@arki/env 0.0.11 → 0.2.0

package/dist/api.json

@@ -0,0 +1,597 @@
+{
+  "package": "@arki/env",
+  "version": "0.2.0",
+  "entries": [
+    {
+      "subpath": ".",
+      "name": "presets",
+      "kind": "variable",
+      "signature": "export declare const presets: { string: (defaultValue?: string) => import(\"zod\").ZodDefault<import(\"zod\").ZodString> | import(\"zod\").ZodString; number: (defaultValue?: number) => import(\"zod\").ZodCoercedNumber<unknown> | import(\"zod\").ZodDefault<import(\"zod\").ZodCoercedNumber<unknown>>; port: (defaultValue?: number) => import(\"zod\").ZodDefault<import(\"zod\").ZodCoercedNumber<unknown>>; nodeEnv: () => import(\"zod\").ZodDefault<import(\"zod\").ZodEnum<{ development: \"development\"; production: \"production\"; test: \"test\"; }>>; boolean: (defaultValue?: boolean) => import(\"zod\").ZodPipe<import(\"zod\").ZodDefault<import(\"zod\").ZodEnum<{ 0: \"0\"; 1: \"1\"; false: \"false\"; true: \"true\"; }>>, import(\"zod\").ZodTransform<boolean, \"0\" | \"1\" | \"false\" | \"true\">>; logLevel: (defaultValue?: 'debug' | 'info' | 'warn' | 'error') => import(\"zod\").ZodDefault<import(\"zod\").ZodEnum<{ debug: \"debug\"; error: \"error\"; info: \"info\"; warn: \"warn\"; }>>; json: <T extends import(\"zod\").ZodType>(schema: T) => import(\"zod\").ZodPipe<import(\"zod\").ZodPipe<import(\"zod\").ZodString, import(\"zod\").ZodTransform<unknown, string>>, T>; csvArray: <T extends import(\"zod\").ZodType>(itemSchema: T) => import(\"zod\").ZodPreprocess<import(\"zod\").ZodArray<T>, unknown>; csvSet: <T extends import(\"zod\").ZodType>(itemSchema: T) => import(\"zod\").ZodPreprocess<import(\"zod\").ZodArray<T>, unknown>; url: (defaultValue?: string) => import(\"zod\").ZodDefault<import(\"zod\").ZodURL> | import(\"zod\").ZodURL; databaseUrl: () => import(\"zod\").ZodURL; redisUrl: () => import(\"zod\").ZodURL; };",
+      "jsdocSummary": ""
+    },
+    {
+      "subpath": "./core",
+      "name": "defineEnv",
+      "kind": "function",
+      "signature": "export declare function defineEnv<TServer extends Record<string, StandardSchemaV1>, TClient extends Record<string, StandardSchemaV1> = NonNullable<unknown>, TShared extends Record<string, StandardSchemaV1> = NonNullable<unknown>, const TPrefix extends string = '', const TExtends extends Record<string, unknown>[] = []>(config: { /** * Label shown in validation-error logs, e.g. `'@acme/backend'`. Without it a misconfigured * deploy logs a bare \"Invalid environment variables\" with no hint which env failed — exactly the * blind failure this wrapper exists to prevent. */ name?: string; server: TServer; /** Client-side schema. Every key must start with `clientPrefix` (enforced by `createEnv`). */ client?: TClient; /** Prefix client keys must carry, e.g. `'VITE_'`. Defaults to `''` (no client vars). */ clientPrefix?: TPrefix; /** Shared vars available to both client and server, unprefixed (e.g. `NODE_ENV`). */ shared?: TShared; /** * Already-built envs to compose in (e.g. `@arki/auth`, `@arki/db`). Their parsed variables merge * into the result with full types; each was validated by its own `createEnv` at import time. */ extends?: TExtends; /** * Explicit runtime source. Omit it and `defineEnv` auto-builds one by reading `process.env` for * every declared key — correct for any server-side env. Provide it only when the auto-build would * be wrong: Vite/`start` apps whose client vars come from `import.meta.env` in the browser, or * keys with a fallback/alias (e.g. `DB_URL: process.env.DB_URL ?? process.env.DATABASE_URL`). */ runtimeEnv?: Record<string, string | boolean | number | undefined>; options?: { /** * `true` skips schema validation: values pass through raw. Default: validate on the first read, * in every environment, unless the process sets `SKIP_ENV_VALIDATION=1` (exactly `1`). That * variable is the only implicit opt-out, meant for Docker build stages that prerender without * secrets. `CI`, lint and `NODE_ENV` never skip. */ skipValidation?: boolean; /** * Treat empty-string env values as `undefined` so defaults apply (e.g. `PORT=` in `.env`, or a * Docker arg baked as `X=\"\"`). Defaults to `true` — set `false` only if an app intentionally * accepts `\"\"` as a valid required string. */ emptyStringAsUndefined?: boolean; onValidationError?: (issues: ValidationIssues) => never; }; }): CreateEnv<DefaultCombinedSchema<TServer, TClient, TShared>, TExtends>;",
+      "jsdocSummary": "Thin, type-preserving wrapper over `@t3-oss/env-core`'s `createEnv`. Generic over the server, client, shared and composed schemas so the parsed env keeps its exact inferred types — the wrapper adds the ARKI defaults (auto `runtimeEnv`, validation on in every environment, a legible labelled error handler) without widening any value to `unknown`."
+    },
+    {
+      "subpath": "./core",
+      "name": "describeEnv",
+      "kind": "function",
+      "signature": "export declare function describeEnv(env: object): EnvDescription | undefined;",
+      "jsdocSummary": "The description of an env built by `defineEnv`, or `undefined` for any other object."
+    },
+    {
+      "subpath": "./core",
+      "name": "EnvDescription",
+      "kind": "type",
+      "signature": "export type EnvDescription = { readonly name?: string; readonly keys: readonly EnvKeyDescription[]; };",
+      "jsdocSummary": "What an env declares, its `extends` included."
+    },
+    {
+      "subpath": "./core",
+      "name": "EnvKeyDescription",
+      "kind": "type",
+      "signature": "export type EnvKeyDescription = { readonly key: string; /** Declared with `secret()`: must never be plaintext in a tracked file. */ readonly secret: boolean; readonly scope: 'server' | 'client' | 'shared'; };",
+      "jsdocSummary": "One declared key."
+    },
+    {
+      "subpath": "./core",
+      "name": "formatIssues",
+      "kind": "function",
+      "signature": "export declare function formatIssues(name: string | undefined, issues: ValidationIssues): string;",
+      "jsdocSummary": "Fold validation issues into a human-legible, log-pipeline-safe string. The t3-oss default handler logs `issues` as a raw object, which platforms like Coolify collapse to `[Object]` — so the var that actually failed never reaches the logs. A flat ` path: message` list survives transport."
+    },
+    {
+      "subpath": "./core",
+      "name": "InvalidEnvironment",
+      "kind": "variable",
+      "signature": "export declare const InvalidEnvironment: import(\"@arki/failure\").FailureDefinition<\"env.invalid_environment\", import(\"@standard-schema/spec\").StandardSchemaV1<{ report: string; }, { report: string; }>>;",
+      "jsdocSummary": "The process environment does not match the schema, so the app must not boot."
+    },
+    {
+      "subpath": "./core",
+      "name": "isSecretSchema",
+      "kind": "function",
+      "signature": "export declare function isSecretSchema(schema: StandardSchemaV1): boolean;",
+      "jsdocSummary": "True for a schema built by {@link secret} (or its `.optional()`)."
+    },
+    {
+      "subpath": "./core",
+      "name": "presets",
+      "kind": "variable",
+      "signature": "export declare const presets: { string: (defaultValue?: string) => import(\"zod\").ZodDefault<import(\"zod\").ZodString> | import(\"zod\").ZodString; number: (defaultValue?: number) => import(\"zod\").ZodCoercedNumber<unknown> | import(\"zod\").ZodDefault<import(\"zod\").ZodCoercedNumber<unknown>>; port: (defaultValue?: number) => import(\"zod\").ZodDefault<import(\"zod\").ZodCoercedNumber<unknown>>; nodeEnv: () => import(\"zod\").ZodDefault<import(\"zod\").ZodEnum<{ development: \"development\"; production: \"production\"; test: \"test\"; }>>; boolean: (defaultValue?: boolean) => import(\"zod\").ZodPipe<import(\"zod\").ZodDefault<import(\"zod\").ZodEnum<{ 0: \"0\"; 1: \"1\"; false: \"false\"; true: \"true\"; }>>, import(\"zod\").ZodTransform<boolean, \"0\" | \"1\" | \"false\" | \"true\">>; logLevel: (defaultValue?: 'debug' | 'info' | 'warn' | 'error') => import(\"zod\").ZodDefault<import(\"zod\").ZodEnum<{ debug: \"debug\"; error: \"error\"; info: \"info\"; warn: \"warn\"; }>>; json: <T extends import(\"zod\").ZodType>(schema: T) => import(\"zod\").ZodPipe<import(\"zod\").ZodPipe<import(\"zod\").ZodString, import(\"zod\").ZodTransform<unknown, string>>, T>; csvArray: <T extends import(\"zod\").ZodType>(itemSchema: T) => import(\"zod\").ZodPreprocess<import(\"zod\").ZodArray<T>, unknown>; csvSet: <T extends import(\"zod\").ZodType>(itemSchema: T) => import(\"zod\").ZodPreprocess<import(\"zod\").ZodArray<T>, unknown>; url: (defaultValue?: string) => import(\"zod\").ZodDefault<import(\"zod\").ZodURL> | import(\"zod\").ZodURL; databaseUrl: () => import(\"zod\").ZodURL; redisUrl: () => import(\"zod\").ZodURL; };",
+      "jsdocSummary": ""
+    },
+    {
+      "subpath": "./core",
+      "name": "Redacted",
+      "kind": "class",
+      "signature": "export declare class Redacted<Value = string> { #private; constructor(value: Value); toString(): string; toJSON(): string; [inspect](): string; }",
+      "jsdocSummary": "A value that prints as `[redacted]`. Read it with {@link reveal}."
+    },
+    {
+      "subpath": "./core",
+      "name": "reveal",
+      "kind": "function",
+      "signature": "export declare function reveal<Value>(value: Redacted<Value> | Value): Value;",
+      "jsdocSummary": "The plain value of a secret. Also takes the raw value, because when validation is skipped (`skipValidation`, or `CI` builds) schemas do not run and the variable is still a plain string."
+    },
+    {
+      "subpath": "./core",
+      "name": "secret",
+      "kind": "function",
+      "signature": "export declare function secret<Schema extends StandardSchemaV1>(schema: Schema): SecretSchema<Schema>;",
+      "jsdocSummary": "Validate with `schema` (any Standard Schema), then wrap the value in a {@link Redacted}. For an optional secret, call `.optional()`: `secret(z.string()).optional()`. The inner result passes straight through: an async inner schema yields a promise, so `defineEnv`'s synchronous check fails with the same `UnexpectedFailure` it would give without `secret`, and a throwing validator still throws."
+    },
+    {
+      "subpath": "./core",
+      "name": "SECRET_SCHEMA",
+      "kind": "variable",
+      "signature": "export declare const SECRET_SCHEMA: unique symbol;",
+      "jsdocSummary": "Marks a schema built by {@link secret}, so `describeEnv` can tell secrets apart."
+    },
+    {
+      "subpath": "./node",
+      "name": "decryptEnvFile",
+      "kind": "function",
+      "signature": "export declare function decryptEnvFile(file: string, privateKeys: readonly EnvPrivateKey[], keys?: readonly string[]): string[] | import(\"@arki/failure\").Failure<\"env.decryption_failed\", undefined> | import(\"@arki/failure\").Failure<\"env.file_read_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.file_write_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.unrepresentable_value\", undefined>;",
+      "jsdocSummary": "Decrypt values in place with `privateKeys`: the listed keys, or every value. Returns the keys decrypted."
+    },
+    {
+      "subpath": "./node",
+      "name": "DecryptionFailed",
+      "kind": "variable",
+      "signature": "export declare const DecryptionFailed: import(\"@arki/failure\").FailureDefinition<\"env.decryption_failed\", undefined>;",
+      "jsdocSummary": "Ciphertext authentication or decoding failed."
+    },
+    {
+      "subpath": "./node",
+      "name": "decryptValue",
+      "kind": "function",
+      "signature": "export declare function decryptValue(value: string, privateKey: EnvPrivateKey): string | import(\"@arki/failure\").Failure<\"env.decryption_failed\", undefined>;",
+      "jsdocSummary": "Decrypt authenticated UTF-8, or return DecryptionFailed when the ciphertext/key does not match."
+    },
+    {
+      "subpath": "./node",
+      "name": "DEFAULT_RESOLVERS",
+      "kind": "variable",
+      "signature": "export declare const DEFAULT_RESOLVERS: Readonly<Record<string, ReferenceResolver>>;",
+      "jsdocSummary": "The resolvers used unless the caller supplies an explicit registry."
+    },
+    {
+      "subpath": "./node",
+      "name": "ENCRYPTED_PREFIX",
+      "kind": "variable",
+      "signature": "export declare const ENCRYPTED_PREFIX = \"encrypted:\";",
+      "jsdocSummary": "The prefix of a value encrypted in a dotenvx-format env file (`@arki/env/node`)."
+    },
+    {
+      "subpath": "./node",
+      "name": "encryptEnvFile",
+      "kind": "function",
+      "signature": "export declare function encryptEnvFile(file: string, keys?: readonly string[]): string[] | import(\"@arki/failure\").Failure<\"env.encryption_failed\", undefined> | import(\"@arki/failure\").Failure<\"env.file_read_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.file_write_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.missing_public_key\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.unrepresentable_value\", undefined> | import(\"@arki/failure\").Failure<\"schema.async_required\", undefined> | import(\"@arki/failure\").Failure<\"schema.invalid_input\", { issues: readonly import(\"@standard-schema/spec\").StandardSchemaV1.Issue[]; }> | import(\"@arki/failure\").Failure<\"schema.validator_defect\", undefined>;",
+      "jsdocSummary": "Encrypt plaintext values in place: the listed keys, or every value. Returns the keys encrypted."
+    },
+    {
+      "subpath": "./node",
+      "name": "EncryptionFailed",
+      "kind": "variable",
+      "signature": "export declare const EncryptionFailed: import(\"@arki/failure\").FailureDefinition<\"env.encryption_failed\", undefined>;",
+      "jsdocSummary": "Cryptographic encryption failed."
+    },
+    {
+      "subpath": "./node",
+      "name": "encryptValue",
+      "kind": "function",
+      "signature": "export declare function encryptValue(value: string, publicKey: EnvPublicKey): string | import(\"@arki/failure\").Failure<\"env.encryption_failed\", undefined>;",
+      "jsdocSummary": "Encrypt `value` to a compressed or uncompressed secp256k1 public key (hex)."
+    },
+    {
+      "subpath": "./node",
+      "name": "ENV_FILES_ERROR_CODES",
+      "kind": "variable",
+      "signature": "export declare const ENV_FILES_ERROR_CODES: { readonly missingPrivateKey: \"env.missing_private_key\"; readonly cannotDecrypt: \"env.decryption_failed\"; readonly unresolvedReference: \"env.reference_failed\"; readonly cannotRead: \"env.file_read_failed\"; readonly cancelled: \"env.cancelled\"; readonly deadline: \"env.deadline\"; };",
+      "jsdocSummary": "Loader problem codes are derived from their canonical definitions."
+    },
+    {
+      "subpath": "./node",
+      "name": "EnvCancelled",
+      "kind": "variable",
+      "signature": "export declare const EnvCancelled: import(\"@arki/failure\").FailureDefinition<\"env.cancelled\", undefined>;",
+      "jsdocSummary": "Loading was cancelled."
+    },
+    {
+      "subpath": "./node",
+      "name": "EnvDeadline",
+      "kind": "variable",
+      "signature": "export declare const EnvDeadline: import(\"@arki/failure\").FailureDefinition<\"env.deadline\", undefined>;",
+      "jsdocSummary": "The aggregate load deadline elapsed."
+    },
+    {
+      "subpath": "./node",
+      "name": "envDirs",
+      "kind": "function",
+      "signature": "export declare function envDirs(root: string, cwd: string): readonly string[];",
+      "jsdocSummary": "The directories from `root` down to `cwd`, root first. Just `cwd` when it is not inside `root`."
+    },
+    {
+      "subpath": "./node",
+      "name": "EnvDocument",
+      "kind": "type",
+      "signature": "export type EnvDocument = { readonly lines: readonly string[]; readonly entries: readonly EnvEntry[]; };",
+      "jsdocSummary": "A parsed `.env` file: its lines as written, and every assignment in order."
+    },
+    {
+      "subpath": "./node",
+      "name": "EnvEntry",
+      "kind": "type",
+      "signature": "export type EnvEntry = { readonly key: string; readonly value: string; readonly start: number; readonly end: number; };",
+      "jsdocSummary": "One `KEY=value` assignment: its decoded value and the lines it spans (`end` exclusive)."
+    },
+    {
+      "subpath": "./node",
+      "name": "EnvFilesError",
+      "kind": "type",
+      "signature": "export type EnvFilesError = FailureOf<typeof EnvFilesFailed>['data']['errors'][number];",
+      "jsdocSummary": "One problem, by name. Messages never contain a value."
+    },
+    {
+      "subpath": "./node",
+      "name": "EnvFilesFailed",
+      "kind": "variable",
+      "signature": "export declare const EnvFilesFailed: import(\"@arki/failure\").FailureDefinition<\"env.files_failed\", import(\"@standard-schema/spec\").StandardSchemaV1<{ environment: string; errors: { code: \"env.cancelled\" | \"env.deadline\" | \"env.decryption_failed\" | \"env.file_read_failed\" | \"env.missing_private_key\" | \"env.reference_failed\"; message: string; file: string; key?: string | undefined; }[]; }, { environment: string; errors: { code: \"env.cancelled\" | \"env.deadline\" | \"env.decryption_failed\" | \"env.file_read_failed\" | \"env.missing_private_key\" | \"env.reference_failed\"; message: string; file: string; key?: string | undefined; }[]; }>>;",
+      "jsdocSummary": "One or more env entries could not be loaded. Public data excludes values and raw causes."
+    },
+    {
+      "subpath": "./node",
+      "name": "EnvFilesReport",
+      "kind": "type",
+      "signature": "export type EnvFilesReport = { readonly root: string; readonly environment: string; /** Files read, in load order. */ readonly files: readonly string[]; readonly values: readonly EnvFileValue[]; /** Keys written into the environment. */ readonly applied: readonly string[]; /** Keys the real environment set to a different value, so the file value was not used. */ readonly shadowed: readonly { readonly key: string; readonly file: string; readonly line: number; }[]; /** File entries never applied: loader-hijacking keys (`NODE_OPTIONS`, `LD_*`, `DYLD_*`) and references into public keys. */ readonly refused: readonly { readonly key: string; readonly file: string; readonly line: number; readonly reason: string; }[]; readonly errors: readonly EnvFilesError[]; };",
+      "jsdocSummary": "What a load found and did. Holds plaintext in `values`: never print it whole."
+    },
+    {
+      "subpath": "./node",
+      "name": "EnvFileValue",
+      "kind": "type",
+      "signature": "export type EnvFileValue = { readonly key: string; readonly file: string; readonly line: number; readonly kind: EnvValueKind; readonly value?: string; };",
+      "jsdocSummary": "The winning file entry of one key. `value` is the plaintext, absent when it could not be read."
+    },
+    {
+      "subpath": "./node",
+      "name": "envHeader",
+      "kind": "function",
+      "signature": "export declare function envHeader(fileName: string, publicKey: EnvPublicKey): string;",
+      "jsdocSummary": "The dotenvx header for a file: banner, public key, and a `# <file>` line."
+    },
+    {
+      "subpath": "./node",
+      "name": "EnvKeypair",
+      "kind": "type",
+      "signature": "export type EnvKeypair = { readonly publicKey: EnvPublicKey; readonly privateKey: EnvPrivateKey; };",
+      "jsdocSummary": "A keypair as dotenvx writes it: a compressed public key (66 hex chars), a private key (64)."
+    },
+    {
+      "subpath": "./node",
+      "name": "EnvPrivateKey",
+      "kind": "type",
+      "signature": "export type EnvPrivateKey = string & { readonly [privateKeyBrand]: true; };",
+      "jsdocSummary": "A validated secp256k1 private key. Never serialize it into diagnostics."
+    },
+    {
+      "subpath": "./node",
+      "name": "envPrivateKeySchema",
+      "kind": "variable",
+      "signature": "export declare const envPrivateKeySchema: StandardSchemaV1<unknown, EnvPrivateKey>;",
+      "jsdocSummary": "Standard Schema for an external private key; issue text never echoes the key."
+    },
+    {
+      "subpath": "./node",
+      "name": "EnvPublicKey",
+      "kind": "type",
+      "signature": "export type EnvPublicKey = string & { readonly [publicKeyBrand]: true; };",
+      "jsdocSummary": "A validated secp256k1 public key, distinct from its private key."
+    },
+    {
+      "subpath": "./node",
+      "name": "envPublicKeySchema",
+      "kind": "variable",
+      "signature": "export declare const envPublicKeySchema: StandardSchemaV1<unknown, EnvPublicKey>;",
+      "jsdocSummary": "Standard Schema for an external public key; issue text never echoes the key."
+    },
+    {
+      "subpath": "./node",
+      "name": "EnvValueKind",
+      "kind": "type",
+      "signature": "export type EnvValueKind = 'plain' | 'encrypted' | 'reference';",
+      "jsdocSummary": "How a value is stored in its file."
+    },
+    {
+      "subpath": "./node",
+      "name": "envValues",
+      "kind": "function",
+      "signature": "export declare function envValues(document: EnvDocument): Map<string, EnvEntry>;",
+      "jsdocSummary": "Every key with its last value, in first-seen order."
+    },
+    {
+      "subpath": "./node",
+      "name": "FileReadFailed",
+      "kind": "variable",
+      "signature": "export declare const FileReadFailed: import(\"@arki/failure\").FailureDefinition<\"env.file_read_failed\", import(\"@standard-schema/spec\").StandardSchemaV1<{ file: string; }, { file: string; }>>;",
+      "jsdocSummary": "An env file could not be read."
+    },
+    {
+      "subpath": "./node",
+      "name": "FileWriteFailed",
+      "kind": "variable",
+      "signature": "export declare const FileWriteFailed: import(\"@arki/failure\").FailureDefinition<\"env.file_write_failed\", import(\"@standard-schema/spec\").StandardSchemaV1<{ file: string; }, { file: string; }>>;",
+      "jsdocSummary": "An env file could not be replaced."
+    },
+    {
+      "subpath": "./node",
+      "name": "findPrivateKey",
+      "kind": "function",
+      "signature": "export declare function findPrivateKey(file: string, options: { readonly root: string; readonly env: Readonly<Record<string, string | undefined>>; }): import(\"@arki/failure\").Failure<\"env.file_read_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"schema.async_required\", undefined> | import(\"@arki/failure\").Failure<\"schema.invalid_input\", { issues: readonly import(\"@standard-schema/spec\").StandardSchemaV1.Issue[]; }> | import(\"@arki/failure\").Failure<\"schema.validator_defect\", undefined> | { keys: EnvPrivateKey[]; source: { path?: undefined; kind: \"env\"; name: string; }; } | { keys: EnvPrivateKey[]; source: { kind: \"file\"; name: string; path: string; }; } | undefined;",
+      "jsdocSummary": "The private key for `file`, or `undefined` when no source has one."
+    },
+    {
+      "subpath": "./node",
+      "name": "findRoot",
+      "kind": "function",
+      "signature": "export declare function findRoot(cwd: string): string;",
+      "jsdocSummary": "The nearest ancestor of `cwd` with `.git`, else with a `workspaces` package.json, else `cwd`."
+    },
+    {
+      "subpath": "./node",
+      "name": "formatEnvFilesErrors",
+      "kind": "function",
+      "signature": "export declare function formatEnvFilesErrors(failure: FailureOf<typeof EnvFilesFailed>): string;",
+      "jsdocSummary": "The report's errors as one message, one line each."
+    },
+    {
+      "subpath": "./node",
+      "name": "FoundPrivateKey",
+      "kind": "type",
+      "signature": "export type FoundPrivateKey = { readonly keys: readonly EnvPrivateKey[]; readonly source: PrivateKeySource; };",
+      "jsdocSummary": "The candidate keys for a file, and where they came from."
+    },
+    {
+      "subpath": "./node",
+      "name": "generateKeypair",
+      "kind": "function",
+      "signature": "export declare function generateKeypair(): import(\"@arki/failure\").Failure<\"env.key_generation_failed\", undefined> | { publicKey: EnvPublicKey; privateKey: EnvPrivateKey; };",
+      "jsdocSummary": "A new random keypair."
+    },
+    {
+      "subpath": "./node",
+      "name": "initEnvFile",
+      "kind": "function",
+      "signature": "export declare function initEnvFile(file: string, options: { readonly root: string; readonly env?: Readonly<Record<string, string | undefined>>; }): import(\"@arki/failure\").Failure<\"env.file_read_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.file_write_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.key_generation_failed\", undefined> | import(\"@arki/failure\").Failure<\"env.unrepresentable_value\", undefined> | import(\"@arki/failure\").Failure<\"schema.async_required\", undefined> | import(\"@arki/failure\").Failure<\"schema.invalid_input\", { issues: readonly import(\"@standard-schema/spec\").StandardSchemaV1.Issue[]; }> | import(\"@arki/failure\").Failure<\"schema.validator_defect\", undefined> | { file: string; publicKey: EnvPublicKey; headerAdded: boolean; keysWritten?: undefined; } | { file: string; publicKey: EnvPublicKey; headerAdded: boolean; keysWritten: string; };",
+      "jsdocSummary": "Give `file` a dotenvx header, creating the file if needed. Reuses the private key of the same environment when one is already reachable (so every `.env.development` in a repo shares one key); otherwise generates a keypair and stores the private key in `<root>/.env.keys`."
+    },
+    {
+      "subpath": "./node",
+      "name": "InitResult",
+      "kind": "type",
+      "signature": "export type InitResult = { readonly file: string; readonly publicKey: EnvPublicKey; /** `false` when the file already had a header. */ readonly headerAdded: boolean; /** Where a new private key was written; `undefined` when an existing key was reused. */ readonly keysWritten?: string; };",
+      "jsdocSummary": "What `initEnvFile` did."
+    },
+    {
+      "subpath": "./node",
+      "name": "isEncrypted",
+      "kind": "function",
+      "signature": "export declare function isEncrypted(value: string): boolean;",
+      "jsdocSummary": "True for a value written by {@link encryptValue} (or by dotenvx)."
+    },
+    {
+      "subpath": "./node",
+      "name": "isKeyName",
+      "kind": "function",
+      "signature": "export declare function isKeyName(key: string): boolean;",
+      "jsdocSummary": "True for the `DOTENV_PUBLIC_KEY*` / `DOTENV_PRIVATE_KEY*` names, which are never app values."
+    },
+    {
+      "subpath": "./node",
+      "name": "KeyGenerationFailed",
+      "kind": "variable",
+      "signature": "export declare const KeyGenerationFailed: import(\"@arki/failure\").FailureDefinition<\"env.key_generation_failed\", undefined>;",
+      "jsdocSummary": "The runtime could not generate a keypair."
+    },
+    {
+      "subpath": "./node",
+      "name": "keyNamesFor",
+      "kind": "function",
+      "signature": "export declare function keyNamesFor(fileName: string): { readonly publicKey: string; readonly privateKey: string; };",
+      "jsdocSummary": "The key names dotenvx uses for a file: `.env` → `DOTENV_PUBLIC_KEY` / `DOTENV_PRIVATE_KEY`, `.env.production` → `..._PRODUCTION`, `.env.ci.local` → `..._CI_LOCAL`."
+    },
+    {
+      "subpath": "./node",
+      "name": "KEYS_FILE",
+      "kind": "variable",
+      "signature": "export declare const KEYS_FILE = \".env.keys\";",
+      "jsdocSummary": "The git-ignored file that holds private keys, one `DOTENV_PRIVATE_KEY_<ENV>=<hex>` line each."
+    },
+    {
+      "subpath": "./node",
+      "name": "keysFileCandidates",
+      "kind": "function",
+      "signature": "export declare function keysFileCandidates(file: string, root: string): readonly string[];",
+      "jsdocSummary": "The `.env.keys` paths searched for `file`, nearest first."
+    },
+    {
+      "subpath": "./node",
+      "name": "loadEnvFiles",
+      "kind": "function",
+      "signature": "export declare function loadEnvFiles(options?: LoadEnvFilesOptions): import(\"@arki/failure\").Failure<\"env.cancelled\", undefined> | import(\"@arki/failure\").Failure<\"env.deadline\", undefined> | import(\"@arki/failure\").Failure<\"env.files_failed\", { environment: string; errors: { code: \"env.cancelled\" | \"env.deadline\" | \"env.decryption_failed\" | \"env.file_read_failed\" | \"env.missing_private_key\" | \"env.reference_failed\"; message: string; file: string; key?: string | undefined; }[]; }> | { root: string; environment: string; files: string[]; values: EnvFileValue[]; applied: string[]; shadowed: { key: string; file: string; line: number; }[]; refused: { key: string; file: string; line: number; reason: string; }[]; errors: { code: \"env.cancelled\" | \"env.deadline\" | \"env.decryption_failed\" | \"env.file_read_failed\" | \"env.missing_private_key\" | \"env.reference_failed\"; message: string; file: string; key?: string | undefined; }[]; };",
+      "jsdocSummary": "Load atomically into the env map: operational problems return canonical failures before applying values."
+    },
+    {
+      "subpath": "./node",
+      "name": "LoadEnvFilesOptions",
+      "kind": "type",
+      "signature": "export type LoadEnvFilesOptions = { /** Where to stop descending. Default: `process.cwd()`. */ readonly cwd?: string; /** Where to start. Default: the nearest ancestor with `.git`, else with a `workspaces` package.json, else `cwd`. */ readonly root?: string; /** Picks `.env.<environment>`. Default: `NODE_ENV`, else `development`. */ readonly environment?: string; /** File names read in every directory, later wins. Default: `.env.<environment>`, then `.env.local` (not under `test`). */ readonly files?: readonly string[]; /** The environment read and written. Default: `process.env`. */ readonly env?: Record<string, string | undefined>; /** `false` reads and decrypts without writing anything. Default: `true`. */ readonly write?: boolean; /** Reference resolvers by scheme. Default: `op`, `infisical`, `doppler`. */ readonly references?: Readonly<Record<string, ReferenceResolver>>; /** Cooperative cancellation between synchronous reads; passed to provider callbacks. */ readonly signal?: AbortSignal; /** Aggregate load budget, shared by all provider subprocesses. Default: 30 seconds. */ readonly timeoutMs?: number; };",
+      "jsdocSummary": "How `loadEnvFiles` finds, reads and applies the files."
+    },
+    {
+      "subpath": "./node",
+      "name": "MissingPrivateKey",
+      "kind": "variable",
+      "signature": "export declare const MissingPrivateKey: import(\"@arki/failure\").FailureDefinition<\"env.missing_private_key\", import(\"@standard-schema/spec\").StandardSchemaV1<{ file: string; }, { file: string; }>>;",
+      "jsdocSummary": "No private key is available."
+    },
+    {
+      "subpath": "./node",
+      "name": "MissingPublicKey",
+      "kind": "variable",
+      "signature": "export declare const MissingPublicKey: import(\"@arki/failure\").FailureDefinition<\"env.missing_public_key\", import(\"@standard-schema/spec\").StandardSchemaV1<{ file: string; }, { file: string; }>>;",
+      "jsdocSummary": "The target file has no public key."
+    },
+    {
+      "subpath": "./node",
+      "name": "parseEnv",
+      "kind": "function",
+      "signature": "export declare function parseEnv(text: string): EnvDocument;",
+      "jsdocSummary": "Parse `.env` text the way `dotenv` reads it: `export` prefixes, `#` comments, single, double and backtick quotes, multi-line quoted values, and `\\n` / `\\r` expanded inside double quotes. An unquoted value ends at the first `#`. A key that appears twice keeps both entries; readers take the last one, as dotenv does."
+    },
+    {
+      "subpath": "./node",
+      "name": "parsePrivateKey",
+      "kind": "function",
+      "signature": "export declare function parsePrivateKey(value: unknown): import(\"@arki/failure\").Failure<\"schema.async_required\", undefined> | import(\"@arki/failure\").Failure<\"schema.invalid_input\", { issues: readonly StandardSchemaV1.Issue[]; }> | import(\"@arki/failure\").Failure<\"schema.validator_defect\", undefined> | EnvPrivateKey;",
+      "jsdocSummary": "Parse an external private key without exposing its bytes in issues."
+    },
+    {
+      "subpath": "./node",
+      "name": "parsePublicKey",
+      "kind": "function",
+      "signature": "export declare function parsePublicKey(value: unknown): import(\"@arki/failure\").Failure<\"schema.async_required\", undefined> | import(\"@arki/failure\").Failure<\"schema.invalid_input\", { issues: readonly StandardSchemaV1.Issue[]; }> | import(\"@arki/failure\").Failure<\"schema.validator_defect\", undefined> | EnvPublicKey;",
+      "jsdocSummary": "Parse an external public key without manufacturing a brand."
+    },
+    {
+      "subpath": "./node",
+      "name": "PrivateKeySource",
+      "kind": "type",
+      "signature": "export type PrivateKeySource = { readonly kind: 'env'; readonly name: string; } | { readonly kind: 'file'; readonly name: string; readonly path: string; };",
+      "jsdocSummary": "Where a private key was found. Never carries the key itself."
+    },
+    {
+      "subpath": "./node",
+      "name": "publicKeyIn",
+      "kind": "function",
+      "signature": "export declare function publicKeyIn(file: string): import(\"@arki/failure\").Failure<\"env.file_read_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"schema.async_required\", undefined> | import(\"@arki/failure\").Failure<\"schema.invalid_input\", { issues: readonly import(\"@standard-schema/spec\").StandardSchemaV1.Issue[]; }> | import(\"@arki/failure\").Failure<\"schema.validator_defect\", undefined> | EnvPublicKey | undefined;",
+      "jsdocSummary": "The public key in a file's header, or `undefined` when it has none."
+    },
+    {
+      "subpath": "./node",
+      "name": "publicKeyOf",
+      "kind": "function",
+      "signature": "export declare function publicKeyOf(privateKey: EnvPrivateKey): EnvPublicKey;",
+      "jsdocSummary": "The compressed public key of an already validated private key."
+    },
+    {
+      "subpath": "./node",
+      "name": "readEnvValue",
+      "kind": "function",
+      "signature": "export declare function readEnvValue(document: EnvDocument, key: string): string | undefined;",
+      "jsdocSummary": "The last value of `key`, or `undefined`."
+    },
+    {
+      "subpath": "./node",
+      "name": "ReferenceFailed",
+      "kind": "variable",
+      "signature": "export declare const ReferenceFailed: import(\"@arki/failure\").FailureDefinition<\"env.reference_failed\", import(\"@standard-schema/spec\").StandardSchemaV1<{ scheme: string; }, { scheme: string; }>>;",
+      "jsdocSummary": "A secret provider rejected a read."
+    },
+    {
+      "subpath": "./node",
+      "name": "ReferenceOptions",
+      "kind": "type",
+      "signature": "export type ReferenceOptions = { readonly timeoutMs?: number; readonly signal?: AbortSignal; };",
+      "jsdocSummary": "The remaining aggregate budget and cooperative cancellation for a synchronous provider read."
+    },
+    {
+      "subpath": "./node",
+      "name": "ReferenceResolver",
+      "kind": "type",
+      "signature": "export type ReferenceResolver = (reference: string, options?: ReferenceOptions) => ReturnType<typeof runProvider>;",
+      "jsdocSummary": "A provider returns its value or the exact owned provider/cancellation/deadline outcomes."
+    },
+    {
+      "subpath": "./node",
+      "name": "referenceScheme",
+      "kind": "function",
+      "signature": "export declare function referenceScheme(value: string, resolvers: Readonly<Record<string, ReferenceResolver>>): string | undefined;",
+      "jsdocSummary": "Registered schemes are references; unknown URLs remain plain values."
+    },
+    {
+      "subpath": "./node",
+      "name": "removeEnvValue",
+      "kind": "function",
+      "signature": "export declare function removeEnvValue(text: string, key: string): string;",
+      "jsdocSummary": "The text without any assignment of `key`."
+    },
+    {
+      "subpath": "./node",
+      "name": "rotateEnvFiles",
+      "kind": "function",
+      "signature": "export declare function rotateEnvFiles(files: readonly string[], options: { readonly root: string; readonly env?: Readonly<Record<string, string | undefined>>; }): import(\"@arki/failure\").Failure<\"env.decryption_failed\", undefined> | import(\"@arki/failure\").Failure<\"env.encryption_failed\", undefined> | import(\"@arki/failure\").Failure<\"env.file_read_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.file_write_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.key_generation_failed\", undefined> | import(\"@arki/failure\").Failure<\"env.missing_private_key\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.rotation_incomplete\", { keysFile: string; completedFiles: number; totalFiles: number; }> | import(\"@arki/failure\").Failure<\"env.unrepresentable_value\", undefined> | import(\"@arki/failure\").Failure<\"schema.async_required\", undefined> | import(\"@arki/failure\").Failure<\"schema.invalid_input\", { issues: readonly import(\"@standard-schema/spec\").StandardSchemaV1.Issue[]; }> | import(\"@arki/failure\").Failure<\"schema.validator_defect\", undefined> | { privateKeyName: string; files: { file: string; values: number; }[]; keysFile: string; };",
+      "jsdocSummary": "Re-encrypt every file of one environment to a new keypair, in one step: decrypt everything first (so a wrong key changes nothing), then write each file, then the new private key. All `files` must share a file name (`.env.production`), because they share a key name."
+    },
+    {
+      "subpath": "./node",
+      "name": "RotateResult",
+      "kind": "type",
+      "signature": "export type RotateResult = { readonly privateKeyName: string; readonly files: readonly { readonly file: string; readonly values: number; }[]; /** Where the new private key was written. */ readonly keysFile: string; };",
+      "jsdocSummary": "What `rotateEnvFiles` did."
+    },
+    {
+      "subpath": "./node",
+      "name": "RotationIncomplete",
+      "kind": "variable",
+      "signature": "export declare const RotationIncomplete: import(\"@arki/failure\").FailureDefinition<\"env.rotation_incomplete\", import(\"@standard-schema/spec\").StandardSchemaV1<{ keysFile: string; completedFiles: number; totalFiles: number; }, { keysFile: string; completedFiles: number; totalFiles: number; }>>;",
+      "jsdocSummary": "Rotation stopped after its recovery keys were saved."
+    },
+    {
+      "subpath": "./node",
+      "name": "secretValues",
+      "kind": "function",
+      "signature": "export declare function secretValues(): readonly string[];",
+      "jsdocSummary": "Every value this process loaded from an encrypted or referenced entry: what log masking hides."
+    },
+    {
+      "subpath": "./node",
+      "name": "setEnvFileValue",
+      "kind": "function",
+      "signature": "export declare function setEnvFileValue(file: string, key: string, value: string, options: { readonly plain: boolean; }): boolean | import(\"@arki/failure\").Failure<\"env.encryption_failed\", undefined> | import(\"@arki/failure\").Failure<\"env.file_read_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.file_write_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.missing_public_key\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.unrepresentable_value\", undefined> | import(\"@arki/failure\").Failure<\"schema.async_required\", undefined> | import(\"@arki/failure\").Failure<\"schema.invalid_input\", { issues: readonly import(\"@standard-schema/spec\").StandardSchemaV1.Issue[]; }> | import(\"@arki/failure\").Failure<\"schema.validator_defect\", undefined>;",
+      "jsdocSummary": "Set `key` in `file`, encrypted to the file's public key unless `plain`. Returns `false` when the file already held exactly this plaintext value (an encrypted value is always rewritten, because the same plaintext never encrypts to the same bytes)."
+    },
+    {
+      "subpath": "./node",
+      "name": "setEnvValue",
+      "kind": "function",
+      "signature": "export declare function setEnvValue(text: string, key: string, value: string): string | import(\"@arki/failure\").Failure<\"env.unrepresentable_value\", undefined>;",
+      "jsdocSummary": "The text with `key` set to `value`. An existing assignment (the last one) is rewritten in place; a new key is appended. Every other line is kept as written."
+    },
+    {
+      "subpath": "./node",
+      "name": "UnrepresentableValue",
+      "kind": "variable",
+      "signature": "export declare const UnrepresentableValue: import(\"@arki/failure\").FailureDefinition<\"env.unrepresentable_value\", undefined>;",
+      "jsdocSummary": "A dotenv value has no lossless quoting."
+    },
+    {
+      "subpath": "./node",
+      "name": "writePrivateKey",
+      "kind": "function",
+      "signature": "export declare function writePrivateKey(keysPath: string, name: string, privateKey: EnvPrivateKey, comment: string, options?: { readonly preserve?: readonly EnvPrivateKey[]; }): import(\"@arki/failure\").Failure<\"env.file_read_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.file_write_failed\", { file: string; }> | import(\"@arki/failure\").Failure<\"env.unrepresentable_value\", undefined> | undefined;",
+      "jsdocSummary": "Store `privateKey` under `name` in a keys file, creating it with the dotenvx banner. An existing entry is replaced. The file is left readable by its owner only."
+    },
+    {
+      "subpath": "./presets",
+      "name": "commonPresets",
+      "kind": "variable",
+      "signature": "export declare const commonPresets: { string: (defaultValue?: string) => z.ZodDefault<z.ZodString> | z.ZodString; number: (defaultValue?: number) => z.ZodCoercedNumber<unknown> | z.ZodDefault<z.ZodCoercedNumber<unknown>>; port: (defaultValue?: number) => z.ZodDefault<z.ZodCoercedNumber<unknown>>; nodeEnv: () => z.ZodDefault<z.ZodEnum<{ development: \"development\"; production: \"production\"; test: \"test\"; }>>; boolean: (defaultValue?: boolean) => z.ZodPipe<z.ZodDefault<z.ZodEnum<{ 0: \"0\"; 1: \"1\"; false: \"false\"; true: \"true\"; }>>, z.ZodTransform<boolean, \"0\" | \"1\" | \"false\" | \"true\">>; logLevel: (defaultValue?: 'debug' | 'info' | 'warn' | 'error') => z.ZodDefault<z.ZodEnum<{ debug: \"debug\"; error: \"error\"; info: \"info\"; warn: \"warn\"; }>>; };",
+      "jsdocSummary": ""
+    },
+    {
+      "subpath": "./presets",
+      "name": "parsePresets",
+      "kind": "variable",
+      "signature": "export declare const parsePresets: { json: <T extends z.ZodType>(schema: T) => z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<unknown, string>>, T>; csvArray: <T extends z.ZodType>(itemSchema: T) => z.ZodPreprocess<z.ZodArray<T>, unknown>; csvSet: <T extends z.ZodType>(itemSchema: T) => z.ZodPreprocess<z.ZodArray<T>, unknown>; };",
+      "jsdocSummary": ""
+    },
+    {
+      "subpath": "./presets",
+      "name": "presets",
+      "kind": "variable",
+      "signature": "export declare const presets: { string: (defaultValue?: string) => import(\"zod\").ZodDefault<import(\"zod\").ZodString> | import(\"zod\").ZodString; number: (defaultValue?: number) => import(\"zod\").ZodCoercedNumber<unknown> | import(\"zod\").ZodDefault<import(\"zod\").ZodCoercedNumber<unknown>>; port: (defaultValue?: number) => import(\"zod\").ZodDefault<import(\"zod\").ZodCoercedNumber<unknown>>; nodeEnv: () => import(\"zod\").ZodDefault<import(\"zod\").ZodEnum<{ development: \"development\"; production: \"production\"; test: \"test\"; }>>; boolean: (defaultValue?: boolean) => import(\"zod\").ZodPipe<import(\"zod\").ZodDefault<import(\"zod\").ZodEnum<{ 0: \"0\"; 1: \"1\"; false: \"false\"; true: \"true\"; }>>, import(\"zod\").ZodTransform<boolean, \"0\" | \"1\" | \"false\" | \"true\">>; logLevel: (defaultValue?: 'debug' | 'info' | 'warn' | 'error') => import(\"zod\").ZodDefault<import(\"zod\").ZodEnum<{ debug: \"debug\"; error: \"error\"; info: \"info\"; warn: \"warn\"; }>>; json: <T extends import(\"zod\").ZodType>(schema: T) => import(\"zod\").ZodPipe<import(\"zod\").ZodPipe<import(\"zod\").ZodString, import(\"zod\").ZodTransform<unknown, string>>, T>; csvArray: <T extends import(\"zod\").ZodType>(itemSchema: T) => import(\"zod\").ZodPreprocess<import(\"zod\").ZodArray<T>, unknown>; csvSet: <T extends import(\"zod\").ZodType>(itemSchema: T) => import(\"zod\").ZodPreprocess<import(\"zod\").ZodArray<T>, unknown>; url: (defaultValue?: string) => import(\"zod\").ZodDefault<import(\"zod\").ZodURL> | import(\"zod\").ZodURL; databaseUrl: () => import(\"zod\").ZodURL; redisUrl: () => import(\"zod\").ZodURL; };",
+      "jsdocSummary": ""
+    },
+    {
+      "subpath": "./presets",
+      "name": "urlPresets",
+      "kind": "variable",
+      "signature": "export declare const urlPresets: { url: (defaultValue?: string) => z.ZodDefault<z.ZodURL> | z.ZodURL; databaseUrl: () => z.ZodURL; redisUrl: () => z.ZodURL; };",
+      "jsdocSummary": ""
+    }
+  ],
+  "groups": [],
+  "errorCodes": [
+    "env.cancelled",
+    "env.deadline",
+    "env.decryption_failed",
+    "env.encryption_failed",
+    "env.file_read_failed",
+    "env.file_write_failed",
+    "env.files_failed",
+    "env.invalid_environment",
+    "env.key_generation_failed",
+    "env.missing_private_key",
+    "env.missing_public_key",
+    "env.reference_failed",
+    "env.rotation_incomplete",
+    "env.unrepresentable_value"
+  ]
+}