@arki/env 0.0.9 → 0.2.0

package/dist/node/edit.js

@@ -0,0 +1,268 @@
+/**
+ * File edits behind `dot env init | set | encrypt | decrypt | rotate`. Each write goes to a temp file
+ * first and is renamed into place, so an interrupted command never leaves half a file.
+ */
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { InvalidInput, isFailure } from '@arki/failure';
+import { decryptValue, encryptValue, envHeader, envValues, generateKeypair, isEncrypted, isKeyName, keyNamesFor, parseEnv, publicKeyOf, readEnvValue, setEnvValue, } from './codec.js';
+import { DecryptionFailed, FileWriteFailed, MissingPrivateKey, MissingPublicKey, RotationIncomplete, } from './errors.js';
+import { readEnvText, writeEnvText } from './files.js';
+import { parsePublicKey } from './key-schemas.js';
+import { findPrivateKey, KEYS_FILE, keysFileCandidates, writePrivateKey } from './keys.js';
+import { nodeOperation } from './operation-telemetry.js';
+/** The public key in a file's header, or `undefined` when it has none. */
+export function publicKeyIn(file) {
+    if (!existsSync(file))
+        return;
+    const text = readEnvText(file);
+    if (isFailure(text))
+        return text;
+    const key = readEnvValue(parseEnv(text), keyNamesFor(path.basename(file)).publicKey);
+    if (key === undefined)
+        return;
+    return parsePublicKey(key);
+}
+/**
+ * Give `file` a dotenvx header, creating the file if needed. Reuses the private key of the same
+ * environment when one is already reachable (so every `.env.development` in a repo shares one key);
+ * otherwise generates a keypair and stores the private key in `<root>/.env.keys`.
+ */
+export function initEnvFile(file, options) {
+    return nodeOperation('init', () => {
+        const existing = publicKeyIn(file);
+        if (isFailure(existing))
+            return existing;
+        if (existing !== undefined)
+            return { file, publicKey: existing, headerAdded: false };
+        const names = keyNamesFor(path.basename(file));
+        const found = findPrivateKey(file, { root: options.root, env: options.env ?? process.env });
+        if (isFailure(found))
+            return found;
+        const reused = found?.keys[0];
+        let publicKey;
+        let keysWritten;
+        if (reused === undefined) {
+            const pair = generateKeypair();
+            if (isFailure(pair))
+                return pair;
+            keysWritten = path.join(options.root, KEYS_FILE);
+            const written = writePrivateKey(keysWritten, names.privateKey, pair.privateKey, path.basename(file));
+            if (isFailure(written))
+                return written;
+            publicKey = pair.publicKey;
+        }
+        else {
+            publicKey = publicKeyOf(reused);
+        }
+        const body = existsSync(file) ? readEnvText(file) : '';
+        if (isFailure(body))
+            return body;
+        const written = writeEnvText(file, `${envHeader(path.basename(file), publicKey)}\n${body}`);
+        if (isFailure(written))
+            return written;
+        return keysWritten === undefined
+            ? { file, publicKey, headerAdded: true }
+            : { file, publicKey, headerAdded: true, keysWritten };
+    });
+}
+/**
+ * Set `key` in `file`, encrypted to the file's public key unless `plain`. Returns `false` when the
+ * file already held exactly this plaintext value (an encrypted value is always rewritten, because
+ * the same plaintext never encrypts to the same bytes).
+ */
+export function setEnvFileValue(file, key, value, options) {
+    return nodeOperation('set', () => {
+        const text = existsSync(file) ? readEnvText(file) : '';
+        if (isFailure(text))
+            return text;
+        let stored = value;
+        if (!options.plain) {
+            const publicKey = readEnvValue(parseEnv(text), keyNamesFor(path.basename(file)).publicKey);
+            if (publicKey === undefined)
+                return MissingPublicKey({ file });
+            const parsedKey = parsePublicKey(publicKey);
+            if (isFailure(parsedKey))
+                return parsedKey;
+            const encrypted = encryptValue(value, parsedKey);
+            if (isFailure(encrypted))
+                return encrypted;
+            stored = encrypted;
+        }
+        const next = setEnvValue(text, key, stored);
+        if (isFailure(next))
+            return next;
+        if (next === text)
+            return false;
+        const written = writeEnvText(file, next);
+        return isFailure(written) ? written : true;
+    });
+}
+/** Encrypt plaintext values in place: the listed keys, or every value. Returns the keys encrypted. */
+export function encryptEnvFile(file, keys) {
+    return nodeOperation('encrypt_file', () => {
+        const text = readEnvText(file);
+        if (isFailure(text))
+            return text;
+        const publicKey = readEnvValue(parseEnv(text), keyNamesFor(path.basename(file)).publicKey);
+        if (publicKey === undefined)
+            return MissingPublicKey({ file });
+        const parsedKey = parsePublicKey(publicKey);
+        if (isFailure(parsedKey))
+            return parsedKey;
+        let next = text;
+        const done = [];
+        for (const [key, entry] of envValues(parseEnv(text))) {
+            if (isKeyName(key) || isEncrypted(entry.value) || (keys !== undefined && !keys.includes(key)))
+                continue;
+            const encrypted = encryptValue(entry.value, parsedKey);
+            if (isFailure(encrypted))
+                return encrypted;
+            const updated = setEnvValue(next, key, encrypted);
+            if (isFailure(updated))
+                return updated;
+            next = updated;
+            done.push(key);
+        }
+        if (done.length > 0) {
+            const written = writeEnvText(file, next);
+            if (isFailure(written))
+                return written;
+        }
+        return done;
+    });
+}
+/** Decrypt values in place with `privateKeys`: the listed keys, or every value. Returns the keys decrypted. */
+export function decryptEnvFile(file, privateKeys, keys) {
+    return nodeOperation('decrypt_file', () => {
+        const text = readEnvText(file);
+        if (isFailure(text))
+            return text;
+        let next = text;
+        const done = [];
+        for (const [key, entry] of envValues(parseEnv(text))) {
+            if (!isEncrypted(entry.value) || (keys !== undefined && !keys.includes(key)))
+                continue;
+            const decrypted = decryptWithAny(entry.value, privateKeys);
+            if (isFailure(decrypted))
+                return decrypted;
+            const updated = setEnvValue(next, key, decrypted);
+            if (isFailure(updated))
+                return updated;
+            next = updated;
+            done.push(key);
+        }
+        if (done.length > 0) {
+            const written = writeEnvText(file, next);
+            if (isFailure(written))
+                return written;
+        }
+        return done;
+    });
+}
+/**
+ * Re-encrypt every file of one environment to a new keypair, in one step: decrypt everything first
+ * (so a wrong key changes nothing), then write each file, then the new private key. All `files` must
+ * share a file name (`.env.production`), because they share a key name.
+ */
+export function rotateEnvFiles(files, options) {
+    const first = files[0];
+    if (first === undefined)
+        return InvalidInput({ issues: [{ message: 'No files to rotate.' }] });
+    const names = keyNamesFor(path.basename(first));
+    if (files.some(file => keyNamesFor(path.basename(file)).privateKey !== names.privateKey)) {
+        return InvalidInput({ issues: [{ message: 'Rotate takes files of one environment at a time.' }] });
+    }
+    return nodeOperation('rotate', () => {
+        const pair = generateKeypair();
+        if (isFailure(pair))
+            return pair;
+        const previousKeys = new Set();
+        const keysFile = path.join(options.root, KEYS_FILE);
+        const keyStores = new Set([keysFile]);
+        const plans = [];
+        for (const file of files) {
+            for (const candidate of keysFileCandidates(file, options.root)) {
+                if (existsSync(candidate))
+                    keyStores.add(candidate);
+            }
+            const text = readEnvText(file);
+            if (isFailure(text))
+                return text;
+            const found = findPrivateKey(file, { root: options.root, env: options.env ?? process.env });
+            if (isFailure(found))
+                return found;
+            for (const key of found?.keys ?? [])
+                previousKeys.add(key);
+            let next = text;
+            let values = 0;
+            for (const [key, entry] of envValues(parseEnv(text))) {
+                let value;
+                if (key === names.publicKey)
+                    value = pair.publicKey;
+                else if (isEncrypted(entry.value)) {
+                    if (found === undefined)
+                        return MissingPrivateKey({ file });
+                    const decrypted = decryptWithAny(entry.value, found.keys);
+                    if (isFailure(decrypted))
+                        return decrypted;
+                    const encrypted = encryptValue(decrypted, pair.publicKey);
+                    if (isFailure(encrypted))
+                        return encrypted;
+                    value = encrypted;
+                    values++;
+                }
+                else
+                    continue;
+                const updated = setEnvValue(next, key, value);
+                if (isFailure(updated))
+                    return updated;
+                next = updated;
+            }
+            if (readEnvValue(parseEnv(text), names.publicKey) === undefined)
+                next = `${envHeader(path.basename(file), pair.publicKey)}\n${next}`;
+            plans.push({ file, next, values });
+        }
+        // Persist both generations BEFORE any ciphertext changes. An interruption at any later point
+        // leaves every old/new file recoverable from this key store, including a partial rotation.
+        for (const store of keyStores) {
+            const staged = writePrivateKey(store, names.privateKey, pair.privateKey, path.basename(first), {
+                preserve: [...previousKeys],
+            });
+            if (isFailure(staged))
+                return staged;
+        }
+        let completedFiles = 0;
+        for (const plan of plans) {
+            const written = writeEnvText(plan.file, plan.next);
+            if (isFailure(written))
+                return RotationIncomplete({ keysFile, completedFiles, totalFiles: plans.length }, { cause: written });
+            completedFiles++;
+        }
+        // Do not retire the old generation until every committed file reads back exactly as planned.
+        for (const plan of plans) {
+            const confirmed = readEnvText(plan.file);
+            if (isFailure(confirmed) || confirmed !== plan.next)
+                return RotationIncomplete({ keysFile, completedFiles, totalFiles: plans.length }, { cause: isFailure(confirmed) ? confirmed : FileWriteFailed({ file: plan.file }) });
+        }
+        for (const store of keyStores) {
+            const finalized = writePrivateKey(store, names.privateKey, pair.privateKey, path.basename(first));
+            if (isFailure(finalized))
+                return RotationIncomplete({ keysFile, completedFiles, totalFiles: plans.length }, { cause: finalized });
+        }
+        return {
+            privateKeyName: names.privateKey,
+            files: plans.map(({ file, values }) => ({ file, values })),
+            keysFile,
+        };
+    });
+}
+function decryptWithAny(value, privateKeys) {
+    for (const privateKey of privateKeys) {
+        const decrypted = decryptValue(value, privateKey);
+        if (!isFailure(decrypted))
+            return decrypted;
+    }
+    return DecryptionFailed();
+}
+//# sourceMappingURL=edit.js.map

package/dist/node/edit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edit.js","sourceRoot":"","sources":["../../src/node/edit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGxD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,SAAS,EACT,eAAe,EACf,WAAW,EACX,SAAS,EACT,WAAW,EACX,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,OAA+F;IAE/F,OAAO,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE;QAChC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAuB,CAAC;QAC1G,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5F,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,SAAuB,CAAC;QAC5B,IAAI,WAA+B,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;YAC/B,IAAI,SAAS,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACrG,IAAI,SAAS,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YACvC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5F,IAAI,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;QACvC,OAAO,WAAW,KAAK,SAAS;YAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE;YACxC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,GAAW,EAAE,KAAa,EAAE,OAAoC;IAC5G,OAAO,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE;QAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC3F,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,SAAS,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACjD,IAAI,SAAS,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC3C,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAwB;IACnE,OAAO,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE;QACxC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3F,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,SAAS,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrD,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAE,SAAS;YACxG,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACvD,IAAI,SAAS,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAClD,IAAI,SAAS,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YACvC,IAAI,GAAG,OAAO,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,SAAS,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,WAAqC,EAAE,IAAwB;IAC1G,OAAO,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE;QACxC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAE,SAAS;YACvF,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC3D,IAAI,SAAS,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAClD,IAAI,SAAS,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YACvC,IAAI,GAAG,OAAO,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,SAAS,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAwB,EACxB,OAA+F;IAE/F,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACzF,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;QAC/B,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiB,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtC,MAAM,KAAK,GAAqD,EAAE,CAAC;QACnE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,KAAK,MAAM,SAAS,IAAI,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,IAAI,UAAU,CAAC,SAAS,CAAC;oBAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,SAAS,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5F,IAAI,SAAS,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACnC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,IAAI,IAAI,EAAE;gBAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,IAAI,GAAG,IAAI,CAAC;YAChB,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrD,IAAI,KAAa,CAAC;gBAClB,IAAI,GAAG,KAAK,KAAK,CAAC,SAAS;oBAAE,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;qBAC/C,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClC,IAAI,KAAK,KAAK,SAAS;wBAAE,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5D,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC1D,IAAI,SAAS,CAAC,SAAS,CAAC;wBAAE,OAAO,SAAS,CAAC;oBAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC1D,IAAI,SAAS,CAAC,SAAS,CAAC;wBAAE,OAAO,SAAS,CAAC;oBAC3C,KAAK,GAAG,SAAS,CAAC;oBAClB,MAAM,EAAE,CAAC;gBACX,CAAC;;oBAAM,SAAS;gBAChB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC9C,IAAI,SAAS,CAAC,OAAO,CAAC;oBAAE,OAAO,OAAO,CAAC;gBACvC,IAAI,GAAG,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS;gBAC7D,IAAI,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;YACtE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,6FAA6F;QAC7F,2FAA2F;QAC3F,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAC7F,QAAQ,EAAE,CAAC,GAAG,YAAY,CAAC;aAC5B,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;QACvC,CAAC;QACD,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,SAAS,CAAC,OAAO,CAAC;gBACpB,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACxG,cAAc,EAAE,CAAC;QACnB,CAAC;QACD,6FAA6F;QAC7F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI;gBACjD,OAAO,kBAAkB,CACvB,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,EACtD,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CACnF,CAAC;QACN,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAClG,IAAI,SAAS,CAAC,SAAS,CAAC;gBACtB,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO;YACL,cAAc,EAAE,KAAK,CAAC,UAAU;YAChC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,QAAQ;SACc,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,WAAqC;IAC1E,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC"}

package/dist/node/errors.d.ts

@@ -0,0 +1,119 @@
+/** A dotenv value has no lossless quoting.
+ * @fix Use encryption or a value supported by dotenv quoting.
+ * @verify bun run test
+ */
+export declare const UnrepresentableValue: import("@arki/failure").FailureDefinition<"env.unrepresentable_value", undefined>;
+/** Cryptographic encryption failed.
+ * @fix Verify the public key and runtime crypto support.
+ * @verify bun run test
+ */
+export declare const EncryptionFailed: import("@arki/failure").FailureDefinition<"env.encryption_failed", undefined>;
+/** Ciphertext authentication or decoding failed.
+ * @fix Restore the correct private key or reset the damaged value.
+ * @verify bun run test
+ */
+export declare const DecryptionFailed: import("@arki/failure").FailureDefinition<"env.decryption_failed", undefined>;
+/** The runtime could not generate a keypair.
+ * @fix Restore runtime crypto support.
+ * @verify bun run test
+ */
+export declare const KeyGenerationFailed: import("@arki/failure").FailureDefinition<"env.key_generation_failed", undefined>;
+/** An env file could not be read.
+ * @fix Check the path, file type and access permissions.
+ * @verify bun run test
+ */
+export declare const FileReadFailed: import("@arki/failure").FailureDefinition<"env.file_read_failed", import("@standard-schema/spec").StandardSchemaV1<{
+    file: string;
+}, {
+    file: string;
+}>>;
+/** An env file could not be replaced.
+ * @fix Check disk space and parent-directory permissions.
+ * @verify bun run test
+ */
+export declare const FileWriteFailed: import("@arki/failure").FailureDefinition<"env.file_write_failed", import("@standard-schema/spec").StandardSchemaV1<{
+    file: string;
+}, {
+    file: string;
+}>>;
+/** The target file has no public key.
+ * @fix Initialize the file before encrypting values.
+ * @verify bun run test
+ */
+export declare const MissingPublicKey: import("@arki/failure").FailureDefinition<"env.missing_public_key", import("@standard-schema/spec").StandardSchemaV1<{
+    file: string;
+}, {
+    file: string;
+}>>;
+/** No private key is available.
+ * @fix Restore the environment key from its backup.
+ * @verify bun run test
+ */
+export declare const MissingPrivateKey: import("@arki/failure").FailureDefinition<"env.missing_private_key", import("@standard-schema/spec").StandardSchemaV1<{
+    file: string;
+}, {
+    file: string;
+}>>;
+/** Rotation stopped after its recovery keys were saved.
+ * @fix Keep the staged key file and retry rotation.
+ * @verify bun run test
+ */
+export declare const RotationIncomplete: import("@arki/failure").FailureDefinition<"env.rotation_incomplete", import("@standard-schema/spec").StandardSchemaV1<{
+    keysFile: string;
+    completedFiles: number;
+    totalFiles: number;
+}, {
+    keysFile: string;
+    completedFiles: number;
+    totalFiles: number;
+}>>;
+/** A secret provider rejected a read.
+ * @fix Check the provider CLI installation, login and reference.
+ * @verify bun run test
+ */
+export declare const ReferenceFailed: import("@arki/failure").FailureDefinition<"env.reference_failed", import("@standard-schema/spec").StandardSchemaV1<{
+    scheme: string;
+}, {
+    scheme: string;
+}>>;
+/** Loading was cancelled.
+ * @fix Handle cancellation at the calling boundary.
+ * @verify bun run test
+ */
+export declare const EnvCancelled: import("@arki/failure").FailureDefinition<"env.cancelled", undefined>;
+/** The aggregate load deadline elapsed.
+ * @fix Increase the budget or restore provider responsiveness.
+ * @verify bun run test
+ */
+export declare const EnvDeadline: import("@arki/failure").FailureDefinition<"env.deadline", undefined>;
+/** Loader problem codes are derived from their canonical definitions. */
+export declare const ENV_FILES_ERROR_CODES: {
+    readonly missingPrivateKey: "env.missing_private_key";
+    readonly cannotDecrypt: "env.decryption_failed";
+    readonly unresolvedReference: "env.reference_failed";
+    readonly cannotRead: "env.file_read_failed";
+    readonly cancelled: "env.cancelled";
+    readonly deadline: "env.deadline";
+};
+/** One or more env entries could not be loaded. Public data excludes values and raw causes.
+ * @fix Address each named problem before starting the app.
+ * @verify bun run test
+ */
+export declare const EnvFilesFailed: import("@arki/failure").FailureDefinition<"env.files_failed", import("@standard-schema/spec").StandardSchemaV1<{
+    environment: string;
+    errors: {
+        code: "env.cancelled" | "env.deadline" | "env.decryption_failed" | "env.file_read_failed" | "env.missing_private_key" | "env.reference_failed";
+        message: string;
+        file: string;
+        key?: string | undefined;
+    }[];
+}, {
+    environment: string;
+    errors: {
+        code: "env.cancelled" | "env.deadline" | "env.decryption_failed" | "env.file_read_failed" | "env.missing_private_key" | "env.reference_failed";
+        message: string;
+        file: string;
+        key?: string | undefined;
+    }[];
+}>>;
+//# sourceMappingURL=errors.d.ts.map

package/dist/node/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/node/errors.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,mFAI/B,CAAC;AACH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,+EAI3B,CAAC;AACH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,+EAI3B,CAAC;AACH;;;GAGG;AACH,eAAO,MAAM,mBAAmB,mFAI9B,CAAC;AACH;;;GAGG;AACH,eAAO,MAAM,cAAc;;;;GAKzB,CAAC;AACH;;;GAGG;AACH,eAAO,MAAM,eAAe;;;;GAK1B,CAAC;AACH;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;;GAI3B,CAAC;AACH;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;;GAI5B,CAAC;AACH;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;GAU7B,CAAC;AACH;;;GAGG;AACH,eAAO,MAAM,eAAe;;;;GAK1B,CAAC;AACH;;;GAGG;AACH,eAAO,MAAM,YAAY,uEAIvB,CAAC;AACH;;;GAGG;AACH,eAAO,MAAM,WAAW,sEAItB,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,qBAAqB;aAChC,iBAAiB;aACjB,aAAa;aACb,mBAAmB;aACnB,UAAU;aACV,SAAS;aACT,QAAQ;CACA,CAAC;AAOX;;;GAGG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;GAKzB,CAAC"}

package/dist/node/errors.js

@@ -0,0 +1,144 @@
+import { z } from 'zod';
+import { defineFailure } from '@arki/failure';
+/** A dotenv value has no lossless quoting.
+ * @fix Use encryption or a value supported by dotenv quoting.
+ * @verify bun run test
+ */
+export const UnrepresentableValue = defineFailure('env.unrepresentable_value', {
+    message: 'The value cannot be stored losslessly in dotenv text',
+    status: 422,
+    remediation: 'Encrypt the value or remove the unsupported combination of quotes and line breaks.',
+});
+/** Cryptographic encryption failed.
+ * @fix Verify the public key and runtime crypto support.
+ * @verify bun run test
+ */
+export const EncryptionFailed = defineFailure('env.encryption_failed', {
+    message: 'Cannot encrypt the env value',
+    status: 500,
+    remediation: 'Verify the public key and runtime crypto support.',
+});
+/** Ciphertext authentication or decoding failed.
+ * @fix Restore the correct private key or reset the damaged value.
+ * @verify bun run test
+ */
+export const DecryptionFailed = defineFailure('env.decryption_failed', {
+    message: 'Cannot decrypt the env value',
+    status: 422,
+    remediation: 'Restore the correct private key or reset the damaged encrypted value.',
+});
+/** The runtime could not generate a keypair.
+ * @fix Restore runtime crypto support.
+ * @verify bun run test
+ */
+export const KeyGenerationFailed = defineFailure('env.key_generation_failed', {
+    message: 'Cannot generate an env keypair',
+    status: 500,
+    remediation: 'Restore runtime crypto support before retrying.',
+});
+/** An env file could not be read.
+ * @fix Check the path, file type and access permissions.
+ * @verify bun run test
+ */
+export const FileReadFailed = defineFailure('env.file_read_failed', {
+    data: z.object({ file: z.string() }),
+    message: 'Cannot read env file {file}',
+    status: 500,
+    remediation: 'Check the file path, type and access permissions.',
+});
+/** An env file could not be replaced.
+ * @fix Check disk space and parent-directory permissions.
+ * @verify bun run test
+ */
+export const FileWriteFailed = defineFailure('env.file_write_failed', {
+    data: z.object({ file: z.string() }),
+    message: 'Cannot write env file {file}',
+    status: 500,
+    remediation: 'Check disk space and parent-directory permissions before retrying.',
+});
+/** The target file has no public key.
+ * @fix Initialize the file before encrypting values.
+ * @verify bun run test
+ */
+export const MissingPublicKey = defineFailure('env.missing_public_key', {
+    data: z.object({ file: z.string() }),
+    message: 'Env file {file} has no public key header',
+    remediation: 'Initialize the file before encrypting values.',
+});
+/** No private key is available.
+ * @fix Restore the environment key from its backup.
+ * @verify bun run test
+ */
+export const MissingPrivateKey = defineFailure('env.missing_private_key', {
+    data: z.object({ file: z.string() }),
+    message: 'No private key is available for {file}',
+    remediation: 'Restore the environment private key from its backup or shell variable.',
+});
+/** Rotation stopped after its recovery keys were saved.
+ * @fix Keep the staged key file and retry rotation.
+ * @verify bun run test
+ */
+export const RotationIncomplete = defineFailure('env.rotation_incomplete', {
+    data: z.object({
+        keysFile: z.string(),
+        completedFiles: z.number().int().nonnegative(),
+        totalFiles: z.number().int().nonnegative(),
+    }),
+    message: 'Env rotation stopped; recovery keys are saved in {keysFile}',
+    status: 500,
+    remediation: 'Keep the staged key file: it contains keys for both old and new ciphertext. Repair the filesystem and retry rotation.',
+});
+/** A secret provider rejected a read.
+ * @fix Check the provider CLI installation, login and reference.
+ * @verify bun run test
+ */
+export const ReferenceFailed = defineFailure('env.reference_failed', {
+    data: z.object({ scheme: z.string() }),
+    message: 'Cannot resolve the {scheme} secret reference',
+    status: 502,
+    remediation: 'Check the provider CLI installation, login and reference; inspect the local cause privately.',
+});
+/** Loading was cancelled.
+ * @fix Handle cancellation at the calling boundary.
+ * @verify bun run test
+ */
+export const EnvCancelled = defineFailure('env.cancelled', {
+    message: 'Env loading was cancelled',
+    status: 499,
+    remediation: 'Honor cancellation at the calling boundary.',
+});
+/** The aggregate load deadline elapsed.
+ * @fix Increase the budget or restore provider responsiveness.
+ * @verify bun run test
+ */
+export const EnvDeadline = defineFailure('env.deadline', {
+    message: 'The env loading deadline elapsed',
+    status: 504,
+    remediation: 'Increase the load budget or restore provider responsiveness.',
+});
+/** Loader problem codes are derived from their canonical definitions. */
+export const ENV_FILES_ERROR_CODES = {
+    missingPrivateKey: MissingPrivateKey.code,
+    cannotDecrypt: DecryptionFailed.code,
+    unresolvedReference: ReferenceFailed.code,
+    cannotRead: FileReadFailed.code,
+    cancelled: EnvCancelled.code,
+    deadline: EnvDeadline.code,
+};
+const problem = z.object({
+    code: z.enum(Object.values(ENV_FILES_ERROR_CODES)),
+    message: z.string(),
+    file: z.string(),
+    key: z.string().optional(),
+});
+/** One or more env entries could not be loaded. Public data excludes values and raw causes.
+ * @fix Address each named problem before starting the app.
+ * @verify bun run test
+ */
+export const EnvFilesFailed = defineFailure('env.files_failed', {
+    data: z.object({ environment: z.string(), errors: z.array(problem) }),
+    message: 'Cannot load the env files',
+    status: 500,
+    remediation: 'Address each named file/key problem before starting the application.',
+});
+//# sourceMappingURL=errors.js.map

package/dist/node/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/node/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC,2BAA2B,EAAE;IAC7E,OAAO,EAAE,sDAAsD;IAC/D,MAAM,EAAE,GAAG;IACX,WAAW,EAAE,oFAAoF;CAClG,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC,uBAAuB,EAAE;IACrE,OAAO,EAAE,8BAA8B;IACvC,MAAM,EAAE,GAAG;IACX,WAAW,EAAE,mDAAmD;CACjE,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC,uBAAuB,EAAE;IACrE,OAAO,EAAE,8BAA8B;IACvC,MAAM,EAAE,GAAG;IACX,WAAW,EAAE,uEAAuE;CACrF,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC,2BAA2B,EAAE;IAC5E,OAAO,EAAE,gCAAgC;IACzC,MAAM,EAAE,GAAG;IACX,WAAW,EAAE,iDAAiD;CAC/D,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC,sBAAsB,EAAE;IAClE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACpC,OAAO,EAAE,6BAA6B;IACtC,MAAM,EAAE,GAAG;IACX,WAAW,EAAE,mDAAmD;CACjE,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC,uBAAuB,EAAE;IACpE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACpC,OAAO,EAAE,8BAA8B;IACvC,MAAM,EAAE,GAAG;IACX,WAAW,EAAE,oEAAoE;CAClF,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC,wBAAwB,EAAE;IACtE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACpC,OAAO,EAAE,0CAA0C;IACnD,WAAW,EAAE,+CAA+C;CAC7D,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC,yBAAyB,EAAE;IACxE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACpC,OAAO,EAAE,wCAAwC;IACjD,WAAW,EAAE,wEAAwE;CACtF,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC,yBAAyB,EAAE;IACzE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC3C,CAAC;IACF,OAAO,EAAE,6DAA6D;IACtE,MAAM,EAAE,GAAG;IACX,WAAW,EACT,uHAAuH;CAC1H,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC,sBAAsB,EAAE;IACnE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtC,OAAO,EAAE,8CAA8C;IACvD,MAAM,EAAE,GAAG;IACX,WAAW,EAAE,8FAA8F;CAC5G,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE;IACzD,OAAO,EAAE,2BAA2B;IACpC,MAAM,EAAE,GAAG;IACX,WAAW,EAAE,6CAA6C;CAC3D,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,cAAc,EAAE;IACvD,OAAO,EAAE,kCAAkC;IAC3C,MAAM,EAAE,GAAG;IACX,WAAW,EAAE,8DAA8D;CAC5E,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iBAAiB,EAAE,iBAAiB,CAAC,IAAI;IACzC,aAAa,EAAE,gBAAgB,CAAC,IAAI;IACpC,mBAAmB,EAAE,eAAe,CAAC,IAAI;IACzC,UAAU,EAAE,cAAc,CAAC,IAAI;IAC/B,SAAS,EAAE,YAAY,CAAC,IAAI;IAC5B,QAAQ,EAAE,WAAW,CAAC,IAAI;CAClB,CAAC;AACX,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC,kBAAkB,EAAE;IAC9D,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACrE,OAAO,EAAE,2BAA2B;IACpC,MAAM,EAAE,GAAG;IACX,WAAW,EAAE,sEAAsE;CACpF,CAAC,CAAC"}

package/dist/node/files.d.ts

@@ -0,0 +1,9 @@
+/** Foreign filesystem errors stay private; public outcomes identify only the file. */
+export declare function readEnvText(file: string): string | import("@arki/failure").Failure<"env.file_read_failed", {
+    file: string;
+}>;
+/** Each replacement is atomic; owner-only new files and key stores never follow a planted temp symlink. */
+export declare function writeEnvText(file: string, text: string, privateFile?: boolean): import("@arki/failure").Failure<"env.file_write_failed", {
+    file: string;
+}> | undefined;
+//# sourceMappingURL=files.d.ts.map

package/dist/node/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/node/files.ts"],"names":[],"mappings":"AASA,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM;;GAOvC;AAED,2GAA2G;AAC3G,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,UAAQ;;eAoB3E"}

package/dist/node/files.js

@@ -0,0 +1,35 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { attempt } from '@arki/failure';
+import { FileReadFailed, FileWriteFailed } from './errors.js';
+import { nodeOperation } from './operation-telemetry.js';
+/** Foreign filesystem errors stay private; public outcomes identify only the file. */
+export function readEnvText(file) {
+    return nodeOperation('file.read', () => attempt(() => readFileSync(file, 'utf8'), error => FileReadFailed({ file }, { cause: error })));
+}
+/** Each replacement is atomic; owner-only new files and key stores never follow a planted temp symlink. */
+export function writeEnvText(file, text, privateFile = false) {
+    return nodeOperation('file.write', () => {
+        let temp;
+        try {
+            const mode = privateFile ? 0o600 : existsSync(file) ? statSync(file).mode & 0o777 : 0o600;
+            temp = path.join(path.dirname(file), `.${path.basename(file)}.${randomUUID()}.tmp`);
+            writeFileSync(temp, text, { flag: 'wx', mode });
+            renameSync(temp, file);
+            return;
+        }
+        catch (error) {
+            if (temp !== undefined) {
+                try {
+                    unlinkSync(temp);
+                }
+                catch {
+                    /* The failed write may not have created a file. */
+                }
+            }
+            return FileWriteFailed({ file }, { cause: error });
+        }
+    });
+}
+//# sourceMappingURL=files.js.map

package/dist/node/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/node/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE,CACrC,OAAO,CACL,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAChC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CACpD,CACF,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,WAAW,GAAG,KAAK;IAC1E,OAAO,aAAa,CAAC,YAAY,EAAE,GAAG,EAAE;QACtC,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;YAC1F,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;YACpF,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,UAAU,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;gBAAC,MAAM,CAAC;oBACP,mDAAmD;gBACrD,CAAC;YACH,CAAC;YACD,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/node/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Encrypted env files in the dotenvx 2.x format, for Node, Bun and Deno: load them into the
+ * environment (`loadEnvFiles`), edit them (`initEnvFile`, `setEnvFileValue`, ...), and the codec
+ * underneath. The Dot CLI's `dot env` commands are built on these.
+ */
+export { decryptValue, ENCRYPTED_PREFIX, encryptValue, envHeader, envValues, generateKeypair, isEncrypted, isKeyName, keyNamesFor, parseEnv, publicKeyOf, readEnvValue, removeEnvValue, setEnvValue, } from './codec.js';
+export type { EnvDocument, EnvEntry, EnvKeypair } from './codec.js';
+export { decryptEnvFile, encryptEnvFile, initEnvFile, publicKeyIn, rotateEnvFiles, setEnvFileValue } from './edit.js';
+export type { InitResult, RotateResult } from './edit.js';
+export { findPrivateKey, KEYS_FILE, keysFileCandidates, writePrivateKey } from './keys.js';
+export type { FoundPrivateKey, PrivateKeySource } from './keys.js';
+export { envDirs, ENV_FILES_ERROR_CODES, findRoot, formatEnvFilesErrors, loadEnvFiles, secretValues } from './load.js';
+export type { EnvFilesError, EnvFilesReport, EnvFileValue, EnvValueKind, LoadEnvFilesOptions } from './load.js';
+export { DEFAULT_RESOLVERS, referenceScheme } from './references.js';
+export type { ReferenceResolver } from './references.js';
+export type { ReferenceOptions } from './references.js';
+export { DecryptionFailed, EncryptionFailed, EnvCancelled, EnvDeadline, EnvFilesFailed, FileReadFailed, FileWriteFailed, KeyGenerationFailed, MissingPrivateKey, MissingPublicKey, ReferenceFailed, RotationIncomplete, UnrepresentableValue, } from './errors.js';
+export { envPrivateKeySchema, envPublicKeySchema, parsePrivateKey, parsePublicKey } from './key-schemas.js';
+export type { EnvPrivateKey, EnvPublicKey } from './key-schemas.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/node/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,SAAS,EACT,eAAe,EACf,WAAW,EACX,SAAS,EACT,WAAW,EACX,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,cAAc,EACd,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACtH,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC3F,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACvH,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,cAAc,EACd,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC5G,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC"}