@arki/env 0.0.11 → 0.2.0

package/dist/core/define-env.d.ts

@@ -1,19 +1,38 @@
 import type { CreateEnv, DefaultCombinedSchema } from '@t3-oss/env-core';
-import type { ZodType } from 'zod';
 import { createEnv } from '@t3-oss/env-core';
+import type { StandardSchemaV1 } from '@arki/schema';
+/**
+ * The process environment, or `undefined` on engines with no `process` (Hermes, browsers, Deno without
+ * Node compat). Reads through `globalThis` so a missing global is not a ReferenceError. Called only when
+ * the env is first read, never at import.
+ */
+export declare function processEnv(): Record<string, string | undefined> | undefined;
+/** The prefix of a value encrypted in a dotenvx-format env file (`@arki/env/node`). */
+export declare const ENCRYPTED_PREFIX = "encrypted:";
 /** The issue shape t3-oss hands to `onValidationError`, derived so it stays in sync with the lib. */
 type ValidationIssues = Parameters<NonNullable<Parameters<typeof createEnv>[0]['onValidationError']>>[0];
+/**
+ * Fold validation issues into a human-legible, log-pipeline-safe string. The t3-oss default handler
+ * logs `issues` as a raw object, which platforms like Coolify collapse to `[Object]` — so the var
+ * that actually failed never reaches the logs. A flat `  path: message` list survives transport.
+ */
+export declare function formatIssues(name: string | undefined, issues: ValidationIssues): string;
 /**
  * Thin, type-preserving wrapper over `@t3-oss/env-core`'s `createEnv`. Generic over the server,
  * client, shared and composed schemas so the parsed env keeps its exact inferred types — the wrapper
- * adds the ARKI defaults (auto `runtimeEnv`, prod-safe `skipValidation`, a legible labelled error
- * handler) without widening any value to `unknown`.
+ * adds the ARKI defaults (auto `runtimeEnv`, validation on in every environment, a legible labelled
+ * error handler) without widening any value to `unknown`.
+ *
+ * Every schema is a Standard Schema (Zod, Valibot, ArkType, or a hand-written `~standard` object); each
+ * value's type is the schema's OUTPUT, so defaults and coercions in the caller's schemas still apply.
+ * Validation is synchronous: a schema whose `validate` returns a Promise or throws makes the first read
+ * throw `UnexpectedFailure` with the canonical schema failure, never a validation error.
  *
  * `TPrefix` is kept as a string-literal generic on purpose: `createEnv` uses it to enforce that
  * client keys (and only client keys) carry the prefix. Widening it to `string` would make every
  * server key collapse to a type-level `ErrorMessage`, so the prefix must stay a literal.
  */
-export declare function defineEnv<TServer extends Record<string, ZodType>, TClient extends Record<string, ZodType> = NonNullable<unknown>, TShared extends Record<string, ZodType> = NonNullable<unknown>, const TPrefix extends string = '', const TExtends extends Record<string, unknown>[] = []>(config: {
+export declare function defineEnv<TServer extends Record<string, StandardSchemaV1>, TClient extends Record<string, StandardSchemaV1> = NonNullable<unknown>, TShared extends Record<string, StandardSchemaV1> = NonNullable<unknown>, const TPrefix extends string = '', const TExtends extends Record<string, unknown>[] = []>(config: {
     /**
      * Label shown in validation-error logs, e.g. `'@acme/backend'`. Without it a misconfigured
      * deploy logs a bare "Invalid environment variables" with no hint which env failed — exactly the
@@ -40,6 +59,12 @@ export declare function defineEnv<TServer extends Record<string, ZodType>, TClie
      */
     runtimeEnv?: Record<string, string | boolean | number | undefined>;
     options?: {
+        /**
+         * `true` skips schema validation: values pass through raw. Default: validate on the first read,
+         * in every environment, unless the process sets `SKIP_ENV_VALIDATION=1` (exactly `1`). That
+         * variable is the only implicit opt-out, meant for Docker build stages that prerender without
+         * secrets. `CI`, lint and `NODE_ENV` never skip.
+         */
         skipValidation?: boolean;
         /**
          * Treat empty-string env values as `undefined` so defaults apply (e.g. `PORT=` in `.env`, or a

package/dist/core/define-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define-env.d.ts","sourceRoot":"","sources":["../../src/core/define-env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,qGAAqG;AACrG,KAAK,gBAAgB,GAAG,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAkBzG;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CACvB,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EAC9D,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EAC9D,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,EAAE,EACjC,KAAK,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,EACrD,MAAM,EAAE;IACR;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wFAAwF;IACxF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qFAAqF;IACrF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACnE,OAAO,CAAC,EAAE;QACR,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;WAIG;QACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;QACjC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,KAAK,CAAC;KACzD,CAAC;CACH,GAAG,SAAS,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAsExE"}
+{"version":3,"file":"define-env.d.ts","sourceRoot":"","sources":["../../src/core/define-env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAOrD;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAI3E;AAED,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAK7C,qGAAqG;AACrG,KAAK,gBAAgB,GAAG,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzG;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAOvF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CACvB,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAChD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EACvE,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EACvE,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,EAAE,EACjC,KAAK,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,EACrD,MAAM,EAAE;IACR;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wFAAwF;IACxF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qFAAqF;IACrF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACnE,OAAO,CAAC,EAAE;QACR;;;;;WAKG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;WAIG;QACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;QACjC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,KAAK,CAAC;KACzD,CAAC;CACH,GAAG,SAAS,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CA6FxE"}

package/dist/core/define-env.js

@@ -1,15 +1,30 @@
 import { createEnv } from '@t3-oss/env-core';
+import { InvalidInput, orThrow, UnexpectedFailure } from '@arki/failure';
+import { parse, pathOf } from '@arki/schema';
+import { registerEnvDescription } from './describe.js';
+import { InvalidEnvironment } from './errors.js';
+/**
+ * The process environment, or `undefined` on engines with no `process` (Hermes, browsers, Deno without
+ * Node compat). Reads through `globalThis` so a missing global is not a ReferenceError. Called only when
+ * the env is first read, never at import.
+ */
+export function processEnv() {
+    // Typed as optional on purpose: the Node typings say `process` always exists, Hermes says otherwise.
+    const scope = globalThis;
+    return scope.process?.env;
+}
+/** The prefix of a value encrypted in a dotenvx-format env file (`@arki/env/node`). */
+export const ENCRYPTED_PREFIX = 'encrypted:';
+const STILL_ENCRYPTED_MESSAGE = 'still encrypted: start the process with `dot env run -- <cmd>`, or import `@arki/env/node/register` first';
 /**
  * Fold validation issues into a human-legible, log-pipeline-safe string. The t3-oss default handler
  * logs `issues` as a raw object, which platforms like Coolify collapse to `[Object]` — so the var
  * that actually failed never reaches the logs. A flat `  path: message` list survives transport.
  */
-function formatIssues(name, issues) {
+export function formatIssues(name, issues) {
     const label = name ? `[${name}] ` : '';
     const lines = issues.map(issue => {
-        const path = (issue.path ?? [])
-            .map(seg => (typeof seg === 'object' && seg !== null && 'key' in seg ? String(seg.key) : String(seg)))
-            .join('.');
+        const path = pathOf(issue).map(String).join('.');
         return `  ${path || '(root)'}: ${issue.message}`;
     });
     return `❌ ${label}Invalid environment variables:\n${lines.join('\n')}`;
@@ -17,8 +32,13 @@ function formatIssues(name, issues) {
 /**
  * Thin, type-preserving wrapper over `@t3-oss/env-core`'s `createEnv`. Generic over the server,
  * client, shared and composed schemas so the parsed env keeps its exact inferred types — the wrapper
- * adds the ARKI defaults (auto `runtimeEnv`, prod-safe `skipValidation`, a legible labelled error
- * handler) without widening any value to `unknown`.
+ * adds the ARKI defaults (auto `runtimeEnv`, validation on in every environment, a legible labelled
+ * error handler) without widening any value to `unknown`.
+ *
+ * Every schema is a Standard Schema (Zod, Valibot, ArkType, or a hand-written `~standard` object); each
+ * value's type is the schema's OUTPUT, so defaults and coercions in the caller's schemas still apply.
+ * Validation is synchronous: a schema whose `validate` returns a Promise or throws makes the first read
+ * throw `UnexpectedFailure` with the canonical schema failure, never a validation error.
  *
  * `TPrefix` is kept as a string-literal generic on purpose: `createEnv` uses it to enforce that
  * client keys (and only client keys) carry the prefix. Widening it to `string` would make every
@@ -33,7 +53,11 @@ export function defineEnv(config) {
     // consumed (boot, a request, a job). This is the same import/observe split
     // drizzle tables have: define everywhere, observe only at use.
     const build = () => {
-        const skipValidation = config.options?.skipValidation ?? (!!process.env.CI || process.env.NODE_ENV !== 'development');
+        // Validate everywhere the app runs, production included. The only implicit opt-out is the
+        // purpose-named SKIP_ENV_VALIDATION=1 (Docker build stages without secrets). Ambient variables
+        // like CI or the npm script name must never turn validation off: that would boot production on
+        // an unchecked config.
+        const skipValidation = config.options?.skipValidation ?? processEnv()?.SKIP_ENV_VALIDATION === '1';
         // Use the caller's explicit runtimeEnv when supplied (Vite client vars via import.meta.env, or
         // fallback aliases). Otherwise auto-build from every declared key (server + client + shared);
         // createEnv tolerates keys absent from process.env (they parse as undefined → optional/default).
@@ -43,22 +67,34 @@ export function defineEnv(config) {
         }
         else {
             runtimeEnv = {};
+            const source = processEnv();
             for (const key of Object.keys(config.server)) {
-                runtimeEnv[key] = process.env[key];
+                runtimeEnv[key] = source?.[key];
             }
             for (const key of Object.keys(config.client ?? {})) {
-                runtimeEnv[key] = process.env[key];
+                runtimeEnv[key] = source?.[key];
             }
             for (const key of Object.keys(config.shared ?? {})) {
-                runtimeEnv[key] = process.env[key];
+                runtimeEnv[key] = source?.[key];
             }
         }
         const onValidationError = config.options?.onValidationError ??
             ((issues) => {
                 const message = formatIssues(config.name, issues);
                 console.error(message);
-                throw new Error(message);
+                // A configuration fault at boot: a typed failure, so a catcher can match on the code.
+                throw new UnexpectedFailure(InvalidEnvironment({ report: message }));
             });
+        // A value that is still `encrypted:` means the env files were not loaded (Bun auto-loads them
+        // as they are, ciphertext included). A string schema would accept it, so refuse it here, by name.
+        if (!skipValidation) {
+            const stillEncrypted = Object.keys(runtimeEnv).filter(key => {
+                const value = runtimeEnv[key];
+                return typeof value === 'string' && value.startsWith(ENCRYPTED_PREFIX);
+            });
+            if (stillEncrypted.length > 0)
+                onValidationError(stillEncrypted.map(key => ({ message: STILL_ENCRYPTED_MESSAGE, path: [key] })));
+        }
         // `createEnv`'s `server`/`client` params are conditional on `clientPrefix` being a *concrete*
         // string literal; inside a generic wrapper `TPrefix` is abstract, so the body cannot be verified
         // for all prefixes and the call argument must be asserted once. The PUBLIC contract stays exact:
@@ -66,10 +102,10 @@ export function defineEnv(config) {
         // caller's `server`/`client`/`extends` are fully type-checked against `TServer`/`TClient`/`TExtends`
         // at the call site. This is the only seam where types are asserted — value types are never widened.
         const options = {
-            shared: config.shared ?? {},
+            shared: syncSchemas(config.shared),
             extends: config.extends,
-            server: config.server,
-            client: config.client ?? {},
+            server: syncSchemas(config.server),
+            client: syncSchemas(config.client),
             clientPrefix: config.clientPrefix ?? '',
             runtimeEnv,
             skipValidation,
@@ -85,7 +121,41 @@ export function defineEnv(config) {
         const isPrivate = skipValidation ? config.runtimeEnv === undefined : isServer();
         return { env, isPrivate };
     };
-    return lazyEnv(build);
+    const env = lazyEnv(build);
+    registerEnvDescription(env, {
+        ...(config.name === undefined ? {} : { name: config.name }),
+        server: config.server,
+        ...(config.client === undefined ? {} : { client: config.client }),
+        ...(config.shared === undefined ? {} : { shared: config.shared }),
+        ...(config.extends === undefined ? {} : { extends: config.extends }),
+    });
+    return env;
+}
+/**
+ * The caller's schemas, each run through `parse` before t3 sees it. t3 would let a throwing validator's
+ * raw error escape and report an async one with its own error (leaving a rejection unhandled). Here both
+ * fail as `UnexpectedFailure` (canonical validator defect with its private cause, or async mismatch), and bad values still reach t3 as issues.
+ */
+function syncSchemas(schemas) {
+    const wrapped = {};
+    for (const [key, schema] of Object.entries(schemas ?? {}))
+        wrapped[key] = syncSchema(schema);
+    return wrapped;
+}
+/** Same `version`, `vendor` and `types` as `schema`; only `validate` changes. */
+function syncSchema(schema) {
+    return {
+        '~standard': {
+            ...schema['~standard'],
+            validate: value => {
+                const result = parse(schema, value);
+                if (InvalidInput.is(result))
+                    return { issues: result.data.issues };
+                // env-core expects validator defects to throw; bridge that foreign contract explicitly.
+                return { value: orThrow(result) };
+            },
+        },
+    };
 }
 /**
  * Reads an env takes through the lazy view before it copies the values for fast reads. A copy costs

package/dist/core/define-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"define-env.js","sourceRoot":"","sources":["../../src/core/define-env.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAK7C;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAwB,EAAE,MAAwB;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QAC/B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;aAC5B,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;aACrG,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,KAAK,IAAI,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,KAAK,mCAAmC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAMvB,MAoCD;IAGC,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,GAAkB,EAAE;QAChC,MAAM,cAAc,GAClB,MAAM,CAAC,OAAO,EAAE,cAAc,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC;QAEjG,+FAA+F;QAC/F,8FAA8F;QAC9F,iGAAiG;QACjG,IAAI,UAAiE,CAAC;QACtE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,EAAE,CAAC;YAChB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7C,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;gBACnD,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;gBACnD,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,GACrB,MAAM,CAAC,OAAO,EAAE,iBAAiB;YACjC,CAAC,CAAC,MAAwB,EAAS,EAAE;gBACnC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAClD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC;QAEL,8FAA8F;QAC9F,iGAAiG;QACjG,iGAAiG;QACjG,kGAAkG;QAClG,qGAAqG;QACrG,oGAAoG;QACpG,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACvC,UAAU;YACV,cAAc;YACd,6FAA6F;YAC7F,gGAAgG;YAChG,wFAAwF;YACxF,sBAAsB,EAAE,MAAM,CAAC,OAAO,EAAE,sBAAsB,IAAI,IAAI;YACtE,iBAAiB;SACgB,CAAC;QAEpC,MAAM,GAAG,GAAG,SAAS,CAAC,OAA0C,CAAW,CAAC;QAC5E,0FAA0F;QAC1F,kGAAkG;QAClG,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAKD;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;;;;;;;;GAcG;AACH,SAAS,OAAO,CAAmB,KAAqB;IACtD,IAAI,KAAoB,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,MAAM,GAAiC,EAAE,CAAC;IAEhD,MAAM,OAAO,GAAG,GAAM,EAAE;QACtB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;QACvB,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC;QACnB,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,QAAW,EAAQ,EAAE;QACjC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,OAAO,GAA+C;QAC1D,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACzB,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC;YAC3B,IAAI,OAAO,IAAI,EAAE,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBAC5C,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACf,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;YACD,OAAO,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAChC,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,EAAE,IAAI,MAAM;gBAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC5E,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,cAAc,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACpC,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAI,EAAE,IAAI,MAAM;gBAAE,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC3D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QACvD,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC;QAC5D,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzC,wBAAwB,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC;KACtG,CAAC;IAEF,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,CAAM,CAAC;AACzC,CAAC;AAED,yFAAyF;AACzF,SAAS,QAAQ;IACf,MAAM,EAAE,MAAM,EAAE,GAAG,UAAiC,CAAC;IACrD,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC;AAClD,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,QAAgB,EAAE,QAAqB;IACxD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjE,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAyC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzG,CAAC;AAED,sGAAsG;AACtG,SAAS,QAAQ,CAAC,MAAoC,EAAE,GAAgB,EAAE,KAAc;IACtF,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACtG,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;AACH,CAAC"}
+{"version":3,"file":"define-env.js","sourceRoot":"","sources":["../../src/core/define-env.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,qGAAqG;IACrG,MAAM,KAAK,GAA8D,UAAU,CAAC;IACpF,OAAO,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC;AAC5B,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C,MAAM,uBAAuB,GAC3B,2GAA2G,CAAC;AAK9G;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAwB,EAAE,MAAwB;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,OAAO,KAAK,IAAI,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,KAAK,mCAAmC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,SAAS,CAMvB,MA0CD;IAGC,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,GAAkB,EAAE;QAChC,0FAA0F;QAC1F,+FAA+F;QAC/F,+FAA+F;QAC/F,uBAAuB;QACvB,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,EAAE,cAAc,IAAI,UAAU,EAAE,EAAE,mBAAmB,KAAK,GAAG,CAAC;QAEnG,+FAA+F;QAC/F,8FAA8F;QAC9F,iGAAiG;QACjG,IAAI,UAAiE,CAAC;QACtE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7C,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;gBACnD,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;gBACnD,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,GACrB,MAAM,CAAC,OAAO,EAAE,iBAAiB;YACjC,CAAC,CAAC,MAAwB,EAAS,EAAE;gBACnC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAClD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACvB,sFAAsF;gBACtF,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACvE,CAAC,CAAC,CAAC;QAEL,8FAA8F;QAC9F,kGAAkG;QAClG,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;gBAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;YACH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;gBAAE,iBAAiB,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnI,CAAC;QAED,8FAA8F;QAC9F,iGAAiG;QACjG,iGAAiG;QACjG,kGAAkG;QAClG,qGAAqG;QACrG,oGAAoG;QACpG,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;YAClC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;YAClC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;YAClC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACvC,UAAU;YACV,cAAc;YACd,6FAA6F;YAC7F,gGAAgG;YAChG,wFAAwF;YACxF,sBAAsB,EAAE,MAAM,CAAC,OAAO,EAAE,sBAAsB,IAAI,IAAI;YACtE,iBAAiB;SACgB,CAAC;QAEpC,MAAM,GAAG,GAAG,SAAS,CAAC,OAA0C,CAAW,CAAC;QAC5E,0FAA0F;QAC1F,kGAAkG;QAClG,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,sBAAsB,CAAC,GAAG,EAAE;QAC1B,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;KACrE,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,OAAqD;IACxE,MAAM,OAAO,GAAqC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7F,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAgB,MAAuC;IACxE,OAAO;QACL,WAAW,EAAE;YACX,GAAG,MAAM,CAAC,WAAW,CAAC;YACtB,QAAQ,EAAE,KAAK,CAAC,EAAE;gBAChB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACpC,IAAI,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACnE,wFAAwF;gBACxF,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAKD;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;;;;;;;;GAcG;AACH,SAAS,OAAO,CAAmB,KAAqB;IACtD,IAAI,KAAoB,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,MAAM,GAAiC,EAAE,CAAC;IAEhD,MAAM,OAAO,GAAG,GAAM,EAAE;QACtB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;QACvB,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC;QACnB,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,QAAW,EAAQ,EAAE;QACjC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,OAAO,GAA+C;QAC1D,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACzB,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC;YAC3B,IAAI,OAAO,IAAI,EAAE,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBAC5C,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACf,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;YACD,OAAO,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAChC,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,EAAE,IAAI,MAAM;gBAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC5E,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,cAAc,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACpC,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAI,EAAE,IAAI,MAAM;gBAAE,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC3D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QACvD,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC;QAC5D,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzC,wBAAwB,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC;KACtG,CAAC;IAEF,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,CAAM,CAAC;AACzC,CAAC;AAED,yFAAyF;AACzF,SAAS,QAAQ;IACf,MAAM,EAAE,MAAM,EAAE,GAAG,UAAiC,CAAC;IACrD,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC;AAClD,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,QAAgB,EAAE,QAAqB;IACxD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjE,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAyC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzG,CAAC;AAED,sGAAsG;AACtG,SAAS,QAAQ,CAAC,MAAoC,EAAE,GAAgB,EAAE,KAAc;IACtF,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACtG,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/core/describe.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `describeEnv(env)`: the keys an env built by `defineEnv` declares, which of them are `secret()`,
+ * and where they live. It reads the declaration only, never a value, so tools (`dot env check`) can
+ * use it on a bare checkout.
+ */
+import type { StandardSchemaV1 } from '@arki/schema';
+/** One declared key. */
+export type EnvKeyDescription = {
+    readonly key: string;
+    /** Declared with `secret()`: must never be plaintext in a tracked file. */
+    readonly secret: boolean;
+    readonly scope: 'server' | 'client' | 'shared';
+};
+/** What an env declares, its `extends` included. */
+export type EnvDescription = {
+    readonly name?: string;
+    readonly keys: readonly EnvKeyDescription[];
+};
+/** The description of an env built by `defineEnv`, or `undefined` for any other object. */
+export declare function describeEnv(env: object): EnvDescription | undefined;
+/** Called by `defineEnv` once per env. Later scopes and the env's own keys win over `extends`. */
+export declare function registerEnvDescription(env: object, declaration: {
+    readonly name?: string;
+    readonly server: Record<string, StandardSchemaV1>;
+    readonly client?: Record<string, StandardSchemaV1>;
+    readonly shared?: Record<string, StandardSchemaV1>;
+    readonly extends?: readonly object[];
+}): void;
+//# sourceMappingURL=describe.d.ts.map

package/dist/core/describe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../src/core/describe.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIrD,wBAAwB;AACxB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;CAChD,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAAE,CAAC;AAIrG,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEnE;AAED,kGAAkG;AAClG,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE;IACX,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GACA,IAAI,CAcN"}

package/dist/core/describe.js

@@ -0,0 +1,25 @@
+import { isSecretSchema } from './secret.js';
+const descriptions = new WeakMap();
+/** The description of an env built by `defineEnv`, or `undefined` for any other object. */
+export function describeEnv(env) {
+    return descriptions.get(env);
+}
+/** Called by `defineEnv` once per env. Later scopes and the env's own keys win over `extends`. */
+export function registerEnvDescription(env, declaration) {
+    const keys = new Map();
+    for (const base of declaration.extends ?? []) {
+        for (const key of describeEnv(base)?.keys ?? [])
+            keys.set(key.key, key);
+    }
+    const scopes = [
+        ['shared', declaration.shared],
+        ['client', declaration.client],
+        ['server', declaration.server],
+    ];
+    for (const [scope, schemas] of scopes) {
+        for (const [key, schema] of Object.entries(schemas ?? {}))
+            keys.set(key, { key, secret: isSecretSchema(schema), scope });
+    }
+    descriptions.set(env, declaration.name === undefined ? { keys: [...keys.values()] } : { name: declaration.name, keys: [...keys.values()] });
+}
+//# sourceMappingURL=describe.js.map

package/dist/core/describe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe.js","sourceRoot":"","sources":["../../src/core/describe.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAa7C,MAAM,YAAY,GAAG,IAAI,OAAO,EAA0B,CAAC;AAE3D,2FAA2F;AAC3F,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,WAMC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG;QACb,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC;QAC9B,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC;QAC9B,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC;KACtB,CAAC;IACX,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAC9I,CAAC"}

package/dist/core/errors.d.ts

@@ -0,0 +1,10 @@
+/** The process environment does not match the schema, so the app must not boot.
+ * @fix Set or correct the variables listed in the report, then start the app again.
+ * @verify bun run test -- src/core/define-env.test.ts
+ */
+export declare const InvalidEnvironment: import("@arki/failure").FailureDefinition<"env.invalid_environment", import("@standard-schema/spec").StandardSchemaV1<{
+    report: string;
+}, {
+    report: string;
+}>>;
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;GAK7B,CAAC"}

package/dist/core/errors.js

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+import { defineFailure } from '@arki/failure';
+/** The process environment does not match the schema, so the app must not boot.
+ * @fix Set or correct the variables listed in the report, then start the app again.
+ * @verify bun run test -- src/core/define-env.test.ts
+ */
+export const InvalidEnvironment = /* @__PURE__ */ defineFailure('env.invalid_environment', {
+    status: 500,
+    data: z.object({ report: z.string() }),
+    message: data => data.report,
+    remediation: 'Set or correct the variables listed in the report, then start the app again.',
+});
+//# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC,aAAa,CAAC,yBAAyB,EAAE;IACzF,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM;IAC5B,WAAW,EAAE,8EAA8E;CAC5F,CAAC,CAAC"}

package/dist/core/index.d.ts

@@ -1,3 +1,8 @@
-export { defineEnv } from './define-env.js';
-export { contracts } from '../contracts/index.js';
+/** `defineEnv()` plus `secret()`, `reveal()` and `Redacted` for typed, lazily validated environments. */
+export { defineEnv, formatIssues } from './define-env.js';
+export { InvalidEnvironment } from './errors.js';
+export { isSecretSchema, Redacted, reveal, secret, SECRET_SCHEMA } from './secret.js';
+export { describeEnv } from './describe.js';
+export type { EnvDescription, EnvKeyDescription } from './describe.js';
+export { presets } from '../presets/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/core/index.js

@@ -1,3 +1,7 @@
-export { defineEnv } from './define-env.js';
-export { contracts } from '../contracts/index.js';
+/** `defineEnv()` plus `secret()`, `reveal()` and `Redacted` for typed, lazily validated environments. */
+export { defineEnv, formatIssues } from './define-env.js';
+export { InvalidEnvironment } from './errors.js';
+export { isSecretSchema, Redacted, reveal, secret, SECRET_SCHEMA } from './secret.js';
+export { describeEnv } from './describe.js';
+export { presets } from '../presets/index.js';
 //# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/core/secret.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Secrets that cannot leak by accident.
+ *
+ * `secret(schema)` parses a variable as usual and wraps the result in a
+ * {@link Redacted}. Printing it, logging it, serialising it or putting it in a
+ * template string all show `[redacted]`. Reading the value takes a deliberate,
+ * greppable `reveal(env.KEY)` call at the one place that needs it.
+ *
+ * Redaction guards against accidents (a logged config object, an error
+ * message with the env in it). It is not encryption: code that calls
+ * `reveal` gets the plain value.
+ */
+import type { SchemaInput, SchemaOutput, StandardSchemaV1 } from '@arki/schema';
+/** Node's `util.inspect` hook, so `console.log(env)` shows `[redacted]` too. */
+declare const inspect: unique symbol;
+/** A value that prints as `[redacted]`. Read it with {@link reveal}. */
+export declare class Redacted<Value = string> {
+    #private;
+    constructor(value: Value);
+    toString(): string;
+    toJSON(): string;
+    [inspect](): string;
+}
+/** What {@link secret} returns: a Standard Schema whose output is redacted, with an `.optional()` variant. */
+export type SecretSchema<Schema extends StandardSchemaV1> = StandardSchemaV1<SchemaInput<Schema>, Redacted<SchemaOutput<Schema>>> & {
+    readonly [SECRET_SCHEMA]: true;
+    /** Accepts a missing variable. `undefined` passes through as `undefined`, never redacted. */
+    optional(): StandardSchemaV1<SchemaInput<Schema> | undefined, Redacted<SchemaOutput<Schema>> | undefined> & {
+        readonly [SECRET_SCHEMA]: true;
+    };
+};
+/** Marks a schema built by {@link secret}, so `describeEnv` can tell secrets apart. */
+export declare const SECRET_SCHEMA: unique symbol;
+/** True for a schema built by {@link secret} (or its `.optional()`). */
+export declare function isSecretSchema(schema: StandardSchemaV1): boolean;
+/**
+ * Validate with `schema` (any Standard Schema), then wrap the value in a {@link Redacted}. For an
+ * optional secret, call `.optional()`: `secret(z.string()).optional()`. The inner result passes
+ * straight through: an async inner schema yields a promise, so `defineEnv`'s synchronous check
+ * fails with the same `UnexpectedFailure` it would give without `secret`, and a throwing validator
+ * still throws.
+ *
+ * @example
+ * const env = defineEnv({ server: { STRIPE_KEY: secret(z.string().min(1)) } });
+ * console.log(env.STRIPE_KEY);          // [redacted]
+ * stripe(reveal(env.STRIPE_KEY));       // the key
+ */
+export declare function secret<Schema extends StandardSchemaV1>(schema: Schema): SecretSchema<Schema>;
+/**
+ * The plain value of a secret. Also takes the raw value, because when
+ * validation is skipped (`skipValidation`, or `CI` builds) schemas do not run
+ * and the variable is still a plain string.
+ */
+export declare function reveal<Value>(value: Redacted<Value> | Value): Value;
+export {};
+//# sourceMappingURL=secret.d.ts.map

package/dist/core/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../../src/core/secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKhF,gFAAgF;AAChF,QAAA,MAAM,OAAO,EAAE,OAAO,MAAiD,CAAC;AAKxE,wEAAwE;AACxE,qBAAa,QAAQ,CAAC,KAAK,GAAG,MAAM;;IAQlC,YAAY,KAAK,EAAE,KAAK,EAEvB;IAED,QAAQ,IAAI,MAAM,CAEjB;IAED,MAAM,IAAI,MAAM,CAEf;IAED,CAAC,OAAO,CAAC,IAAI,MAAM,CAElB;CACF;AAED,8GAA8G;AAC9G,MAAM,MAAM,YAAY,CAAC,MAAM,SAAS,gBAAgB,IAAI,gBAAgB,CAC1E,WAAW,CAAC,MAAM,CAAC,EACnB,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAC/B,GAAG;IACF,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC;IAC/B,6FAA6F;IAC7F,QAAQ,IAAI,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG;QAC1G,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC;KAChC,CAAC;CACH,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,aAAa,EAAE,OAAO,MAAsC,CAAC;AAE1E,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAEhE;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,MAAM,CAAC,MAAM,SAAS,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CA6B5F;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,KAAK,CAEnE"}

package/dist/core/secret.js

@@ -0,0 +1,85 @@
+/** What a redacted value prints as, everywhere. */
+const REDACTED_TEXT = '[redacted]';
+/** Node's `util.inspect` hook, so `console.log(env)` shows `[redacted]` too. */
+const inspect = Symbol.for('nodejs.util.inspect.custom');
+/** Reads the private value. Assigned in the class's static block, so only this module can read it. */
+let read;
+/** A value that prints as `[redacted]`. Read it with {@link reveal}. */
+export class Redacted {
+    // A private field: invisible to JSON, `Object.keys`, spreading and `util.inspect`.
+    #value;
+    static {
+        read = redacted => redacted.#value;
+    }
+    constructor(value) {
+        this.#value = value;
+    }
+    toString() {
+        return REDACTED_TEXT;
+    }
+    toJSON() {
+        return REDACTED_TEXT;
+    }
+    [inspect]() {
+        return REDACTED_TEXT;
+    }
+}
+/** Marks a schema built by {@link secret}, so `describeEnv` can tell secrets apart. */
+export const SECRET_SCHEMA = Symbol.for('arki.env.secret');
+/** True for a schema built by {@link secret} (or its `.optional()`). */
+export function isSecretSchema(schema) {
+    return SECRET_SCHEMA in schema;
+}
+/**
+ * What every issue of a rejected secret says. Vendors such as valibot put the received value in
+ * their messages (`Received "sk_live_…"`), and `defineEnv` logs and throws issues, so a secret's
+ * issues keep only their path.
+ */
+const HIDDEN_ISSUE_MESSAGE = 'Invalid secret (details hidden so the value cannot leak)';
+/**
+ * Validate with `schema` (any Standard Schema), then wrap the value in a {@link Redacted}. For an
+ * optional secret, call `.optional()`: `secret(z.string()).optional()`. The inner result passes
+ * straight through: an async inner schema yields a promise, so `defineEnv`'s synchronous check
+ * fails with the same `UnexpectedFailure` it would give without `secret`, and a throwing validator
+ * still throws.
+ *
+ * @example
+ * const env = defineEnv({ server: { STRIPE_KEY: secret(z.string().min(1)) } });
+ * console.log(env.STRIPE_KEY);          // [redacted]
+ * stripe(reveal(env.STRIPE_KEY));       // the key
+ */
+export function secret(schema) {
+    const { version, vendor } = schema['~standard'];
+    const seal = (result) => result.issues === undefined
+        ? { value: new Redacted(result.value) }
+        : {
+            issues: result.issues.map(issue => issue.path === undefined
+                ? { message: HIDDEN_ISSUE_MESSAGE }
+                : { message: HIDDEN_ISSUE_MESSAGE, path: issue.path }),
+        };
+    const redact = (value) => {
+        const result = schema['~standard'].validate(value);
+        return result instanceof Promise ? result.then(seal) : seal(result);
+    };
+    return {
+        [SECRET_SCHEMA]: true,
+        '~standard': { version, vendor, validate: redact },
+        optional: () => ({
+            [SECRET_SCHEMA]: true,
+            '~standard': {
+                version,
+                vendor,
+                validate: value => (value === undefined ? { value: undefined } : redact(value)),
+            },
+        }),
+    };
+}
+/**
+ * The plain value of a secret. Also takes the raw value, because when
+ * validation is skipped (`skipValidation`, or `CI` builds) schemas do not run
+ * and the variable is still a plain string.
+ */
+export function reveal(value) {
+    return value instanceof Redacted ? read(value) : value;
+}
+//# sourceMappingURL=secret.js.map

package/dist/core/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/core/secret.ts"],"names":[],"mappings":"AAcA,mDAAmD;AACnD,MAAM,aAAa,GAAG,YAAY,CAAC;AAEnC,gFAAgF;AAChF,MAAM,OAAO,GAAkB,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AAExE,sGAAsG;AACtG,IAAI,IAAiD,CAAC;AAEtD,wEAAwE;AACxE,MAAM,OAAO,QAAQ;IACnB,mFAAmF;IAC1E,MAAM,CAAQ;IAEvB;QACE,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,CAAC;IAED,YAAY,KAAY;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,QAAQ;QACN,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM;QACJ,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,CAAC,OAAO,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;CACF;AAcD,uFAAuF;AACvF,MAAM,CAAC,MAAM,aAAa,GAAkB,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAE1E,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,MAAwB;IACrD,OAAO,aAAa,IAAI,MAAM,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,0DAA0D,CAAC;AAExF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,MAAM,CAAkC,MAAc;IACpE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,CAAC,MAAqD,EAAU,EAAE,CAC7E,MAAM,CAAC,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACvC,CAAC,CAAC;YACE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAChC,KAAK,CAAC,IAAI,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE;gBACnC,CAAC,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CACxD;SACF,CAAC;IACR,MAAM,MAAM,GAAG,CAAC,KAAc,EAA4B,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnD,OAAO,MAAM,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC,CAAC;IACF,OAAO;QACL,CAAC,aAAa,CAAC,EAAE,IAAI;QACrB,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;QAClD,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YACf,CAAC,aAAa,CAAC,EAAE,IAAI;YACrB,WAAW,EAAE;gBACX,OAAO;gBACP,MAAM;gBACN,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aAChF;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAQ,KAA8B;IAC1D,OAAO,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC"}