@arki/env 0.0.11 → 0.2.0

package/dist/node/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/node/load.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAItC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACpG,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,WAAW,EACX,cAAc,EACd,cAAc,EACd,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAErE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA4DpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;AAExC;;;;;GAKG;AACH,MAAM,WAAW,GAAG,IAAI,MAAM,CAC5B,OAAO;IACL,MAAM;IACN,cAAc;IACd,WAAW;IACX,qBAAqB;IACrB,8BAA8B;IAC9B,2BAA2B;IAC3B,aAAa;IACb,eAAe;IACf,cAAc;IACd,SAAS;IACT,WAAW;IACX,UAAU;IACV,cAAc;IACd,KAAK;IACL,gBAAgB;IAChB,SAAS;IACT,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,UAAU;IACV,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,eAAe;IACf,SAAS;IACT,SAAS;IACT,mBAAmB;IACnB,eAAe;IACf,kBAAkB;CACnB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EACf,GAAG,CACJ,CAAC;AAEF,gGAAgG;AAChG,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC,8CAA8C;AAC9C,MAAM,UAAU,GAAG,8CAA8C,CAAC;AAElE,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAE9D,+GAA+G;AAC/G,MAAM,UAAU,YAAY,CAAC,OAAO,GAAwB,EAAE;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/D,OAAO,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,OAAO,CAAC,MAAM,EAAE,OAAO;YACrB,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBACtB,CAAC,CAAC,WAAW,EAAE;gBACf,CAAC,CAAC,SAAS,CAAC;QAClB,MAAM,WAAW,GAAG,OAAO,EAAE,CAAC;QAC9B,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC;QAClD,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,aAAa,CAAC;QACzF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,QAAQ,WAAW,EAAE,EAAE,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1G,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC;QAE1D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAC7B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;aACvD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkF,CAAC;QAC1G,MAAM,OAAO,GAAkE,EAAE,CAAC;QAClF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACpC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrD,IAAI,SAAS,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC7B,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;wBACjC,CAAC,CAAC,uDAAuD;wBACzD,CAAC,CAAC,oCAAoC,CAAC;oBACzC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC3D,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2C,CAAC;QACtE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,uGAAuG;QACvG,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,QAAiB,EAAmC,EAAE;YAC1F,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC1D,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa;wBACvG,IAAI;wBACJ,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAC;oBACH,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC1B,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC7B,CAAC;;oBAAM,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;YAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,qBAAqB,CAAC,iBAAiB;oBAC7C,IAAI;oBACJ,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,iDAAiD,cAAc,CAAC,IAAI,CAAC,iBAAiB,kBAAkB,CAC3I,IAAI,EACJ,IAAI,CACL;yBACE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;yBAChD,IAAI,CAAC,MAAM,CAAC,EAAE;iBAClB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,gGAAgG;gBAChG,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;gBACjF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAClB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACpC,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,qBAAqB,CAAC,aAAa;wBACzC,IAAI;wBACJ,GAAG;wBACH,OAAO,EAAE,GAAG,GAAG,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,6BAA6B,cAAc,CAAC,IAAI,CAAC,EAAE;qBACnH,CAAC,CAAC;oBACH,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;gBACtD,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5D,SAAS;YACX,CAAC;YACD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC;oBACX,GAAG;oBACH,IAAI;oBACJ,IAAI;oBACJ,MAAM,EAAE,uEAAuE;iBAChF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CACtB,GAAG,EAAE,CACH,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE;gBACvB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC/D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aACpE,CAAC,EACJ,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAChD,CAAC;YACF,MAAM,iBAAiB,GAAG,OAAO,EAAE,CAAC;YACpC,IAAI,iBAAiB,KAAK,SAAS;gBAAE,OAAO,iBAAiB,CAAC;YAC9D,IAAI,YAAY,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC3E,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7E,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,qBAAqB,CAAC,mBAAmB;oBAC/C,IAAI;oBACJ,GAAG;oBACH,OAAO,EAAE,GAAG,GAAG,KAAK,MAAM,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,wBAAwB;iBACvG,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YACtD,CAAC;;gBAAM,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,4FAA4F;QAC5F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,cAAc,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAEzF,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAkD,EAAE,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrE,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,qBAAqB,CAAC,aAAa;oBACzC,IAAI,EAAE,eAAe;oBACrB,GAAG;oBACH,OAAO,EAAE,GAAG,GAAG,yFAAyF;iBACzG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,cAAc,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACzF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnD,IAAI,OAAO,KAAK,KAAK,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACnG,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;gBAAE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAA2B,CAAC;IAC3G,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;AAC5B,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,oBAAoB,CAAC,OAAyC;IAC5E,OAAO;QACL,0BAA0B,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI;QACtD,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;KACxE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,SAA6B,CAAC;IAClC,KAAK,IAAI,GAAG,GAAG,GAAG,GAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAAE,SAAS,GAAG,GAAG,CAAC;QAChG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,OAAO,SAAS,IAAI,GAAG,CAAC;IACzD,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,GAAW;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;CACxF,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAA8B;IAC7D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACtC,CAAC;IACD,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC"}

package/dist/node/operation-telemetry.d.ts

@@ -0,0 +1,3 @@
+/** Safe execution-boundary telemetry; never records paths, references, values, keys or raw causes. */
+export declare function nodeOperation<Value>(name: string, run: () => Value): Value;
+//# sourceMappingURL=operation-telemetry.d.ts.map

package/dist/node/operation-telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-telemetry.d.ts","sourceRoot":"","sources":["../../src/node/operation-telemetry.ts"],"names":[],"mappings":"AAiBA,sGAAsG;AACtG,wBAAgB,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,GAAG,KAAK,CAqC1E"}

package/dist/node/operation-telemetry.js

@@ -0,0 +1,53 @@
+import { context, metrics, SpanStatusCode, trace } from '@opentelemetry/api';
+import packageMetadata from '@arki/env/package.json' with { type: 'json' };
+import { isFailure } from '@arki/failure';
+function observe(fn) {
+    try {
+        const value = fn();
+        void Promise.resolve(value).catch(() => {
+            /* Reporting never owns execution. */
+        });
+        return value;
+    }
+    catch {
+        return;
+    }
+}
+/** Safe execution-boundary telemetry; never records paths, references, values, keys or raw causes. */
+export function nodeOperation(name, run) {
+    const span = observe(() => trace.getTracer('@arki/env', packageMetadata.version).startSpan(`env.${name}`));
+    const active = observe(() => (span === undefined ? context.active() : trace.setSpan(context.active(), span)));
+    const started = Date.now();
+    const invocation = {};
+    const invoke = () => {
+        if (invocation.outcome === undefined) {
+            try {
+                invocation.outcome = { value: run() };
+            }
+            catch (error) {
+                invocation.outcome = { cause: error };
+            }
+        }
+        if ('cause' in invocation.outcome)
+            throw invocation.outcome.cause;
+        return invocation.outcome.value;
+    };
+    let result;
+    try {
+        if (active !== undefined)
+            observe(() => context.with(active, invoke));
+        result = invoke();
+        return result;
+    }
+    finally {
+        const outcome = result;
+        const failed = isFailure(outcome) || (invocation.outcome !== undefined && 'cause' in invocation.outcome);
+        observe(() => span?.setStatus({ code: failed ? SpanStatusCode.ERROR : SpanStatusCode.OK }));
+        observe(() => metrics
+            .getMeter('@arki/env', packageMetadata.version)
+            .createHistogram('env.operation.duration', { unit: 'ms' })
+            .record(Math.max(0, Date.now() - started), { 'env.operation': name, 'env.outcome': failed ? 'failed' : 'ok' }, active));
+        observe(() => span?.end());
+    }
+}
+//# sourceMappingURL=operation-telemetry.js.map

package/dist/node/operation-telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-telemetry.js","sourceRoot":"","sources":["../../src/node/operation-telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE7E,OAAO,eAAe,MAAM,wBAAwB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,SAAS,OAAO,CAAQ,EAAe;IACrC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,EAAE,CAAC;QACnB,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACrC,qCAAqC;QACvC,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,aAAa,CAAQ,IAAY,EAAE,GAAgB;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9G,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAwD,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,UAAU,CAAC,OAAO,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,UAAU,CAAC,OAAO,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QACD,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO;YAAE,MAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;QAClE,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,CAAC,CAAC;IACF,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,MAAM,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,GAAY,MAAM,CAAC;QAChC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QACzG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5F,OAAO,CAAC,GAAG,EAAE,CACX,OAAO;aACJ,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC;aAC9C,eAAe,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;aACzD,MAAM,CACL,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,EACjC,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAClE,MAAM,CACP,CACJ,CAAC;QACF,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC"}

package/dist/node/references.d.ts

@@ -0,0 +1,16 @@
+/** The remaining aggregate budget and cooperative cancellation for a synchronous provider read. */
+export type ReferenceOptions = {
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+};
+/** A provider returns its value or the exact owned provider/cancellation/deadline outcomes. */
+export type ReferenceResolver = (reference: string, options?: ReferenceOptions) => ReturnType<typeof runProvider>;
+/** The resolvers used unless the caller supplies an explicit registry. */
+export declare const DEFAULT_RESOLVERS: Readonly<Record<string, ReferenceResolver>>;
+/** Registered schemes are references; unknown URLs remain plain values. */
+export declare function referenceScheme(value: string, resolvers: Readonly<Record<string, ReferenceResolver>>): string | undefined;
+declare function runProvider(command: string, args: readonly string[], options?: ReferenceOptions): string | import("@arki/failure").Failure<"env.cancelled", undefined> | import("@arki/failure").Failure<"env.deadline", undefined> | import("@arki/failure").Failure<"env.reference_failed", {
+    scheme: string;
+}>;
+export {};
+//# sourceMappingURL=references.d.ts.map

package/dist/node/references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"references.d.ts","sourceRoot":"","sources":["../../src/node/references.ts"],"names":[],"mappings":"AAUA,mGAAmG;AACnG,MAAM,MAAM,gBAAgB,GAAG;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,CAAC;AAC9F,+FAA+F;AAC/F,MAAM,MAAM,iBAAiB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;AAOlH,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CA0BzE,CAAC;AAEF,2EAA2E;AAC3E,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,GACrD,MAAM,GAAG,SAAS,CAGpB;AAED,iBAAS,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,GAAE,gBAAqB;;GAqB5F"}

package/dist/node/references.js

@@ -0,0 +1,72 @@
+/** Secret-manager reads use argv, a bounded subprocess and caller-owned provider authentication. */
+import { execFileSync } from 'node:child_process';
+import { z } from 'zod';
+import { isFailure } from '@arki/failure';
+import { ensure, parse } from '@arki/schema';
+import { EnvCancelled, EnvDeadline, ReferenceFailed } from './errors.js';
+import { nodeOperation } from './operation-telemetry.js';
+const segment = z.string().regex(/^\w[\w.-]*$/);
+const referencePath = z.array(segment);
+const timeoutSchema = z.number().int().min(1).max(30_000);
+const execFailure = z.object({ code: z.string().optional() });
+/** The resolvers used unless the caller supplies an explicit registry. */
+export const DEFAULT_RESOLVERS = {
+    op: (reference, options) => runProvider('op', ['read', '--no-newline', reference], options),
+    infisical: (reference, options) => {
+        const parts = pathOf(reference);
+        if (isFailure(parts))
+            return ReferenceFailed({ scheme: 'infisical' }, { cause: parts });
+        const [environment, ...rest] = parts;
+        const name = rest.pop();
+        if (environment === undefined || name === undefined)
+            return ReferenceFailed({ scheme: 'infisical' });
+        return runProvider('infisical', ['secrets', 'get', '--plain', '--silent', `--env=${environment}`, `--path=/${rest.join('/')}`, '--', name], options);
+    },
+    doppler: (reference, options) => {
+        const parts = pathOf(reference);
+        if (isFailure(parts))
+            return ReferenceFailed({ scheme: 'doppler' }, { cause: parts });
+        const [project, config, name, ...extra] = parts;
+        if (project === undefined || config === undefined || name === undefined || extra.length > 0)
+            return ReferenceFailed({ scheme: 'doppler' });
+        return runProvider('doppler', ['secrets', 'get', '--plain', `--project=${project}`, `--config=${config}`, '--', name], options);
+    },
+};
+/** Registered schemes are references; unknown URLs remain plain values. */
+export function referenceScheme(value, resolvers) {
+    const scheme = /^([a-z][a-z0-9+.-]*):\/\/./.exec(value)?.[1];
+    return scheme !== undefined && Object.hasOwn(resolvers, scheme) ? scheme : undefined;
+}
+function runProvider(command, args, options = {}) {
+    const timeout = ensure(options.timeoutMs ?? 30_000, timeoutSchema);
+    return nodeOperation(`reference.${command}`, () => {
+        if (options.signal?.aborted)
+            return EnvCancelled({ cause: options.signal.reason });
+        try {
+            const value = execFileSync(command, args, {
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'pipe'],
+                timeout,
+                // These are bounded reads: a provider must not evade the deadline by ignoring SIGTERM.
+                killSignal: 'SIGKILL',
+            }).replace(/\r?\n$/, '');
+            return options.signal?.aborted ? EnvCancelled({ cause: options.signal.reason }) : value;
+        }
+        catch (error) {
+            const detail = execFailure.safeParse(error);
+            if (options.signal?.aborted)
+                return EnvCancelled({ cause: error });
+            if (detail.success && detail.data.code === 'ETIMEDOUT')
+                return EnvDeadline({ cause: error });
+            // CLI stderr may contain a credential. Keep the complete original error only in the private cause.
+            return ReferenceFailed({ scheme: command }, { cause: error });
+        }
+    });
+}
+function pathOf(reference) {
+    return parse(referencePath, reference
+        .slice(reference.indexOf('://') + 3)
+        .split('/')
+        .filter(part => part !== ''));
+}
+//# sourceMappingURL=references.js.map

package/dist/node/references.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"references.js","sourceRoot":"","sources":["../../src/node/references.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAOzD,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAChD,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACvC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC1D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE9D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAgD;IAC5E,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAC3F,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxB,IAAI,WAAW,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACrG,OAAO,WAAW,CAChB,WAAW,EACX,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,WAAW,EAAE,EAAE,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EAC1G,OAAO,CACR,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACtF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;QAChD,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YACzF,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAChD,OAAO,WAAW,CAChB,SAAS,EACT,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,OAAO,EAAE,EAAE,YAAY,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EACvF,OAAO,CACR,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,SAAsD;IAEtD,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,IAAuB,EAAE,OAAO,GAAqB,EAAE;IAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,aAAa,CAAC,CAAC;IACnE,OAAO,aAAa,CAAC,aAAa,OAAO,EAAE,EAAE,GAAG,EAAE;QAChD,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE;gBACxC,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,OAAO;gBACP,uFAAuF;gBACvF,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACzB,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;gBAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7F,mGAAmG;YACnG,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,SAAiB;IAC/B,OAAO,KAAK,CACV,aAAa,EACb,SAAS;SACN,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACnC,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAC/B,CAAC;AACJ,CAAC"}

package/dist/node/register.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=register.d.ts.map

package/dist/node/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/node/register.ts"],"names":[],"mappings":""}

package/dist/node/register.js

@@ -0,0 +1,19 @@
+/**
+ * Side-effect entry: load the env files into `process.env` as this module is imported. Import it
+ * first in a process entry, before any module that reads the environment:
+ *
+ * ```ts
+ * import '@arki/env/node/register';
+ * ```
+ *
+ * Fails the import with every problem listed (names only, never values).
+ */
+import { isFailure, orThrow } from '@arki/failure';
+import { EnvFilesFailed } from './errors.js';
+import { formatEnvFilesErrors, loadEnvFiles } from './load.js';
+const report = loadEnvFiles();
+if (EnvFilesFailed.is(report))
+    throw new Error(formatEnvFilesErrors(report), { cause: report });
+if (isFailure(report))
+    orThrow(report);
+//# sourceMappingURL=register.js.map

package/dist/node/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/node/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE/D,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;AAC9B,IAAI,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC;IAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAChG,IAAI,SAAS,CAAC,MAAM,CAAC;IAAE,OAAO,CAAC,MAAM,CAAC,CAAC"}

package/dist/{contracts → presets}/common.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const commonContracts: {
+export declare const commonPresets: {
     string: (defaultValue?: string) => z.ZodDefault<z.ZodString> | z.ZodString;
     number: (defaultValue?: number) => z.ZodCoercedNumber<unknown> | z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     port: (defaultValue?: number) => z.ZodDefault<z.ZodCoercedNumber<unknown>>;

package/dist/presets/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/presets/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,aAAa;IACxB,MAAM,kBAAkB,MAAM;IAK9B,MAAM,kBAAkB,MAAM;IAK9B,IAAI;IAGJ,OAAO;;;;;IAEP,OAAO;;;;;;IAMP,QAAQ,kBAAiB,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO;;;;;;CAE7D,CAAC"}

package/dist/{contracts → presets}/common.js

@@ -1,18 +1,14 @@
 import { z } from 'zod';
-export const commonContracts = {
+export const commonPresets = {
     string: (defaultValue) => {
         const schema = z.string();
-        return defaultValue ? schema.default(defaultValue) : schema;
+        return defaultValue === undefined ? schema : schema.default(defaultValue);
     },
     number: (defaultValue) => {
         const schema = z.coerce.number();
-        return defaultValue ? schema.default(defaultValue) : schema;
+        return defaultValue === undefined ? schema : schema.default(defaultValue);
     },
-    port: (defaultValue = 3000) => z
-        .coerce.number()
-        .min(1, 'Port must be at least 1')
-        .max(65_535, 'Port must be at most 65535')
-        .default(defaultValue),
+    port: (defaultValue = 3000) => z.coerce.number().min(1, 'Port must be at least 1').max(65_535, 'Port must be at most 65535').default(defaultValue),
     nodeEnv: () => z.enum(['development', 'production', 'test']).default('development'),
     boolean: (defaultValue = false) => z
         .enum(['true', 'false', '1', '0'])

package/dist/presets/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../src/presets/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,CAAC,YAAqB,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,EAAE,CAAC,YAAqB,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,EAAE,CAAC,YAAY,GAAG,IAAI,EAAE,EAAE,CAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAErH,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAEnF,OAAO,EAAE,CAAC,YAAY,GAAG,KAAK,EAAE,EAAE,CAChC,CAAC;SACE,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;SACjC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;SACxC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;IAEpD,QAAQ,EAAE,CAAC,YAAY,GAAwC,MAAM,EAAE,EAAE,CACvE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;CACnE,CAAC"}

package/dist/{contracts → presets}/index.d.ts

@@ -1,4 +1,4 @@
-export declare const contracts: {
+export declare const presets: {
     string: (defaultValue?: string) => import("zod").ZodDefault<import("zod").ZodString> | import("zod").ZodString;
     number: (defaultValue?: number) => import("zod").ZodCoercedNumber<unknown> | import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
     port: (defaultValue?: number) => import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
@@ -19,14 +19,14 @@ export declare const contracts: {
         info: "info";
         warn: "warn";
     }>>;
-    json: <T extends import("zod").ZodType>(schema: T) => import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<Awaited<import("zod").infer<T>>, string>>;
+    json: <T extends import("zod").ZodType>(schema: T) => import("zod").ZodPipe<import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<unknown, string>>, T>;
     csvArray: <T extends import("zod").ZodType>(itemSchema: T) => import("zod").ZodPreprocess<import("zod").ZodArray<T>, unknown>;
     csvSet: <T extends import("zod").ZodType>(itemSchema: T) => import("zod").ZodPreprocess<import("zod").ZodArray<T>, unknown>;
     url: (defaultValue?: string) => import("zod").ZodDefault<import("zod").ZodURL> | import("zod").ZodURL;
     databaseUrl: () => import("zod").ZodURL;
     redisUrl: () => import("zod").ZodURL;
 };
-export { commonContracts } from './common.js';
-export { urlContracts } from './urls.js';
-export { parseContracts } from './parsing.js';
+export { commonPresets } from './common.js';
+export { urlPresets } from './urls.js';
+export { parsePresets } from './parsing.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/presets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/presets/index.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;CAInB,CAAC;AAKF,OAAO,EAAC,aAAa,EAAC,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAC,UAAU,EAAC,MAAM,WAAW,CAAC;AACrC,OAAO,EAAC,YAAY,EAAC,MAAM,cAAc,CAAC"}

package/dist/presets/index.js

@@ -0,0 +1,15 @@
+/** Ready-made Zod presets for ports, URLs, lists, JSON and other common variable shapes. */
+import { commonPresets } from './common.js';
+import { parsePresets } from './parsing.js';
+import { urlPresets } from './urls.js';
+// Unified presets export
+export const presets = {
+    ...commonPresets,
+    ...urlPresets,
+    ...parsePresets,
+};
+// Individual category exports
+export { commonPresets } from './common.js';
+export { urlPresets } from './urls.js';
+export { parsePresets } from './parsing.js';
+//# sourceMappingURL=index.js.map

package/dist/presets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/presets/index.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,yBAAyB;AACzB,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,GAAG,aAAa;IAChB,GAAG,UAAU;IACb,GAAG,YAAY;CAChB,CAAC;AAEF,8BAA8B;AAG9B,OAAO,EAAC,aAAa,EAAC,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAC,UAAU,EAAC,MAAM,WAAW,CAAC;AACrC,OAAO,EAAC,YAAY,EAAC,MAAM,cAAc,CAAC"}

package/dist/{contracts → presets}/parsing.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-export declare const parseContracts: {
-    json: <T extends z.ZodType>(schema: T) => z.ZodPipe<z.ZodString, z.ZodTransform<Awaited<z.infer<T>>, string>>;
+export declare const parsePresets: {
+    json: <T extends z.ZodType>(schema: T) => z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<unknown, string>>, T>;
     csvArray: <T extends z.ZodType>(itemSchema: T) => z.ZodPreprocess<z.ZodArray<T>, unknown>;
     csvSet: <T extends z.ZodType>(itemSchema: T) => z.ZodPreprocess<z.ZodArray<T>, unknown>;
 };

package/dist/presets/parsing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsing.d.ts","sourceRoot":"","sources":["../../src/presets/parsing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,YAAY;IACvB,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,UAAU,CAAC;IAarC,QAAQ,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,cAAc,CAAC;IAM7C,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,cAAc,CAAC;CAK5C,CAAC"}

package/dist/{contracts → presets}/parsing.js

@@ -1,9 +1,17 @@
 import { z } from 'zod';
-export const parseContracts = {
-    json: (schema) => z.string().transform(str => {
-        const parsed = JSON.parse(str);
-        return schema.parse(parsed);
-    }),
+export const parsePresets = {
+    json: (schema) => z
+        .string()
+        .transform((str, context) => {
+        try {
+            return JSON.parse(str);
+        }
+        catch {
+            context.issues.push({ code: 'custom', message: 'Invalid JSON', input: str });
+            return z.NEVER;
+        }
+    })
+        .pipe(schema),
     csvArray: (itemSchema) => z.preprocess(val => {
         if (typeof val !== 'string')
             return val;

package/dist/presets/parsing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsing.js","sourceRoot":"","sources":["../../src/presets/parsing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,CAAsB,MAAS,EAAE,EAAE,CACvC,CAAC;SACE,MAAM,EAAE;SACR,SAAS,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7E,OAAO,CAAC,CAAC,KAAK,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,MAAM,CAAC;IAEjB,QAAQ,EAAE,CAAsB,UAAa,EAAE,EAAE,CAC/C,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;QACjB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC;QACxC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEzB,MAAM,EAAE,CAAsB,UAAa,EAAE,EAAE,CAC7C,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;QACjB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC;QACxC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;CAC1B,CAAC"}

package/dist/{contracts → presets}/urls.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const urlContracts: {
+export declare const urlPresets: {
     url: (defaultValue?: string) => z.ZodDefault<z.ZodURL> | z.ZodURL;
     databaseUrl: () => z.ZodURL;
     redisUrl: () => z.ZodURL;

package/dist/presets/urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"urls.d.ts","sourceRoot":"","sources":["../../src/presets/urls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,UAAU;IACrB,GAAG,kBAAkB,MAAM;IAK3B,WAAW;IAQX,QAAQ;CAOT,CAAC"}

package/dist/{contracts → presets}/urls.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export const urlContracts = {
+export const urlPresets = {
     url: (defaultValue) => {
         const schema = z.url();
         return defaultValue ? schema.default(defaultValue) : schema;

package/dist/presets/urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"urls.js","sourceRoot":"","sources":["../../src/presets/urls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,GAAG,EAAE,CAAC,YAAqB,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9D,CAAC;IAED,WAAW,EAAE,GAAG,EAAE,CAChB,CAAC;SACE,GAAG,EAAE;SACL,MAAM,CACL,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,EACvE,2DAA2D,CAC5D;IAEL,QAAQ,EAAE,GAAG,EAAE,CACb,CAAC;SACE,GAAG,EAAE;SACL,MAAM,CACL,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAChE,iDAAiD,CAClD;CACN,CAAC"}

package/docs/agent-guide.md

@@ -0,0 +1,121 @@
+# @arki/env for agents
+
+The long form of [llms.txt](../llms.txt). When they disagree, `src/index.ts` wins.
+
+## The model
+
+1. `defineEnv({ server, client, shared, runtimeEnv })` returns a typed object. It validates on the first read.
+2. A schema is any Standard Schema. Each value is typed as the schema's output, so defaults and coercions apply.
+3. `presets` holds ready-made shapes: ports, URLs, comma lists and JSON.
+4. `secret(schema)` makes a `Redacted` value. It prints as `[redacted]`. `reveal(value)` returns the raw string.
+5. `env()` from `@arki/dot/env` turns the same options into a Dot plugin that validates at boot.
+6. The package reads no environment at import and does not need `process`.
+7. `@arki/env/node` loads committed `.env.<environment>` files (dotenvx format, values encrypted) into `process.env`. The real environment always wins.
+
+## Task map
+
+### Define the environment of an app
+
+1. Create one `env.ts`.
+2. Declare each variable with a preset or your own schema.
+3. Import `env` where you need a value.
+
+```ts
+import { defineEnv } from '@arki/env/core';
+import { presets } from '@arki/env/presets';
+
+export const env = defineEnv({
+  server: {
+    PORT: presets.port(3000),
+    DATABASE_URL: presets.databaseUrl(),
+  },
+});
+```
+
+### Keep a secret out of logs
+
+```ts
+import { z } from 'zod';
+
+import { defineEnv, reveal, secret } from '@arki/env/core';
+
+const env = defineEnv({ server: { API_KEY: secret(z.string().min(1)) } });
+
+export const apiKey = (): string => reveal(env.API_KEY);
+```
+
+### Commit secrets, encrypted
+
+Use `dot env`, never a text editor, for secret values. Never print a value to check it.
+
+```sh
+printf %s "$API_KEY" | dot env set API_KEY --stdin   # stored encrypted, never in argv
+dot env ls --json                          # keys and kinds, never values
+dot env explain API_KEY --json             # which file and which key source, no value
+dot env check --json                       # must be ok before committing
+dot env run -- bun run test                # run with the files loaded
+```
+
+Do not read `.env.keys`. Agents are denied it. A process you start with `dot env run` gets the values but never the private key.
+
+### Load env files outside `dot env run`
+
+Make `import '@arki/env/node/register'` the first import of the process entry. This explicit boot import throws on returned load failures. Direct `loadEnvFiles()` callers check `isFailure` and handle `EnvFilesFailed.data.errors`, cancellation or deadline before starting work.
+
+### Build a Docker image without secrets
+
+Set `SKIP_ENV_VALIDATION=1` in the build stage only. Do not set it in the run stage.
+
+### Validate at boot in a Dot app
+
+```ts skip="needs a Dot app; see the adapter tests in packages/dot/src/env.test.ts"
+import { z } from 'zod';
+
+import { defineApp } from '@arki/dot';
+import { env } from '@arki/dot/env';
+
+const app = await defineApp('pizzeria')
+  .infra(env({ schema: { PORT: z.coerce.number().default(3000) } }))
+  .build();
+```
+
+## Rules that bite
+
+- `SKIP_ENV_VALIDATION=true` does not skip. Only exactly `1` does.
+- `CI`, `lint` and `NODE_ENV` never skip validation.
+- With validation skipped, schemas do not run. Values are raw strings.
+- Do not call `.parse` on a `secret()` result. Use `['~standard'].validate(value)`.
+- Pass `runtimeEnv` on engines with no `process`.
+- Client keys need the `clientPrefix`.
+- Load env files before any module that reads `process.env`: `register` first, or `dot env run`.
+- Commit only `.env.<environment>`. Bare `.env`, `.env.local` and `.env.keys*` stay untracked.
+- `dot env check` fails when the schema cannot be read and a tracked file has a plain value. Run it under Bun (`bun --bun dot env check`) or encrypt the value.
+
+## Errors
+
+| Code or error             | Meaning                                     | What to do                                                           |
+| ------------------------- | ------------------------------------------- | -------------------------------------------------------------------- |
+| `Error` from `defineEnv`  | A variable failed its schema on first read. | Read the `path: message` lines. Fix the variables.                   |
+| `ARKI_ENV_PLUGIN_E001`    | The Dot plugin found a bad env at boot.     | Set the listed variables before booting. Do not skip validation.     |
+| `env.missing_private_key` | Encrypted values and no private key.        | Export the `DOTENV_PRIVATE_KEY_<ENV>` named, or `dot env keys pull`. |
+| `env.decryption_failed`   | A value did not decrypt.                    | `dot env explain <KEY>`; set it again with `dot env set --stdin`.    |
+| `env.reference_failed`    | A reference did not resolve.                | Sign in to the provider CLI named in the message.                    |
+
+### Handle node operations
+
+Use `isFailure` before reading a generated keypair, loaded report, edit result or private-key source. Parse external strings with `parsePublicKey` / `parsePrivateKey`; never cast key brands. Expected filesystem/crypto/provider rejection is returned. Boot declaration misuse still throws.
+
+Pass a shared `timeoutMs` and optional `signal` to `loadEnvFiles`. Providers receive the remaining synchronous read budget; native subprocesses time out. Cancellation is cooperative between synchronous callbacks. Provider stderr stays in the local private cause.
+
+Keep `.env.keys` after `RotationIncomplete`. Every existing candidate local key store is staged as well as the root. Their existing comma-list format holds old and new generations; use it to retry. Old keys are removed only after every rewritten file reads back exactly as planned. Never print the file or attach keys to diagnostics.
+
+Node/provider OpenTelemetry is enabled through the API without SDK setup. It emits only bounded operation/outcome data, never file paths, references or secret bytes. Local declarations, schemas, text parsing and crypto helpers do not create redundant spans.
+
+## Verify
+
+```sh
+bun run test
+bun run test:docs
+dot explain --json | jq '.data.services'   # in a Dot app: env is listed, nothing is validated
+dot doctor --json | jq '.data'             # boots the app: a bad env fails here with ARKI_ENV_PLUGIN_E001
+```

package/docs/upgrades/0.0.11-to-0.1.0.md

@@ -0,0 +1,62 @@
+# Upgrade @arki/env 0.0.11 to 0.1.0
+
+Every app that calls `defineEnv` must act: validation now runs in every environment, so builds without secrets need `SKIP_ENV_VALIDATION=1`. Apps that never use `secret()` or the zod types of `secret()` can skip steps 2 and 3.
+
+## What changed
+
+- `secret()` takes any Standard Schema (zod, valibot, arktype, hand-written) and returns a Standard Schema, not a zod schema. `.optional()` is still there: it accepts a missing variable and leaves `undefined` unwrapped. The result no longer has zod methods such as `.parse`; use `secret(schema)['~standard'].validate(value)`.
+
+  A rejected secret's issues keep their path but get a fixed message, because some validators (valibot) repeat the received value in theirs and `defineEnv` logs issues.
+
+- **Validation now runs in production by default.** `defineEnv` used to skip validation whenever `NODE_ENV !== 'development'`, so an app without an explicit `skipValidation` booted production on an unchecked config. The default now skips only when `CI` is set (Docker build stages) or during `lint` runs, the same rule most apps already passed by hand. Apps that set `options.skipValidation` are unaffected.
+
+  New `secret(schema)`, `reveal(value)` and `Redacted` (from `@arki/env/core`): a secret variable becomes a `Redacted` value that prints as `[redacted]` in logs, JSON, template strings and `util.inspect`, and is read with a deliberate `reveal(env.KEY)`. `reveal` also accepts the raw string, for runs where validation is skipped.
+
+- `defineEnv()` `server`, `client` and `shared` take records of any Standard Schema (Zod, Valibot, ArkType, hand-written), not only `ZodType`; values are typed as each schema's output.
+  `@arki/env/dot`: `EnvDotOptions`, `EnvServices` and `env()` take `Record<string, StandardSchemaV1>` instead of `Record<string, ZodType>`.
+- Breaking: `defineEnv` now validates in every environment. `CI` and `lint` runs no longer skip validation. The only implicit opt-out is `SKIP_ENV_VALIDATION=1` (exactly `1`); set it only in build stages that run without secrets. `options.skipValidation` still overrides it. The `@arki/env/dot` plugin now validates at boot and fails with `ARKI_ENV_PLUGIN_E001` (new `ENV_PLUGIN_ERROR_CODES`), and `EnvServices['env']` is derived from `defineEnv` without a cast.
+
+## Public API changes
+
+- `secret()` now returns a Standard Schema, not a zod schema. It has no `.parse`. `.optional()` still works.
+- `defineEnv` `server`, `client` and `shared` accept any Standard Schema, not only zod.
+- `@arki/env/dot`: `EnvDotOptions`, `EnvServices` and `env()` take `Record<string, StandardSchemaV1>`. The plugin validates at boot and fails with `ARKI_ENV_PLUGIN_E001`.
+- New exports: `reveal`, `Redacted`, `ENV_PLUGIN_ERROR_CODES`.
+
+## Steps
+
+1. Find builds that run without secrets (Docker build stages, lint, CI). `defineEnv` no longer skips validation there. Set `SKIP_ENV_VALIDATION=1` (exactly `1`) in those stages only.
+
+   ```sh
+   # before: CI=1 skipped validation
+   CI=1 bun run build
+   # after
+   SKIP_ENV_VALIDATION=1 bun run build
+   ```
+
+2. Replace zod methods on `secret()` results. Use the Standard Schema call.
+
+   ```ts skip="before and after fragment of a migration"
+   // before
+   const key = secret(z.string()).parse(value);
+   // after
+   const result = secret(z.string())['~standard'].validate(value);
+   ```
+
+3. Read secrets with `reveal`. A secret prints as `[redacted]` in logs and JSON.
+
+   ```ts skip="before and after fragment of a migration"
+   // after
+   import { reveal } from '@arki/env/core';
+
+   // before
+   const key = env.API_KEY;
+
+   const key = reveal(env.API_KEY);
+   ```
+
+4. Dot apps: expect `ARKI_ENV_PLUGIN_E001` at boot when a variable is missing. Fix the variable. Do not add a skip.
+
+## Verify
+
+Run the app's boot with a missing required variable and confirm it fails. Run `bun run typecheck` in the app to catch `.parse` calls on `secret()`.