MAAM,OAAO;AAAA,IAC5B,IAAI,oBAAoB;AAAA,MACtB,MAAM,wBAAwB,WAAW;AAAA,MACzC,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,QAAM,MAAM,SAAS,WAAW;AAChC,MAAI,QAAQ,QAAW;AACrB,UAAM,IAAI,MAAM,iCAAiC,WAAW,eAAe;AAAA,EAC7E;AACA,SAAO,EAAE,KAAK,QAAQ,MAAM,GAAG,EAAE;AACnC;AAEA,eAAsB,eACpB,cAAc,OACd,UAAiC,EAAE,WAAW,KAAK,GAClB;AACjC,QAAM,EAAE,OAAO,IAAI,MAAM,cAAc,aAAa,QAAQ,MAAM;AAClE,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,cAAc,SAAS,QAAQ,IAAI,GAAG,MAAM,QAAW;AACjE,cAAQ,IAAI,GAAG,IAAI;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;","names":[]}