@kindgi/env-inmemory 0.0.0-bootstrap.0 → 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Kindgi Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,76 @@
-# @kindgi/env-inmemory
+# `@kindgi/env-inmemory`
 
-A placeholder. Releases come from https://github.com/kindgi/kindgi-sdk.
+Reference in-memory implementation of the `EnvBinding` contract from [`@kindgi/api`](../api/): the store for non-sensitive, per-environment configuration values keyed by `(scope, envName, name)`. Use it in tests and local development. It refuses to start under `NODE_ENV=production`; deployed environments use a durable `EnvBinding` implemented by the Kindgi runtime.
+
+## Purpose
+
+Give every consumer of `EnvBinding` a store that needs no database but keeps the contract's semantics: values are partitioned by `envName` (a `staging` write is invisible to `production` reads), every write bumps a revision counter that supports optimistic concurrency, and `resolve` walks from the most specific scope to the tenant. With an `AuditEventBinding` attached it also emits the `env-*` audit events, so evidence trails can be exercised end to end in tests.
+
+## Exports
+
+- **`createInMemoryEnvBinding(options?)`** — returns a fresh, isolated `EnvBinding` backed by process memory. Throws at construction when `process.env.NODE_ENV === 'production'` and `productionSafe` is not `true`. The returned binding:
+  - `resolve` — checks the requested scope, then the tenant scope (`project → tenant`, `org → tenant`). Returns `{ kind: 'ok', value: { name, value, revision } }` or an `env-not-found` error.
+  - `get` / `list` — exact scope only, no walk. `list` filters by `namePrefix` and `tagFilter` (every pair must match; untagged entries never match), sorts by name and returns at most `limit` entries. `cursor` is ignored and `nextCursor` is never set.
+  - `set` — creates or overwrites; `revision` starts at `1` and increments on every write. A mismatched `ifRevision` returns `{ kind: 'revision-conflict', currentRevision }` (`0` for a name that does not exist). `enqueueTuples` is required by the contract but not called.
+  - `delete` — removes the entry and returns `{ deleted }`; a later `resolve` at that scope falls through to the tenant value.
+- **`InMemoryEnvBindingOptions`**:
+  - `productionSafe?: boolean` — default `false`. Allows construction under `NODE_ENV=production`, for example in a parity-test container.
+  - `now?: () => number` — clock used for `createdAt` / `updatedAt`; defaults to `Date.now`.
+  - `auditEvents?: AuditEventBinding`, `tenantId?: TenantId`, `projectId?: ProjectId` — audit emission is enabled only when all three are set. `set` emits `env-set` (outcome `failed` with `env-write-conflict` on a revision conflict), `resolve` emits `env-resolved`, and a `delete` that removed something emits `env-deleted`. Every event is recorded under the configured `tenantId` / `projectId`, and payloads never contain the value. Emission is awaited, but a failing audit sink is logged with `console.warn` and does not fail the operation.
+
+## Example
+
+```ts
+import { createInMemoryAuditEventBinding } from '@kindgi/audit-events-inmemory';
+import { createInMemoryEnvBinding } from '@kindgi/env-inmemory';
+import type { Scope } from '@kindgi/platform';
+import { makeEnvName, type ProjectId, type TenantId } from '@kindgi/types';
+
+const tenantId = 'acme' as TenantId;
+const projectId = 'acme-support' as ProjectId;
+const staging = makeEnvName('staging');
+if (staging === null) throw new Error('invalid env name');
+
+const tenant: Scope = { kind: 'tenant', tenantId };
+const project: Scope = { kind: 'project', tenantId, projectId };
+
+const audit = createInMemoryAuditEventBinding();
+const env = createInMemoryEnvBinding({ auditEvents: audit, tenantId, projectId });
+
+const kbUrl = { envName: staging, name: 'KB_URL' } as const;
+await env.set({ scope: tenant, ...kbUrl, value: 'https://kb.acme.test', enqueueTuples: () => [] });
+
+// The project has no value of its own, so resolution falls back to the tenant.
+const resolved = await env.resolve({
+  scope: project,
+  ...kbUrl,
+  resolveContext: { caller: 'dispatch', runId: 'run-1' },
+});
+if (resolved.kind === 'ok') console.log(resolved.value.value, resolved.value.revision); // https://kb.acme.test 1
+
+// Optimistic concurrency: this write applies only while the tenant value is at revision 1.
+const updated = await env.set({
+  scope: tenant,
+  ...kbUrl,
+  value: 'https://kb-v2.acme.test',
+  ifRevision: 1,
+  enqueueTuples: () => [],
+});
+if (updated.kind === 'revision-conflict') console.warn('stale write', updated.currentRevision);
+
+const events = await audit.query({ tenantId }); // env-set, env-resolved, env-set
+```
+
+## Non-goals
+
+- **Durability or cross-process sharing.** State lives in one process and is lost on exit.
+- **Org-level resolution for project scopes.** The in-memory store has no project → org relation, so a project scope falls back straight to the tenant. Durable implementations walk `project → org → tenant`.
+- **Secrets.** Values are stored and returned in plaintext; sensitive values belong in a `SecretBinding`.
+- **Soft delete.** `delete` removes the entry; the contract defines env as a plain overwrite-shaped store.
+
+## Related
+
+- [`@kindgi/api`](../api/) — the `EnvBinding` contract and `ResolveContext`.
+- [`@kindgi/platform`](../platform/) — the `Scope` union.
+- [`@kindgi/types`](../types/) — `EnvName` and the `makeEnvName` validator.
+- [`@kindgi/audit-events-inmemory`](../audit-events-inmemory/) — in-memory `AuditEventBinding` for the emitted events.

package/dist/index.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `@kindgi/env-inmemory` — reference in-memory `EnvBinding` for
+ * dev + tests. Refuses to boot in production.
+ *
+ * Storage: `Map<scopeKey(scope), Map<EnvName, Map<name, EnvRecord>>>`.
+ * Resolution walks most-specific-wins: `project → tenant` and
+ * `org → tenant`. A project scope skips the `org` middle step because
+ * this adapter has no project → org relation; the full walk described
+ * on `Scope` in `@kindgi/platform` is `project → org → tenant`.
+ */
+import type { EnvBinding } from '@kindgi/api';
+import type { AuditEventBinding } from '@kindgi/audit-events';
+import type { ProjectId, TenantId } from '@kindgi/types';
+/**
+ * Options for the in-memory env binding.
+ */
+export interface InMemoryEnvBindingOptions {
+    /**
+     * Set `true` to allow booting under `NODE_ENV === 'production'`.
+     * Default `false` — `createInMemoryEnvBinding` throws when the process
+     * is in production without this flag. Never set in production unless
+     * the process is truly a dev-shape (e.g. an isolated test container
+     * running with `NODE_ENV=production` for parity testing).
+     */
+    readonly productionSafe?: boolean;
+    /**
+     * Deterministic clock for tests. Defaults to `Date.now`.
+     */
+    readonly now?: () => number;
+    /**
+     * Optional unified audit binding — when supplied, `set`, `resolve`,
+     * and a `delete` that removed an entry each emit an `env-*`
+     * `AuditEvent`. Emission is awaited before the op returns; emission
+     * failures are logged (`console.warn`) but never fail the caller's op.
+     *
+     * `tenantId` + `projectId` must be provided alongside — emission is
+     * enabled only when all three are set, and every emitted record is
+     * attributed to this tenant + project.
+     */
+    readonly auditEvents?: AuditEventBinding;
+    readonly tenantId?: TenantId;
+    readonly projectId?: ProjectId;
+}
+export declare function createInMemoryEnvBinding(options?: InMemoryEnvBindingOptions): EnvBinding;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,UAAU,EAYX,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAK9D,OAAO,KAAK,EAAW,SAAS,EAAU,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;OAEG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,yBAA8B,GAAG,UAAU,CAsM5F"}

package/dist/index.js

@@ -0,0 +1,202 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { emitLifecycleEvent, emitResolveEvent } from '@kindgi/compliance';
+import { scopeKey } from '@kindgi/platform';
+export function createInMemoryEnvBinding(options = {}) {
+    if (!options.productionSafe && process.env.NODE_ENV === 'production') {
+        throw new Error('@kindgi/env-inmemory refuses to boot with NODE_ENV=production; supply { productionSafe: true } if this is a parity test.');
+    }
+    const now = options.now ?? (() => Date.now());
+    const auditEvents = options.auditEvents;
+    const evidenceTenant = options.tenantId;
+    const evidenceProject = options.projectId;
+    const canEmit = auditEvents !== undefined && evidenceTenant !== undefined && evidenceProject !== undefined;
+    // scopeKey → envName → name → record.
+    const store = new Map();
+    const bucket = (scope, envName) => {
+        const sk = scopeKey(scope);
+        let byEnv = store.get(sk);
+        if (byEnv === undefined) {
+            byEnv = new Map();
+            store.set(sk, byEnv);
+        }
+        let byName = byEnv.get(envName);
+        if (byName === undefined) {
+            byName = new Map();
+            byEnv.set(envName, byName);
+        }
+        return byName;
+    };
+    const parents = (scope) => {
+        // Most-specific first; caller iterates and returns first hit.
+        const chain = [scope];
+        if (scope.kind === 'project') {
+            chain.push({ kind: 'tenant', tenantId: scope.tenantId });
+        }
+        else if (scope.kind === 'org') {
+            chain.push({ kind: 'tenant', tenantId: scope.tenantId });
+        }
+        return chain;
+    };
+    const seqRef = { seq: 0 };
+    const nextTimestamp = () => {
+        seqRef.seq += 1;
+        return new Date(now() + seqRef.seq).toISOString();
+    };
+    return {
+        async list(input) {
+            const byName = bucket(input.scope, input.envName);
+            const all = [];
+            for (const rec of byName.values()) {
+                if (input.namePrefix !== undefined &&
+                    input.namePrefix.length > 0 &&
+                    !rec.name.startsWith(input.namePrefix)) {
+                    continue;
+                }
+                if (input.tagFilter !== undefined) {
+                    if (!matchesTagFilter(rec, input.tagFilter))
+                        continue;
+                }
+                all.push(rec);
+            }
+            all.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+            return { data: all.slice(0, input.limit) };
+        },
+        async get(input) {
+            const byName = bucket(input.scope, input.envName);
+            return byName.get(input.name) ?? null;
+        },
+        async resolve(input) {
+            for (const s of parents(input.scope)) {
+                const byName = bucket(s, input.envName);
+                const rec = byName.get(input.name);
+                if (rec !== undefined) {
+                    if (canEmit) {
+                        await emitResolveEvent({
+                            kind: 'env',
+                            scope: input.scope,
+                            envName: input.envName,
+                            name: input.name,
+                            outcome: 'succeeded',
+                            version: rec.revision,
+                            resolveContext: input.resolveContext,
+                            auditEvents: auditEvents,
+                            tenantId: evidenceTenant,
+                            projectId: evidenceProject,
+                        });
+                    }
+                    return {
+                        kind: 'ok',
+                        value: { name: rec.name, value: rec.value, revision: rec.revision },
+                    };
+                }
+            }
+            if (canEmit) {
+                await emitResolveEvent({
+                    kind: 'env',
+                    scope: input.scope,
+                    envName: input.envName,
+                    name: input.name,
+                    outcome: 'failed',
+                    errorCode: 'env-not-found',
+                    resolveContext: input.resolveContext,
+                    auditEvents: auditEvents,
+                    tenantId: evidenceTenant,
+                    projectId: evidenceProject,
+                });
+            }
+            return {
+                kind: 'err',
+                error: {
+                    code: 'env-not-found',
+                    message: `No env value at scope + envName for name "${input.name}"`,
+                    name: input.name,
+                },
+            };
+        },
+        async set(input) {
+            const byName = bucket(input.scope, input.envName);
+            const existing = byName.get(input.name);
+            if (input.ifRevision !== undefined) {
+                const current = existing?.revision ?? 0;
+                if (current !== input.ifRevision) {
+                    if (canEmit) {
+                        await emitLifecycleEvent({
+                            evidenceKind: 'env-set',
+                            bindingKind: 'env',
+                            scope: input.scope,
+                            envName: input.envName,
+                            name: input.name,
+                            outcome: 'failed',
+                            errorCode: 'env-write-conflict',
+                            version: current,
+                            auditEvents: auditEvents,
+                            tenantId: evidenceTenant,
+                            projectId: evidenceProject,
+                        });
+                    }
+                    return { kind: 'revision-conflict', currentRevision: current };
+                }
+            }
+            const createdAt = existing?.createdAt ?? nextTimestamp();
+            const updatedAt = nextTimestamp();
+            const previousRevision = existing?.revision;
+            const record = {
+                scope: input.scope,
+                envName: input.envName,
+                name: input.name,
+                value: input.value,
+                revision: (existing?.revision ?? 0) + 1,
+                createdAt,
+                updatedAt,
+                ...(input.tags !== undefined && { tags: input.tags }),
+            };
+            byName.set(input.name, record);
+            if (canEmit) {
+                await emitLifecycleEvent({
+                    evidenceKind: 'env-set',
+                    bindingKind: 'env',
+                    scope: input.scope,
+                    envName: input.envName,
+                    name: input.name,
+                    outcome: 'succeeded',
+                    version: record.revision,
+                    ...(previousRevision !== undefined && { previousVersion: previousRevision }),
+                    auditEvents: auditEvents,
+                    tenantId: evidenceTenant,
+                    projectId: evidenceProject,
+                });
+            }
+            return { kind: 'ok', record };
+        },
+        async delete(input) {
+            const byName = bucket(input.scope, input.envName);
+            const had = byName.delete(input.name);
+            if (had && canEmit) {
+                await emitLifecycleEvent({
+                    evidenceKind: 'env-deleted',
+                    bindingKind: 'env',
+                    scope: input.scope,
+                    envName: input.envName,
+                    name: input.name,
+                    outcome: 'succeeded',
+                    auditEvents: auditEvents,
+                    tenantId: evidenceTenant,
+                    projectId: evidenceProject,
+                });
+            }
+            return { deleted: had };
+        },
+    };
+}
+function matchesTagFilter(rec, filter) {
+    const tags = rec.tags;
+    if (tags === undefined)
+        return false;
+    for (const [k, v] of Object.entries(filter)) {
+        if (tags[k] !== v)
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AA6BjC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAkC5C,MAAM,UAAU,wBAAwB,CAAC,UAAqC,EAAE;IAC9E,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACxC,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;IACxC,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC;IAC1C,MAAM,OAAO,GACX,WAAW,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,CAAC;IAE7F,sCAAsC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgD,CAAC;IAEtE,MAAM,MAAM,GAAG,CAAC,KAAY,EAAE,OAAgB,EAA0B,EAAE;QACxE,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACnB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,KAAY,EAAW,EAAE;QACxC,8DAA8D;QAC9D,MAAM,KAAK,GAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAoB,EAAE,CAAC,CAAC;QACvE,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAoB,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC1B,MAAM,aAAa,GAAG,GAAW,EAAE;QACjC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,KAAmB;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,GAAG,GAAgB,EAAE,CAAC;YAC5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,IACE,KAAK,CAAC,UAAU,KAAK,SAAS;oBAC9B,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;oBAC3B,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EACtC,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBAClC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;wBAAE,SAAS;gBACxD,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,KAAkB;YAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACxC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAsB;YAClC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACxC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACtB,IAAI,OAAO,EAAE,CAAC;wBACZ,MAAM,gBAAgB,CAAC;4BACrB,IAAI,EAAE,KAAK;4BACX,KAAK,EAAE,KAAK,CAAC,KAAK;4BAClB,OAAO,EAAE,KAAK,CAAC,OAAO;4BACtB,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,OAAO,EAAE,WAAW;4BACpB,OAAO,EAAE,GAAG,CAAC,QAAQ;4BACrB,cAAc,EAAE,KAAK,CAAC,cAA0C;4BAChE,WAAW,EAAE,WAAY;4BACzB,QAAQ,EAAE,cAAc;4BACxB,SAAS,EAAE,eAAe;yBAC3B,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO;wBACL,IAAI,EAAE,IAAI;wBACV,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;qBACpE,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,gBAAgB,CAAC;oBACrB,IAAI,EAAE,KAAK;oBACX,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,QAAQ;oBACjB,SAAS,EAAE,eAAe;oBAC1B,cAAc,EAAE,KAAK,CAAC,cAA0C;oBAChE,WAAW,EAAE,WAAY;oBACzB,QAAQ,EAAE,cAAc;oBACxB,SAAS,EAAE,eAAe;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,6CAA6C,KAAK,CAAC,IAAI,GAAG;oBACnE,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,KAAkB;YAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC;gBACxC,IAAI,OAAO,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;oBACjC,IAAI,OAAO,EAAE,CAAC;wBACZ,MAAM,kBAAkB,CAAC;4BACvB,YAAY,EAAE,SAAS;4BACvB,WAAW,EAAE,KAAK;4BAClB,KAAK,EAAE,KAAK,CAAC,KAAK;4BAClB,OAAO,EAAE,KAAK,CAAC,OAAO;4BACtB,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,OAAO,EAAE,QAAQ;4BACjB,SAAS,EAAE,oBAAoB;4BAC/B,OAAO,EAAE,OAAO;4BAChB,WAAW,EAAE,WAAY;4BACzB,QAAQ,EAAE,cAAc;4BACxB,SAAS,EAAE,eAAe;yBAC3B,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;gBACjE,CAAC;YACH,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,EAAE,SAAS,IAAI,aAAa,EAAE,CAAC;YACzD,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;YAClC,MAAM,gBAAgB,GAAG,QAAQ,EAAE,QAAQ,CAAC;YAC5C,MAAM,MAAM,GAAc;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;gBACvC,SAAS;gBACT,SAAS;gBACT,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;aACtD,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/B,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,kBAAkB,CAAC;oBACvB,YAAY,EAAE,SAAS;oBACvB,WAAW,EAAE,KAAK;oBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,MAAM,CAAC,QAAQ;oBACxB,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;oBAC5E,WAAW,EAAE,WAAY;oBACzB,QAAQ,EAAE,cAAc;oBACxB,SAAS,EAAE,eAAe;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAqB;YAChC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;gBACnB,MAAM,kBAAkB,CAAC;oBACvB,YAAY,EAAE,aAAa;oBAC3B,WAAW,EAAE,KAAK;oBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,WAAW;oBACpB,WAAW,EAAE,WAAY;oBACzB,QAAQ,EAAE,cAAc;oBACxB,SAAS,EAAE,eAAe;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAc,EAAE,MAAwC;IAChF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,7 +1,55 @@
 {
   "name": "@kindgi/env-inmemory",
-  "version": "0.0.0-bootstrap.0",
-  "description": "Placeholder so a trusted publisher can be attached. Releases are published from https://github.com/kindgi/kindgi-sdk with provenance; use 0.1.0 or later.",
+  "version": "0.1.0",
+  "description": "Reference in-memory `EnvBinding` adapter — dev + tests only; refuses to boot in production.",
   "license": "Apache-2.0",
-  "repository": { "type": "git", "url": "git+https://github.com/kindgi/kindgi-sdk.git" }
-}
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kindgi/kindgi-sdk.git",
+    "directory": "packages/env-inmemory"
+  },
+  "homepage": "https://github.com/kindgi/kindgi-sdk/tree/main/packages/env-inmemory#readme",
+  "bugs": {
+    "url": "https://github.com/kindgi/kindgi-sdk/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md"
+  ],
+  "dependencies": {
+    "@kindgi/api": "0.1.0",
+    "@kindgi/audit-events": "0.1.0",
+    "@kindgi/compliance": "0.1.0",
+    "@kindgi/platform": "0.1.0",
+    "@kindgi/types": "0.1.0"
+  },
+  "devDependencies": {
+    "@kindgi/audit-events-inmemory": "0.1.0",
+    "@types/node": "^22.10.5",
+    "typescript": "^5.7.3",
+    "vitest": "^2.1.8"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist *.tsbuildinfo"
+  }
+}

package/src/index.ts

@@ -0,0 +1,274 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+/**
+ * `@kindgi/env-inmemory` — reference in-memory `EnvBinding` for
+ * dev + tests. Refuses to boot in production.
+ *
+ * Storage: `Map<scopeKey(scope), Map<EnvName, Map<name, EnvRecord>>>`.
+ * Resolution walks most-specific-wins: `project → tenant` and
+ * `org → tenant`. A project scope skips the `org` middle step because
+ * this adapter has no project → org relation; the full walk described
+ * on `Scope` in `@kindgi/platform` is `project → org → tenant`.
+ */
+
+import type {
+  EnvBinding,
+  EnvDeleteInput,
+  EnvDeleteOutcome,
+  EnvError,
+  EnvGetInput,
+  EnvListInput,
+  EnvListPage,
+  EnvRecord,
+  EnvResolveInput,
+  EnvResolveOutcome,
+  EnvSetInput,
+  EnvSetOutcome,
+} from '@kindgi/api';
+import type { AuditEventBinding } from '@kindgi/audit-events';
+import type { ResolveContext as ComplianceResolveContext } from '@kindgi/compliance';
+import { emitLifecycleEvent, emitResolveEvent } from '@kindgi/compliance';
+import type { Scope } from '@kindgi/platform';
+import { scopeKey } from '@kindgi/platform';
+import type { EnvName, ProjectId, Result, TenantId } from '@kindgi/types';
+
+/**
+ * Options for the in-memory env binding.
+ */
+export interface InMemoryEnvBindingOptions {
+  /**
+   * Set `true` to allow booting under `NODE_ENV === 'production'`.
+   * Default `false` — `createInMemoryEnvBinding` throws when the process
+   * is in production without this flag. Never set in production unless
+   * the process is truly a dev-shape (e.g. an isolated test container
+   * running with `NODE_ENV=production` for parity testing).
+   */
+  readonly productionSafe?: boolean;
+  /**
+   * Deterministic clock for tests. Defaults to `Date.now`.
+   */
+  readonly now?: () => number;
+  /**
+   * Optional unified audit binding — when supplied, `set`, `resolve`,
+   * and a `delete` that removed an entry each emit an `env-*`
+   * `AuditEvent`. Emission is awaited before the op returns; emission
+   * failures are logged (`console.warn`) but never fail the caller's op.
+   *
+   * `tenantId` + `projectId` must be provided alongside — emission is
+   * enabled only when all three are set, and every emitted record is
+   * attributed to this tenant + project.
+   */
+  readonly auditEvents?: AuditEventBinding;
+  readonly tenantId?: TenantId;
+  readonly projectId?: ProjectId;
+}
+
+export function createInMemoryEnvBinding(options: InMemoryEnvBindingOptions = {}): EnvBinding {
+  if (!options.productionSafe && process.env.NODE_ENV === 'production') {
+    throw new Error(
+      '@kindgi/env-inmemory refuses to boot with NODE_ENV=production; supply { productionSafe: true } if this is a parity test.',
+    );
+  }
+  const now = options.now ?? (() => Date.now());
+  const auditEvents = options.auditEvents;
+  const evidenceTenant = options.tenantId;
+  const evidenceProject = options.projectId;
+  const canEmit =
+    auditEvents !== undefined && evidenceTenant !== undefined && evidenceProject !== undefined;
+
+  // scopeKey → envName → name → record.
+  const store = new Map<string, Map<EnvName, Map<string, EnvRecord>>>();
+
+  const bucket = (scope: Scope, envName: EnvName): Map<string, EnvRecord> => {
+    const sk = scopeKey(scope);
+    let byEnv = store.get(sk);
+    if (byEnv === undefined) {
+      byEnv = new Map();
+      store.set(sk, byEnv);
+    }
+    let byName = byEnv.get(envName);
+    if (byName === undefined) {
+      byName = new Map();
+      byEnv.set(envName, byName);
+    }
+    return byName;
+  };
+
+  const parents = (scope: Scope): Scope[] => {
+    // Most-specific first; caller iterates and returns first hit.
+    const chain: Scope[] = [scope];
+    if (scope.kind === 'project') {
+      chain.push({ kind: 'tenant', tenantId: scope.tenantId as TenantId });
+    } else if (scope.kind === 'org') {
+      chain.push({ kind: 'tenant', tenantId: scope.tenantId as TenantId });
+    }
+    return chain;
+  };
+
+  const seqRef = { seq: 0 };
+  const nextTimestamp = (): string => {
+    seqRef.seq += 1;
+    return new Date(now() + seqRef.seq).toISOString();
+  };
+
+  return {
+    async list(input: EnvListInput): Promise<EnvListPage> {
+      const byName = bucket(input.scope, input.envName);
+      const all: EnvRecord[] = [];
+      for (const rec of byName.values()) {
+        if (
+          input.namePrefix !== undefined &&
+          input.namePrefix.length > 0 &&
+          !rec.name.startsWith(input.namePrefix)
+        ) {
+          continue;
+        }
+        if (input.tagFilter !== undefined) {
+          if (!matchesTagFilter(rec, input.tagFilter)) continue;
+        }
+        all.push(rec);
+      }
+      all.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+      return { data: all.slice(0, input.limit) };
+    },
+
+    async get(input: EnvGetInput): Promise<EnvRecord | null> {
+      const byName = bucket(input.scope, input.envName);
+      return byName.get(input.name) ?? null;
+    },
+
+    async resolve(input: EnvResolveInput): Promise<Result<EnvResolveOutcome, EnvError>> {
+      for (const s of parents(input.scope)) {
+        const byName = bucket(s, input.envName);
+        const rec = byName.get(input.name);
+        if (rec !== undefined) {
+          if (canEmit) {
+            await emitResolveEvent({
+              kind: 'env',
+              scope: input.scope,
+              envName: input.envName,
+              name: input.name,
+              outcome: 'succeeded',
+              version: rec.revision,
+              resolveContext: input.resolveContext as ComplianceResolveContext,
+              auditEvents: auditEvents!,
+              tenantId: evidenceTenant,
+              projectId: evidenceProject,
+            });
+          }
+          return {
+            kind: 'ok',
+            value: { name: rec.name, value: rec.value, revision: rec.revision },
+          };
+        }
+      }
+      if (canEmit) {
+        await emitResolveEvent({
+          kind: 'env',
+          scope: input.scope,
+          envName: input.envName,
+          name: input.name,
+          outcome: 'failed',
+          errorCode: 'env-not-found',
+          resolveContext: input.resolveContext as ComplianceResolveContext,
+          auditEvents: auditEvents!,
+          tenantId: evidenceTenant,
+          projectId: evidenceProject,
+        });
+      }
+      return {
+        kind: 'err',
+        error: {
+          code: 'env-not-found',
+          message: `No env value at scope + envName for name "${input.name}"`,
+          name: input.name,
+        },
+      };
+    },
+
+    async set(input: EnvSetInput): Promise<EnvSetOutcome> {
+      const byName = bucket(input.scope, input.envName);
+      const existing = byName.get(input.name);
+      if (input.ifRevision !== undefined) {
+        const current = existing?.revision ?? 0;
+        if (current !== input.ifRevision) {
+          if (canEmit) {
+            await emitLifecycleEvent({
+              evidenceKind: 'env-set',
+              bindingKind: 'env',
+              scope: input.scope,
+              envName: input.envName,
+              name: input.name,
+              outcome: 'failed',
+              errorCode: 'env-write-conflict',
+              version: current,
+              auditEvents: auditEvents!,
+              tenantId: evidenceTenant,
+              projectId: evidenceProject,
+            });
+          }
+          return { kind: 'revision-conflict', currentRevision: current };
+        }
+      }
+      const createdAt = existing?.createdAt ?? nextTimestamp();
+      const updatedAt = nextTimestamp();
+      const previousRevision = existing?.revision;
+      const record: EnvRecord = {
+        scope: input.scope,
+        envName: input.envName,
+        name: input.name,
+        value: input.value,
+        revision: (existing?.revision ?? 0) + 1,
+        createdAt,
+        updatedAt,
+        ...(input.tags !== undefined && { tags: input.tags }),
+      };
+      byName.set(input.name, record);
+      if (canEmit) {
+        await emitLifecycleEvent({
+          evidenceKind: 'env-set',
+          bindingKind: 'env',
+          scope: input.scope,
+          envName: input.envName,
+          name: input.name,
+          outcome: 'succeeded',
+          version: record.revision,
+          ...(previousRevision !== undefined && { previousVersion: previousRevision }),
+          auditEvents: auditEvents!,
+          tenantId: evidenceTenant,
+          projectId: evidenceProject,
+        });
+      }
+      return { kind: 'ok', record };
+    },
+
+    async delete(input: EnvDeleteInput): Promise<EnvDeleteOutcome> {
+      const byName = bucket(input.scope, input.envName);
+      const had = byName.delete(input.name);
+      if (had && canEmit) {
+        await emitLifecycleEvent({
+          evidenceKind: 'env-deleted',
+          bindingKind: 'env',
+          scope: input.scope,
+          envName: input.envName,
+          name: input.name,
+          outcome: 'succeeded',
+          auditEvents: auditEvents!,
+          tenantId: evidenceTenant,
+          projectId: evidenceProject,
+        });
+      }
+      return { deleted: had };
+    },
+  };
+}
+
+function matchesTagFilter(rec: EnvRecord, filter: Readonly<Record<string, string>>): boolean {
+  const tags = rec.tags;
+  if (tags === undefined) return false;
+  for (const [k, v] of Object.entries(filter)) {
+    if (tags[k] !== v) return false;
+  }
+  return true;
+}