@floracodex/nestjs-secrets 1.0.3 → 1.1.0

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from './interfaces/secrets-loader-options.interface';
+export * from './interfaces/secrets-module-options.interface';
+export * from './interfaces/secrets-provider.interface';
+export * from './modules/secrets.module';
+export * from './services/secrets-loader.service';

package/dist/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./interfaces/secrets-loader-options.interface"), exports);
+__exportStar(require("./interfaces/secrets-module-options.interface"), exports);
+__exportStar(require("./interfaces/secrets-provider.interface"), exports);
+__exportStar(require("./modules/secrets.module"), exports);
+__exportStar(require("./services/secrets-loader.service"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gFAA8D;AAC9D,gFAA8D;AAC9D,0EAAwD;AACxD,2DAAyC;AACzC,oEAAkD"}

package/dist/interfaces/secrets-loader-options.interface.d.ts

@@ -0,0 +1,12 @@
+import { type SecretsProvider, type SecretsProviderType } from './secrets-provider.interface';
+export interface SecretsLoaderOptions {
+    provider?: SecretsProviderType | SecretsProvider;
+    client?: any;
+    /**
+     * Base directory for config files (absolute or relative). If relative and not specified, defaults to
+     * <app_root>/config. If just a directory name is given (e.g. 'config'), it's resolved relative to app root
+     */
+    root?: string;
+    files: string[];
+    fileType?: 'yaml' | 'json';
+}

package/dist/interfaces/secrets-loader-options.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=secrets-loader-options.interface.js.map

package/dist/interfaces/secrets-loader-options.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-loader-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/secrets-loader-options.interface.ts"],"names":[],"mappings":""}

package/dist/interfaces/secrets-module-options.interface.d.ts

@@ -0,0 +1,4 @@
+import { type ConfigModuleOptions } from '@nestjs/config';
+import { type SecretsLoaderOptions } from './secrets-loader-options.interface';
+export interface SecretsModuleOptions extends ConfigModuleOptions, SecretsLoaderOptions {
+}

package/dist/interfaces/secrets-module-options.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=secrets-module-options.interface.js.map

package/dist/interfaces/secrets-module-options.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-module-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/secrets-module-options.interface.ts"],"names":[],"mappings":""}

package/dist/interfaces/secrets-provider.interface.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Interface for secret providers
+ */
+export declare abstract class SecretsProvider {
+    /**
+     * Checks if a string is a valid secret reference for this provider
+     * @param value The string to check
+     * @returns True if the string is a valid secret reference
+     */
+    abstract isSecretReference(value: string): boolean;
+    /**
+     * Resolves a secret reference to its actual value.
+     * @param secretRef The reference to the secret
+     * @returns The resolved secret value (string or array of strings)
+     * @throws Error when the secret cannot be retrieved or has an invalid format
+     */
+    abstract resolveSecret(secretRef: string): Promise<string | string[]>;
+}
+/**
+ * The secret providers included with this library.
+ *
+ * Note: You can also use a custom provider by passing an instance of your provider class to the SecretsLoaderService.
+ * Open a PR or reach out to us at support@floracodex.com if you implement your own provider. We'd love to officially
+ * support it if it makes sense to add it to this list.
+ */
+export type SecretsProviderType = 'AwsParameterStoreProvider' | 'AwsSecretsManagerProvider' | 'AzureKeyVaultProvider' | 'GoogleSecretManagerProvider';

package/dist/interfaces/secrets-provider.interface.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretsProvider = void 0;
+/**
+ * Interface for secret providers
+ */
+class SecretsProvider {
+}
+exports.SecretsProvider = SecretsProvider;
+//# sourceMappingURL=secrets-provider.interface.js.map

package/dist/interfaces/secrets-provider.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-provider.interface.js","sourceRoot":"","sources":["../../src/interfaces/secrets-provider.interface.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACH,MAAsB,eAAe;CAepC;AAfD,0CAeC"}

package/dist/modules/secrets.module.d.ts

@@ -0,0 +1,5 @@
+import { DynamicModule } from '@nestjs/common';
+import { SecretsModuleOptions } from '../interfaces/secrets-module-options.interface';
+export declare class SecretsModule {
+    static forRoot(options: SecretsModuleOptions): Promise<DynamicModule>;
+}

package/dist/modules/secrets.module.js

@@ -0,0 +1,37 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var SecretsModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretsModule = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const secrets_loader_service_1 = require("../services/secrets-loader.service");
+let SecretsModule = SecretsModule_1 = class SecretsModule {
+    static async forRoot(options) {
+        const secretsLoaderService = new secrets_loader_service_1.SecretsLoaderService();
+        const configFactory = secretsLoaderService.createConfigFactory(options);
+        return {
+            module: SecretsModule_1,
+            imports: [
+                await config_1.ConfigModule.forRoot({
+                    ...options,
+                    load: [configFactory],
+                    // Override any options that we handle ourselves
+                    ignoreEnvFile: true
+                })
+            ],
+            exports: [config_1.ConfigModule]
+        };
+    }
+};
+exports.SecretsModule = SecretsModule;
+exports.SecretsModule = SecretsModule = SecretsModule_1 = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({})
+], SecretsModule);
+//# sourceMappingURL=secrets.module.js.map

package/dist/modules/secrets.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.module.js","sourceRoot":"","sources":["../../src/modules/secrets.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA6D;AAC7D,2CAA4C;AAC5C,+EAAwE;AAKjE,IAAM,aAAa,qBAAnB,MAAM,aAAa;IACtB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAA6B;QAC9C,MAAM,oBAAoB,GAAG,IAAI,6CAAoB,EAAE,CAAC;QACxD,MAAM,aAAa,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAExE,OAAO;YACH,MAAM,EAAE,eAAa;YACrB,OAAO,EAAE;gBACL,MAAM,qBAAY,CAAC,OAAO,CAAC;oBACvB,GAAG,OAAO;oBACV,IAAI,EAAE,CAAC,aAAa,CAAC;oBACrB,gDAAgD;oBAChD,aAAa,EAAE,IAAI;iBACtB,CAAC;aACL;YACD,OAAO,EAAE,CAAC,qBAAY,CAAC;SAC1B,CAAC;IACN,CAAC;CACJ,CAAA;AAlBY,sCAAa;wBAAb,aAAa;IAFzB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,aAAa,CAkBzB"}

package/dist/providers/aws-parameter-store.provider.d.ts

@@ -0,0 +1,39 @@
+import { SSMClient } from '@aws-sdk/client-ssm';
+import { SecretsProvider } from '../interfaces/secrets-provider.interface';
+export declare class AwsParameterStoreProvider implements SecretsProvider {
+    private readonly client;
+    private readonly logger;
+    /**
+     * Regular expression to validate AWS Parameter Store paths.
+     * Matches either:
+     * - Path format: /path/to/parameter
+     * - ARN format: arn:aws:ssm:region:account:parameter/path/to/parameter
+     */
+    private readonly parameterPathPattern;
+    constructor(client: SSMClient);
+    /**
+     * Checks if a string is a valid Parameter Store reference.
+     * @param value The string to check
+     * @returns True if the string is a valid Parameter Store reference
+     */
+    isSecretReference(value: string): boolean;
+    /**
+     * Resolves a Parameter Store reference to its actual value
+     * @param secretRef The reference to the secret in AWS Parameter Store
+     * @returns The resolved secret value as a string
+     * @throws Error when the secret cannot be retrieved or has an invalid format
+     */
+    resolveSecret(secretRef: string): Promise<string | string[]>;
+    /**
+     * Retrieves all parameters under a specific path.
+     * @param pathRef The parameter path reference ending with '/*'
+     * @returns Array of parameter values
+     */
+    private retrieveParametersByPath;
+    /**
+     * Retrieves a single parameter by name.
+     * @param paramName The parameter name or ARN
+     * @returns The parameter value
+     */
+    private retrieveSingleParameter;
+}

package/dist/providers/aws-parameter-store.provider.js

@@ -0,0 +1,98 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AwsParameterStoreProvider_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsParameterStoreProvider = void 0;
+const common_1 = require("@nestjs/common");
+const client_ssm_1 = require("@aws-sdk/client-ssm");
+let AwsParameterStoreProvider = AwsParameterStoreProvider_1 = class AwsParameterStoreProvider {
+    client;
+    logger = new common_1.Logger(AwsParameterStoreProvider_1.name);
+    /**
+     * Regular expression to validate AWS Parameter Store paths.
+     * Matches either:
+     * - Path format: /path/to/parameter
+     * - ARN format: arn:aws:ssm:region:account:parameter/path/to/parameter
+     */
+    parameterPathPattern = /^(?:\/[a-zA-Z0-9_./-]+|arn:[a-z-]+:ssm:[a-z0-9-]+:\d{12}:parameter\/[a-zA-Z0-9_./-]+)$/;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * Checks if a string is a valid Parameter Store reference.
+     * @param value The string to check
+     * @returns True if the string is a valid Parameter Store reference
+     */
+    isSecretReference(value) {
+        return this.parameterPathPattern.test(value);
+    }
+    /**
+     * Resolves a Parameter Store reference to its actual value
+     * @param secretRef The reference to the secret in AWS Parameter Store
+     * @returns The resolved secret value as a string
+     * @throws Error when the secret cannot be retrieved or has an invalid format
+     */
+    async resolveSecret(secretRef) {
+        if (secretRef.endsWith('/*')) {
+            return await this.retrieveParametersByPath(secretRef);
+        }
+        return await this.retrieveSingleParameter(secretRef);
+    }
+    /**
+     * Retrieves all parameters under a specific path.
+     * @param pathRef The parameter path reference ending with '/*'
+     * @returns Array of parameter values
+     */
+    async retrieveParametersByPath(pathRef) {
+        const basePath = pathRef.slice(0, -2);
+        const command = new client_ssm_1.GetParametersByPathCommand({
+            Path: basePath,
+            WithDecryption: true,
+            Recursive: true
+        });
+        const response = await this.client.send(command);
+        if (!response.Parameters || response.Parameters.length === 0) {
+            throw new Error(`No parameters found at path: ${basePath}`);
+        }
+        return response.Parameters.map((param) => {
+            if (!param.Value) {
+                this.logger.warn(`Parameter ${param.Name} has no value`);
+                return '';
+            }
+            return param.Value;
+        }).filter(Boolean);
+    }
+    /**
+     * Retrieves a single parameter by name.
+     * @param paramName The parameter name or ARN
+     * @returns The parameter value
+     */
+    async retrieveSingleParameter(paramName) {
+        const command = new client_ssm_1.GetParameterCommand({
+            Name: paramName,
+            WithDecryption: true
+        });
+        const response = await this.client.send(command);
+        if (!response.Parameter) {
+            throw new Error(`Parameter not found: ${paramName}`);
+        }
+        if (!response.Parameter.Value) {
+            throw new Error(`Parameter value is empty for: ${paramName}`);
+        }
+        return response.Parameter.Value;
+    }
+};
+exports.AwsParameterStoreProvider = AwsParameterStoreProvider;
+exports.AwsParameterStoreProvider = AwsParameterStoreProvider = AwsParameterStoreProvider_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [client_ssm_1.SSMClient])
+], AwsParameterStoreProvider);
+//# sourceMappingURL=aws-parameter-store.provider.js.map

package/dist/providers/aws-parameter-store.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-parameter-store.provider.js","sourceRoot":"","sources":["../../src/providers/aws-parameter-store.provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAkD;AAClD,oDAA0G;AAInG,IAAM,yBAAyB,iCAA/B,MAAM,yBAAyB;IAWL;IAVZ,MAAM,GAAG,IAAI,eAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;IAErE;;;;;OAKG;IACc,oBAAoB,GAAG,wFAAwF,CAAC;IAEjI,YAA6B,MAAiB;QAAjB,WAAM,GAAN,MAAM,CAAW;IAC9C,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACjC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,wBAAwB,CAAC,OAAe;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG,IAAI,uCAA0B,CAAC;YAC3C,IAAI,EAAE,QAAQ;YACd,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;SAClB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEjD,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAgB,EAAE,EAAE;YAChD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,eAAe,CAAC,CAAC;gBACzD,OAAO,EAAE,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC,KAAK,CAAC;QACvB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,uBAAuB,CAAC,SAAiB;QACnD,MAAM,OAAO,GAAG,IAAI,gCAAmB,CAAC;YACpC,IAAI,EAAE,SAAS;YACf,cAAc,EAAE,IAAI;SACvB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEjD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,iCAAiC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;IACpC,CAAC;CACJ,CAAA;AAzFY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;qCAY4B,sBAAS;GAXrC,yBAAyB,CAyFrC"}

package/dist/providers/aws-secrets-manager.provider.d.ts

@@ -0,0 +1,30 @@
+import { SecretsManager } from '@aws-sdk/client-secrets-manager';
+import { SecretsProvider } from '../interfaces/secrets-provider.interface';
+export declare class AwsSecretsManagerProvider implements SecretsProvider {
+    private readonly client;
+    private readonly logger;
+    /**
+     * Regular expression pattern for validating AWS Secrets Manager ARNs
+     */
+    private readonly arnPattern;
+    constructor(client: SecretsManager);
+    /**
+     * Checks if a string is a valid AWS Secrets Manager ARN.
+     * @param value The string to check
+     * @returns True if the string is a valid AWS Secrets Manager ARN
+     */
+    isSecretReference(value: string): boolean;
+    /**
+     * Resolves an AWS Secrets Manager ARN to its actual value
+     * @param secretRef The AWS Secrets Manager ARN
+     * @returns The resolved secret value as a string
+     * @throws Error when the secret cannot be retrieved or has an invalid format
+     */
+    resolveSecret(secretRef: string): Promise<string>;
+    /**
+     * Decodes a binary secret to a string.
+     * @param binaryData The binary data to decode
+     * @returns The decoded string
+     */
+    private decodeBinarySecret;
+}

package/dist/providers/aws-secrets-manager.provider.js

@@ -0,0 +1,65 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AwsSecretsManagerProvider_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsSecretsManagerProvider = void 0;
+const common_1 = require("@nestjs/common");
+const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+let AwsSecretsManagerProvider = AwsSecretsManagerProvider_1 = class AwsSecretsManagerProvider {
+    client;
+    logger = new common_1.Logger(AwsSecretsManagerProvider_1.name);
+    /**
+     * Regular expression pattern for validating AWS Secrets Manager ARNs
+     */
+    arnPattern = /^arn:aws:secretsmanager:[a-z0-9-]+:[0-9]+:secret:.+$/;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * Checks if a string is a valid AWS Secrets Manager ARN.
+     * @param value The string to check
+     * @returns True if the string is a valid AWS Secrets Manager ARN
+     */
+    isSecretReference(value) {
+        return this.arnPattern.test(value);
+    }
+    /**
+     * Resolves an AWS Secrets Manager ARN to its actual value
+     * @param secretRef The AWS Secrets Manager ARN
+     * @returns The resolved secret value as a string
+     * @throws Error when the secret cannot be retrieved or has an invalid format
+     */
+    async resolveSecret(secretRef) {
+        const response = await this.client.getSecretValue({ SecretId: secretRef });
+        if (response.SecretString) {
+            return response.SecretString;
+        }
+        else if (response.SecretBinary) {
+            return this.decodeBinarySecret(response.SecretBinary);
+        }
+        throw new Error('Secret value is empty');
+    }
+    /**
+     * Decodes a binary secret to a string.
+     * @param binaryData The binary data to decode
+     * @returns The decoded string
+     */
+    decodeBinarySecret(binaryData) {
+        const buff = Buffer.from(binaryData, 'base64');
+        return buff.toString('utf8');
+    }
+};
+exports.AwsSecretsManagerProvider = AwsSecretsManagerProvider;
+exports.AwsSecretsManagerProvider = AwsSecretsManagerProvider = AwsSecretsManagerProvider_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [client_secrets_manager_1.SecretsManager])
+], AwsSecretsManagerProvider);
+//# sourceMappingURL=aws-secrets-manager.provider.js.map

package/dist/providers/aws-secrets-manager.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-secrets-manager.provider.js","sourceRoot":"","sources":["../../src/providers/aws-secrets-manager.provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAkD;AAClD,4EAA+D;AAIxD,IAAM,yBAAyB,iCAA/B,MAAM,yBAAyB;IAQL;IAPZ,MAAM,GAAG,IAAI,eAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;IAErE;;OAEG;IACc,UAAU,GAAG,sDAAsD,CAAC;IAErF,YAA6B,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;IACnD,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAC,QAAQ,EAAE,SAAS,EAAC,CAAC,CAAC;QAEzE,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC,YAAY,CAAC;QACjC,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,UAAe;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAA+B,EAAE,QAAQ,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CAEJ,CAAA;AAhDY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;qCAS4B,uCAAc;GAR1C,yBAAyB,CAgDrC"}

package/dist/providers/azure-key-vault.provider.d.ts

@@ -0,0 +1,34 @@
+import { SecretClient } from '@azure/keyvault-secrets';
+import { SecretsProvider } from '../interfaces/secrets-provider.interface';
+export declare class AzureKeyVaultProvider implements SecretsProvider {
+    private readonly client;
+    private readonly logger;
+    /**
+     * Regular expression to validate Azure Vault paths.
+     * - Standard format: https://<vault-name>.vault.azure.net/secrets/<secret-name>
+     * - With versions: https://<vault-name>.vault.azure.net/secrets/<secret-name>/<version>
+     * - With paths in secret names: https://<vault-name>.vault.azure.net/secrets/<path>/<secret-name>
+     */
+    private readonly secretUrlPattern;
+    constructor(client: SecretClient);
+    /**
+     * Checks if the provided string is a valid Azure Key Vault secret reference.
+     * @param value The string to check
+     * @returns True if the string is a valid Azure Key Vault secret reference
+     */
+    isSecretReference(value: string): boolean;
+    /**
+     * Resolves an Azure Key Vault secret reference to its actual value.
+     * @param secretRef The reference URL to the secret (https://<vault-name>.vault.azure.net/secrets/<secret-name>[/<version>])
+     * @returns The resolved secret value as a string
+     * @throws Error when the secret reference is invalid or cannot be retrieved
+     */
+    resolveSecret(secretRef: string): Promise<string>;
+    /**
+     * Parses an Azure Key Vault secret reference and extracts the secret name.
+     * @param secretRef The Azure Key Vault secret reference URL
+     * @returns The extracted secret name
+     * @throws Error when the secret reference format is invalid
+     */
+    private parseSecretReference;
+}

package/dist/providers/azure-key-vault.provider.js

@@ -0,0 +1,74 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AzureKeyVaultProvider_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AzureKeyVaultProvider = void 0;
+const common_1 = require("@nestjs/common");
+const keyvault_secrets_1 = require("@azure/keyvault-secrets");
+let AzureKeyVaultProvider = AzureKeyVaultProvider_1 = class AzureKeyVaultProvider {
+    client;
+    logger = new common_1.Logger(AzureKeyVaultProvider_1.name);
+    /**
+     * Regular expression to validate Azure Vault paths.
+     * - Standard format: https://<vault-name>.vault.azure.net/secrets/<secret-name>
+     * - With versions: https://<vault-name>.vault.azure.net/secrets/<secret-name>/<version>
+     * - With paths in secret names: https://<vault-name>.vault.azure.net/secrets/<path>/<secret-name>
+     */
+    secretUrlPattern = /^https:\/\/[\w-]+\.vault\.azure\.net\/secrets\/([^/\s]+)(?:\/([^/\s]+))?$/;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * Checks if the provided string is a valid Azure Key Vault secret reference.
+     * @param value The string to check
+     * @returns True if the string is a valid Azure Key Vault secret reference
+     */
+    isSecretReference(value) {
+        return this.secretUrlPattern.test(value);
+    }
+    /**
+     * Resolves an Azure Key Vault secret reference to its actual value.
+     * @param secretRef The reference URL to the secret (https://<vault-name>.vault.azure.net/secrets/<secret-name>[/<version>])
+     * @returns The resolved secret value as a string
+     * @throws Error when the secret reference is invalid or cannot be retrieved
+     */
+    async resolveSecret(secretRef) {
+        const secretName = this.parseSecretReference(secretRef);
+        const response = await this.client.getSecret(secretName);
+        if (!response || !response.value) {
+            throw new Error(`Secret '${secretName}' was retrieved but has an empty value`);
+        }
+        return response.value;
+    }
+    /**
+     * Parses an Azure Key Vault secret reference and extracts the secret name.
+     * @param secretRef The Azure Key Vault secret reference URL
+     * @returns The extracted secret name
+     * @throws Error when the secret reference format is invalid
+     */
+    parseSecretReference(secretRef) {
+        const match = secretRef.match(this.secretUrlPattern);
+        if (!match) {
+            throw new Error(`Invalid Azure Key Vault secret reference: ${secretRef}. Expected format: https://<vault-name>.vault.azure.net/secrets/<secret-name>[/<version>]`);
+        }
+        // Extract the vault name (match[0]) and secret name (match[1])
+        const vaultName = match[0];
+        const secretName = match[1];
+        this.logger.debug(`Parsed secret reference from vault: ${vaultName}, secret: ${secretName}`);
+        return secretName;
+    }
+};
+exports.AzureKeyVaultProvider = AzureKeyVaultProvider;
+exports.AzureKeyVaultProvider = AzureKeyVaultProvider = AzureKeyVaultProvider_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [keyvault_secrets_1.SecretClient])
+], AzureKeyVaultProvider);
+//# sourceMappingURL=azure-key-vault.provider.js.map

package/dist/providers/azure-key-vault.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-key-vault.provider.js","sourceRoot":"","sources":["../../src/providers/azure-key-vault.provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAkD;AAClD,8DAAqD;AAI9C,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAWD;IAVZ,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAEjE;;;;;OAKG;IACc,gBAAgB,GAAG,2EAA2E,CAAC;IAEhH,YAA6B,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IACjD,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAEzD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,WAAW,UAAU,wCAAwC,CAAC,CAAC;QACnF,CAAC;QAED,OAAO,QAAQ,CAAC,KAAK,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,SAAiB;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAErD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAS,2FAA2F,CAAC,CAAC;QACvK,CAAC;QAED,+DAA+D;QAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAE5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,SAAS,aAAa,UAAU,EAAE,CAAC,CAAC;QAC7F,OAAO,UAAU,CAAC;IACtB,CAAC;CAEJ,CAAA;AA9DY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;qCAY4B,+BAAY;GAXxC,qBAAqB,CA8DjC"}

package/dist/providers/google-secret-manager.provider.d.ts

@@ -0,0 +1,25 @@
+import { SecretManagerServiceClient } from '@google-cloud/secret-manager';
+import { SecretsProvider } from '../interfaces/secrets-provider.interface';
+export declare class GoogleSecretManagerProvider implements SecretsProvider {
+    private readonly client;
+    private readonly logger;
+    /**
+     * Regular expression pattern for Google Secret Manager paths
+     * Format: projects/{project-id}/secrets/{secret-id}/versions/{version}
+     */
+    private readonly secretPathPattern;
+    constructor(client: SecretManagerServiceClient);
+    /**
+     * Checks if a string is a valid Google Secret Manager reference.
+     * @param value The string to check
+     * @returns True if the string is a valid Google Secret Manager reference
+     */
+    isSecretReference(value: string): boolean;
+    /**
+     * Resolves a Google Secret Manager reference to its actual value.
+     * @param secretRef The full path to the secret in format projects/{project}/secrets/{secret}/versions/{version}
+     * @returns The resolved secret value as a string
+     * @throws Error when the secret cannot be retrieved or has an invalid format
+     */
+    resolveSecret(secretRef: string): Promise<string>;
+}

package/dist/providers/google-secret-manager.provider.js

@@ -0,0 +1,63 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var GoogleSecretManagerProvider_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GoogleSecretManagerProvider = void 0;
+const common_1 = require("@nestjs/common");
+const secret_manager_1 = require("@google-cloud/secret-manager");
+let GoogleSecretManagerProvider = GoogleSecretManagerProvider_1 = class GoogleSecretManagerProvider {
+    client;
+    logger = new common_1.Logger(GoogleSecretManagerProvider_1.name);
+    /**
+     * Regular expression pattern for Google Secret Manager paths
+     * Format: projects/{project-id}/secrets/{secret-id}/versions/{version}
+     */
+    secretPathPattern = /^projects\/[^/]+\/secrets\/[^/]+\/versions\/[^/]+$/;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * Checks if a string is a valid Google Secret Manager reference.
+     * @param value The string to check
+     * @returns True if the string is a valid Google Secret Manager reference
+     */
+    isSecretReference(value) {
+        return this.secretPathPattern.test(value);
+    }
+    /**
+     * Resolves a Google Secret Manager reference to its actual value.
+     * @param secretRef The full path to the secret in format projects/{project}/secrets/{secret}/versions/{version}
+     * @returns The resolved secret value as a string
+     * @throws Error when the secret cannot be retrieved or has an invalid format
+     */
+    async resolveSecret(secretRef) {
+        // The Google client returns an array where the first element contains the response
+        const [response] = await this.client.accessSecretVersion({
+            name: secretRef
+        });
+        if (!response || !response.payload) {
+            throw new Error('Secret payload is missing');
+        }
+        if (!response.payload.data) {
+            throw new Error('Secret payload data is missing');
+        }
+        // Return the secret data as a string, handling both Buffer and string formats
+        return Buffer.isBuffer(response.payload.data)
+            ? response.payload.data.toString('utf8')
+            : response.payload.data.toString();
+    }
+};
+exports.GoogleSecretManagerProvider = GoogleSecretManagerProvider;
+exports.GoogleSecretManagerProvider = GoogleSecretManagerProvider = GoogleSecretManagerProvider_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [secret_manager_1.SecretManagerServiceClient])
+], GoogleSecretManagerProvider);
+//# sourceMappingURL=google-secret-manager.provider.js.map

package/dist/providers/google-secret-manager.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-secret-manager.provider.js","sourceRoot":"","sources":["../../src/providers/google-secret-manager.provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAkD;AAClD,iEAAwE;AAIjE,IAAM,2BAA2B,mCAAjC,MAAM,2BAA2B;IASP;IARZ,MAAM,GAAG,IAAI,eAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;IAEvE;;;OAGG;IACc,iBAAiB,GAAG,oDAAoD,CAAC;IAE1F,YAA6B,MAAkC;QAAlC,WAAM,GAAN,MAAM,CAA4B;IAC/D,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACjC,mFAAmF;QACnF,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;YACrD,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtD,CAAC;QAED,8EAA8E;QAC9E,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC3C,CAAC;CACJ,CAAA;AA9CY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;qCAU4B,2CAA0B;GATtD,2BAA2B,CA8CvC"}

package/dist/services/secrets-loader.service.d.ts

@@ -0,0 +1,58 @@
+import { ConfigFactory, ConfigService } from '@nestjs/config';
+import { SecretsLoaderOptions } from '../interfaces/secrets-loader-options.interface';
+import { SecretsProvider } from '../interfaces/secrets-provider.interface';
+/**
+ * Configuration loader with support for secret resolution
+ */
+export declare class SecretsLoaderService {
+    private readonly logger;
+    /**
+     * Creates a config factory for use with ConfigModule.forRoot()
+     * @param options Configuration options
+     * @returns A config factory function
+     */
+    createConfigFactory(options: SecretsLoaderOptions): ConfigFactory;
+    /**
+     * Creates a secrets provider based on the provided key and client.
+     * @param key The provider type identifier
+     * @param client The client instance to be used by the provider
+     * @returns A promise that resolves to the created SecretsProvider or undefined if not supported
+     */
+    createSecretProvider(key: string, client: any): Promise<SecretsProvider | undefined>;
+    /**
+     * Finds the application root directory
+     * (Usually one level up from where this code is running in a typical NestJS app)
+     */
+    private findAppRootDirectory;
+    /**
+     * Determines if the path is specified relative to the current working directory
+     */
+    private isRelativePathFromCwd;
+    /**
+     * Loads configuration and resolves secrets
+     * @param options Configuration options
+     * @returns ConfigService instance
+     */
+    load(options: SecretsLoaderOptions): Promise<ConfigService>;
+    /**
+     * Loads and merges configuration files, resolving secrets if a provider is available
+     * @param provider The instantiated secret provider
+     * @param options Configuration options
+     * @returns Merged configuration object
+     */
+    private loadConfigFiles;
+    loadProvider(options: SecretsLoaderOptions): Promise<SecretsProvider | undefined>;
+    /**
+     * Resolves the base directory for configuration files based on the provided configuration
+     * or defaults to the application's standard config directory
+     */
+    private resolveBaseDirectory;
+    /**
+     * Resolves the default configuration directory path and logs it
+     */
+    private resolveDefaultConfigDirectory;
+    /**
+     * Recursively resolves secrets in configuration objects
+     */
+    private resolveSecrets;
+}

package/dist/services/secrets-loader.service.js

@@ -0,0 +1,249 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var SecretsLoaderService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretsLoaderService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const node_fs_1 = require("node:fs");
+const yaml = __importStar(require("js-yaml"));
+const node_path_1 = require("node:path");
+const lodash_1 = require("lodash");
+/**
+ * Configuration loader with support for secret resolution
+ */
+let SecretsLoaderService = SecretsLoaderService_1 = class SecretsLoaderService {
+    logger = new common_1.Logger(SecretsLoaderService_1.name);
+    /**
+     * Creates a config factory for use with ConfigModule.forRoot()
+     * @param options Configuration options
+     * @returns A config factory function
+     */
+    createConfigFactory(options) {
+        return async () => {
+            const provider = await this.loadProvider(options);
+            return await this.loadConfigFiles(provider, options);
+        };
+    }
+    /**
+     * Creates a secrets provider based on the provided key and client.
+     * @param key The provider type identifier
+     * @param client The client instance to be used by the provider
+     * @returns A promise that resolves to the created SecretsProvider or undefined if not supported
+     */
+    async createSecretProvider(key, client) {
+        switch (key) {
+            case 'AwsSecretsManagerProvider':
+            case 'SecretsManager': {
+                const { AwsSecretsManagerProvider } = await Promise.resolve().then(() => __importStar(require('../providers/aws-secrets-manager.provider')));
+                return new AwsSecretsManagerProvider(client);
+            }
+            case 'AwsParameterStoreProvider':
+            case 'SSMClient': {
+                const { AwsParameterStoreProvider } = await Promise.resolve().then(() => __importStar(require('../providers/aws-parameter-store.provider')));
+                return new AwsParameterStoreProvider(client);
+            }
+            case 'AzureKeyVaultProvider':
+            case 'SecretClient': {
+                const { AzureKeyVaultProvider } = await Promise.resolve().then(() => __importStar(require('../providers/azure-key-vault.provider')));
+                return new AzureKeyVaultProvider(client);
+            }
+            case 'GoogleSecretManagerProvider':
+            case 'SecretManagerServiceClient': {
+                const { GoogleSecretManagerProvider } = await Promise.resolve().then(() => __importStar(require('../providers/google-secret-manager.provider')));
+                return new GoogleSecretManagerProvider(client);
+            }
+        }
+        this.logger.warn(`Unsupported secret provider: ${client.constructor.name}`);
+        return undefined;
+    }
+    /**
+     * Finds the application root directory
+     * (Usually one level up from where this code is running in a typical NestJS app)
+     */
+    findAppRootDirectory() {
+        // Get the directory of the currently executing file
+        let currentDir = __dirname;
+        const specialDirs = ['dist', 'src', 'lib'];
+        // Check if we're in a special directory and move up if needed
+        const dirName = (0, node_path_1.basename)(currentDir);
+        if (specialDirs.includes(dirName)) {
+            currentDir = (0, node_path_1.resolve)(currentDir, '..');
+        }
+        // Handle the case where we might be in a deeper directory structure
+        const nodeModulesIndex = currentDir.indexOf('node_modules');
+        if (nodeModulesIndex > -1) {
+            currentDir = currentDir.substring(0, nodeModulesIndex);
+        }
+        return currentDir;
+    }
+    /**
+     * Determines if the path is specified relative to the current working directory
+     */
+    isRelativePathFromCwd(path) {
+        return path.startsWith('./') || path.startsWith('../');
+    }
+    /**
+     * Loads configuration and resolves secrets
+     * @param options Configuration options
+     * @returns ConfigService instance
+     */
+    async load(options) {
+        const provider = await this.loadProvider(options);
+        const config = await this.loadConfigFiles(provider, options);
+        return new config_1.ConfigService(config);
+    }
+    /**
+     * Loads and merges configuration files, resolving secrets if a provider is available
+     * @param provider The instantiated secret provider
+     * @param options Configuration options
+     * @returns Merged configuration object
+     */
+    async loadConfigFiles(provider, options) {
+        const { files, fileType = 'yaml' } = options;
+        // Resolve the base directory
+        const baseDirectory = this.resolveBaseDirectory(options.root);
+        if (!files.length) {
+            this.logger.warn('No configuration files specified');
+            return {};
+        }
+        let mergedConfig = {};
+        for (const filename of files) {
+            const filePath = (0, node_path_1.join)(baseDirectory, filename);
+            if ((0, node_fs_1.existsSync)(filePath)) {
+                try {
+                    this.logger.debug(`Loading config from ${filePath}`);
+                    const fileContent = (0, node_fs_1.readFileSync)(filePath, 'utf8');
+                    let fileConfig;
+                    if (fileType === 'yaml' || filename.endsWith('.yml') || filename.endsWith('.yaml')) {
+                        fileConfig = yaml.load(fileContent);
+                    }
+                    else {
+                        fileConfig = JSON.parse(fileContent);
+                    }
+                    // Merge with existing config, with the new config taking precedence
+                    // Using lodash's merge function
+                    mergedConfig = (0, lodash_1.merge)({}, mergedConfig, fileConfig);
+                }
+                catch (error) {
+                    this.logger.error(`Failed to load config from ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            else {
+                this.logger.debug(`Config file not found: ${filePath}`);
+            }
+        }
+        // Resolve secrets if provider is available
+        if (provider) {
+            await this.resolveSecrets(mergedConfig, '', provider);
+        }
+        return mergedConfig;
+    }
+    async loadProvider(options) {
+        if (typeof options.provider === 'object') {
+            return options.provider;
+        }
+        if (typeof options.provider === 'string' && options.client) {
+            return this.createSecretProvider(options.provider, options.client);
+        }
+        if (options.client) {
+            return this.createSecretProvider(options.client.constructor.name, options.client);
+        }
+        return undefined;
+    }
+    /**
+     * Resolves the base directory for configuration files based on the provided configuration
+     * or defaults to the application's standard config directory
+     */
+    resolveBaseDirectory(directoryPath) {
+        const appRoot = this.findAppRootDirectory();
+        // If no directory path is specified, use the default config location
+        if (!directoryPath) {
+            return this.resolveDefaultConfigDirectory(appRoot, 'config');
+        }
+        // If it's an absolute path, use it directly
+        if ((0, node_path_1.isAbsolute)(directoryPath)) {
+            return directoryPath;
+        }
+        // Resolve from the current working directory
+        if (this.isRelativePathFromCwd(directoryPath)) {
+            return (0, node_path_1.resolve)(process.cwd(), directoryPath);
+        }
+        // If it's just a directory name, resolve from app root
+        return (0, node_path_1.join)(appRoot, directoryPath);
+    }
+    /**
+     * Resolves the default configuration directory path and logs it
+     */
+    resolveDefaultConfigDirectory(appRoot, configDir) {
+        configDir = (0, node_path_1.join)(appRoot, configDir);
+        this.logger.debug(`No base directory specified, using: ${configDir}`);
+        return configDir;
+    }
+    /**
+     * Recursively resolves secrets in configuration objects
+     */
+    async resolveSecrets(config, path = '', secretProvider) {
+        for (const key in config) {
+            const fullPath = path ? `${path}.${key}` : key;
+            // Using lodash's isString and isObject
+            if ((0, lodash_1.isString)(config[key])) {
+                if (secretProvider.isSecretReference(config[key])) {
+                    try {
+                        config[key] = await secretProvider.resolveSecret(config[key]);
+                        this.logger.debug(`Loaded secret from provider [${fullPath}]`);
+                    }
+                    catch (error) {
+                        this.logger.error(`Failed to load secret [${fullPath}]: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                }
+            }
+            else if ((0, lodash_1.isObject)(config[key]) && !Array.isArray(config[key])) {
+                await this.resolveSecrets(config[key], fullPath, secretProvider);
+            }
+        }
+    }
+};
+exports.SecretsLoaderService = SecretsLoaderService;
+exports.SecretsLoaderService = SecretsLoaderService = SecretsLoaderService_1 = __decorate([
+    (0, common_1.Injectable)()
+], SecretsLoaderService);
+//# sourceMappingURL=secrets-loader.service.js.map

package/dist/services/secrets-loader.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-loader.service.js","sourceRoot":"","sources":["../../src/services/secrets-loader.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAkD;AAClD,2CAA4D;AAC5D,qCAAiD;AACjD,8CAAgC;AAChC,yCAA8D;AAC9D,mCAAiD;AAIjD;;GAEG;AAEI,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IACZ,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEhE;;;;OAIG;IACI,mBAAmB,CAAC,OAA6B;QACpD,OAAO,KAAK,IAAI,EAAE;YACd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAClD,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,GAAW,EAAE,MAAW;QAC/C,QAAQ,GAAG,EAAE,CAAC;YACV,KAAK,2BAA2B,CAAC;YACjC,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACpB,MAAM,EAAC,yBAAyB,EAAC,GAAG,wDAAa,2CAA2C,GAAC,CAAC;gBAC9F,OAAO,IAAI,yBAAyB,CAAC,MAAM,CAAC,CAAC;YACjD,CAAC;YACD,KAAK,2BAA2B,CAAC;YACjC,KAAK,WAAW,CAAC,CAAC,CAAC;gBACf,MAAM,EAAC,yBAAyB,EAAC,GAAG,wDAAa,2CAA2C,GAAC,CAAC;gBAC9F,OAAO,IAAI,yBAAyB,CAAC,MAAM,CAAC,CAAC;YACjD,CAAC;YACD,KAAK,uBAAuB,CAAC;YAC7B,KAAK,cAAc,CAAC,CAAC,CAAC;gBAClB,MAAM,EAAC,qBAAqB,EAAC,GAAG,wDAAa,uCAAuC,GAAC,CAAC;gBACtF,OAAO,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,6BAA6B,CAAC;YACnC,KAAK,4BAA4B,CAAC,CAAC,CAAC;gBAChC,MAAM,EAAC,2BAA2B,EAAC,GAAG,wDAAa,6CAA6C,GAAC,CAAC;gBAClG,OAAO,IAAI,2BAA2B,CAAC,MAAM,CAAC,CAAC;YACnD,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;;OAGG;IACK,oBAAoB;QACxB,oDAAoD;QACpD,IAAI,UAAU,GAAG,SAAS,CAAC;QAE3B,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAE3C,8DAA8D;QAC9D,MAAM,OAAO,GAAG,IAAA,oBAAQ,EAAC,UAAU,CAAC,CAAC;QACrC,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,UAAU,GAAG,IAAA,mBAAO,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,oEAAoE;QACpE,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,gBAAgB,GAAG,CAAC,CAAC,EAAE,CAAC;YACxB,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,UAAU,CAAC;IACtB,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,IAAY;QACtC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,IAAI,CAAC,OAA6B;QAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7D,OAAO,IAAI,sBAAa,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,eAAe,CAAC,QAAqC,EAAE,OAA6B;QAC9F,MAAM,EAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,EAAC,GAAG,OAAO,CAAC;QAE3C,6BAA6B;QAC7B,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9D,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YACrD,OAAO,EAAE,CAAC;QACd,CAAC;QAED,IAAI,YAAY,GAAG,EAAE,CAAC;QAEtB,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAE/C,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC;oBACrD,MAAM,WAAW,GAAG,IAAA,sBAAY,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;oBAEnD,IAAI,UAA+B,CAAC;oBACpC,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBACjF,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAwB,CAAC;oBAC/D,CAAC;yBAAM,CAAC;wBACJ,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAwB,CAAC;oBAChE,CAAC;oBAED,oEAAoE;oBACpE,gCAAgC;oBAChC,YAAY,GAAG,IAAA,cAAK,EAAC,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;gBACvD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC3H,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;YAC5D,CAAC;QACL,CAAC;QAED,2CAA2C;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,YAAY,CAAC;IACxB,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,OAA6B;QACnD,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACtF,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;;OAGG;IACK,oBAAoB,CAAC,aAAsB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE5C,qEAAqE;QACrE,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjE,CAAC;QAED,4CAA4C;QAC5C,IAAI,IAAA,sBAAU,EAAC,aAAa,CAAC,EAAE,CAAC;YAC5B,OAAO,aAAa,CAAC;QACzB,CAAC;QAED,6CAA6C;QAC7C,IAAI,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAA,mBAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;QACjD,CAAC;QAED,uDAAuD;QACvD,OAAO,IAAA,gBAAI,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACK,6BAA6B,CAAC,OAAe,EAAE,SAAiB;QACpE,SAAS,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,SAAS,EAAE,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc,CACxB,MAA2B,EAC3B,OAAe,EAAE,EACjB,cAA+B;QAE/B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAE/C,uCAAuC;YACvC,IAAI,IAAA,iBAAQ,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACxB,IAAI,cAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAChD,IAAI,CAAC;wBACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,QAAQ,GAAG,CAAC,CAAC;oBACnE,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,0BAA0B,QAAQ,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnG,CAAC;oBACN,CAAC;gBACL,CAAC;YACL,CAAC;iBAAM,IAAI,IAAA,iBAAQ,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;YACrE,CAAC;QACL,CAAC;IACL,CAAC;CACJ,CAAA;AAhOY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;GACA,oBAAoB,CAgOhC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floracodex/nestjs-secrets",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "workspaces": [
     "example"
   ],
@@ -29,8 +29,8 @@
     "lint": "eslint . --max-warnings 0",
     "lint:fix": "eslint . --fix",
     "format": "eslint . --fix",
-    "test": "jest --config ./test/jest-e2e.json",
-    "test:watch": "jest --config ./test/jest-e2e.json --watch",
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js --config ./test/jest-e2e.json",
+    "test:watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --config ./test/jest-e2e.json --watch",
     "prepublishOnly": "npm run build"
   },
   "repository": {
@@ -59,37 +59,37 @@
     "testEnvironment": "node"
   },
   "dependencies": {
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.3.2",
     "lodash": "^4.17.21",
     "reflect-metadata": "^0.2.2"
   },
   "devDependencies": {
-    "@aws-sdk/client-secrets-manager": "^3.1041.0",
-    "@aws-sdk/client-ssm": "^3.1041.0",
-    "@azure/identity": "^4.9.1",
-    "@azure/keyvault-secrets": "^4.9.0",
-    "@floracodex/eslint-config": "^1.1.0",
-    "@google-cloud/secret-manager": "^6.1.2",
-    "@nestjs/cli": "^11.0.21",
-    "@nestjs/testing": "^11.1.0",
+    "@aws-sdk/client-secrets-manager": "^3.1136.0",
+    "@aws-sdk/client-ssm": "^3.1136.0",
+    "@azure/identity": "^4.13.3",
+    "@azure/keyvault-secrets": "^4.11.2",
+    "@floracodex/eslint-config": "^1.2.0",
+    "@google-cloud/secret-manager": "^6.3.0",
+    "@nestjs/cli": "^12.0.3",
+    "@nestjs/testing": "^12.0.3",
     "@types/jest": "^30.0.0",
     "@types/js-yaml": "^4.0.9",
-    "@types/lodash": "^4.17.16",
-    "@types/node": "^25.6.0",
-    "eslint": "^10.3.0",
-    "jest": "^30.3.0",
+    "@types/lodash": "^4.17.25",
+    "@types/node": "^25.9.8",
+    "eslint": "^10.11.0",
+    "jest": "^30.5.2",
     "rimraf": "^6.0.1",
-    "ts-jest": "^29.3.2",
+    "ts-jest": "^29.4.12",
     "ts-node": "^10.9.2",
-    "typescript": "^5.9.3"
+    "typescript": "~6.0.3"
   },
   "peerDependencies": {
     "@aws-sdk/client-secrets-manager": "^3.799.0",
     "@aws-sdk/client-ssm": "^3.0.0",
     "@azure/keyvault-secrets": "^4.0.0",
     "@google-cloud/secret-manager": "^6.0.1",
-    "@nestjs/common": "^10.0.0 || ^11.0.0",
-    "@nestjs/config": "^3.0.0 || ^4.0.0"
+    "@nestjs/common": "^10.0.0 || ^11.0.0 || ^12.0.0",
+    "@nestjs/config": "^3.0.0 || ^4.0.0 || ^12.0.0"
   },
   "peerDependenciesMeta": {
     "@aws-sdk/client-secrets-manager": {