@geekmidas/envkit 9.0.2 → 10.0.0-alpha.1

package/src/__tests__/sst.spec.ts

@@ -1,437 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import {
-	type ApiGatewayV2,
-	type Bucket,
-	environmentCase,
-	type Function,
-	normalizeResourceEnv,
-	type Postgres,
-	ResourceType,
-	type Secret,
-	type Vpc,
-} from '../sst';
-
-describe('sst', () => {
-	describe('environmentCase', () => {
-		it('should convert camelCase to UPPER_SNAKE_CASE', () => {
-			expect(environmentCase('myVariable')).toBe('MY_VARIABLE');
-			expect(environmentCase('somePropertyName')).toBe('SOME_PROPERTY_NAME');
-			expect(environmentCase('APIKey')).toBe('API_KEY');
-		});
-
-		it('should convert snake_case to UPPER_SNAKE_CASE', () => {
-			expect(environmentCase('my_variable')).toBe('MY_VARIABLE');
-			expect(environmentCase('some_property_name')).toBe('SOME_PROPERTY_NAME');
-		});
-
-		it('should handle numbers correctly', () => {
-			// The function only removes underscore before digits
-			expect(environmentCase('api_v2')).toBe('API_V2');
-			expect(environmentCase('value_123')).toBe('VALUE123');
-			expect(environmentCase('test_1_thing')).toBe('TEST1_THING');
-			expect(environmentCase('api_2')).toBe('API2');
-		});
-
-		it('should handle already uppercase strings', () => {
-			expect(environmentCase('ALREADY_UPPER')).toBe('ALREADY_UPPER');
-			expect(environmentCase('TEST')).toBe('TEST');
-		});
-
-		it('should handle kebab-case', () => {
-			expect(environmentCase('my-variable')).toBe('MY_VARIABLE');
-			expect(environmentCase('kebab-case-example')).toBe('KEBAB_CASE_EXAMPLE');
-		});
-
-		it('should handle mixed cases', () => {
-			expect(environmentCase('MixedCASE')).toBe('MIXED_CASE');
-			expect(environmentCase('XMLParser')).toBe('XML_PARSER');
-			expect(environmentCase('IOStream')).toBe('IO_STREAM');
-		});
-
-		it('should handle empty string', () => {
-			expect(environmentCase('')).toBe('');
-		});
-
-		it('should handle single character', () => {
-			expect(environmentCase('a')).toBe('A');
-			expect(environmentCase('A')).toBe('A');
-		});
-
-		it('should handle strings with special characters', () => {
-			expect(environmentCase('my.variable')).toBe('MY_VARIABLE');
-			expect(environmentCase('my@variable')).toBe('MY_VARIABLE');
-			expect(environmentCase('my#variable')).toBe('MY_VARIABLE');
-		});
-	});
-
-	describe('normalizeResourceEnv', () => {
-		describe('string values', () => {
-			it('should convert string values to environment case', () => {
-				const input = {
-					apiUrl: 'https://api.example.com',
-					secretKey: 'my-secret-key',
-					NODE_ENV: 'production',
-				};
-
-				const result = normalizeResourceEnv(input);
-
-				expect(result).toEqual({
-					API_URL: 'https://api.example.com',
-					SECRET_KEY: 'my-secret-key',
-					NODE_ENV: 'production',
-				});
-			});
-
-			it('should handle empty object', () => {
-				expect(normalizeResourceEnv({})).toEqual({});
-			});
-		});
-
-		describe('Secret resource', () => {
-			it('should process Secret resource correctly', () => {
-				const secret: Secret = {
-					type: ResourceType.Secret,
-					value: 'super-secret-value',
-				};
-
-				const result = normalizeResourceEnv({
-					mySecret: secret,
-				});
-
-				expect(result).toEqual({
-					MY_SECRET: 'super-secret-value',
-				});
-			});
-
-			it('should process SSTSecret resource correctly', () => {
-				const secret = {
-					type: ResourceType.SSTSecret as ResourceType.SSTSecret,
-					value: 'another-secret',
-				};
-
-				const result = normalizeResourceEnv({
-					appSecret: secret as any,
-				});
-
-				expect(result).toEqual({
-					APP_SECRET: 'another-secret',
-				});
-			});
-		});
-
-		describe('Postgres resource', () => {
-			it('should process Postgres resource correctly', () => {
-				const postgres: Postgres = {
-					type: ResourceType.Postgres,
-					database: 'myapp',
-					host: 'localhost',
-					password: 'password123',
-					port: 5432,
-					username: 'postgres',
-				};
-
-				const result = normalizeResourceEnv({
-					database: postgres,
-				});
-
-				expect(result).toEqual({
-					DATABASE_NAME: 'myapp',
-					DATABASE_HOST: 'localhost',
-					DATABASE_PASSWORD: 'password123',
-					DATABASE_PORT: 5432,
-					DATABASE_USERNAME: 'postgres',
-					DATABASE_URL:
-						'postgresql://postgres:password123@localhost:5432/myapp',
-				});
-			});
-
-			it('should process SSTPostgres resource correctly', () => {
-				const postgres = {
-					type: ResourceType.SSTPostgres as ResourceType.SSTPostgres,
-					database: 'prod_db',
-					host: 'prod.example.com',
-					password: 'prod-password',
-					port: 5433,
-					username: 'prod_user',
-				};
-
-				const result = normalizeResourceEnv({
-					mainDb: postgres as any,
-				});
-
-				expect(result).toEqual({
-					MAIN_DB_NAME: 'prod_db',
-					MAIN_DB_HOST: 'prod.example.com',
-					MAIN_DB_PASSWORD: 'prod-password',
-					MAIN_DB_PORT: 5433,
-					MAIN_DB_URL:
-						'postgresql://prod_user:prod-password@prod.example.com:5433/prod_db',
-					MAIN_DB_USERNAME: 'prod_user',
-				});
-			});
-		});
-
-		describe('Queue resource', () => {
-			it('emits url, arn, and an SQS publisher connection string', () => {
-				const result = normalizeResourceEnv({
-					orders: {
-						type: ResourceType.Queue,
-						url: 'https://sqs.us-east-1.amazonaws.com/123/shop-orders',
-						arn: 'arn:aws:sqs:us-east-1:123:shop-orders',
-					},
-				});
-
-				expect(result).toEqual({
-					ORDERS_URL: 'https://sqs.us-east-1.amazonaws.com/123/shop-orders',
-					ORDERS_ARN: 'arn:aws:sqs:us-east-1:123:shop-orders',
-					ORDERS_PUBLISHER_CONNECTION_STRING:
-						'sqs://?queueUrl=https%3A%2F%2Fsqs.us-east-1.amazonaws.com%2F123%2Fshop-orders',
-				});
-			});
-		});
-
-		describe('SnsTopic resource', () => {
-			it('emits arn and an SNS publisher connection string', () => {
-				const result = normalizeResourceEnv({
-					events: {
-						type: ResourceType.SnsTopic,
-						arn: 'arn:aws:sns:us-east-1:123:shop-events',
-					},
-				});
-
-				expect(result).toEqual({
-					EVENTS_ARN: 'arn:aws:sns:us-east-1:123:shop-events',
-					EVENTS_PUBLISHER_CONNECTION_STRING:
-						'sns://?topicArn=arn%3Aaws%3Asns%3Aus-east-1%3A123%3Ashop-events',
-				});
-			});
-		});
-
-		describe('Bucket resource', () => {
-			it('should process Bucket resource correctly', () => {
-				const bucket: Bucket = {
-					type: ResourceType.Bucket,
-					name: 'my-s3-bucket',
-				};
-
-				const result = normalizeResourceEnv({
-					uploadBucket: bucket,
-				});
-
-				expect(result).toEqual({
-					UPLOAD_BUCKET_NAME: 'my-s3-bucket',
-				});
-			});
-
-			it('should process SSTBucket resource correctly', () => {
-				const bucket = {
-					type: ResourceType.SSTBucket as ResourceType.SSTBucket,
-					name: 'assets-bucket-prod',
-				};
-
-				const result = normalizeResourceEnv({
-					assetStorage: bucket as any,
-				});
-
-				expect(result).toEqual({
-					ASSET_STORAGE_NAME: 'assets-bucket-prod',
-				});
-			});
-		});
-
-		describe('noop resources', () => {
-			it('should not add environment variables for ApiGatewayV2', () => {
-				const api: ApiGatewayV2 = {
-					type: ResourceType.ApiGatewayV2,
-					url: 'https://api.example.com',
-				};
-
-				const result = normalizeResourceEnv({
-					api: api,
-				});
-
-				expect(result).toEqual({});
-			});
-
-			it('should not add environment variables for Function', () => {
-				const fn: Function = {
-					type: ResourceType.Function,
-					name: 'my-lambda',
-				};
-
-				const result = normalizeResourceEnv({
-					handler: fn,
-				});
-
-				expect(result).toEqual({});
-			});
-
-			it('should not add environment variables for Vpc', () => {
-				const vpc: Vpc = {
-					type: ResourceType.Vpc,
-					bastion: 'bastion-host',
-				};
-
-				const result = normalizeResourceEnv({
-					network: vpc,
-				});
-
-				expect(result).toEqual({});
-			});
-
-			it('should handle all SST noop resource types', () => {
-				const api = {
-					type: ResourceType.SSTApiGatewayV2 as ResourceType.SSTApiGatewayV2,
-					url: 'https://api.example.com',
-				};
-
-				const fn = {
-					type: ResourceType.SSTFunction as ResourceType.SSTFunction,
-					name: 'my-function',
-				};
-
-				const result = normalizeResourceEnv({
-					api: api as any,
-					function: fn as any,
-				});
-
-				expect(result).toEqual({});
-			});
-		});
-
-		describe('mixed resources', () => {
-			it('should handle mix of strings and resources', () => {
-				const postgres: Postgres = {
-					type: ResourceType.Postgres,
-					database: 'app_db',
-					host: 'db.example.com',
-					password: 'db-pass',
-					port: 5432,
-					username: 'app_user',
-				};
-
-				const secret: Secret = {
-					type: ResourceType.Secret,
-					value: 'jwt-secret',
-				};
-
-				const bucket: Bucket = {
-					type: ResourceType.Bucket,
-					name: 'uploads-bucket',
-				};
-
-				const result = normalizeResourceEnv({
-					nodeEnv: 'production',
-					appName: 'My App',
-					database: postgres,
-					jwtSecret: secret,
-					uploads: bucket,
-					apiVersion: 'v2',
-				});
-
-				expect(result).toEqual({
-					NODE_ENV: 'production',
-					APP_NAME: 'My App',
-					DATABASE_NAME: 'app_db',
-					DATABASE_HOST: 'db.example.com',
-					DATABASE_PASSWORD: 'db-pass',
-					DATABASE_PORT: 5432,
-					DATABASE_URL:
-						'postgresql://app_user:db-pass@db.example.com:5432/app_db',
-					DATABASE_USERNAME: 'app_user',
-					JWT_SECRET: 'jwt-secret',
-					UPLOADS_NAME: 'uploads-bucket',
-					API_VERSION: 'v2',
-				});
-			});
-		});
-
-		describe('edge cases', () => {
-			it('should handle resources with special characters in keys', () => {
-				const secret: Secret = {
-					type: ResourceType.Secret,
-					value: 'value',
-				};
-
-				const result = normalizeResourceEnv({
-					'my-secret-key': secret,
-					'another.secret': secret,
-					'secret@123': secret,
-				});
-
-				expect(result).toEqual({
-					MY_SECRET_KEY: 'value',
-					ANOTHER_SECRET: 'value',
-					SECRET123: 'value',
-				});
-			});
-
-			it('should handle numeric values in postgres port', () => {
-				const postgres: Postgres = {
-					type: ResourceType.Postgres,
-					database: 'test',
-					host: 'localhost',
-					password: 'pass',
-					port: 5432,
-					username: 'user',
-				};
-
-				const result = normalizeResourceEnv({
-					db: postgres,
-				});
-
-				expect(result.DB_PORT).toBe(5432);
-				expect(typeof result.DB_PORT).toBe('number');
-			});
-
-			it('should handle very long keys', () => {
-				const secret: Secret = {
-					type: ResourceType.Secret,
-					value: 'value',
-				};
-
-				const result = normalizeResourceEnv({
-					thisIsAVeryLongKeyNameThatShouldBeConvertedProperly: secret,
-				});
-
-				expect(result).toEqual({
-					THIS_IS_A_VERY_LONG_KEY_NAME_THAT_SHOULD_BE_CONVERTED_PROPERLY:
-						'value',
-				});
-			});
-
-			it('should handle multiple underscores and numbers', () => {
-				const bucket: Bucket = {
-					type: ResourceType.Bucket,
-					name: 'test-bucket',
-				};
-
-				const result = normalizeResourceEnv({
-					s3_bucket_v2_1: bucket,
-					bucket_123_456: bucket,
-				});
-
-				expect(result).toEqual({
-					S3_BUCKET_V21_NAME: 'test-bucket',
-					BUCKET123456_NAME: 'test-bucket',
-				});
-			});
-		});
-	});
-
-	describe('ResourceType enum', () => {
-		it('should have all expected resource types', () => {
-			expect(ResourceType.ApiGatewayV2).toBe('sst.aws.ApiGatewayV2');
-			expect(ResourceType.Postgres).toBe('sst.aws.Postgres');
-			expect(ResourceType.Function).toBe('sst.aws.Function');
-			expect(ResourceType.Bucket).toBe('sst.aws.Bucket');
-			expect(ResourceType.Vpc).toBe('sst.aws.Vpc');
-			expect(ResourceType.Secret).toBe('sst.sst.Secret');
-			expect(ResourceType.SSTSecret).toBe('sst:sst:Secret');
-			expect(ResourceType.SSTFunction).toBe('sst:sst:Function');
-			expect(ResourceType.SSTApiGatewayV2).toBe('sst:aws:ApiGatewayV2');
-			expect(ResourceType.SSTPostgres).toBe('sst:aws:Postgres');
-			expect(ResourceType.SSTBucket).toBe('sst:aws:Bucket');
-		});
-	});
-});

package/src/credentials.ts

@@ -1,112 +0,0 @@
-import { createDecipheriv } from 'node:crypto';
-
-/**
- * Build-time injected encrypted credentials.
- * These are replaced by tsdown/esbuild --define at build time.
- */
-declare const __GKM_ENCRYPTED_CREDENTIALS__: string | undefined;
-declare const __GKM_CREDENTIALS_IV__: string | undefined;
-
-/** AES-256-GCM auth tag length */
-const AUTH_TAG_LENGTH = 16;
-
-/**
- * Decrypt credentials from encrypted payload.
- * Exported for testing purposes.
- */
-export function decryptCredentials(
-	encrypted: string,
-	iv: string,
-	masterKey: string,
-): Record<string, string> {
-	const key = Buffer.from(masterKey, 'hex');
-	const ivBuffer = Buffer.from(iv, 'hex');
-	const combined = Buffer.from(encrypted, 'base64');
-
-	// Split ciphertext and auth tag
-	const ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);
-	const authTag = combined.subarray(-AUTH_TAG_LENGTH);
-
-	// Decrypt using AES-256-GCM
-	const decipher = createDecipheriv('aes-256-gcm', key, ivBuffer);
-	decipher.setAuthTag(authTag);
-
-	const plaintext = Buffer.concat([
-		decipher.update(ciphertext),
-		decipher.final(),
-	]);
-
-	return JSON.parse(plaintext.toString('utf-8'));
-}
-
-/**
- * Credentials object for use with EnvironmentParser.
- *
- * Resolution order:
- * 1. **Dev mode (gkm dev/exec)**: Checks `globalThis.__gkm_credentials__` for
- *    credentials injected by the CLI preload script. This approach survives
- *    CJS/ESM module duplication (where mutating the export would only affect one copy).
- * 2. **Production mode**: Decrypts build-time embedded credentials using the
- *    `GKM_MASTER_KEY` environment variable (AES-256-GCM).
- * 3. **Fallback**: Returns empty object (allows graceful fallback to process.env).
- *
- * @example
- * ```typescript
- * import { EnvironmentParser } from '@geekmidas/envkit';
- * import { Credentials } from '@geekmidas/envkit/credentials';
- *
- * export const envParser = new EnvironmentParser({...process.env, ...Credentials})
- *   .create((get) => ({
- *     database: {
- *       url: get('DATABASE_URL').string(),
- *     },
- *   }))
- *   .parse();
- * ```
- */
-export const Credentials: Record<string, string> = (() => {
-	// Dev mode: check if gkm exec/dev preload injected credentials via globalThis
-	// This survives CJS/ESM module duplication where Object.assign on the
-	// export would only mutate one copy of the module's Credentials object.
-	const injected = (globalThis as Record<string, unknown>)
-		.__gkm_credentials__ as Record<string, string> | undefined;
-	if (injected) {
-		return injected;
-	}
-
-	// Development mode - no credentials embedded at build time
-	if (
-		typeof __GKM_ENCRYPTED_CREDENTIALS__ === 'undefined' ||
-		typeof __GKM_CREDENTIALS_IV__ === 'undefined'
-	) {
-		return {};
-	}
-
-	// Production mode - decrypt credentials using master key
-	const masterKey = process.env.GKM_MASTER_KEY;
-
-	if (!masterKey) {
-		// Log warning but don't throw - allows graceful fallback to env vars
-		console.error(
-			'[gkm] GKM_MASTER_KEY environment variable is required to decrypt credentials.',
-		);
-		console.error(
-			'[gkm] Falling back to environment variables. Some secrets may be missing.',
-		);
-		return {};
-	}
-
-	try {
-		return decryptCredentials(
-			__GKM_ENCRYPTED_CREDENTIALS__,
-			__GKM_CREDENTIALS_IV__,
-			masterKey,
-		);
-	} catch (error) {
-		console.error('[gkm] Failed to decrypt credentials:', error);
-		console.error('[gkm] Falling back to environment variables.');
-		return {};
-	}
-})();
-
-export default Credentials;

package/src/formatter.ts

@@ -1,146 +0,0 @@
-import type { z } from 'zod/v4';
-
-/**
- * Options for formatting parse errors.
- */
-export interface FormatOptions {
-	/** Whether to use colors in output. Defaults to auto-detect TTY. */
-	colors?: boolean;
-}
-
-/**
- * ANSI color codes for terminal output.
- */
-const colors = {
-	reset: '\x1b[0m',
-	red: '\x1b[31m',
-	yellow: '\x1b[33m',
-	cyan: '\x1b[36m',
-	dim: '\x1b[2m',
-	bold: '\x1b[1m',
-};
-
-/**
- * Formats a ZodError into a user-friendly string for development.
- *
- * @param error - The ZodError to format
- * @param options - Formatting options
- * @returns Formatted error message
- *
- * @example
- * ```typescript
- * try {
- *   config.parse();
- * } catch (error) {
- *   if (error instanceof ZodError) {
- *     console.error(formatParseError(error));
- *   }
- * }
- * ```
- *
- * Output:
- * ```
- * Environment Configuration Failed
- *
- * Missing Variables:
- *   DATABASE_URL - Required
- *   JWT_SECRET - Required
- *
- * Invalid Values:
- *   NODE_ENV = "invalid"
- *     Expected: "development" | "staging" | "production"
- * ```
- */
-export function formatParseError(
-	error: z.ZodError,
-	options: FormatOptions = {},
-): string {
-	const useColors =
-		options.colors ?? (process.stdout?.isTTY && process.env.NO_COLOR == null);
-
-	const c = useColors
-		? colors
-		: { reset: '', red: '', yellow: '', cyan: '', dim: '', bold: '' };
-
-	const missingVars: Array<{ name: string; message: string }> = [];
-	const invalidVars: Array<{ name: string; value: unknown; message: string }> =
-		[];
-
-	for (const issue of error.issues) {
-		// Extract environment variable name from path or message
-		let envName = '';
-		if (issue.path.length > 0) {
-			// Join the full path with '.' to show nested config keys and env var name
-			envName = issue.path.map(String).join('.');
-		} else {
-			// Try to extract from message like 'Environment variable "NAME": ...'
-			const match = issue.message.match(/Environment variable "([^"]+)"/);
-			if (match?.[1]) {
-				envName = match[1];
-			}
-		}
-
-		// Determine if this is a missing or invalid value
-		// Use type guard for received property
-		const received = 'received' in issue ? issue.received : undefined;
-		const isMissing =
-			issue.code === 'invalid_type' &&
-			(received === 'undefined' || received === 'null');
-
-		if (isMissing) {
-			missingVars.push({
-				name: envName || 'Unknown',
-				message: cleanMessage(issue.message),
-			});
-		} else {
-			invalidVars.push({
-				name: envName || 'Unknown',
-				value: received,
-				message: cleanMessage(issue.message),
-			});
-		}
-	}
-
-	const lines: string[] = [];
-
-	lines.push('');
-	lines.push(`${c.red}${c.bold}Environment Configuration Failed${c.reset}`);
-	lines.push('');
-
-	if (missingVars.length > 0) {
-		lines.push(`${c.yellow}Missing Variables:${c.reset}`);
-		for (const v of missingVars) {
-			lines.push(`  ${c.cyan}${v.name}${c.reset} ${c.dim}- Required${c.reset}`);
-		}
-		lines.push('');
-	}
-
-	if (invalidVars.length > 0) {
-		lines.push(`${c.yellow}Invalid Values:${c.reset}`);
-		for (const v of invalidVars) {
-			const valueStr =
-				v.value !== undefined ? ` = ${JSON.stringify(v.value)}` : '';
-			lines.push(`  ${c.cyan}${v.name}${c.reset}${valueStr}`);
-			lines.push(`    ${c.dim}${v.message}${c.reset}`);
-		}
-		lines.push('');
-	}
-
-	return lines.join('\n');
-}
-
-/**
- * Cleans up a Zod error message by removing redundant prefixes.
- */
-function cleanMessage(message: string): string {
-	// Remove "Environment variable "NAME": " prefix if present
-	return message.replace(/^Environment variable "[^"]+": /, '');
-}
-
-/**
- * Checks if the current environment is development.
- */
-export function isDevelopment(): boolean {
-	const nodeEnv = process.env.NODE_ENV?.toLowerCase();
-	return nodeEnv == null || nodeEnv === 'development' || nodeEnv === 'dev';
-}

package/src/index.ts

@@ -1,24 +0,0 @@
-export {
-	EnvironmentBuilder,
-	type EnvironmentBuilderOptions,
-	type EnvironmentResolver,
-	type EnvRecord,
-	type EnvValue,
-	environmentCase,
-	type InputValue,
-	type Resolvers,
-	type TypedInputValue,
-	type TypedResolvers,
-} from './EnvironmentBuilder';
-export {
-	ConfigParser,
-	type EmptyObject,
-	type EnvFetcher,
-	EnvironmentParser,
-	type InferConfig,
-} from './EnvironmentParser';
-export {
-	type FormatOptions,
-	formatParseError,
-	isDevelopment,
-} from './formatter';