@arki/env 0.0.11 → 0.2.0

package/dist/errors.json

@@ -0,0 +1,128 @@
+[
+  {
+    "code": "env.cancelled",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "Loading was cancelled.",
+    "fix": "Handle cancellation at the calling boundary.",
+    "verify": "bun run test",
+    "source": "src/node/errors.ts:108"
+  },
+  {
+    "code": "env.deadline",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "The aggregate load deadline elapsed.",
+    "fix": "Increase the budget or restore provider responsiveness.",
+    "verify": "bun run test",
+    "source": "src/node/errors.ts:117"
+  },
+  {
+    "code": "env.decryption_failed",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "Ciphertext authentication or decoding failed.",
+    "fix": "Restore the correct private key or reset the damaged value.",
+    "verify": "bun run test",
+    "source": "src/node/errors.ts:27"
+  },
+  {
+    "code": "env.encryption_failed",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "Cryptographic encryption failed.",
+    "fix": "Verify the public key and runtime crypto support.",
+    "verify": "bun run test",
+    "source": "src/node/errors.ts:18"
+  },
+  {
+    "code": "env.file_read_failed",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "An env file could not be read.",
+    "fix": "Check the path, file type and access permissions.",
+    "verify": "bun run test",
+    "source": "src/node/errors.ts:45"
+  },
+  {
+    "code": "env.file_write_failed",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "An env file could not be replaced.",
+    "fix": "Check disk space and parent-directory permissions.",
+    "verify": "bun run test",
+    "source": "src/node/errors.ts:55"
+  },
+  {
+    "code": "env.files_failed",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "One or more env entries could not be loaded. Public data excludes values and raw causes.",
+    "fix": "Address each named problem before starting the app.",
+    "verify": "bun run test",
+    "source": "src/node/errors.ts:142"
+  },
+  {
+    "code": "env.invalid_environment",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "The process environment does not match the schema, so the app must not boot.",
+    "fix": "Set or correct the variables listed in the report, then start the app again.",
+    "verify": "bun run test -- src/core/define-env.test.ts",
+    "source": "src/core/errors.ts:9"
+  },
+  {
+    "code": "env.key_generation_failed",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "The runtime could not generate a keypair.",
+    "fix": "Restore runtime crypto support.",
+    "verify": "bun run test",
+    "source": "src/node/errors.ts:36"
+  },
+  {
+    "code": "env.missing_private_key",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "No private key is available.",
+    "fix": "Restore the environment key from its backup.",
+    "verify": "bun run test",
+    "source": "src/node/errors.ts:74"
+  },
+  {
+    "code": "env.missing_public_key",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "The target file has no public key.",
+    "fix": "Initialize the file before encrypting values.",
+    "verify": "bun run test",
+    "source": "src/node/errors.ts:65"
+  },
+  {
+    "code": "env.reference_failed",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "A secret provider rejected a read.",
+    "fix": "Check the provider CLI installation, login and reference.",
+    "verify": "bun run test",
+    "source": "src/node/errors.ts:98"
+  },
+  {
+    "code": "env.rotation_incomplete",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "Rotation stopped after its recovery keys were saved.",
+    "fix": "Keep the staged key file and retry rotation.",
+    "verify": "bun run test",
+    "source": "src/node/errors.ts:83"
+  },
+  {
+    "code": "env.unrepresentable_value",
+    "package": "@arki/env",
+    "kind": "failure",
+    "what": "A dotenv value has no lossless quoting.",
+    "fix": "Use encryption or a value supported by dotenv quoting.",
+    "verify": "bun run test",
+    "source": "src/node/errors.ts:9"
+  }
+]

package/dist/index.d.ts

@@ -1,2 +1,3 @@
-export { contracts } from './contracts/index.js';
+/** The `presets` namespace of ready-made variable shapes, for `defineEnv()`. */
+export { presets } from './presets/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -1,3 +1,4 @@
-// Re-export contracts for convenience
-export { contracts } from './contracts/index.js';
+/** The `presets` namespace of ready-made variable shapes, for `defineEnv()`. */
+// Re-export presets for convenience
+export { presets } from './presets/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,oCAAoC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/node/codec.d.ts

@@ -0,0 +1,63 @@
+import type { EnvPrivateKey, EnvPublicKey } from './key-schemas.js';
+export { ENCRYPTED_PREFIX } from '../core/define-env.js';
+/** One `KEY=value` assignment: its decoded value and the lines it spans (`end` exclusive). */
+export type EnvEntry = {
+    readonly key: string;
+    readonly value: string;
+    readonly start: number;
+    readonly end: number;
+};
+/** A parsed `.env` file: its lines as written, and every assignment in order. */
+export type EnvDocument = {
+    readonly lines: readonly string[];
+    readonly entries: readonly EnvEntry[];
+};
+/** A keypair as dotenvx writes it: a compressed public key (66 hex chars), a private key (64). */
+export type EnvKeypair = {
+    readonly publicKey: EnvPublicKey;
+    readonly privateKey: EnvPrivateKey;
+};
+/**
+ * Parse `.env` text the way `dotenv` reads it: `export` prefixes, `#` comments, single, double and
+ * backtick quotes, multi-line quoted values, and `\n` / `\r` expanded inside double quotes. An
+ * unquoted value ends at the first `#`. A key that appears twice keeps both entries; readers take the
+ * last one, as dotenv does.
+ */
+export declare function parseEnv(text: string): EnvDocument;
+/** The last value of `key`, or `undefined`. */
+export declare function readEnvValue(document: EnvDocument, key: string): string | undefined;
+/** Every key with its last value, in first-seen order. */
+export declare function envValues(document: EnvDocument): Map<string, EnvEntry>;
+/**
+ * The text with `key` set to `value`. An existing assignment (the last one) is rewritten in place;
+ * a new key is appended. Every other line is kept as written.
+ */
+export declare function setEnvValue(text: string, key: string, value: string): string | import("@arki/failure").Failure<"env.unrepresentable_value", undefined>;
+/** The text without any assignment of `key`. */
+export declare function removeEnvValue(text: string, key: string): string;
+/** True for a value written by {@link encryptValue} (or by dotenvx). */
+export declare function isEncrypted(value: string): boolean;
+/** Encrypt `value` to a compressed or uncompressed secp256k1 public key (hex). */
+export declare function encryptValue(value: string, publicKey: EnvPublicKey): string | import("@arki/failure").Failure<"env.encryption_failed", undefined>;
+/** Decrypt authenticated UTF-8, or return DecryptionFailed when the ciphertext/key does not match. */
+export declare function decryptValue(value: string, privateKey: EnvPrivateKey): string | import("@arki/failure").Failure<"env.decryption_failed", undefined>;
+/** A new random keypair. */
+export declare function generateKeypair(): import("@arki/failure").Failure<"env.key_generation_failed", undefined> | {
+    publicKey: EnvPublicKey;
+    privateKey: EnvPrivateKey;
+};
+/** The compressed public key of an already validated private key. */
+export declare function publicKeyOf(privateKey: EnvPrivateKey): EnvPublicKey;
+/**
+ * The key names dotenvx uses for a file: `.env` → `DOTENV_PUBLIC_KEY` / `DOTENV_PRIVATE_KEY`,
+ * `.env.production` → `..._PRODUCTION`, `.env.ci.local` → `..._CI_LOCAL`.
+ */
+export declare function keyNamesFor(fileName: string): {
+    readonly publicKey: string;
+    readonly privateKey: string;
+};
+/** True for the `DOTENV_PUBLIC_KEY*` / `DOTENV_PRIVATE_KEY*` names, which are never app values. */
+export declare function isKeyName(key: string): boolean;
+/** The dotenvx header for a file: banner, public key, and a `# <file>` line. */
+export declare function envHeader(fileName: string, publicKey: EnvPublicKey): string;
+//# sourceMappingURL=codec.d.ts.map

package/dist/node/codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../../src/node/codec.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAKpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAQzD,8FAA8F;AAC9F,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;CACvC,CAAC;AAEF,kGAAkG;AAClG,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAA;CAAE,CAAC;AAElG;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAmBlD;AAED,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnF;AAED,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,QAAQ,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAItE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,oFAYnE;AAED,gDAAgD;AAChD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQhE;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,gFAQlE;AAED,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,gFASpE;AAED,4BAA4B;AAC5B,wBAAgB,eAAe;;;EAW9B;AAED,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,UAAU,EAAE,aAAa,GAAG,YAAY,CAEnE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CASzG;AAED,mGAAmG;AACnG,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9C;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,GAAG,MAAM,CAU3E"}

package/dist/node/codec.js

@@ -0,0 +1,182 @@
+/**
+ * The dotenvx 2.x file format: parse and edit `.env` text without losing a byte of the lines you
+ * did not touch, and encrypt or decrypt one value.
+ *
+ * A value is encrypted as `encrypted:` + base64 of ECIES over secp256k1 (HKDF-SHA256, AES-256-GCM,
+ * an ephemeral key per value), exactly what `eciesjs` produces with its defaults. The same bytes are
+ * what dotenvx writes, so files move freely between `dot env` and the `dotenvx` CLI.
+ */
+import { Buffer } from 'node:buffer';
+import { decrypt, encrypt, PrivateKey } from 'eciesjs';
+import { Config } from 'eciesjs/config';
+import { attempt, isFailure } from '@arki/failure';
+import { ensure } from '@arki/schema';
+import { ENCRYPTED_PREFIX } from '../core/define-env.js';
+import { DecryptionFailed, EncryptionFailed, KeyGenerationFailed, UnrepresentableValue } from './errors.js';
+import { envPrivateKeySchema, envPublicKeySchema } from './key-schemas.js';
+export { ENCRYPTED_PREFIX } from '../core/define-env.js';
+/** Pinned so a process that changes the global `ECIES_CONFIG` cannot change our bytes. */
+const DOTENVX_ECIES = new Config();
+const KEY_PATTERN = /^[ \t]*(?:export[ \t]+)?([\w.-]+)[ \t]*=(.*)$/;
+const QUOTES = ['"', "'", '`'];
+/**
+ * Parse `.env` text the way `dotenv` reads it: `export` prefixes, `#` comments, single, double and
+ * backtick quotes, multi-line quoted values, and `\n` / `\r` expanded inside double quotes. An
+ * unquoted value ends at the first `#`. A key that appears twice keeps both entries; readers take the
+ * last one, as dotenv does.
+ */
+export function parseEnv(text) {
+    const lines = text.replaceAll('\r\n', '\n').split('\n');
+    const entries = [];
+    for (let index = 0; index < lines.length; index++) {
+        const match = KEY_PATTERN.exec(lines[index] ?? '');
+        if (match === null)
+            continue;
+        const key = match[1] ?? '';
+        let raw = (match[2] ?? '').trimStart();
+        const start = index;
+        const quote = QUOTES.find(candidate => raw.startsWith(candidate));
+        if (quote !== undefined) {
+            while (closingQuote(raw, quote) === -1 && index + 1 < lines.length) {
+                index++;
+                raw += `\n${lines[index] ?? ''}`;
+            }
+        }
+        entries.push({ key, value: decodeValue(raw, quote), start, end: index + 1 });
+    }
+    return { lines, entries };
+}
+/** The last value of `key`, or `undefined`. */
+export function readEnvValue(document, key) {
+    return document.entries.findLast(entry => entry.key === key)?.value;
+}
+/** Every key with its last value, in first-seen order. */
+export function envValues(document) {
+    const values = new Map();
+    for (const entry of document.entries)
+        values.set(entry.key, entry);
+    return values;
+}
+/**
+ * The text with `key` set to `value`. An existing assignment (the last one) is rewritten in place;
+ * a new key is appended. Every other line is kept as written.
+ */
+export function setEnvValue(text, key, value) {
+    const document = parseEnv(text);
+    const encoded = encodeValue(value);
+    if (isFailure(encoded))
+        return encoded;
+    const line = `${key}=${encoded}`;
+    const existing = document.entries.findLast(entry => entry.key === key);
+    if (existing === undefined) {
+        const body = document.lines.join('\n');
+        const separator = body === '' || body.endsWith('\n') ? '' : '\n';
+        return `${body}${separator}${line}\n`;
+    }
+    return [...document.lines.slice(0, existing.start), line, ...document.lines.slice(existing.end)].join('\n');
+}
+/** The text without any assignment of `key`. */
+export function removeEnvValue(text, key) {
+    const document = parseEnv(text);
+    const dropped = new Set();
+    for (const entry of document.entries) {
+        if (entry.key !== key)
+            continue;
+        for (let line = entry.start; line < entry.end; line++)
+            dropped.add(line);
+    }
+    return document.lines.filter((_, index) => !dropped.has(index)).join('\n');
+}
+/** True for a value written by {@link encryptValue} (or by dotenvx). */
+export function isEncrypted(value) {
+    return value.startsWith(ENCRYPTED_PREFIX);
+}
+/** Encrypt `value` to a compressed or uncompressed secp256k1 public key (hex). */
+export function encryptValue(value, publicKey) {
+    return attempt(() => {
+        const sealed = encrypt(publicKey, new TextEncoder().encode(value), DOTENVX_ECIES);
+        return `${ENCRYPTED_PREFIX}${Buffer.from(sealed).toString('base64')}`;
+    }, cause => EncryptionFailed({ cause }));
+}
+/** Decrypt authenticated UTF-8, or return DecryptionFailed when the ciphertext/key does not match. */
+export function decryptValue(value, privateKey) {
+    if (!isEncrypted(value))
+        return DecryptionFailed();
+    return attempt(() => {
+        const sealed = Buffer.from(value.slice(ENCRYPTED_PREFIX.length), 'base64');
+        return new TextDecoder('utf-8', { fatal: true }).decode(decrypt(privateKey, sealed, DOTENVX_ECIES));
+    }, cause => DecryptionFailed({ cause }));
+}
+/** A new random keypair. */
+export function generateKeypair() {
+    return attempt(() => {
+        const secret = new PrivateKey(undefined, DOTENVX_ECIES.ellipticCurve);
+        return {
+            publicKey: ensure(secret.publicKey.toHex(true), envPublicKeySchema),
+            privateKey: ensure(secret.toHex(), envPrivateKeySchema),
+        };
+    }, cause => KeyGenerationFailed({ cause }));
+}
+/** The compressed public key of an already validated private key. */
+export function publicKeyOf(privateKey) {
+    return ensure(PrivateKey.fromHex(privateKey, DOTENVX_ECIES.ellipticCurve).publicKey.toHex(true), envPublicKeySchema);
+}
+/**
+ * The key names dotenvx uses for a file: `.env` → `DOTENV_PUBLIC_KEY` / `DOTENV_PRIVATE_KEY`,
+ * `.env.production` → `..._PRODUCTION`, `.env.ci.local` → `..._CI_LOCAL`.
+ */
+export function keyNamesFor(fileName) {
+    const base = fileName.toLowerCase().replace(/\.txt$/, '');
+    const suffix = base.startsWith('.env.')
+        ? `_${base
+            .slice('.env.'.length)
+            .replaceAll(/[^a-z0-9]+/g, '_')
+            .toUpperCase()}`
+        : '';
+    return { publicKey: `DOTENV_PUBLIC_KEY${suffix}`, privateKey: `DOTENV_PRIVATE_KEY${suffix}` };
+}
+/** True for the `DOTENV_PUBLIC_KEY*` / `DOTENV_PRIVATE_KEY*` names, which are never app values. */
+export function isKeyName(key) {
+    return key.startsWith('DOTENV_PUBLIC_KEY') || key.startsWith('DOTENV_PRIVATE_KEY');
+}
+/** The dotenvx header for a file: banner, public key, and a `# <file>` line. */
+export function envHeader(fileName, publicKey) {
+    return [
+        '#/-------------------[DOTENV_PUBLIC_KEY]--------------------/',
+        '#/            public-key encryption for .env files          /',
+        '#/       [how it works](https://dotenvx.com/encryption)     /',
+        '#/----------------------------------------------------------/',
+        `${keyNamesFor(fileName).publicKey}="${publicKey}"`,
+        '',
+        `# ${fileName}`,
+    ].join('\n');
+}
+function closingQuote(raw, quote) {
+    for (let index = 1; index < raw.length; index++) {
+        if (raw[index] === quote && raw[index - 1] !== '\\')
+            return index;
+    }
+    return -1;
+}
+function decodeValue(raw, quote) {
+    if (quote === undefined)
+        return raw.split('#')[0]?.trim() ?? '';
+    const close = closingQuote(raw, quote);
+    const inner = close === -1 ? raw.slice(1) : raw.slice(1, close);
+    return quote === '"' ? inner.replaceAll('\\n', '\n').replaceAll('\\r', '\r') : inner;
+}
+/**
+ * The first quoting that reads back as exactly `value`, in one entry: double quotes (newlines as
+ * `\n`), then single, then backticks. A value no quoting can carry (it holds every quote character
+ * and a line break, say) is refused rather than written in a form that could inject other keys.
+ */
+function encodeValue(value) {
+    const candidates = [`"${value.replaceAll('\r', '\\r').replaceAll('\n', '\\n')}"`, `'${value}'`, `\`${value}\``];
+    for (const candidate of candidates) {
+        const document = parseEnv(`K=${candidate}`);
+        if (document.entries.length === 1 && document.entries[0]?.value === value)
+            return candidate;
+    }
+    return UnrepresentableValue();
+}
+//# sourceMappingURL=codec.js.map

package/dist/node/codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.js","sourceRoot":"","sources":["../../src/node/codec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAGtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC5G,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,0FAA0F;AAC1F,MAAM,aAAa,GAAG,IAAI,MAAM,EAAE,CAAC;AAEnC,MAAM,WAAW,GAAG,+CAA+C,CAAC;AACpE,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAU,CAAC;AAmBxC;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAClE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBACnE,KAAK,EAAE,CAAC;gBACR,GAAG,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,YAAY,CAAC,QAAqB,EAAE,GAAW;IAC7D,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC;AACtE,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,SAAS,CAAC,QAAqB;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAW,EAAE,KAAa;IAClE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACvE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9G,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IACtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG;YAAE,SAAS;QAChC,KAAK,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AAC5C,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,SAAuB;IACjE,OAAO,OAAO,CACZ,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;QAClF,OAAO,GAAG,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxE,CAAC,EACD,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,UAAyB;IACnE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,EAAE,CAAC;IACnD,OAAO,OAAO,CACZ,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC3E,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IACtG,CAAC,EACD,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CACZ,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;QACtE,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;YACnE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,mBAAmB,CAAC;SACnC,CAAC;IACzB,CAAC,EACD,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,UAAyB;IACnD,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACvH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACrC,CAAC,CAAC,IAAI,IAAI;aACL,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;aACrB,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC;aAC9B,WAAW,EAAE,EAAE;QACpB,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,SAAS,EAAE,oBAAoB,MAAM,EAAE,EAAE,UAAU,EAAE,qBAAqB,MAAM,EAAE,EAAE,CAAC;AAChG,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AACrF,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,SAAuB;IACjE,OAAO;QACL,+DAA+D;QAC/D,+DAA+D;QAC/D,+DAA+D;QAC/D,+DAA+D;QAC/D,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,SAAS,KAAK,SAAS,GAAG;QACnD,EAAE;QACF,KAAK,QAAQ,EAAE;KAChB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,KAAa;IAC9C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAChD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IACpE,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,KAAyB;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChE,OAAO,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,UAAU,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC;IAChH,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;QAC5C,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;IAC9F,CAAC;IACD,OAAO,oBAAoB,EAAE,CAAC;AAChC,CAAC"}

package/dist/node/edit.d.ts

@@ -0,0 +1,112 @@
+import type { EnvPrivateKey, EnvPublicKey } from './key-schemas.js';
+/** The public key in a file's header, or `undefined` when it has none. */
+export declare function publicKeyIn(file: string): import("@arki/failure").Failure<"env.file_read_failed", {
+    file: string;
+}> | import("@arki/failure").Failure<"schema.async_required", undefined> | import("@arki/failure").Failure<"schema.invalid_input", {
+    issues: readonly import("@standard-schema/spec").StandardSchemaV1.Issue[];
+}> | import("@arki/failure").Failure<"schema.validator_defect", undefined> | EnvPublicKey | undefined;
+/** What `initEnvFile` did. */
+export type InitResult = {
+    readonly file: string;
+    readonly publicKey: EnvPublicKey;
+    /** `false` when the file already had a header. */
+    readonly headerAdded: boolean;
+    /** Where a new private key was written; `undefined` when an existing key was reused. */
+    readonly keysWritten?: string;
+};
+/**
+ * Give `file` a dotenvx header, creating the file if needed. Reuses the private key of the same
+ * environment when one is already reachable (so every `.env.development` in a repo shares one key);
+ * otherwise generates a keypair and stores the private key in `<root>/.env.keys`.
+ */
+export declare function initEnvFile(file: string, options: {
+    readonly root: string;
+    readonly env?: Readonly<Record<string, string | undefined>>;
+}): import("@arki/failure").Failure<"env.file_read_failed", {
+    file: string;
+}> | import("@arki/failure").Failure<"env.file_write_failed", {
+    file: string;
+}> | import("@arki/failure").Failure<"env.key_generation_failed", undefined> | import("@arki/failure").Failure<"env.unrepresentable_value", undefined> | import("@arki/failure").Failure<"schema.async_required", undefined> | import("@arki/failure").Failure<"schema.invalid_input", {
+    issues: readonly import("@standard-schema/spec").StandardSchemaV1.Issue[];
+}> | import("@arki/failure").Failure<"schema.validator_defect", undefined> | {
+    file: string;
+    publicKey: EnvPublicKey;
+    headerAdded: boolean;
+    keysWritten?: undefined;
+} | {
+    file: string;
+    publicKey: EnvPublicKey;
+    headerAdded: boolean;
+    keysWritten: string;
+};
+/**
+ * Set `key` in `file`, encrypted to the file's public key unless `plain`. Returns `false` when the
+ * file already held exactly this plaintext value (an encrypted value is always rewritten, because
+ * the same plaintext never encrypts to the same bytes).
+ */
+export declare function setEnvFileValue(file: string, key: string, value: string, options: {
+    readonly plain: boolean;
+}): boolean | import("@arki/failure").Failure<"env.encryption_failed", undefined> | import("@arki/failure").Failure<"env.file_read_failed", {
+    file: string;
+}> | import("@arki/failure").Failure<"env.file_write_failed", {
+    file: string;
+}> | import("@arki/failure").Failure<"env.missing_public_key", {
+    file: string;
+}> | import("@arki/failure").Failure<"env.unrepresentable_value", undefined> | import("@arki/failure").Failure<"schema.async_required", undefined> | import("@arki/failure").Failure<"schema.invalid_input", {
+    issues: readonly import("@standard-schema/spec").StandardSchemaV1.Issue[];
+}> | import("@arki/failure").Failure<"schema.validator_defect", undefined>;
+/** Encrypt plaintext values in place: the listed keys, or every value. Returns the keys encrypted. */
+export declare function encryptEnvFile(file: string, keys?: readonly string[]): string[] | import("@arki/failure").Failure<"env.encryption_failed", undefined> | import("@arki/failure").Failure<"env.file_read_failed", {
+    file: string;
+}> | import("@arki/failure").Failure<"env.file_write_failed", {
+    file: string;
+}> | import("@arki/failure").Failure<"env.missing_public_key", {
+    file: string;
+}> | import("@arki/failure").Failure<"env.unrepresentable_value", undefined> | import("@arki/failure").Failure<"schema.async_required", undefined> | import("@arki/failure").Failure<"schema.invalid_input", {
+    issues: readonly import("@standard-schema/spec").StandardSchemaV1.Issue[];
+}> | import("@arki/failure").Failure<"schema.validator_defect", undefined>;
+/** Decrypt values in place with `privateKeys`: the listed keys, or every value. Returns the keys decrypted. */
+export declare function decryptEnvFile(file: string, privateKeys: readonly EnvPrivateKey[], keys?: readonly string[]): string[] | import("@arki/failure").Failure<"env.decryption_failed", undefined> | import("@arki/failure").Failure<"env.file_read_failed", {
+    file: string;
+}> | import("@arki/failure").Failure<"env.file_write_failed", {
+    file: string;
+}> | import("@arki/failure").Failure<"env.unrepresentable_value", undefined>;
+/** What `rotateEnvFiles` did. */
+export type RotateResult = {
+    readonly privateKeyName: string;
+    readonly files: readonly {
+        readonly file: string;
+        readonly values: number;
+    }[];
+    /** Where the new private key was written. */
+    readonly keysFile: string;
+};
+/**
+ * Re-encrypt every file of one environment to a new keypair, in one step: decrypt everything first
+ * (so a wrong key changes nothing), then write each file, then the new private key. All `files` must
+ * share a file name (`.env.production`), because they share a key name.
+ */
+export declare function rotateEnvFiles(files: readonly string[], options: {
+    readonly root: string;
+    readonly env?: Readonly<Record<string, string | undefined>>;
+}): import("@arki/failure").Failure<"env.decryption_failed", undefined> | import("@arki/failure").Failure<"env.encryption_failed", undefined> | import("@arki/failure").Failure<"env.file_read_failed", {
+    file: string;
+}> | import("@arki/failure").Failure<"env.file_write_failed", {
+    file: string;
+}> | import("@arki/failure").Failure<"env.key_generation_failed", undefined> | import("@arki/failure").Failure<"env.missing_private_key", {
+    file: string;
+}> | import("@arki/failure").Failure<"env.rotation_incomplete", {
+    keysFile: string;
+    completedFiles: number;
+    totalFiles: number;
+}> | import("@arki/failure").Failure<"env.unrepresentable_value", undefined> | import("@arki/failure").Failure<"schema.async_required", undefined> | import("@arki/failure").Failure<"schema.invalid_input", {
+    issues: readonly import("@standard-schema/spec").StandardSchemaV1.Issue[];
+}> | import("@arki/failure").Failure<"schema.validator_defect", undefined> | {
+    privateKeyName: string;
+    files: {
+        file: string;
+        values: number;
+    }[];
+    keysFile: string;
+};
+//# sourceMappingURL=edit.d.ts.map

package/dist/node/edit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edit.d.ts","sourceRoot":"","sources":["../../src/node/edit.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA2BpE,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM;;;;sGAOvC;AAED,8BAA8B;AAC9B,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,kDAAkD;IAClD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;CAAE;;;;;;;;;;;;;;;;EA8BhG;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE;;;;;;;;2EAoB7G;AAED,sGAAsG;AACtG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE;;;;;;;;2EAyBpE;AAED,+GAA+G;AAC/G,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,aAAa,EAAE,EAAE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE;;;;6EAqB3G;AAED,iCAAiC;AACjC,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9E,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;CAAE;;;;;;;;;;;;;;;;;;;EAiFhG"}